Crypto.com Withdrawals Triggered - Revision history

Azoundria: 30 minutes. Updated source names. Integrated information from Futurism article. Removed duplicate source. Integrating information from CBS News.

2024-04-12T18:12:36Z

30 minutes. Updated source names. Integrated information from Futurism article. Removed duplicate source. Integrating information from CBS News.

Show changes

Azoundria: New sources added to wiki.

2023-10-06T17:50:28Z

New sources added to wiki.

← Older revision		Revision as of 11:50, 6 October 2023
Line 5:		Line 5:
	After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.		After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.

	<ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />		<ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cnbc-5942" /><ref name="rektnews-6287" /><ref>https://www.cbsnews.com/news/cryptocurrency-theft-hack-defi-beanstalk-blockchain/ (Nov 30, 2022)</ref><ref>https://www.cbsnews.com/news/crypto-com-hack-bitcoin-ethereum-30-million/ (Oct 6, 2023)</ref><ref>https://rekt.news/cryptocom-rekt/ (Oct 6, 2023)</ref>

	== About Crypto.com ==		== About Crypto.com ==

Azoundria: Another 30 minutes complete. Prevention added and much more research.

2023-07-18T22:01:23Z

Another 30 minutes complete. Prevention added and much more research.

Show changes

Azoundria at 20:29, 17 July 2023

2023-07-17T20:29:38Z

← Older revision		Revision as of 14:29, 17 July 2023
Line 328:		Line 328:

	== Prevention Policies ==		== Prevention Policies ==
	There were no customer losses in this case, as the funds which were able to be stolen were a very small fraction of the available funds on the platform. The original loss could have been prevented by using cold storage and requiring multiple signatures on withdrawals. Even within the hot wallet infrastructure, there are opportunities to add additional factors, which make it exponentially harder for an adversary. While the APP is a great program, the decisions about coverage are subject to Crypto.com, which has an incentive only to cover smaller losses, where the value of the customer relationship and/or reputation damage is greater than the amount lost. An ~~inustry~~ insurance fund would act in a more impartial capacity.		There were no customer losses in this case, as the funds which were able to be stolen were a very small fraction of the available funds on the platform. The original loss could have been prevented by using cold storage and requiring multiple signatures on withdrawals. Even within the hot wallet infrastructure, there are opportunities to add additional factors, which make it exponentially harder for an adversary. While the APP is a great program, the decisions about coverage are subject to Crypto.com, which has an incentive only to cover smaller losses, where the value of the customer relationship and/or reputation damage is greater than the amount lost. An industry insurance fund would act in a more impartial capacity.

			==Individual Prevention Policies==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}
			==Platform Prevention Policies==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}
			==Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}
	== References ==		== References ==
	<references>		<references>

Azoundria: Another 30 minutes complete.

2023-06-30T16:51:37Z

Another 30 minutes complete.

Show changes

Azoundria: https://www.vice.com/en/article/qjb3zq/cryptocom-says-alleged-dollar15-million-hack-was-just-an-incident done into the article, 7 sources left.

2023-03-30T22:43:10Z

https://www.vice.com/en/article/qjb3zq/cryptocom-says-alleged-dollar15-million-hack-was-just-an-incident done into the article, 7 sources left.

← Older revision		Revision as of 16:43, 30 March 2023
Line 6:		Line 6:
	After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.		After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.

	~~<ref name="vice-5933" />~~<ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />		<ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />

