Exmo Assets Lost

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Exmo

Exmo stored a relatively large amount of customer assets in hot wallets, which according to their policy ranged between 5% and 10%. Therefore, they were fortunate that only 6% were taken, instead of 9% or 10%. They were also fortunate in that numerous other assets were not taken - only the top 6 cryptocurrencies out of many dozens of assets on their platform.

In general, once crypto-assets are taken, one should not expect to recover them. USDT (Tether) and XRP (Ripple) are somewhat centralized assets and have been known to block certain transactions if requested, however this was realized too late. The hackers also managed to withdraw the ETH through Poloniex. BTC and BCH have a high level of liquidity globally, while ZEC is a protocol with built-in privacy to restore fungibility.

This exchange or platform is based in United Kingdom, or the incident targeted people primarily in United Kingdom.

About Exmo

"EXMO is a British cryptocurrency exchange. The platform was established in 2014 and is constantly expanding its functionality, adding new assets to the listing, and, most importantly, increasing the number of customers. More than six years of operation without data leaks and hacks, flexible commissions, and fast technical support – these are among a list of reasons why clients choose EXMO." "EXMO exchange is registered in London, with offices in London, Moscow, and Kyiv, and employs a project team of 150+ people." "The trading platform accounts for $43 million (1,890 BTC) in 24-hour trade volume according to market aggregators. Exmo claims to have 1.6 million registered users and roughly 50,000 daily traders." "EXMO received temporary registration from the U.K.’s Financial Conduct Authority, allowing it to continue operating until July 9, 2021, pending the regulator's determination of their application."

"According to a security notice, the company detected “suspicious withdrawal activity” on Monday, 21 December. A security audit report showed large withdrawals of BTC, XRP, ZEC, USDT, ETC, and ETH from Exmo’s hot wallets. The affected hot wallets represent nearly 5% of the exchange’s total assets, the company said, adding that none of its cold wallets were affected." "According to The Block's research analyst Igor Igamberdiev, EXMO appears to have lost $10.5 million worth of funds." "Maria Stankevich, head of business development at Exmo, told Cointelegraph that the incident is “nothing very serious,”"

"All withdrawals are temporarily suspended." "We are still investigating the incident, but as of now, the security audit report showed that some amounts of BTC, XRP, ZEC, USDT, ETC and ETH in EXMO’s hot wallets were transferred out of the exchange. We reacted immediately and re-deployed hot wallets." "Compromised due to the hack amount makes up around 6% of the company’s total assets. We don’t believe it could somehow affect a going concern basis for EXMO. The company’s policy is to store around 5-10% of all its assets on hot wallets to enable fast withdrawals for users and limit potential losses from the hacks. At the moment of the hack, there was approximately 5-10% of BTC on a withdrawal wallet according to the internal rules."

"BTC, XRP, ZEC, USDT, ETC and ETH were withdrawn to the personal addresses of hackers." "According to a Cointelegraph report on Friday, hackers moved funds using Poloniex hours before the hacked British exchange announced about the attack and shared the crypto addresses to avoid." "Igamberdiev said all of the stolen ETH, XRP, and USDT has been sent to the exchange." “After we received the information from the Exmo team, we quickly identified and froze the two accounts. Unfortunately, all affected assets had been withdrawn hours before we were even contacted by Exmo,” a Poloniex spokesperson told the crypto-focused publication. “We utilize industry-leading software from Jumio, EVS and Elliptic to conduct identification, verification, OFAC, sanctions and transaction tracing. The affected accounts were created more than 4 weeks ago and were fully verified using the aforementioned software and standards.”

"Most importantly, we want to assure you that if any user fund is affected by this incident, it will be covered completely by EXMO." "We reported the case to the London police this morning and keep in touch with the Cybercrime team there. We also will conduct a thorough security review that will include all parts of our systems and data." Exmo "[c]ontacted CipherTrace, Chainalysis, and Crystal to mark the hackers’ addresses, where the funds came to, as “criminal” and “high risk.” By collaborating with these services, we are making sure the stolen crypto will never get in the hands of innocent users." "To prevent further attacks, the company said, it’s planning to set a third-party custody provider for hot wallets, decrease the level of cryptocurrency they keep in hot wallets to 4% to 7% and to expand and strengthened its security department." "Please mind that users’ account balances remain untouched by the attack. You can check it yourself by logging into the platform."

This exchange or platform is based in United Kingdom, or the incident targeted people primarily in United Kingdom.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Exmo Assets Lost

Date	Event	Description
December 21st, 2020	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $10,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

While a third party wallet provider may have a better security protocol in place, this also adds third party risk and a communication link which can be breached all the same. The nature of a hot wallet makes it difficult to have certainty of the security. Better security can be provided through offline storage with a multi-signature wallet.

A hybrid approach may make sense, where a smaller amount of funds are available for quick withdrawal, however larger withdrawals are handled from an offline multi-signature wallet a few times a day. It would also be recommended that the quick withdrawal funds not come from customer funds, or that they be protected by some form of insurance.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.