Singapore-based crypto firm hit by December 26 hack, more than $10 million lost

[ad_1]

SINGAPORE More than US$8 million (S$10 million) was stolen from a Singapore-based crypto wallet provider on December 26, after a hacker manipulated files that allowed users to download the wallets to their phones.

Thousands of users reported having their funds stolen from their BitKeep wallets that day, although it is unclear how many Singaporean users were affected.

According to blockchain security and data analytics firm PeckShield, the stolen cryptocurrencies consisted of Binances BNB Coin, stablecoins Tether and Dai, and Ether.

In response to questions from the Straits Times, a spokesperson for BitKeep said it has adopted countermeasures to protect users from further loss, including tracking the addresses used in the hack and freezing some of the stolen funds.

He added that a police report was filed at the end of December and that a task force was set up by the police in conjunction with cybersecurity experts.

ST contacted the police to check whether such a task force had been created.

In a statement on Bitkeep’s website last Wednesday, BitKeep General Manager Kevin Como acknowledged the incident and said the hacker did so by hijacking and installing code on version 7.2.9 APK files available for download from the website.

APK files allow Android users to download applications directly to their devices without going through the Google Play Store.

With maliciously implanted code, the modified APK leaked users’ private keys and allowed the hacker to move funds, Como said, adding that users who downloaded the app from the Apple’s App Store, Google Play Store, or Chrome Web Store were not affected. .

On its official Telegram channel, affected users were advised to update to version 7.3.0 of the BitKeep app, which was released on December 28.

They would then have to create a new crypto wallet and transfer all their available assets.

ST understands that BitKeep has not applied for a license to provide digital payment token services under the Payment Services Act.

BitKeep is also not a notified entity, which means that it has not been granted a temporary exemption from holding a license by the Monetary Authority of Singapore.

ST understands that as a wallet provider, BitKeeps services are technological in nature and may not be subject to the Payment Services Act, which provides a framework for the regulation of payment systems and payment service providers. payment in Singapore.

[ad_2]