OneArt

This month, the crypto exchange hacked list was replenished with one more item. The FTX collapse and “hack” shook the industry. But this is not the first and not the last case. Let’s recollect the others. About a month ago, Chainalysis called October 2022 the #1 month for hacking activity. Seems November has all the chances to surpass it, with the FTX crisis, bankruptcy, and hacker attack.OneArt is recollecting the most infamous exchange hacks and bankruptcy cases.<h2 id="header-0">1.    FTX: The biggest scandal — 2022</h2>Money loss: At least an <a href="https://www.bloomberg.com/news/articles/2022-11-10/sam-bankman-fried-s-ftx-faces-8-billion-shortfall-possible-bankruptcy#xj4y7vzkg" rel="noopener noreferrer nofollow">$8 billion hole</a> &#43; about <a href="https://coinmarketcap.com/alexandria/article/nearly-500m-stolen-from-ftx-hours-after-bankruptcy-filing" rel="noopener noreferrer nofollow">$500 million stolen</a>.What happened: It all started with an investigation by <a href="https://www.coindesk.com/business/2022/11/02/divisions-in-sam-bankman-frieds-crypto-empire-blur-on-his-trading-titan-alamedas-balance-sheet/" rel="noopener noreferrer nofollow">CoinDesk</a>. According to it, most of Alameda Research&#39;s balance sheet was made up of FTT. The article about Sam Bankman-Fried’s exchange and affiliate company shook the market, resulting in massive withdrawals. It was a kind of snowball effect.FTX faced at least an $8 billion hole. Sam Bankman-Fried asked for help, but even Binance declined the deal to buy the exchange.Finally, Sam Bankman-Fried filed for bankruptcy and had to resign. And the icing on the cake: less than 24 hours after filing, the FTX exchange “hack” followed. At least $477 million were stolen.When: November 2022.Why: FTX was reported to <a href="https://www.coindesk.com/policy/2022/11/10/ftx-violated-its-own-terms-of-service-and-misused-user-funds-lawyers-say/" rel="noopener noreferrer nofollow">misuse its customers’ assets</a> to lend them to Alameda Research. It had <a href="https://www.ft.com/content/f05fe9f8-ca0a-48d5-8ef2-7a4d813af558" rel="noopener noreferrer nofollow">9x more in liabilities</a> than in liquid assets, Financial Times said.Results:<ul><li>Customers will hardly be able to get their assets back.</li><li>The crisis impacted the whole crypto market. BTC, SOL, ETH, and others dropped.</li><li>Top exchanges plan to implement proof-of-reserve. These are Binance, Kucoin, Huobi, OKX, and Gate so far.</li></ul>Binance is also affected. Its users have already withdrawn $1.35 billion worth of BTC.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/3c1202f71ac9473ea8b2252f19557f3d.png" />Source: CryptoQuantBlockFi lender is also getting ready for a “<a href="https://www.wsj.com/articles/blockfi-prepares-for-potential-bankruptcy-as-crypto-contagion-spreads-11668534824?mod&#61;Searchresults_pos1&amp;page&#61;1" rel="noopener noreferrer nofollow">potential bankruptcy</a>” amid the FTX collapse.<h2 id="header-1">2.    Crypto.com: about 500 accounts hacked</h2>Money loss: 4,836.26 ETH &#43; 443.93 BTC &#43; about $66,200 in other currencies (nearly $33.8 million in total).What happened:A hacker disabled two-factor authentication (2FA). Later, Crypto.com CEO confirmed hundreds of accounts were hacked.The company insisted they managed to <a href="https://crypto.com/product-news/crypto-com-security-report-next-steps" rel="noopener noreferrer nofollow">prevent malicious withdrawals</a>. However, a blockchain security company PeckShield reported money loss and laundering:When: January 2022.Why: Again, the security breach. But the exchange hasn’t specified how exactly attackers executed transactions without 2FA.Results: Customers were reimbursed Crypto.com reported. The company has also announced implementing multi-factor authentication.<h2 id="header-2">3.    