$40 000 000 USD

JUNE 2018




“Korea-based coin exchange Coinrail lost more than $40 million in altcoins (ICO-issued tokens) in an apparent weekend cyber heist. Most notably, the hackers got away with $19.5 million worth of NPXS tokens that were issued by payment project Pundi X’s ICO. On top of that crypto loot, “they scored a further $13.8 million from Aston X, an ICO project building a platform to decentralize documents, $5.8 million in tokens for Dent, a mobile data ICO, and over $1.1 million Tron, a much-hyped project originating from China,” "However, Coinrail only provided the names of some of the tokens that were taken in the alleged breach without disclosing the exact amounts at stake. These included the NPXS token from the Pundi X project, ATC from Aston and the NPER project’s NPER token." “The biggest hit was taken by payment processing startup called Pundi X, with around 3% of total NPXS token supply affected. The project’s team was very eager to cooperate by freezing the stolen tokens immediately and halting trading to help with the investigation.” “A total of eleven cryptocurrencies were stolen, Coinrail revealed. They are dent (DENT), tradove b2bcoin (BBC), ether (ETH), jibrel network (JNT), bitcoin (BTC), kyber network (KNC), storm (STORM), tron (TRX), pundi x (NPXS), aston (ATX), and nper (NPER). Funds in DENT, BBC, and ETH have been fully recovered; customers can start trading and withdrawing them. “Recovery [is] in progress” for JNT, the exchange detailed. The remaining seven cryptocurrencies have not been fully recovered, including BTC.” “A month later, on July 15, the exchange resumed trading and offered the victims two compensation schemes: a gradual refund through the purchase of stolen cryptocurrency and compensation with Coinrail RAIL tokens, which can then be converted into a cryptocurrency at the inner rate.”

This hacking took place after a government security inspection by South Korea, and the hack included a significant amount of bitcoin. As the issue was related to vulnerability in the platform, it’s safe to say that the funds were in a hot wallet. ERC20 tokens are especially challenging to secure as there is no native multi-sig system built in, and it can only be done through a risky smart contract. CoinRail displays presently as a “403 error” when viewed from most countries, however viewing from some countries such as Singapore appears to display the website.

South Korean Government Under Fire As 3 More Crypto Platforms Hacked - The Coin Republic: Cryptocurrency , Bitcoin, Ethereum & Blockchain News (Jan 31)
Infographic: An Overview of Compromised Bitcoin Exchange Events (Jan 30)
100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents (Jan 25)
Q3 2018 Cryptocurrency Anti-Money Laundering Report - CipherTrace (Feb 15)
From Coincheck to Bithumb: 2018’s Largest Security Breaches So Far (Feb 23)
Coinrail Exchange Hacked, Loses Possibly $40 Million in Cryptos - CoinDesk (Feb 24)
Korean crypto exchange Coinrail loses over $40M in tokens following a hack – TechCrunch (Feb 24)
South Korean cryptocurrency exchange hacked for nearly $40M (Feb 24)
Crypto Exchange Coinrail Reopens with Offers to Recover 11 Cryptocurrencies | Exchanges Bitcoin News (Feb 24)
Total of 7 Crypto Exchanges and 158 Wallets Hacked in South Korea, Police Find | Security Bitcoin News (Feb 26)
Lessons Learned from the Biggest Crypto Hacks in History (Feb 26)
The Biggest Cryptocurrency Hacks of 2018 (A Year in Which $1 Billion Crypto Was Stolen) (Feb 26)
A Look Back on Some of the Most Devastating Crypto Hacks | Fintech Singapore (Feb 27)
Crypto Exchange Hacks in Review: Proactive Steps and Expert Advice (Mar 2)
Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com (Mar 5)
SlowMist Hacked - SlowMist Zone (Jun 26)
Korean Self-regulatory Crypto Industry Body Under Question After 12 Crypto Exchanges Approved | YOUniversityTV (May 8)
Timeline of Cyber Incidents Involving Financial Institutions - Carnegie Endowment for International Peace (Dec 12)

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.