Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/coinpokerhotwalletthirdpartyvulnerability.php}} {{Unattributed Sources}} CoinPoker Logo/HomepageCoinPoker is an online poker/gambling site where players can play Poker against one another. On November 7th, a large withdrawal occurred from their hot wallet. The system was brought offline the next day, and they sent the hacker an on-chain message roughly a wee..."

2024-12-20T18:03:49Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/coinpokerhotwalletthirdpartyvulnerability.php}} {{Unattributed Sources}} thumb|CoinPoker Logo/HomepageCoinPoker is an online poker/gambling site where players can play Poker against one another. On November 7th, a large withdrawal occurred from their hot wallet. The system was brought offline the next day, and they sent the hacker an on-chain message roughly a wee..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/coinpokerhotwalletthirdpartyvulnerability.php}}
{{Unattributed Sources}}

[[File:Coinpoker.jpg|thumb|CoinPoker Logo/Homepage]]CoinPoker is an online poker/gambling site where players can play Poker against one another. On November 7th, a large withdrawal occurred from their hot wallet. The system was brought offline the next day, and they sent the hacker an on-chain message roughly a week later. In response, it appears that the hacker decided to move the funds through TornadoCash.<ref name="web3isgoinggreat-16983" /><ref name="cyversalertstwitter-16984" /><ref name="etherscan-16985" /><ref name="etherscan-16986" /><ref name="coinpokerofftwitter-16987" /><ref name="coinpokerofftwitter-16988" /><ref name="web3isgoinggreat-16989" />

== About CoinPoker ==
"Join the No.1 Crypto Poker Site and Receive up to $2,000 Welcome Bonus! Instant withdrawals to your crypto wallet. 150% welcome bonus + 33% rakeback. Customer funds secure & visible on-chain"

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
"On November 8, a hacker breached the CoinPoker’s hot wallet, resulting in the unauthorized draining of approximately $2M USD."
{| class="wikitable"
|+Key Event Timeline - CoinPoker Hot Wallet Third-party Vulnerability
!Date
!Event
!Description
|-
|November 7th, 2024 11:01:35 PM MST
|First Transfer To Theif
|The first transfer to the thief address based on the address contacted by CoinPoker.
|-
|November 8th, 2024 4:01:00 AM MST
|Withdrawals Under Maintenance
|The CoinPoker team announces that the withdrawals system is presently undergoing maintenance.
|-
|November 8th, 2024 12:55:00 PM MST
|Withdrawals Back Online
|The CoinPoker team announces that the withdrawal system is now back online.
|-
|November 11th, 2024 8:36:00 AM MST
|Application Under Maintenance
|The application is currently unavailable for some "necessary maintenance".
|-
|November 16th, 2024 4:27:11 AM MST
|Blockchain Direct Message
|The CoinPoker team reached out to the attacker on the blockchain, willing to negotiate a potential bounty for the safe return of the funds.
|-
|November 17th, 2024 12:57:35 AM MST
|TornadoCash Depositing
|The funds start to be deposited into TornadoCash.
|-
|November 18th, 2024 3:23:00 AM MST
|CyversAlert Tweeting
|CyversAlert tweets about the incident.
|}

== Technical Details ==
"The attack spanned across multiple blockchain networks, including BNB Chain, Ethereum, and Polygon networks."

== Total Amount Lost ==
The total amount lost has been estimated at $2,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
"Hey everyone! Just a quick heads-up: our withdrawal feature is taking a little break for some maintenance. We’re on it and expect to have it back up and running soon! Depositing remains available. Thanks for your understanding and patience!"

"Good news all, Withdrawals are working again! Happy Friday :)"

"ALERT! Our system recently flagged multiple hack transactions involving @CoinPoker_OFF across the #Bnb, #Ethereum, and #Polygon chains. It appears that an unauthorized address gained control of CoinPoker's hot wallet. The attacker transferred around $2M $USDT, swapped it into native currencies on various chains, and then funneled the funds through @TornadoCash. The transaction patterns suggest that CoinPoker's hot wallet has utilized a custodian service with a specific policy in place!"

== Ultimate Outcome ==
"To the individual responsible for the recent exploit:
We are aware of the activity involving funds stolen from the wallet address 0x3c1727C283370e476a63768C7cAb843B8bd63130. This message is from CoinPoker to confirm its authenticity.
We seek to establish secure communication to address this matter constructively. If you are open to a resolution, please respond via email to incident.response@coinpoker.com
We are willing to discuss terms, including a potential bounty, for the safe return of the funds."

"Later, [the attacker] funneled through Tornado Cash to obscure the trail and to launder the funds."

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="web3isgoinggreat-16983">[https://www.web3isgoinggreat.com/?id=coinpoker-hack CoinPoker exploited for $2 million] (Accessed Dec 11, 2024)</ref>

<ref name="cyversalertstwitter-16984">[https://twitter.com/CyversAlerts/status/1858455889029550545 @CyversAlerts Twitter] (Accessed Dec 11, 2024)</ref>

<ref name="etherscan-16985">[https://etherscan.io/tx/0x9c40a0fbbeef9e0da5cbc31bf99bd971fa8a51d5db716060a36979fcca3e2344 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Dec 11, 2024)</ref>

<ref name="etherscan-16986">[https://etherscan.io/tx/0xed51cbab66dcfaf33351acd72cafda339763a32b10080ef5a014ad43bdf5969d Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Dec 11, 2024)</ref>

<ref name="coinpokerofftwitter-16987">[https://twitter.com/CoinPoker_OFF/status/1855998056849604790 @CoinPoker_OFF Twitter] (Accessed Dec 11, 2024)</ref>

<ref name="coinpokerofftwitter-16988">[https://twitter.com/CoinPoker_OFF/status/1854841777024360582 @CoinPoker_OFF Twitter] (Accessed Dec 11, 2024)</ref>

<ref name="web3isgoinggreat-16989">[https://www.web3isgoinggreat.com/archive/2024-11-08-0/0 Archived tweet – Web3 is Going Just Great] (Accessed Dec 11, 2024)</ref></references>

CoinPoker Hot Wallet Third-party Vulnerability - Revision history