Maker

Security

The recent hack of 1,590 CoinStats crypto wallets was carried out by compromising a CoinStats employee.
On June 22, the cryptocurrency portfolio manager CoinStats temporarily suspended its services after discovering an active attack on its wallets. A swift and proactive response limited the hacker’s access to only 1.3% of all CoinStats wallets, <a href="https://x.com/narek_gevorgyan/status/1804888083227124216" target="_blank" rel="noopener nofollow">resulting</a> in a loss of $2 million.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/9779580b-7f75-452b-8c61-67710acc6807.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/narek_gevorgyan/status/1805873896836440411" target="_blank" rel="noopener nofollow">Narek Gevorgyan</a>
 </figcaption>
</figure>
Five days later, on June 26, Narek Gevorgyan, CEO of CoinStats, <a href="https://www.reddit.com/r/CoinStats/comments/1doubje/an_update_from_coinstats_ceo/" target="_blank" rel="noopener nofollow">revealed</a> the findings of an internal investigation:
<blockquote data-ct-non-breakable="true">
 “Our AWS infrastructure was hacked, with strong evidence suggesting it was done through one of our employees who was socially engineered into downloading malicious software onto his work computer.”
</blockquote>
Social engineering is a widely-used tactic used by hackers to manipulate, influence or deceive a victim in order to gain control over a computer system.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/4676c939-a8fa-4f1c-84b6-2e3888c0f346.png" alt="" title="">
 <figcaption style="text-align: center;">
 CoinStats shut down its website while it resolves the security issue. Source: CoinStats
 </figcaption>
</figure>
While Gevorgyan’s message did not explicitly promise refunds for all victims, the company plans to provide a detailed plan of action after conducting a thorough post-mortem analysis of the situation.
<blockquote data-ct-non-breakable="true">
 “I empathize with those who lost money; I’m sure their situation is just as difficult. CoinStats will definitely support the victims of the hack, and we’ve been discussing options internally.”
</blockquote>
Some community members have reported even greater losses due to the breach. For instance, a wallet owned by Blurr.eth allegedly lost 3,657 Maker (<a href="https://cointelegraph.com/maker-price-index">MKR</a>) tokens valued at approximately $8.7 million.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/d5d2e88d-78f4-4057-9a2f-7b31c4b8ff33.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/WuBlockchain/status/1804707183961276703" target="_blank" rel="noopener nofollow">Wu Blockchain</a>
 </figcaption>
</figure>
However, the company has yet to acknowledge the claims.
Related: <a href="https://cointelegraph.com/news/cryptocurrency-portfolio-manager-coinstats-security-breach-wallets">1,590 CoinStats crypto wallets ‘affected’ in security breach</a>
Security breaches have become a rising concern among crypto service providers. On June 5, cryptocurrency data aggregator CoinGecko suffered a data breach via its third-party email management platform GetResponse.
Similar to the CoinStats hack, the security breach at CoinGecko occurred due to a compromised employee account, according to the company’s June 7 announcement:
<blockquote data-ct-non-breakable="true">
 “An attacker had compromised a GetResponse employee’s account, leading to a breach. We received confirmation from the GetResponse team on 6 June 2024, at 11:58 AM UTC, that a data breach had occurred.”
</blockquote>
The compromised data include users’ names, email addresses, IP addresses, location of email opens and other metadata such as sign-up dates and subscription plans.
Magazine: <a href="https://cointelegraph.com/magazine/polkadot-indy-500-driver-conor-daly-dad-holds-dot/">Polkadot’s Indy 500 driver Conor Daly: ‘My dad holds DOT, how mad is that?’</a>

CoinStats hack caused by ‘socially engineered’ employee, CEO suspects

Cointelegraph

Other articles published on Jun 27, 2024

Ethereum ETF Inflows Could Be Up To 50% Of Bitcoin ETF Inflows: Galaxy Research

Blast Token Soars 20%, Airdrop Hype Fuels $2 Billion FDV

Coinbase Picks Fresh Legal Battle With US SEC and FDIC

South Korean crypto firm Hashed Ventures expands to Abu Dhabi: Report

Shiba Inu (SHIB) Price Surge: Eyes on $0.000018 Resistance

Sui Network Partners with Copper for Custody Solutions

Join our free newsletter for daily crypto updates!