	== About Crypto.com ==		== About Crypto.com ==
Line 80:		Line 80:
	\|2FA Reset Reported		\|2FA Reset Reported
	\|Twitter user Saint_Pump reports that he was logged out of the Crypto.com application and asked to set up 2FA<ref>[https://twitter.com/Saint_Pump/status/1483357605208936457 Saint_Pump - "got logged out of the app and then asked to set up a 2fa as if I had never done it" - Twitter] (Mar 29, 2023)</ref>. It's unclear if this was a result of the hack or part of the 2FA reset procedure initiated by Crypto.com.		\|Twitter user Saint_Pump reports that he was logged out of the Crypto.com application and asked to set up 2FA<ref>[https://twitter.com/Saint_Pump/status/1483357605208936457 Saint_Pump - "got logged out of the app and then asked to set up a 2fa as if I had never done it" - Twitter] (Mar 29, 2023)</ref>. It's unclear if this was a result of the hack or part of the 2FA reset procedure initiated by Crypto.com.
			\|-
			\|January 18th, 2022 9:26:00 AM MST
			\|Vice Article Published
			\|Vice publishes their article<ref>[https://web.archive.org/web/20220118163202/https://www.vice.com/en/article/qjb3zq/cryptocom-says-alleged-dollar15-million-hack-was-just-an-incident Crypto.Com Says Alleged $15 Million Hack Was Just an 'Incident' - Vice] (Mar 30, 2023)</ref>. They state that several users complained about funds being stolen<ref name="vice-5933" />. (TBD Expand this description.)
	\|-		\|-
	\|January 18th, 2022 10:46:00 AM MST		\|January 18th, 2022 10:46:00 AM MST

Azoundria: https://twitter.com/kris/status/1483277350683185155 added to the article, down to 8 sources left to explore.

2023-03-30T22:35:15Z

https://twitter.com/kris/status/1483277350683185155 added to the article, down to 8 sources left to explore.

← Older revision		Revision as of 16:35, 30 March 2023
Line 6:		Line 6:
	After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.		After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.

	~~<ref name="krishktwitter-5932" />~~<ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />		<ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />

