Crooks Nab Millions in Crypto, Bypass MFA
Earlier this week, online cryptocurrency exchange platform Crypto.com announced the loss of over $34 million in mixed amounts of cash, ETH, and BTC. At the end of the day, it turned out the theft was made possible after the hackers sidestepped the platform's multi-factor authentication.
Last weekend some Crypto.com users were complaining that their accounts have been deflated and currency stolen. The platform initially acknowledged what it simply called reports of "suspicious activity" on some user accounts but also stated that the crypto was "safe".
Nearly 500 User Accounts Drained
This statement eventually changed to Crypto.com admitting malicious actors had stolen millions from hundreds of user accounts. Nearly five thousand ETH and just under 450 BTC were withdrawn illegally. The total number of user accounts that had been compromised in the attack was just over 480.
Rather importantly, the platform also stated that everyone affected by the illegal withdrawals has already been reimbursed in full.
The official disclosure on part of the platform was along the lines of what is customary in similar cases. Crypto.com detected "unauthorized activity" on the affected user accounts, with the transactions being pushed through without any multi-factor authentication input from the users. Withdrawals were halted on a platform-wide level until the issue was resolved.
Platform Reworks MFA Entirely
To address the MFA issue, the platform has announced that authentication has been moved to an entirely new infrastructure and all previously existing MFA tokens have been revoked to avoid further problems. Crypto.com has stated that it is moving to what it calls the Worldwide Account Protection Program in its push to avoid future incidents of this nature.
This is not the first time a crypto trading platform has been targeted successfully by hackers. Over the course of the last year, more than a dozen other similar attacks led to millions of dollars being siphoned out of other platforms. What makes this latest attack a bit more unique is the fact that the attackers circumvented MFA, which is often considered one of the best additional security measures.
