Crypto.com Hack Originating From 2FA Bypass Exceeds $30 Million Forcing Refunds and New Security Measures
The Singapore-based cryptocurrency exchange Crypto.com admitted that hackers stole $34.65 million worth of cryptocurrency after bypassing its two-factor authentication (2FA) system. According to the company’s statement posted online, at least 483 user accounts were affected by the 2FA bypass Crypto.com hack.
The fourth-largest global cryptocurrency exchange platform indicated that the incident allowed unauthorized withdrawals of 4,836.26 Ethereum tokens worth around $15 million and 443.93 bitcoin tokens worth around $17.3 million. Crypto.com also lost digital assets worth approximately $66,200 in other cryptocurrencies.
Crypto.com hack victims refunded after the company’s initial denial
The 2FA bypass of Crypto.com led to the introduction of the company’s Worldwide Account Protection Program (WAPP) that would reimburse “qualifying users” in “select markets” with up to $250,000 after unauthorized withdrawals.
To qualify, users must enable multi-factor authentication (MFA) for all transactions, create an anti-phishing code, avoid using jailbroken devices, complete a forensic questionnaire to assist in forensic investigations, and file a police report.
The cryptocurrency exchange platform had previously denied the heist, assuring its customers that “all funds are safe” after several users complained of missing funds. Crypto.com CEO Kris Marszalek reiterated that “no customer funds were lost” but acknowledged a 14-hour downtime. He also assured users that his team “hardened the infrastructure in response to the incident.”
However, the blockchain security firm PeckShield blew the lid off the Crypto.com hack, indicating that the exchange platform lost about $15 million. Additionally, PeckShield said that the hackers were laundering stolen Ethereum through Tornado Cash mixer service.
Crypto.com CEO later acknowledged the Crypto.com hack during a Bloomberg TV interview, adding that victims had been fully reimbursed. However, some Crypto.com hack victims complained that they were yet to receive their refunds after the official announcement.
Marszalek also downplayed the losses saying, “these materials are not particularly material,” and that “customer funds were never at risk.”
Crypto.com migrates to new authentication infrastructure after the 2FA bypass incident
The 2FA bypass prompted the cryptocurrency exchange to migrate to a new 2FA infrastructure. Additionally, Crypto.com revoked all 2FA tokens for global users to effect the new changes and introduced a 24-hour delay between registering whitelisted withdrawal addresses and the first transaction.
According to the company, the delay would give the users “adequate time to react and respond” and screen the addresses after receiving notifications.
Robert Byrne, a field strategist at One Identity, told IT Pro “We don’t have the details on how the Crypto.com hack evolved, but it appears that the policy controlling 2FA was exploited in some way, deactivating it for certain users.”
However, Byrne suggested that the hackers bypassed 2FA services after compromising a privileged account that they later used to change the 2FA policy of other users. He also suggested that the third-party 2FA provider was likely among the targets of the attack. Similarly, the 2FA bypass incident was a potential administrative security configuration oversight, according to Byrne.
The Crypto.com hack also prompted the exchange to engage third-party security experts to examine the new 2FA infrastructure before eventually transitioning to a true multi-factor authentication (MFA) service. The external parties would also conduct additional “threat intelligence services.”
“In 2022, the technical environment has evolved to, ‘I rob cryptocurrency exchanges because that’s where the money is,’” said Neil Jones, Cybersecurity Evangelist at Egnyte. “I’m actually more surprised by the number of users who had their money pilfered, nearly 500 according to published reports, rather than the $30 million+ that was stolen.”
