Jun 2024 - CoinStats AWS Compromise Wallets Drained - $2m (Global)
"Manage All Your Wallets & Exchanges From One Place Connect your entire portfolio to track, buy, swap, and stake your assets."
"Our AWS infrastructure was hacked, with strong evidence suggesting it was done through one of our employees who was socially engineered into downloading malicious software onto his work computer."
"Cryptocurrency portfolio management company CoinStats temporarily suspended user activities after 1,590 crypto wallets were affected by a security incident. CoinStats stated, "The attack has been mitigated, and we have temporarily shut down the application to isolate the security incident. None of the connected wallets and CEXes were impacted. Thanks to the immediate incident reponse from the CoinStats team, only 1.3% of all CoinStats Wallets were affected, totaling 1,590 wallets. The list might change as the investigation is ongoing but we don’t expect significant changes.""
"The attack has been mitigated, and we have temporarily shut down the application to isolate the security incident.
1. None of the connected wallets and CEXes were impacted.
2. Thanks to the immediate incident reponse from the CoinStats team, only 1.3% of all CoinStats Wallets were affected, totaling 1,590 wallets. The list might change as the investigation is ongoing but we don’t expect significant changes.
3. If your wallet address is in this affected list, please move your funds immediately using your exported private key (if you have exported previously): https://docs.google.com/spreadsheets/d/1Lwxpy2T6W7aptjBJUio0Z01zihsqknXn6KPhzawQLVI/
4. We are actively investigating the extent of funds moved and will provide updates as soon as they become available.
We're actively working to bring the app back online as quickly as possible. Thank you for your patience."
"Seeing all this happen to something you've worked hard on for 6 years is tough, especially since it occurred because of a secondary feature. The CoinStats Wallet, used by no more than 1% of all our users, was certainly not the reason people loved our product.
I empathize with those who lost money; I'm sure their situation is just as difficult. CoinStats will definitely support the victims of the hack, and we've been discussing options internally."
"Thank you for your update and for your continued dedication to CoinStats over the past six years. I understand how challenging it must be to see such hard work impacted by this unfortunate incident.
The success and trust in our industry rely on companies like CoinStats taking full accountability for their actions. This includes making sure those affected by the recent hack are adequately compensated. It is vital for the integrity of our ecosystem that those harmed, including our founder BLURR.ETH who lost $8.7 million due to this breach, are made whole.
We appreciate your commitment to supporting the victims and look forward to a detailed update on how CoinStats plans to address these losses and enhance security measures to prevent future occurrences."
"I wanted to share the list of the EVM wallets where significant portion of the stolen funds are sitting currently. (Totaling around $1.8-1.9m)
We would appreciate any help to monitor / track sources of those wallets in order to be able to recover any amount of funds.
0xe25ca22d0b0820295953f57e53da9b96c32b9237
0xbb84aca7e688eb0841f20dbe0b3e906a5b94c02d
0x10f3b2e121653564bad2bc75e86fa007d1038553
0x74cc3109e2646336e55dd3c4328e02b5cbecc589
0x89215b0f53b902fb580c4b177e4220230293522d
0xb33eff60375b29c6fc8d9da3bd89a65934a08eb9
0x00b03fe97b4d7b1f8948b68d0065344d37aad193
0x0e249592fc5ea4d7fb590bf5ecfa92757572609a
0x92106823b4b64c5a21df02676bd39fd53f3ed753
0x0340f1b9a75a38e487687ee7c41052a70c7224a9
0x45ba1562b7a4d7a3fa5150bdf0107299f35f0b97
0x99c6518a994ce44f110a081e9e17f334828fbac0
0x580c1f75a732555be26d83938a8a1ed51768aa4a
0x6b42900261f7729583cb81e294a58267eff3c5b7
0x0e70fd0271b41ca77a2efdcb07ab178602122d8c
0x12b0128fb5cf9ca6a6a4370b0e567c6c35c575c7
0x48a9dbbca590d3269db882f30db59c72f8f6fd4b
0x8186e7cd489dcda68875ff06df48a40624c8ca7c
0x42e4e114bbde931b2de5c5cdb1b1c0ca783f24fa
0x19ff1c100323b52611ada86a2a576615a283b150
0x5bcfd99c34cf7e06fc756f6f5ae7400504852bc4
0xb0621ece074216f57f4105b8a60c2eb6c3556ce9
0xadfb847b23297b396177e4f6aa0961216311d723
0xF20B76317FaAEA4DEaDdB170Ef692dd9C606707c
0xfd03F78Fc2EaD3814abc9Dc6B7f357415FbBE11D
0x19a1ce39b06480063fb2d76f160b294239b0f725
0xd83611dc27fe606d85e4fde4aa308c84b71d0604"
Further Analysis
CoinStats provides a suite of utilities to assist with managing and tracking portfolio positions. On June 22nd, users started getting strange push notifications attempting to scam them, before wallets which were created through the application were drained. Only 1% of users created their wallets through the application itself, but in those cases, there were devastating losses. The protocol is still figuring out a recovery strategy for affected users.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
MakerDAO Delegate aEthMKR Pendle USDe Phishing Attack > > < < BtcTurk Hot Wallet Network Attack
Sources/Further Reading
SlowMist Hacked - SlowMist Zone (Dec 31)
@CoinStats Twitter (Dec 31)
@narek_gevorgyan Twitter (Dec 31)
@narek_gevorgyan Twitter (Dec 31)
Cryptocurrency Portfolio Tracker and Research | CoinStats (Dec 31)
x.com (Dec 31)
x.com (Dec 31)
x.com (Dec 31)
x.com (Dec 31)
x.com (Dec 31)
x.com (Dec 31)
Crypto Tracker Trusted by 1 Million People Worldwide (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|