Maker

Security

The recent hack of 1,590 CoinStats crypto wallets was carried out by compromising a CoinStats employee.
On June 22, the cryptocurrency portfolio manager CoinStats temporarily suspended its services after discovering an active attack on its wallets. A swift and proactive response limited the hacker’s access to only 1.3% of all CoinStats wallets, <a href="https://x.com/narek_gevorgyan/status/1804888083227124216" target="_blank" rel="noopener nofollow">resulting</a> in a loss of $2 million.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/9779580b-7f75-452b-8c61-67710acc6807.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/narek_gevorgyan/status/1805873896836440411" target="_blank" rel="noopener nofollow">Narek Gevorgyan</a>
 </figcaption>
</figure>
Five days later, on June 26, Narek Gevorgyan, CEO of CoinStats, <a href="https://www.reddit.com/r/CoinStats/comments/1doubje/an_update_from_coinstats_ceo/" target="_blank" rel="noopener nofollow">revealed</a> the findings of an internal investigation:
<blockquote data-ct-non-breakable="true">
 “Our AWS infrastructure was hacked, with strong evidence suggesting it was done through one of our employees who was socially engineered into downloading malicious software onto his work computer.”
</blockquote>
Social engineering is a widely-used tactic used by hackers to manipulate, influence or deceive a victim in order to gain control over a computer system.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/4676c939-a8fa-4f1c-84b6-2e3888c0f346.png" alt="" title="">
 <figcaption style="text-align: center;">
 CoinStats shut down its website while it resolves the security issue. Source: CoinStats
 </figcaption>
</figure>
While Gevorgyan’s message did not explicitly promise refunds for all victims, the company plans to provide a detailed plan of action after conducting a thorough post-mortem analysis of the situation.
<blockquote data-ct-non-breakable="true">
 “I empathize with those who lost money; I’m sure their situation is just as difficult. CoinStats will definitely support the victims of the hack, and we’ve been discussing options internally.”
</blockquote>
Some community members have reported even greater losses due to the breach. For instance, a wallet owned by Blurr.eth allegedly lost 3,657 Maker (<a href="https://cointelegraph.com/maker-price-index">MKR</a>) tokens valued at approximately $8.7 million.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/d5d2e88d-78f4-4057-9a2f-7b31c4b8ff33.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/WuBlockchain/status/1804707183961276703" target="_blank" rel="noopener nofollow">Wu Blockchain</a>
 </figcaption>
</figure>
However, the company has yet to acknowledge the claims.
Related: <a href="https://cointelegraph.com/news/cryptocurrency-portfolio-manager-coinstats-security-breach-wallets">1,590 CoinStats crypto wallets ‘affected’ in security breach</a>
Security breaches have become a rising concern among crypto service providers. On June 5, cryptocurrency data aggregator CoinGecko suffered a data breach via its third-party email management platform GetResponse.
Similar to the CoinStats hack, the security breach at CoinGecko occurred due to a compromised employee account, according to the company’s June 7 announcement:
<blockquote data-ct-non-breakable="true">
 “An attacker had compromised a GetResponse employee’s account, leading to a breach. We received confirmation from the GetResponse team on 6 June 2024, at 11:58 AM UTC, that a data breach had occurred.”
</blockquote>
The compromised data include users’ names, email addresses, IP addresses, location of email opens and other metadata such as sign-up dates and subscription plans.
Magazine: <a href="https://cointelegraph.com/magazine/polkadot-indy-500-driver-conor-daly-dad-holds-dot/">Polkadot’s Indy 500 driver Conor Daly: ‘My dad holds DOT, how mad is that?’</a>

CoinStats hack caused by ‘socially engineered’ employee, CEO suspects

Cointelegraph

Other articles published on Jun 27, 2024

Marathon Diversifies Revenue Streams with Kaspa Mining

Inactive Bitcoin Wallet from Early Mining Days Becomes Active After 14 Years

Justin Sun moves TRX, BTT, and WIN tokens, Is he selling?

BlockDAG: The Hidden Gem Crypto Whales Can’t Ignore! Better Than Ondo Finance and JasmyCoin?

Ethereum ETF Inflows Could Be Up To 50% Of Bitcoin ETF Inflows: Galaxy Research

Marathon Digital mines $16M in Kaspa to diversify from Bitcoin

Join our free newsletter for daily crypto updates!