$3 100 000 USD

JULY 2020




"On July 11, fraudsters hacked into U.K.-based cryptocurrency exchange Cashaa’s digital payment platform which serves Indian customers, and stole 336 Bitcoin (BTC), worth approximately $3.1million."


"The first attack on Cashaa’s wallets actually occurred at 10:57AM UTC on July 10th, 2020 (6:57AM EDT on July 10th, 2020). One of the Cashaa's Bitcoin wallets, at address 1Jt9mebBwqCk8ijrVDoT5aySu2q9zpeKde, had 1.059770800 BTC (about $9800 USD) transferred to the attacker's account at 14RYUUaMW1shoxCav4znEh64xnTtL3a2Ek. According to Cashaa’s report, the attacker stole the victim’s Bitcoin wallet information on Blockchain.info by gaining access to the victim's computer."


"The second attack occurred at 12:10PM UTC on July 11th, 2020 (8:10PM EDT on July 11th, 2020), across eight separate Bitcoin wallets owned by Cashaa. A total of 335.91312085 BTC (~$3.1M USD) was transferred to the same recipient address and the wallet information stolen in the same manner as the first attack."


"Cashaa suspects a piece of malware was installed onto the system that facilitated exchange transfers, such as user withdrawals. The malware notified the hacker when an employee logged into the account on July 10 and made two transfers from the wallet." "[S]ecurity researchers believe that there may be two internal operating errors or that the victim's computer was compromised with a malicious backdoor program."


"A cyberattack occurred on our system that was able to penetrate a vulnerable machine of a ‘Cashaa India OTC’ Employee. Within microseconds, all the funds in that account were wiped off in this first transaction signed."


"The incident occurred on 10th July 2020, with one of our OTC Transaction managers, positioned in East Delhi, India. On 8th July 2020, the employee had reported a machine malfunction with the systems provided to him by the company. Hence, he requested to operate from his personal computer and set up multiple alternative online wallets on various platforms like Blockchain.com, Huobi etc. We made an exception and allowed him to do so keeping ‘customer experience’ in mind for the ongoing OTC deals/transactions. After the mishap, the investigation team has secured the abused system for further investigation and the employee has been suspended until the end of the investigation."


"Following the attack, the company stopped all crypto-related transactions." "The fintech has reportedly filed a cybercrime incident report to the Delhi Crime Bureau under the cryptocurrency-related crime category." "Cashaa’s management aims to ensure that the hacker is not able to sell the stolen Bitcoins on other cryptocurrency exchanges. It has identified and publicly shared the hacker’s BTC address, so that everyone can track whenever the funds are moved to other addresses."


"The Chief Executive Officer of Cashaa, Kumar Gaurav, said that they called the board meeting to decide whether the company will bear all the losses caused by the hack." "An emergency board meeting is being held to decide our further actions." "[T]he company claims that its prima facia users were not affected due to the recent hack." "There is no interruption in our banking services across the globe; all accounts are working without any interruption. I thank everyone for the support and hard work."

The Cashaa exchange operated an OTC desk, and allowed one of the employees in India to process withdrawals from a large hot wallet using their personal computer without any multi-signature wallet.


The employee's wallet fell victim to malware and a large sum of 336 BTC was withdrawn. It does not appear that this balance represents customer funds.


This is an illustration of the importance of multi-signature. One individual can suffer a breach, however when 3 or more signatures are required on an outgoing transaction, this multiplies the protection to the point where a breach has not yet been observed historically.


In addition, it's recommended that greater training be required for all exchange operators, and that less funds be made accessible in one location.


Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.