With just a single transaction, hackers have stolen nearly £31 million ($40m) in Bitcoins from one of the world's largest cryptocurrency trading companies. The theft, which affected Binance, was carried out with a variety of methods that included phishing and viruses.
The hackers were able to withdraw 7,000 Bitcoin (£30.9m) by surpassing all the company's security checks, said the company's CEO. Chief Executive Changpang Zhao said that the amount taken made up 'about 2%' of Binance's total Bitcoin holdings.
The Japan-based company's chief executive Mr. Zhao, who is also known as CZ, said Binance will use its secure asset fund fully cover the incident and promised that it will conduct a 'thorough security review'.
In a statement, CZ described how the latest breach occurred, writing: 'Hackers were able to obtain a large number of user API keys, 2FA codes, and potentially other info. The hackers used a variety of techniques, including phishing, viruses and other attacks. We are still concluding all possible methods used. There may also be additional affected accounts that have not been identified yet.'
The company however warned its account holders that the process will take around a week, during which time withdrawals and deposits will remain suspended, although trading could continue.
'The hackers had the patience to wait, and execute well-orchestrated actions through multiple seemingly independent accounts at the most opportune time. The transaction (was) structured in a way that passed our existing security checks. It was unfortunate that we were not able to block this withdrawal before it was executed. Once executed, the withdrawal triggered various alarms in our system. We stopped all withdrawals immediately after that.'
In a separate Twitter post, the CEO CZ wrote: 'Not the best of days, but we will stay transparent.'
The theft is thought to only have affected the exchange's 'hot wallet', which refers to a cache of Bitcoin connected to the internet.
According to Ilia Kolochenko, founder and CEO of web security company ImmuniWeb, the technical details of the latest security breach remain 'obscure'. Mr Kolochenko said: 'It would be premature to make any conclusions at this point of time. Today, all cryptocurrency-related businesses should be well prepared to defend against constant and sophisticated cyber attacks. In reality, however, virtually all of them underestimate or ignore digital risks and allocate scant resources for cybersecurity. Most have to compete on a very aggressive and turbulent market and thus are reducing their costs by all available means. Software development suffers most tremendously as cheap outsourced code cannot be secure by definition. To bring certainty to the cryptocurrency markets clear regulatory standards are required, such as is PCI (Payment Card Industry Data Security Standard) and PA DSS (Payment Application Data Security Standard). Even if they are not a silver bullet, they greatly reduce both the number and average volume of credit cards theft.'
This is not the first time that unregulated cryptocurrency market has been plagued by scams. On top of large-scale funnelling of bitcoins worth millions of dollars, which are relatively rare, criminals also target individuals using elaborate schemes. These often target multiple investors and average account holders.
A report issued in October last year showed that in the first half of the year alone, more than $800 million were stolen in bitcoins. At the time, Patrick Wyman, FBI supervisory special agent at the financial crimes section of the agency's anti-money laundering unit acknowledges cryptocurrencies pose some unique challenges.
Extracted from: www.dailymail.co.uk