KuCoin Hot Wallet Breach

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

KuCoin

The KuCoin platform suffered a hot wallet breach, where hundreds of millions of dollars were stolen from their hot wallets. Some of the funds were recovered through working with centralized blockchains and platforms to blacklist the coins, however the thieves still successfully kept a significant haul. KuCoin has assured all customers that they will fully cover their losses with operating revenue.

This exchange or platform is based in Singapore, or the incident targeted people primarily in Singapore.

About KuCoin

"Behind KuCoin are two tech geeks who were early blockchain adopters. Having started coding at the age of 8 and founded his first startup at the age of 16, Michael heard about Bitcoin in 2012 from his boss Eric, and immediately started to mine. While he tried to sell some BTC on Mt. Gox, he discovered that, what was the world's largest platform at the time, was difficult for beginners to use. As the adoption of blockchain continued, Michael and Eric realized that it was reshaping the financial system, building a new system that not only serves the few richest, but everyone in the world - even the uneducated, unemployed and unbanked. By the end of 2013, they wrote down the first code in a cafe, beginning the journey of People’s Exchange to allow everyone to get involved with crypto."

"KuCoin is a well-known name in the crypto industry as it managed to establish itself as a prominent one-stop shop for all sorts of crypto operations. Launched in August 2017, the exchange has over 200 cryptocurrencies, more than 400 markets, and has grown into one of the most colorful crypto hubs online."

"The KuCoin platform was designed for investors of all types, with 24/7 world-class services in your preferred channel and language." "KuCoin is the most advanced and secure cryptocurrency exchange to buy and sell Bitcoin, Ethereum, Litecoin, TRON, USDT, NEO, XRP, KCS, and more."

"KuCoin boasts one of the world's most sophisticated security technology and maintenance team, and is constantly upgrading our security systems to ensure the safety of user assets and accounts."

"On 25 September, US $281 million in cryptoassets were stolen from KuCoin, a crypto exchange in Asia." "The exchange reported the breach at 19:05 UTC time on Friday when an unknown wallet initiated withdrawals of Bitcoin (BTC) and Ethereum (ETH)." "This is the third-largest theft ever to be suffered by a crypto exchange. A broad range of assets were taken, including Bitcoin, XRP, Litecoin, and a number of other tokens."

"The KuCoin security team noticed the breach and abnormal transactions two hours prior, at 02:51 AM, thinking it would be easy to solve. However, after shutting down the servers, they noticed that assets kept flowing outward, indicating that their hot wallet’s private key had been compromised."

"The assets in our cold wallets [we]re safe and unharmed, and hot wallets [were quickly] re-deployed." "[KuCoin Global CEO Johnny Lyu] mentioned that, according to the latest internal security audit report, part of the Bitcoin, ERC-20 and other tokens in KuCoin’s hot wallets were transferred out of the exchange" “approximately US $152 million was made up of Ethereum-based tokens (ERC20s), including Tether (USDT), Chainlink (LINK), and Ocean Protocol (OCEAN).”

"In a live stream on 4:30 UTC time Saturday, KuCoin CEO Johnny Lyu said that one or more hackers obtained the private keys to the exchange’s hot wallets." "KuCoin has been able to quickly identify all culprit wallets, and the amounts sent to them, specifically: 14,713 BSV, 26,733 LTC, 18,495,798 XRP and 999,160 USDT, along with over 1,008 BTC, 9,588,383 XLM, and 199,038,936 TRX."

"Token issuers such as Ocean Protocol and Tether began to freeze balances or forcibly move funds, so that KuCoin could retrieve the stolen assets." "[O]n September 30, Kucoin said it had managed to recover about $140 million after ten projects cooperated with it by either swapping or replacing the stolen tokens."

"Elliptic says the Kucoin hacker has sold $17.1 million worth of tokens via decentralized exchanges (dex) platforms like Uniswap, Kyber Network, Tokenlon. The shift to dex applications comes after centralized projects came to the aid of the beleaguered exchange by blocking any cashing out of the hack related funds." KuCoin has also been "in contact with a growing number of crypto platforms including Binance, Huobi, OKEx, Bybit, Upbit, Bibox, Gate, MXC, BitMax, BigONE, BKEX, BitZ, HBTC, Hoo, Crypto.com, Bingbon, Renrenbit, LBank, Max/Maicoin, CoinW and more to blocklist suspicious addresses and trace the funds affected." "Tether and several cryptocurrency assets and exchanges such as Bitfinex have blacklisted the wallet addresses, according to the updated statement."

"With $140 million now recovered while $17.1 million is already lost, it remains to be seen if the remaining $124 million, which is dominated in censorship-resistant cryptocurrencies, can be recovered."

"Hot wallets are said to have been redeployed after the hackers obtained the previous ones’ private keys, with cold wallets being unaffected by the breach." "KuCoin transferred what was left in them to new hot wallets, abandoned the old ones and froze customer deposits and withdrawals, Lyu said." "Moreover, a thorough security review will be conducted to ensure that remaining customer assets are intact and secure. KuCoin reported that deposit and withdrawals will be suspended during this period, after which the service will be gradually restored."

"After announcing the security breach, KuCoin’s token, KCS, fell in price by 14% within an hour. International law enforcement will join KuCoin in investigating the stolen funds and the public will be regularly updated on the development of the situation."

"After a thorough investigation, we have found the suspects of the 9.26 #KuCoin Security Incident with substantial proof at hand. Law enforcement officials and police are officially involved to take action." "With great support from our partners of the industry, another $64 million in assets are now out of the control of the suspicious addresses, bringing the total value to $204 million since Oct 1."

"Despite the security breach, KuCoin reassured consumers that their funds were safe." KuCoin has assured users that "user fund[s] affected by this incident ... will be covered completely by KuCoin and [their] insurance fund." "The CEO of KuCoin said that they may have found evidence of the hacker responsible for the massive security breach."

"A big thank you to all the institutions & individuals who are supporting us during the critical time."

This exchange or platform is based in Singapore, or the incident targeted people primarily in Singapore.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - KuCoin Hot Wallet Breach

Date	Event	Description
September 25th, 2020	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $281,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Third party reviews by security experts can often detect issues and help improve the design of hot wallets, and we recommend the opinions of at least 2 experts before starting, however these are not foolproof. Ultimately, lowering the level of funds in the hot wallet can reduce the risk considerably, and we propose an industry insurance fund which can assist in cases like this, though platform self-insurance would also help in a subset of cases such as this one.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.