	== About Crypto.com ==		== About Crypto.com ==
Line 63:		Line 63:
	\|Peckshield Reports Stolen Ethereum		\|Peckshield Reports Stolen Ethereum
	\|Peckshield posts on Twitter that the total loss is about $15M with at least 4.6K ETHs. They also report that half of the stolen ethereum is being washed via the TornadoCash service<ref name="peckshieldtwitter-5940" />.		\|Peckshield posts on Twitter that the total loss is about $15M with at least 4.6K ETHs. They also report that half of the stolen ethereum is being washed via the TornadoCash service<ref name="peckshieldtwitter-5940" />.
			\|-
			\|January 17th, 2022 8:17:00 PM MST
			\|Kris Marzalek Publishes Tweet
			\|Crypto.com CEO Kris Marzalek publishes a tweet with "thoughts from me on the last 24 hours", including that "no customer funds were lost ", "the downtime of withdrawal infra [structure]was ~14 hours", and "our team has hardened the infrastructure in response to the incident"<ref name="krishktwitter-5932" />. He's "particularly happy" about "the support we received from the community both publicly and in DMs" and "the opportunity this incident gave us to further strengthen our setup"<ref>[https://twitter.com/kris/status/1483277458262859776 Kris Marzalek - "the support we received from the community both publicly and in DMs" - Twitter] (Mar 30, 2023)</ref>. (TBD Publish more on the community reactions.)
	\|-		\|-
	\|January 17th, 2022 11:38:00 PM MST		\|January 17th, 2022 11:38:00 PM MST
	\|BeInCrypto First Article		\|BeInCrypto First Article
	\|		\|(TBD)
	\|-		\|-
	\|January 17th, 2022 8:46:00 PM MST		\|January 17th, 2022 8:46:00 PM MST
	\|Investigation Started Withdrawals Disabled		\|Investigation Started Withdrawals Disabled
	\|According to the Crypto.com postmortem, "withdrawals were resumed" at "5:46 PM UTC, 18 January 2022," after 14 hours of downtime<ref name=":3" />. In his interview on Bloomberg TV, CEO Kris Marzalek stated "we paused withdrawals, we fixed it [and] we were back online in about 13/14 hours"<ref name=":5" /><ref name=":6">[https://twitter.com/BloombergLive/status/1483841347824099330 BloombergLive - "CEO @cryptocom’s Kris Marszalek discusses the site's recent hack" Twitter] (Mar 22, 2023)</ref>. Based on a simple calculation, that puts the time of withdrawals being disabled close to 3:46 AM UTC on January 18th.		\|According to the Crypto.com postmortem, "withdrawals were resumed" at "5:46 PM UTC, 18 January 2022," after 14 hours of downtime<ref name=":3" />. In his interview on Bloomberg TV, CEO Kris Marzalek stated "we paused withdrawals, we fixed it [and] we were back online in about 13/14 hours"<ref name=":5" /><ref name=":6">[https://twitter.com/BloombergLive/status/1483841347824099330 BloombergLive - "CEO @cryptocom’s Kris Marszalek discusses the site's recent hack" Twitter] (Mar 22, 2023)</ref>. His statement on Twitter says "~14 hours"<ref name="krishktwitter-5932" />. Based on a simple calculation, that puts the time of withdrawals being disabled close to 3:46 AM UTC on January 18th.
	Crypto.com also reports that "withdrawals on the platform were suspended for the duration of the investigation"<ref name=":3" />, which suggests that their investigation was also started at this time, which would be approximately 25 hours after initial identification by the risk monitoring system.		Crypto.com also reports that "withdrawals on the platform were suspended for the duration of the investigation"<ref name=":3" />, which suggests that their investigation was also started at this time, which would be approximately 25 hours after initial identification by the risk monitoring system.
	\|-		\|-
Line 307:		Line 311:
	<ref name="ergobtctwitter-5929">[https://twitter.com/ErgoBTC/status/1483540849434763264 ErgoBTC - "Still no acknowledgement of loss, despite large outflows from the custodial wallet" - Twitter] (Jan 23, 2022)</ref>		<ref name="ergobtctwitter-5929">[https://twitter.com/ErgoBTC/status/1483540849434763264 ErgoBTC - "Still no acknowledgement of loss, despite large outflows from the custodial wallet" - Twitter] (Jan 23, 2022)</ref>
	<ref name="transactiontelegram-5930">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - OXT Research] (Jan 23, 2022)</ref>		<ref name="transactiontelegram-5930">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - OXT Research] (Jan 23, 2022)</ref>
	<ref name="krishktwitter-5932">[https://twitter.com/Kris_HK/status/1483277350683185155 ~~@Kris_HK~~ Twitter] (Jan 23, 2022)</ref>		<ref name="krishktwitter-5932">[https://twitter.com/Kris_HK/status/1483277350683185155 Kris Marzalek - "Some thoughts from me on the last 24 hours" - Twitter] (Jan 23, 2022)</ref>
	<ref name="vice-5933">[https://www.vice.com/en/article/qjb3zq/cryptocom-says-alleged-dollar15-million-hack-was-just-an-incident Crypto.com Says Alleged $15 Million Hack Was Just an 'Incident'] (Jan 23, 2022)</ref>		<ref name="vice-5933">[https://www.vice.com/en/article/qjb3zq/cryptocom-says-alleged-dollar15-million-hack-was-just-an-incident Crypto.com Says Alleged $15 Million Hack Was Just an 'Incident'] (Jan 23, 2022)</ref>
	<ref name="crypto-5934">[https://crypto.com/product-news/crypto-com-security-report-next-steps Crypto.com Security Report & Next Steps - Crypto.com] (Jan 23, 2022)</ref>		<ref name="crypto-5934">[https://crypto.com/product-news/crypto-com-security-report-next-steps Crypto.com Security Report & Next Steps - Crypto.com] (Jan 23, 2022)</ref>

Azoundria: 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - OXT.me merged to remove - down to 9 left.

2023-03-30T22:22:12Z

52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - OXT.me merged to remove - down to 9 left.

Azoundria: https://twitter.com/ErgoBTC/status/1483540849434763264 merging together sources, down to 10 left.

2023-03-30T22:20:14Z

https://twitter.com/ErgoBTC/status/1483540849434763264 merging together sources, down to 10 left.

Azoundria: https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst merged with existing source.

2023-03-30T22:15:49Z

https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst merged with existing source.

← Older revision		Revision as of 16:15, 30 March 2023
Line 6:		Line 6:
	After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.		After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.

