Top

Hot Wallet Exploit Results in $23M Bitrue Loss

Web3 & Enterprise·April 19, 2023, 3:34 AM

Bitrue, a Singapore-based crypto exchange, has fallen prey to a $23 million hack due to a hot wallet exploit. The exchange has been forced to suspend all withdrawals until April 18, to provide an opportunity to conduct a thorough security review.

wallet with 20 USD bills in cash
©Pexels/Karolina Grabowska

 

Hot wallet vulnerability

Hot wallets are used by exchanges to store small amounts of cryptocurrencies for easy access. These wallets are connected to the internet and are therefore more vulnerable to attacks compared to cold wallets, which are stored offline. In the case of Bitrue, hackers were able to exploit the hot wallet and steal cryptocurrencies worth $23 million.

In a series of Twitter posts, the exchange outlined that the exploit occurred at 07:18 (UTC) on Friday. “We were able to address the matter quickly and prevented the further exploit of funds”, it went on to state.

The stolen digital assets include ETH, QNT, GALA, SHIB, HOT and MATIC. Bitrue outlined that the hot wallet funds account for only 5% of overall funds and that the rest of its wallets remain secure and have not been compromised.

Blockchain security firm PeckShield outlined how the funds were swapped and drained. A wallet it has labeled as “Bitrue drainer” swapped 173,000 QNT, 22.55 billion SHIB tokens, 46.4 million GALA and 310,000 MATIC for 8,540 ETH. The ether is now being held within the following address:

0x1819EDe3B8411EbC613F3603813Bf42aE09bA5A5

 

Reimbursing users

In response to the hack, Bitrue has promised to reimburse all affected users. However, the process could take some time.

The incident underscores the importance of taking precautions when storing cryptocurrencies on exchanges. Users should only keep a minimal amount of cryptocurrencies on an exchange and should not store more than they can afford to lose. Ongoing exploits, hacks and frauds exemplify the need for users to only use reputable platforms with a proven track record of security.

 

Doubling down on security

Bitrue has promised to improve its security measures to prevent similar incidents from occurring in the future. The exchange’s response to the hack has been lauded by many in the cryptocurrency community, who have praised the company’s transparency and commitment to reimbursing affected users.

The cryptocurrency community has been vocal in its criticism of exchanges that fail to prioritize security. The Bitrue hack is just the latest in a series of incidents that have highlighted the importance of maintaining security in the world of cryptocurrency.

It’s not the first security breach that the exchange has encountered. In 2019 Bitrue suffered a $4.7 million loss, with quantities of both XRP and Cardano (ADA) having been stolen. On that occasion, the exchange released tracking details relative to the stolen funds. Thanks to collaboration with Huobi, Bittrex and ChangeNOW, the funds and associated accounts were frozen.

According to data from CoinGecko, Bitrue trades an average of $1 billion in digital assets daily, with bitcoin and ether trading pairs accounting for a large proportion of that trading volume. The Bitrue hack has been a wake-up call for the cryptocurrency community and serves as a reminder of the ongoing risks associated with storing cryptocurrencies on exchanges.

More to Read
View All
Policy & Regulation·

May 09, 2024

Binance collaborates with Indian authorities to dismantle scam app

The Enforcement Directorate (ED) — an Indian law enforcement agency — seized 90 crores ($10.5 million) from an online scam app called E-Nuggets with the help of global crypto exchange Binance.  ED is the governmental law enforcement agency responsible for enforcing economic laws and with that, tackling economic crime. According to a report published by Indian English language daily newspaper The Hindu, the online gaming app E-Nugget had cryptocurrencies worth $10 million stored in 70 different crypto wallet accounts spread across the three crypto exchanges.  Local Indian exchanges ZebPay and WazirX also aided the ED in its investigations and subsequent actions. The ED contacted these exchanges to block the wallet addresses and transfer the crypto assets to the agency’s wallet. Photo by Naveed Ahmed on UnsplashCrypto assets seizedThe ED, tasked with upholding such financial crimes, spearheaded the operation against E-Nuggets, an online gaming platform masquerading as a legitimate investment opportunity. Taking to the X social media platform on April 30, the Indian law enforcement agency stated: “ED, Kolkata led a successful operation against a major “online gaming app scam” known as “E-Nugget”. The E-Nugget app, masqueraded as a gaming platform, promised users high returns on their investments. Crypto assets which were taken into possession of ED are transferred into Crypto Wallet of ED.” 70 wallets implicatedWith cryptocurrencies valued at $10 million spread across 70 different wallet accounts on three crypto exchanges, the agency swiftly took action. E-Nuggets enticed unsuspecting investors with promises of substantial returns through its purported gaming interface. However, once investments were made, the platform vanished into thin air, leaving users unable to recoup their funds. The ED's investigation revealed a complex web of deceit, with the agency seizing properties totaling over 163 crores ($19.5 million), comprising cash, cryptocurrency holdings, account balances and office spaces. The scam involved the funneling of funds into digital assets through 2,500 dummy bank accounts, resulting in the discovery of 19 crores ($2.2 million) in cash. A first information report (FIR) filed at the Park Street Police Station in Kolkata, became the catalyst that triggered the ED case that was subsequently registered under the provisions of India’s Prevention of Money Laundering Act (PMLA). Masterminded by Aamir Khan, who was apprehended alongside accomplice Romen Agarwal, the scheme operated under the guise of digital transactions, which, ironically, facilitated its unraveling. Law enforcement agencies adeptly traced, froze and seized the illicit funds as they moved through the digital realm. Public ledger upends scammersCritics often point to the potential for cryptocurrency to facilitate money laundering. However, the inherent transparency of blockchain technology presents significant obstacles to such illicit activities. Notably, in the infamous 2016 Bitfinex hack, where hackers absconded with 119,756 Bitcoin, the culprits were eventually apprehended in 2022 while attempting to launder the stolen funds. The collaborative efforts between Binance, the ED, and local exchanges points to a developing commitment towards combating financial fraud within the cryptocurrency space. This wasn’t the first occasion in which Binance had cooperated with law enforcement on such matters. In October of last year, the company got with the Thai authorities to assist them in crushing a crypto-related scam. By leveraging blockchain's transparency and international cooperation, authorities can effectively dismantle illicit schemes, safeguarding investors and upholding the integrity of the digital asset ecosystem.

