Read

Multi-chain trading platform Thunder Terminal has suffered a hacker attack, saying a malicious actor gained access to a MongoDB connection. 
In <a href="https://twitter.com/ThunderTerminal/status/1739843737860374845" target="_blank" rel="noreferrer noopener">an X post</a> on Dec. 27, Thunder Terminal acknowledged the breach, stating that the hacker gained access to a MongoDB connection URL. 
This access allowed the intruder to retrieve session tokens and execute withdrawals on behalf of users. 
The attack concluded at 12:20 AM UTC, Dec 27, after all session tokens and transaction signing access were revoked for security reasons, Thunder Terminal said. 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Incident Report At 12:11:47 AM UTC, suspicious withdrawals started getting sent through Thunder wallets. A malicious actor got access to a MongoDB connection URL which they used to pull session tokens and execute withdrawals on behalf of users. At 12:20:35 AM UTC, the last…— Thunder (@ThunderTerminal) <a href="https://twitter.com/ThunderTerminal/status/1739843737860374845?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">December 27, 2023</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
While Thunder Terminal assured users that no private keys or wallets were compromised, the team admitted that “less than 1% of wallets” were affected. The attack reportedly resulted in funds being stolen from at least 114 wallets. 
<blockquote class="wp-block-quote"> 
 “The exploit happened through withdrawal requests our server considered as authorized because of leaked session tokens. We do not store any private keys, so the attacker does not have access to any wallets. Desktop wallets were not affected.” 
 Thunder Terminal 
</blockquote> 
As of press time, it is unclear, how exactly the hacker got access to the project’s database. Thunder Terminal <a href="https://x.com/ThunderTerminal/status/1739843744416109016?s=20" target="_blank" rel="noreferrer noopener">suggests</a> that the hack may be related to an incident involving New York-based MongoDB. In mid-December, MongoDB <a href="https://www.securityweek.com/mongodb-confirms-hack-says-customer-data-stolen/" target="_blank" rel="noreferrer noopener">detected</a> “suspicious activity” on its network, later confirming that hackers had infiltrated its systems “for some period of time before discovery.” 
 According to blockchain sleuth ZachXBT, the attack <a href="https://t.me/investigations/81" target="_blank" rel="noreferrer noopener">transferred</a> 86.5 ETH (worth around $192,500) to Railgun, a privacy-aimed protocol that enables users to anonymously swap cryptocurrencies and make private transactions. The project <a href="https://x.com/ThunderTerminal/status/1739843741761094047?s=20" target="_blank" rel="noreferrer noopener">also revealed</a> that the hacker stole over 439 SOL (around $49,160). 
Initially, Thunder Terminal said the attack was related to a compromise of its third-party provider. The team also said “funds are safe,” adding that “refunds will be handled shortly.” 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Seems like a 3rd-party service we were using was compromised. Investigating actively – please give us some time. Funds are safe and refunds will be handled shortly.— Thunder (@ThunderTerminal) <a href="https://twitter.com/ThunderTerminal/status/1739812671174951415?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">December 27, 2023</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
However, shortly after this post, the hacker issued a blockchain-based <a href="https://etherscan.io/tx/0x6aae3869ef165c46a7611769644c029ded78cd2c050bbca85a5b17850cf7f10d" target="_blank" rel="noopener">statement</a>, accusing the Thunder Team of lying and threatening to disclose all user data unless the project pays them 50 ETH in ransom. 
Launched in late 2022, Thunder Terminal is a multi-chain trading platform with support for Ethereum, Solana, Avalanche, and other networks. 
 Read more: <a href="https://crypto.news/biggest-crypto-hacks/"> Major crypto hacks of 2023: how industry lost over $1b within minutes </a>

Thunder Terminal suffers hacker attack, losses amount to $240k

crypto.news

Other articles published on Dec 27, 2023

Ethereum’s Market Prospects Amidst BTC Stability and Technical Proposals

Elon Musk Sparks Hilarious Debate on AI and Traffic Lights

OKX partners with Cryptopedia, OneKey, Facet, SVARGA, and BaseSwap

Hong Kong, Which Wants to Become a Cryptocurrency Center, is Preparing to Enact a Law to Regulate...

Thunder Terminal Claims Security After $192,000 Exploit, Hacker Demands Ransom in Dispute

SKALE Price Prediction: Is SKL Ready for a Bullish Breakout?

Join our free newsletter for daily crypto updates!