	~~<ref name="cointelegraph-5928" />~~<ref name="ergobtctwitter-5929" /><ref name="transactiontelegram-5930" /><ref name="krishktwitter-5932" /><ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />		<ref name="ergobtctwitter-5929" /><ref name="transactiontelegram-5930" /><ref name="krishktwitter-5932" /><ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />

	== About Crypto.com ==		== About Crypto.com ==
Line 97:		Line 97:
	\|An article is released on TheBlock in which the CEO of Crypto.com addresses the hack<ref name=":5">[https://www.theblock.co/post/130857/crypto-com-ceo-confirms-400-accounts-were-compromised-in-recent-hack "Crypto.com CEO acknowledged the hack but said customer funds were not in any danger" "the funds stolen were immaterial to the business" - TheBlock] (Mar 16, 2023)</ref>.		\|An article is released on TheBlock in which the CEO of Crypto.com addresses the hack<ref name=":5">[https://www.theblock.co/post/130857/crypto-com-ceo-confirms-400-accounts-were-compromised-in-recent-hack "Crypto.com CEO acknowledged the hack but said customer funds were not in any danger" "the funds stolen were immaterial to the business" - TheBlock] (Mar 16, 2023)</ref>.
	\|-		\|-
	\|January 19th, 2022 10:07:59 PM MST		\|January 19th, 2022 3:07:59 PM MST
	\|CoinTelegraph Article Released		\|CoinTelegraph Article Released
	\|An article released on CoinTelegraph "3 HOURS AGO" provides a loss estimate of $33m. It mostly repeats the information in ErgoBTC's post. CoinTelegraph reports that they reached out to Crypto.com but did not receive any response as of their publishing time<ref name="~~:4">[https://web.archive.org/web/20220119220759/https://~~cointelegraph~~.com/news/crypto~~-~~com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst - CoinTelegraph] (Mar 20, 2023)<~~/~~ref~~>.		\|An article released on CoinTelegraph "3 HOURS AGO" provides a loss estimate of $33m. It mostly repeats the information in ErgoBTC's post. CoinTelegraph reports that they reached out to Crypto.com but did not receive any response as of their publishing time<ref name="cointelegraph-5928" />.
	\|-		\|-
	\|January 20th, 2022 1:24:07 AM MST		\|January 20th, 2022 1:24:07 AM MST
Line 149:		Line 149:
	!PeckShield<ref name="peckshieldtwitter-5940" />		!PeckShield<ref name="peckshieldtwitter-5940" />
	!ErgoBTC<ref name=":1" />		!ErgoBTC<ref name=":1" />
	!CoinTelegraph<ref name=":4" />		!CoinTelegraph<ref name=":4">[https://web.archive.org/web/20220119220759/https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst - CoinTelegraph] (Mar 20, 2023)</ref>
	!Crypto.com<ref name=":3" />		!Crypto.com<ref name=":3" />
	!TechCrunch<ref name="techcrunch-5927" />		!TechCrunch<ref name="techcrunch-5927" />

← Older revision		Revision as of 16:22, 30 March 2023
Line 6:		Line 6:
	After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.		After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.

	~~<ref name="transactiontelegram-5930" />~~<ref name="krishktwitter-5932" /><ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />		<ref name="krishktwitter-5932" /><ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />

