Crypto.com says hackers stole over $30 million worth of bitcoin and ethereum

[ad_1]

Crypto.com said Thursday that cybercriminals breached its security systems earlier in the week and seized more than $30 million in stolen Bitcoin and Ethereum.

Cryptocurrency exchange Crypto.com, known for its viral ad featuring Matt Damon as well as its recent $700 million deal to rename Staples Center in Los Angeles to Crypto.com Arena, said hackers had managed to bypass its two-factor authentication system and withdraw funds from 483 customer accounts, according to a statement published by the Singapore-based crypto exchange on its corporate blog on Thursday.

“Unauthorized withdrawals totaled 4,836.26 ETH, 443.93 BTC, and approximately $66,200 in other currencies,” the company said in the post.

This equates to around $15 million and $19 million in ethereum and bitcoin, respectively, based on current exchange rates. All customers were “fully reimbursed” for any funds lost as a result of the hack, Crypto.com said.

The blog’s statement serves as a post-mortem of the hack, which the company says happened on Monday. It provides details about the event and the company’s detection and response to the cyber breach, as well as its “next steps”, but it does not offer information about the identity of the hackers at origin of the breach.

The timing of Crypto.com’s public statement, three days after the hack, is seen by many as late confirmation. According to a CoinDesk post on Wednesday, approximately 4,600 etherium allegedly stolen from Crypto.com was “currently being laundered through Tornado Cash – an etherium mixer.” Thursday’s blog post also followed a Bloomberg interview on Wednesday with Crypto.com chief executive Kris Marszalek, in which the CEO acknowledged that around 400 customer accounts had been hacked.

“Given the scale of the business, these numbers are not particularly meaningful and client funds were not at risk,” the CEO told Bloomberg.

“Suspicious activity” reports

The company first acknowledged that something unusual had happened in a January 16 tweet in which it announced the temporary suspension of withdrawals following reports from users of “suspicious activity on their accounts. “.

“We will be suspending withdrawals shortly as our team investigates. All funds are safe,” the company said.

We have a small number of users reporting suspicious activity on their accounts.

We will be suspending withdrawals shortly as our team is investigating. All funds are safe.

— Crypto.com (@cryptocom) January 17, 2022

The company’s claim that “All funds are safe” was quickly challenged by customers, including Los Angeles-based jeweler Ben Baller, who immediately tweeted: “I messaged your guys he hours ago about my account having been stolen out of nowhere and I’m also wondering how they did the 2FA?”

2FA challenged

Two-factor authentication, or 2FA, is the multi-step security system that requires users to provide two separate forms of identification, such as a one-time passcode in addition to a password, when login to an online account. The commonly used security measure provides an additional layer of protection against weak passwords such as, for example, a last name followed by “123”. Although used by industries at all levels, 2FA is considered a must for digital currency accounts. Monday’s breach, however, calls into question the reliability of 2FA in protecting digital assets from hackers.

For now, Crypto.com says it is sticking with 2FA, but not for long.

Upon discovering the breach, the company “revoked all 2FA tokens from customers” and used the 14-hour downtime of withdrawal activity to “reorganize,” according to the statement. Customers were then “migrated to a completely new 2FA infrastructure”, as an additional security measure.

That’s only temporary, however, as the company said it plans to ditch 2FA for “true multi-factor authentication (MFA), providing added strength to our global user base.”

Shares of Crypto.com have fallen more than 6% since announcing the security breach, closing Thursday at 46 cents per share.

New trends

Download our free app

For the latest news and analysis Download the free CBS News app

[ad_2]