BitMart: One key, two wallets, and nearly $200 million stolen</h2>Money loss: About $200 millionWhat happened:To hack BitMart, criminals stole a <a href="https://oneart.digital/en/blog/what-is-a-private-key" rel="noopener noreferrer nofollow">private key</a>. It allowed them to access two hot wallets on Ethereum and BSC and <a href="https://www.coindesk.com/tech/2021/12/06/bitmart-ceo-says-stolen-private-key-behind-196m-hack/" rel="noopener noreferrer nofollow">withdraw $196 million</a>.When: December 2021Why: A massive security breach gave hackers access to a private key. PeckShield reported it was a case of “<a href="https://coinmarketcap.com/alexandria/article/bitmart-hack-one-of-the-most-recent-crypto-hacks" rel="noopener noreferrer nofollow">transfer, swap, and wash hacking</a>.” Then criminals exchanged stolen funds via 1inch and deposited them using Tornado cash to hide the receiving address.Results: Bitmart promised to repay its users out of its own pocket. However, in January 2022, users complained they <a href="https://www.cnbc.com/2022/01/07/cryptocurrency-theft-bitmart-still-owes-victims-of-200-million-hack.html" rel="noopener noreferrer nofollow">hadn’t received any compensation</a>.<h2 id="header-3">4.    KuCoin: One of the biggest hacks in the crypto space</h2>Money loss: $281 millionWhat happened: The case is similar to BitMart’s, but it affected more wallets. Hackers <a href="https://www.kucoin.com/news/en-kucoin-security-incident-update" rel="noopener noreferrer nofollow">drained</a> part of BTC, ERC-20, and other tokens from the exchange. Cold wallets were not impacted.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/022c2193eb8446abaff7a2e22e99508e.png" />When: September 2020Why: Again — a leak of private keys.Results: KCS price dropped by 14%. KuCoin recovered $204 million worth of stolen crypto and reported redeploying the hot wallets and <a href="https://twitter.com/lyu_johnny/status/1312359615091277824" rel="noopener noreferrer nofollow">finding the suspects</a>.<h2 id="header-4">5. Binance: The <a href="https://www.statista.com/statistics/864738/leading-cryptocurrency-exchanges-traders/" rel="noopener noreferrer nofollow">largest crypto exchange</a> hacked</h2>Money loss: 7,074 BTC (over $41 million)What happened: Due to phishing, viruses, and other malicious tactics, hackers accessed user API keys and two-factor authentication (2FA) codes. They managed to steal over 7,000 BTC in <a href="https://www.blockchain.com/btc/tx/e8b406091959700dbffcff30a60b190133721e5c39e89bb5fe23c5a554ab05ea" rel="noopener noreferrer nofollow">just one transaction</a>. The hack affected only <a href="https://docs.google.com/document/u/2/d/1CGxQJzDD3bIR76chSW7UyfZYh07kXur0Y3qkHlCGEso/edit" rel="noopener noreferrer nofollow">BTC hot wallet</a>, Binance reported.When: May 2019Why: Security breachResults: Binance used its Secure Asset Fund for Users (SAFU) to repay customers 100% of their losses. It didn’t plan to implement any reorganization, Changpeng Zhao said. The jokes weren’t long in coming:<h2 id="header-5">6.    Coincheck: The largest centralized exchange security breach</h2>Money loss: 523 million NEM ($487,387,361 at that time)What happened: The attackers stole the private key and accessed the hot wallet to drain the tokens. It was a <a href="https://cointelegraph.com/news/coincheck-stolen-534-mln-nem-were-stored-on-low-security-hot-wallet" rel="noopener noreferrer nofollow">simple wallet</a> without multi-signature protection. For unknown reasons, this regarded only NEM. Other cryptocurrencies were stored using multisig.When: January 2018Why: Coincheck stored both users’ and its own assets in the hot wallet with single-signature protection.Results: Coincheck had to repay its 260,000 users with its own funds.<h2 id="header-6">7.    