2024

Crystal

The OKX cryptocurrency exchange and security partner SlowMist are investigating a multi-million dollar exploit that resulted in two stolen user accounts.
The investigation pertains to the theft of two OKX exchange accounts on June 9 through an SMS attack, also known as a SIM swap. This information was reported by Yu Xian, founder of SlowMist, in a <a href="https://x.com/evilcos/status/1799677006097027397" target="_blank" rel="noopener nofollow">post</a> on X.
<blockquote data-ct-non-breakable="true">
 “The SMS risk notification came from Hong Kong and a new API Key was created (with withdrawal and trading permissions, which is why we suspected a cross-trading intention before, but it seems that it can be ruled out now).”
</blockquote>
While the amount stolen through the attack is unclear, Xian wrote that “millions of dollars of assets were stolen.”
Related: <a href="https://cointelegraph.com/news/crypto-hacks-19-billion-13-years">Crypto hacks soar to $19B in 13 years: Crystal Intelligence</a>
<h2 id="2fa-was-not-the-main-issue-behind-the-attack-slowmist">2FA was not the main issue behind the attack: SlowMist</h2>
While onchain security firm SlowMist is still investigating the hacker wallet and the underlying incidents, the exchange’s two-factor authentication (2FA) mechanisms may not be the main point of vulnerability.
In a June 9 X <a href="https://x.com/evilcos/status/1799697751011402159" target="_blank" rel="noopener nofollow">post</a>, SlowMist founder Xian wrote:
<blockquote data-ct-non-breakable="true">
 “I haven’t turned on a 2FA authenticator like Google Authenticator, but I’m not sure if this is the key point.”
</blockquote>
Cointelegraph has approached OKX and SlowMist for comment.
OKX’s 2FA mechanism allowed the attackers to switch to a low-security verification method, which allowed them to whitelist withdrawal addresses via SMS verification, according to an&nbsp;<a href="https://x.com/dilationeffect/status/1800116537128608133" target="_blank" rel="noopener nofollow">analysis</a> by Web3 security group Dilation Effect.
However, more sophisticated hackers have recently been bypassing 2FA verification methods. At the beginning of June, a Chinese trader&nbsp;<a href="https://cointelegraph.com/news/hackers-steal-millions-chrome-plugin-binance-scam">lost $1 million to a scam</a> that used a promotional Google Chrome plugin called Aggr. The plugin steals user cookies, which are used by hackers to bypass passwords and 2FA authentication.<iframe width="100%" height="315" src="https://www.youtube.com/embed/kyNQ5YoFkWo" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen data-ct-non-breakable="true"></iframe>
<figcaption style="text-align: center;">
 $3 billion stolen in hacks — Why are crypto crimes surging? Source: <a href="https://www.youtube.com/watch?v=kyNQ5YoFkWo&amp;t=21s" target="_blank" rel="noopener nofollow">Cointelegraph</a>
</figcaption>
Related: <a href="https://cointelegraph.com/news/crypto-hacks-2024-private-key-leaks">Crypto hacks increase in 2024, but smart contracts are not to blame</a>
<h2 id="phishing-attacks-are-on-the-rise">Phishing attacks are on the rise</h2>
Phishing attacks were on the rise in June after CoinGecko confirmed a data breach suffered by its third-party email management platform, GetResponse. The breach led to the attacker sending <a href="https://cointelegraph.com/news/coingecko-confirms-email-provider-data-breach">23,723 phishing emails to victims</a>.
Phishing attacks involve hackers aiming to steal sensitive information like <a href="https://cointelegraph.com/explained/crypto-wallets-explained">crypto wallet</a> private keys. Other phishing attacks, known as <a href="https://cointelegraph.com/news/binance-antidote-address-poisoning-scams-algorithm">address poisoning scams</a>, aim to trick investors into willingly sending funds to a fraudulent address similar to addresses they previously interacted with.
Private key and personal data leaks have become the biggest reason behind crypto-related hacks, as exploiters are targeting the lowest-hanging fruit.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/8c35fee5-b9ee-46bb-9463-21648f75ea42.png" alt="" title="">
 <figcaption style="text-align: center;">
 Crypto total losses by vulnerabilities. Source: Merkle Science
 </figcaption>
</figure>
Over 55% of hacked digital assets were lost to private key leaks during 2023, according to Merkle Science’s 2024 HackHub <a href="https://info.merklescience.com/hackhub-report-2024" target="_blank" rel="noopener nofollow">report</a>.
Magazine: <a href="https://cointelegraph.com/magazine/roaring-kittys-shares-1b-gme-rally-btc-open-interest-soars-hodlers-digest-june-2-8/">Roaring Kitty’s GME shares hit $1B, BTC open interest soars, and other news: Hodler’s Digest, June 2–8</a>

OKX investigates multimillion account thefts after SIM swap attacks

Table of Contents

Cointelegraph

Other articles published on Jun 12, 2024

Analysts Predict MoonBag at $1, Coinbase Rumours Make Investors Ignore BitBot And Hedera

Price analysis 6/12: BTC, ETH, BNB, SOL, XRP, DOGE, TON, SHIB, ADA, AVAX

Crypto Market Faces Liquidation Shock

Top Crypto Presale in June 2024, MoonBag, Edges BitBot And Avalanche With Live Presale Staking At...

New Memecoin Free Andrew Tate to Explode 17,000% Before KuCoin Listing, as Shiba Inu, Bonk and Do...

Azuro Steps Into AI Using Olas to Predict Sports Event Results

Join our free newsletter for daily crypto updates!