news
Policy & Regulation·

Sep 25, 2023

Upbit Accidentally Accepts Counterfeit APT Tokens, Initiates Retrieval Efforts

Upbit Accidentally Accepts Counterfeit APT Tokens, Initiates Retrieval EffortsUpbit, South Korea’s largest cryptocurrency exchange, is reported to have accepted deposits of counterfeit Aptos (APT) tokens, mistaking them for their legitimate counterparts. The exchange has been reaching out to the sellers of these tokens by phone, requesting their recovery. This news has been circulating in several online crypto communities since the afternoon of September 24 (Korea Standard Time).Photo by Kenny Eliason on UnsplashUpbit’s responsesOn September 24 at 15:47 KST, Upbit announced a temporary suspension of deposit and withdrawal services for APT due to maintenance on the APT wallet. Following this, at 22:32 KST on the same day, Upbit explained that system maintenance was undertaken after identifying an unusual attempt linked to APT deposits. The crypto exchange went on to announce that the deposit and withdrawal services for APT would resume at 23:00 KST on the same day.DeFi degenerates’ insightsIn relation to this incident, Definalist, a group of DeFi degenerates based in Korea, shared insights on X (formerly Twitter). The group stated: “It seems that during the process of reflecting $APT coin deposits, there was a failure to check the type arguments, and all same functions transfers were recognized as the same APT native token. … If all APT ecosystem tokens were sent to Upbit’s wallet, they would have been mistakenly treated as APT native coins.”Decimal place differenceDefinalist also remarked on the fortunate nature of the counterfeit APT token having six decimal places, in contrast to the authentic APT token’s eight. They noted that if the deceptive token had mirrored the genuine token’s decimal places, the market disruption could have amplified a hundredfold. Meanwhile, the value of the counterfeit APT tokens deposited into Upbit is estimated to be about KRW 20 million (approximately $15,000).

news
Web3 & Enterprise·

Jul 05, 2023

3AC Founders Vow to Donate Future Earnings

3AC Founders Vow to Donate Future EarningsThe co-founders of the Singapore-headquartered bankrupt crypto hedge fund Three Arrows Capital (3AC) have publicly committed to donating their “future earnings” to creditors who suffered losses during the fund’s dramatic collapse.Kyle Davies and Su Zhu made this groundbreaking announcement during a candid Twitter Spaces session hosted by Mario Nafwal, aiming to establish a “shadow recovery process” parallel to the ongoing liquidation proceedings.Photo by Josh Appel on UnsplashBelieving in karmaDavies explained that their intended donations would be separate from the formal recovery process, designed to supplement any reimbursements that creditors might receive through the liquidation proceedings. While acknowledging that some early creditors have already been made whole, he emphasized the founders’ unwavering belief in the concept of “karma.”They see their act of giving back as a way to balance the scales and provide an avenue for creditors to potentially recover their losses.Creditor skepticismHowever, these noble intentions expressed by Davies and Zhu have been met with skepticism from the crypto community and the very creditors they seek to assist. Teneo, the liquidator overseeing the 3AC liquidation, responded to Davies’ comments by expressing disappointment in the founders’ lack of cooperation during the ongoing process. They stressed that the founders should prioritize engaging in the court-ordered activities rather than making promises about future earnings from a new venture.Acknowledging concerns about optics, Davies addressed questions surrounding the launch of their new crypto exchange, Open Exchange (OPNX), while their previous company undergoes liquidation. He stressed the inherent connection between OPNX and the creditors, suggesting that the success of their new entrepreneurial endeavor would ultimately benefit those affected by the collapse of Three Arrows Capital.OPNX success requiredOPNX, the newly launched Dubai-based trading platform, is specifically designed to facilitate the trading of bankruptcy claims. Since its announcement in February, the platform has garnered significant attention, boasting an impressive user base of 20 million individuals holding a collective $20 billion in claims. It is worth noting that the collapse of Three Arrows Capital resulted in the loss of $2.5 billion in customer deposits, making the success of OPNX crucial for creditors seeking redress.Davies also revealed that OPNX currently records approximately $50 million in daily trading volume, showcasing promising early traction for the platform. However, the exact mechanics of the “shadow recovery process” were left unspecified.While OPNX currently only facilitates the trading of claims from lender Celsius, the platform has ambitious plans to include claims from other high-profile bankruptcies in the near future. The list of potential additions encompasses notable entities such as FTX, Genesis, BlockFi, Voyager, Hodlnaut, Mt. Gox, Vauld, Zipmex, and even Three Arrows Capital itself.When taken at face value, the founders’ pledge to donate future earnings to creditors takes on the appearance of a significant and commendable gesture. However, doubts persist within the crypto community due to the founders’ prior actions and the ongoing liquidation process. Only time will reveal the true impact of this “shadow recovery process” and whether it will genuinely alleviate the losses suffered by creditors in the wake of Three Arrows Capital’s collapse.

news
Loading