Bitfinex: The largest BTC loss since the Mt. Gox case</h2>Money loss: 120,000 BTC ($72.2 million at that time)What happened: The issue <a href="https://www.coindesk.com/markets/2016/08/03/the-bitfinex-bitcoin-hack-what-we-know-and-dont-know/" rel="noopener noreferrer nofollow">affected multi-signature wallets</a> powered by the BitGo system. According to it, the exchange held two of the three keys. The 3rd one was used by BitGo. The bug allowed hackers to trick algorithms and drain money. Here’s an example of how Bitfinex was hacked, and funds were withdrawn:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/301e2a2e1a414697bd231aefc5fd6334.png" />Source: <a href="https://cointelegraph.com/magazine/crypto-exchange-hacks/" rel="noopener noreferrer nofollow">Cointelegraph</a>When: August 2016Why: The bug affected the 3rd-party service.Results: Bitfinex <a href="https://blog.bitfinex.com/announcements/bitfinex-interim-update/" rel="noopener noreferrer nofollow">froze 36.067%</a> on each account and then refunded with its tokens. Most funds were recovered only this year. In 2021, $623 million worth of BTC from this hack <a href="https://www.coindesk.com/markets/2021/04/14/623m-in-bitcoin-from-2016-bitfinex-hack-moved-under-cover-of-coin-hype/" rel="noopener noreferrer nofollow">was moved</a>. But experts say it’s hard to cash them out:<h2 id="header-7">8.    Mt. Gox: The long-lasting hack (2011-2014) and bankruptcy</h2>Money loss: 850,000 BTC ($230,928,049 at the time of the attack)What happened: In 2011, the attacker <a href="https://cointelegraph.com/news/the-mess-that-was-mt-gox-four-years-on" rel="noopener noreferrer nofollow">accessed</a> the exchange auditor’s computer, assigned himself 2,000 BTC, and then sold them. The price dropped sharply, from $17.50 to $0.01, in just half an hour.The infamous 2014 Mt. Gox hack revealed that security issues and theft were not detected for years. The exchange halted BTC withdrawals, then — all trading operations. Finally, the exchange went bankrupt. It all happened in a month!When: June 2011 – February 2014Why:<ul><li>A compromised computer had admin-level access. Mt. Gox discovered an “<a href="https://web.archive.org/web/20110919162635/https:/www.mtgox.com/press_release_20110630.html" rel="noopener noreferrer nofollow">SQL injection vulnerability</a>.” It granted access to the user database.</li><li>A bug allowed for altering transaction details: the assets were sent, but it seemed they weren’t.</li></ul>Results: Thousands of Mt. Gox customers lost their money. The BTC price<a href="https://www.forbes.com/sites/andygreenberg/2014/02/25/bitcoins-price-plummets-as-mt-gox-goes-dark-with-massive-hack-rumored/" rel="noopener noreferrer nofollow"> crashed by 23%</a> in a few days and by 36% within a month. Its CEO was arrested and admitted “finding” 200,000 of stolen BTC. He was charged with embezzlement and allegedly spent money on prostitutes:Only this summer Mt. Gox creditors were allowed to <a href="https://www.bloomberg.com/news/articles/2022-07-07/mt-gox-creditors-inch-closer-to-repayment-as-bitcoin-dump-looms" rel="noopener noreferrer nofollow">register for repayments</a>.<h2 id="header-8">How do crypto exchanges get hacked?</h2><a href="https://oneart.digital/en/blog/what-is-a-dex" rel="noopener noreferrer nofollow">Decentralized exchanges</a> (DEXs) tend to have less secure protocols which become the target for an attack. In H1 2022, the ratio of CEX vs. DEX hacks was as high as 1:20, according to the <a href="https://crystalblockchain.com/security-breaches-and-fraud-involving-crypto/" rel="noopener noreferrer nofollow">Crystal Blockchain report</a>.Up to 2021, security breaches on centralized exchanges (CEXs) topped the chart. In most cases, the hackers tried to steal crypto from exchanges with low Know Your Customer level. They often target the custodial keys, i.e., those held