	== About Crypto.com ==		== About Crypto.com ==
Line 45:		Line 45:
	\|January 16th, 2022 5:01:00 AM MST		\|January 16th, 2022 5:01:00 AM MST
	\|Bitcoin Withdrawal Transaction		\|Bitcoin Withdrawal Transaction
	\|A large bitcoin withdrawal of 52.55312294 bitcoin is noted originating from Crypto.com<ref>[https://www.blockchain.com/explorer/transactions/btc/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - Blockchain.com~~] (Mar 16, 2023)</ref><ref name=":0">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - OXT.me~~] (Mar 16, 2023)</ref>.		\|A large bitcoin withdrawal of 52.55312294 bitcoin is noted originating from Crypto.com<ref name="transactiontelegram-5930" /><ref>[https://www.blockchain.com/explorer/transactions/btc/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - Blockchain.com] (Mar 16, 2023)</ref>.
	\|-		\|-
	\|January 16th, 2022 5:46:00 PM MST		\|January 16th, 2022 5:46:00 PM MST
Line 83:		Line 83:
	\|January 18th, 2022 1:44:00 PM MST		\|January 18th, 2022 1:44:00 PM MST
	\|ErgoBTC Reports Stolen Bitcoin		\|ErgoBTC Reports Stolen Bitcoin
	\|Twitter user ErgoBTC references the previously reported 4.6k ETH from the Crypto.com breach and reports an additional 444 BTC in suspicious withdrawals also appearing to be withdrawn from Crypto.com. The tweet chain includes a reference to the large bitcoin withdrawal transaction<ref name=":0" /><ref>[https://twitter.com/ErgoBTC/status/1483540852467187713 ErgoBTC - "We noted this abnormally large withdrawal" - Twitter] (Mar 16, 2023)</ref>, an analysis on the path of the funds being laundered<ref>[https://twitter.com/ErgoBTC/status/1483540858137980938 ErgoBTC - "The 271 BTC then make a series 24 or 25 BTC deposits" - Twitter] (Mar 16, 2023)</ref><ref>[https://oxt.me/graph/transaction/tiid/3884758039 ErgoBTC - Analysis Of Funds Laundering - OXT.me] (Mar 16, 2023)</ref>, and other users of the same tumbler services<ref>[https://twitter.com/ErgoBTC/status/1483540861531176962 ErgoBTC - "This tumbler has been commonly used in hacks attributed to the DPRK Lazarus Group" - Twitter] (Mar 16, 2023)</ref>. They note that while there is still no public acknowledgement released by Crypto.com<ref name="ergobtctwitter-5929" />, Crypto.com appears to be making customers whole<ref name=":2">[https://twitter.com/ErgoBTC/status/1483540863607353345 ErgoBtc - "Great that crypto dot com appears to be making its users whole" - Twitter] (Mar 16, 2023)</ref>.		\|Twitter user ErgoBTC references the previously reported 4.6k ETH from the Crypto.com breach and reports an additional 444 BTC in suspicious withdrawals also appearing to be withdrawn from Crypto.com. The tweet chain includes a reference to the large bitcoin withdrawal transaction<ref name=":0">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - OXT.me] (Mar 16, 2023)</ref><ref>[https://twitter.com/ErgoBTC/status/1483540852467187713 ErgoBTC - "We noted this abnormally large withdrawal" - Twitter] (Mar 16, 2023)</ref>, an analysis on the path of the funds being laundered<ref>[https://twitter.com/ErgoBTC/status/1483540858137980938 ErgoBTC - "The 271 BTC then make a series 24 or 25 BTC deposits" - Twitter] (Mar 16, 2023)</ref><ref>[https://oxt.me/graph/transaction/tiid/3884758039 ErgoBTC - Analysis Of Funds Laundering - OXT.me] (Mar 16, 2023)</ref>, and other users of the same tumbler services<ref>[https://twitter.com/ErgoBTC/status/1483540861531176962 ErgoBTC - "This tumbler has been commonly used in hacks attributed to the DPRK Lazarus Group" - Twitter] (Mar 16, 2023)</ref>. They note that while there is still no public acknowledgement released by Crypto.com<ref name="ergobtctwitter-5929" />, Crypto.com appears to be making customers whole<ref name=":2">[https://twitter.com/ErgoBTC/status/1483540863607353345 ErgoBtc - "Great that crypto dot com appears to be making its users whole" - Twitter] (Mar 16, 2023)</ref>.
	\|-		\|-
	\|January 19th, 2022 8:28:00 AM MST		\|January 19th, 2022 8:28:00 AM MST
Line 306:		Line 306:
	<ref name="cointelegraph-5928">[https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst] (Jan 23, 2022)</ref>		<ref name="cointelegraph-5928">[https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst] (Jan 23, 2022)</ref>
	<ref name="ergobtctwitter-5929">[https://twitter.com/ErgoBTC/status/1483540849434763264 ErgoBTC - "Still no acknowledgement of loss, despite large outflows from the custodial wallet" - Twitter] (Jan 23, 2022)</ref>		<ref name="ergobtctwitter-5929">[https://twitter.com/ErgoBTC/status/1483540849434763264 ErgoBTC - "Still no acknowledgement of loss, despite large outflows from the custodial wallet" - Twitter] (Jan 23, 2022)</ref>
	<ref name="transactiontelegram-5930">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 OXT] (Jan 23, 2022)</ref>		<ref name="transactiontelegram-5930">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 52.55312294 Bitcoin Withdrawal Transaction From Crypto.com - OXT Research] (Jan 23, 2022)</ref>
	<ref name="krishktwitter-5932">[https://twitter.com/Kris_HK/status/1483277350683185155 @Kris_HK Twitter] (Jan 23, 2022)</ref>		<ref name="krishktwitter-5932">[https://twitter.com/Kris_HK/status/1483277350683185155 @Kris_HK Twitter] (Jan 23, 2022)</ref>
	<ref name="vice-5933">[https://www.vice.com/en/article/qjb3zq/cryptocom-says-alleged-dollar15-million-hack-was-just-an-incident Crypto.com Says Alleged $15 Million Hack Was Just an 'Incident'] (Jan 23, 2022)</ref>		<ref name="vice-5933">[https://www.vice.com/en/article/qjb3zq/cryptocom-says-alleged-dollar15-million-hack-was-just-an-incident Crypto.com Says Alleged $15 Million Hack Was Just an 'Incident'] (Jan 23, 2022)</ref>