by the exchange and not by users.In fact, CEX is a <a href="https://www.forbes.com/sites/forbestechcouncil/2018/05/03/the-three-layers-of-cryptocurrency-security/" rel="noopener noreferrer nofollow">typical centralized service</a>, and its code and infrastructure security “have nothing to do with blockchain,” Ivan Novikov of Wallarm, a security startup, explains. He points to the <a href="https://www.forbes.com/sites/forbestechcouncil/2018/09/17/why-are-crypto-exchanges-are-hacked-so-often/" rel="noopener noreferrer nofollow">most popular security problems</a>:<ul><li>Cross-site scripting ­— attackers use your browser as their own.</li><li>Open redirects — moving you to a different website.</li><li>Authentication issues — for example, bypassing 2FA.</li><li>And more.</li></ul><a href="https://www.imperva.com/learn/application-security/social-engineering-attack/" rel="noopener noreferrer nofollow">Social engineering</a> is another popular tactic. It includes various methods, such as scareware (false alarms), baiting (false promises to arouse curiosity or greed), phishing, etc. BTW, in October 2022, FTX users got hooked and lost $6 million in a phishing attack.<h2 id="header-9">Key things to keep in mind</h2><h3 id="1-not-your-keys-not-your-coins">1.     Not your keys, not your coins</h3>The growing number and scale of hacks and bankruptcy cases in the crypto space remind all holders of the ground rule: you own your assets as long as you own your keys. That’s why we need to go back to the initial ideas of cryptocurrencies — self-custody and decentralization. To secure yourself, keep on an exchange only a small amount of crypto you need for trading operations. For storing assets, use a <a href="https://oneart.digital/en/blog/what-is-a-non-custodial-wallet" rel="noopener noreferrer nofollow">non-custodial wallet</a>. A cold wallet is also a good idea, however, not really convenient.As of November 14, at least 106,000 BTC have been moved from CEXs into self-custody:<h3 id="2-double-checking-every-step">2.     Double-checking every step</h3>It means you should check crypto and website addresses when transferring crypto, links before you click on, emails, ads, airdrops, etc. To learn the <a href="https://oneart.digital/en/blog/how-to-retrieve-your-hacked-crypto-wallet#how-to-secure-yourself-in-crypto" rel="noopener noreferrer nofollow">top 10 tips on how to secure your assets</a>, check out our article.<h3 id="3-avoiding-bugs-in-smart-contract-code">3.     Avoiding bugs in smart contract code</h3>Vitalik Buterin reminds developers that self-custody is not enough:<h3 id="follow-official-oneart-channels-to-find-the-latest-info-and-updates">Follow official OneArt channels to find the latest info and updates:</h3><ul><li><a href="https://twitter.com/art_wallet" rel="noopener noreferrer nofollow">Twitter</a></li><li><a href="https://t.me/art_wallet" rel="noopener noreferrer nofollow">Telegram Group</a></li><li><a href="https://t.me/artwallet_official" rel="noopener noreferrer nofollow">Telegram Announcements</a></li><li><a href="https://coinmarketcap.com/community/profile/OneArt" rel="noopener noreferrer nofollow">CoinMarketCap Community</a></li><li><a href="https://www.linkedin.com/company/oneart/" rel="noopener noreferrer nofollow">LinkedIn</a></li></ul>

Top 8 Crypto Exchange Hacks & Bankruptcy Cases

Table of Contents

OneArt

Other articles published on Nov 23, 2022

Announcing Fringe’s improved interest rate model

IT from Home: Prepare your IT Infrastructure for the new normal

Crypto News of the Day: Saudi Arabia’s NFT collection soars after soccer win, Mango Markets hacke...

Things That Weaken NFT Games

Bitcoin Market Suffers Amid FTX-Drama as Realized Loss Hits Low In History

What is Stellar Trustline and how to add a trustline to a token

Join our free newsletter for daily crypto updates!