← Older revision		Revision as of 16:20, 30 March 2023
Line 6:		Line 6:
	After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.		After the initial confusion, the company eventually admitted what had happened and has since appeared to compensate all users. The 2FA system has been upgraded. They've also introduced some additional coverage (APP program) where they may cover up to $250k of losses.

	~~<ref name="ergobtctwitter-5929" />~~<ref name="transactiontelegram-5930" /><ref name="krishktwitter-5932" /><ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />		<ref name="transactiontelegram-5930" /><ref name="krishktwitter-5932" /><ref name="vice-5933" /><ref name="forbes-5936" /><ref name="theverge-5937" /><ref name="cointelegraph-5938" /><ref name="cryptocomtwitter-5939" /><ref name="cryptocomtwitter-5941" /><ref name="cnbc-5942" /><ref name="rektnews-6287" />

	== About Crypto.com ==		== About Crypto.com ==
Line 83:		Line 83:
	\|January 18th, 2022 1:44:00 PM MST		\|January 18th, 2022 1:44:00 PM MST
	\|ErgoBTC Reports Stolen Bitcoin		\|ErgoBTC Reports Stolen Bitcoin
	\|Twitter user ErgoBTC references the previously reported 4.6k ETH from the Crypto.com breach and reports an additional 444 BTC in suspicious withdrawals also appearing to be withdrawn from Crypto.com. The tweet chain includes a reference to the large bitcoin withdrawal transaction<ref name=":0" /><ref>[https://twitter.com/ErgoBTC/status/1483540852467187713 ErgoBTC - "We noted this abnormally large withdrawal" - Twitter] (Mar 16, 2023)</ref>, an analysis on the path of the funds being laundered<ref>[https://twitter.com/ErgoBTC/status/1483540858137980938 ErgoBTC - "The 271 BTC then make a series 24 or 25 BTC deposits" - Twitter] (Mar 16, 2023)</ref><ref>[https://oxt.me/graph/transaction/tiid/3884758039 ErgoBTC - Analysis Of Funds Laundering - OXT.me] (Mar 16, 2023)</ref>, and other users of the same tumbler services<ref>[https://twitter.com/ErgoBTC/status/1483540861531176962 ErgoBTC - "This tumbler has been commonly used in hacks attributed to the DPRK Lazarus Group" - Twitter] (Mar 16, 2023)</ref>. They note that while there is still no public acknowledgement released by Crypto.com<ref name="~~:1">[https://twitter.com/ErgoBTC/status/1483540849434763264 ErgoBTC~~ - "~~Still no acknowledgement of loss, despite large outflows from the custodial wallet" - Twitter] (Mar 15, 2023)<~~/~~ref~~>, Crypto.com appears to be making customers whole<ref name=":2">[https://twitter.com/ErgoBTC/status/1483540863607353345 ErgoBtc - "Great that crypto dot com appears to be making its users whole" - Twitter] (Mar 16, 2023)</ref>.		\|Twitter user ErgoBTC references the previously reported 4.6k ETH from the Crypto.com breach and reports an additional 444 BTC in suspicious withdrawals also appearing to be withdrawn from Crypto.com. The tweet chain includes a reference to the large bitcoin withdrawal transaction<ref name=":0" /><ref>[https://twitter.com/ErgoBTC/status/1483540852467187713 ErgoBTC - "We noted this abnormally large withdrawal" - Twitter] (Mar 16, 2023)</ref>, an analysis on the path of the funds being laundered<ref>[https://twitter.com/ErgoBTC/status/1483540858137980938 ErgoBTC - "The 271 BTC then make a series 24 or 25 BTC deposits" - Twitter] (Mar 16, 2023)</ref><ref>[https://oxt.me/graph/transaction/tiid/3884758039 ErgoBTC - Analysis Of Funds Laundering - OXT.me] (Mar 16, 2023)</ref>, and other users of the same tumbler services<ref>[https://twitter.com/ErgoBTC/status/1483540861531176962 ErgoBTC - "This tumbler has been commonly used in hacks attributed to the DPRK Lazarus Group" - Twitter] (Mar 16, 2023)</ref>. They note that while there is still no public acknowledgement released by Crypto.com<ref name="ergobtctwitter-5929" />, Crypto.com appears to be making customers whole<ref name=":2">[https://twitter.com/ErgoBTC/status/1483540863607353345 ErgoBtc - "Great that crypto dot com appears to be making its users whole" - Twitter] (Mar 16, 2023)</ref>.
	\|-		\|-
	\|January 19th, 2022 8:28:00 AM MST		\|January 19th, 2022 8:28:00 AM MST
Line 148:		Line 148:
	!		!
	!PeckShield<ref name="peckshieldtwitter-5940" />		!PeckShield<ref name="peckshieldtwitter-5940" />
	!ErgoBTC<ref name=":1" />		!ErgoBTC<ref name="ergobtctwitter-5929" />
	!CoinTelegraph<ref name=":4">[https://web.archive.org/web/20220119220759/https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst - CoinTelegraph] (Mar 20, 2023)</ref>		!CoinTelegraph<ref name=":4">[https://web.archive.org/web/20220119220759/https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst - CoinTelegraph] (Mar 20, 2023)</ref>
	!Crypto.com<ref name=":3" />		!Crypto.com<ref name=":3" />
Line 305:		Line 305:
	<ref name="techcrunch-5927">[https://techcrunch.com/2022/01/20/2fa-compromise-led-to-34m-crypto-com-hack/ 2FA compromise led to $34M Crypto.com hack – TechCrunch] (Jan 22, 2022)</ref>		<ref name="techcrunch-5927">[https://techcrunch.com/2022/01/20/2fa-compromise-led-to-34m-crypto-com-hack/ 2FA compromise led to $34M Crypto.com hack – TechCrunch] (Jan 22, 2022)</ref>
	<ref name="cointelegraph-5928">[https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst] (Jan 23, 2022)</ref>		<ref name="cointelegraph-5928">[https://cointelegraph.com/news/crypto-com-breach-may-be-worth-up-to-33m-suggests-onchain-analyst Crypto.com breach may be worth up to $33M, suggests onchain analyst] (Jan 23, 2022)</ref>
	<ref name="ergobtctwitter-5929">[https://twitter.com/ErgoBTC/status/1483540849434763264 @ErgoBTC Twitter] (Jan 23, 2022)</ref>		<ref name="ergobtctwitter-5929">[https://twitter.com/ErgoBTC/status/1483540849434763264 ErgoBTC - "Still no acknowledgement of loss, despite large outflows from the custodial wallet" - Twitter] (Jan 23, 2022)</ref>
	<ref name="transactiontelegram-5930">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 OXT] (Jan 23, 2022)</ref>		<ref name="transactiontelegram-5930">[https://oxt.me/transaction/06f7b6adac715ea7f30e2f23f52b3dfeed53e3413b96e84890d83c6b1e78e563 OXT] (Jan 23, 2022)</ref>
	<ref name="krishktwitter-5932">[https://twitter.com/Kris_HK/status/1483277350683185155 @Kris_HK Twitter] (Jan 23, 2022)</ref>		<ref name="krishktwitter-5932">[https://twitter.com/Kris_HK/status/1483277350683185155 @Kris_HK Twitter] (Jan 23, 2022)</ref>