Attacks/Breaches

1/30/2018
02:05 PM
50%
50%

Hack Costs Coincheck Cryptocurrency Exchange $530 Million

Losses at Japanese exchange Coincheck surpass those of the Mt. Gox Bitcoin exchange hack in 2014, and may be largest-ever cryptocurrency theft.

In possibly the largest known cryptocurrency hack to date, Japanese exchange Coincheck announced Friday that they had lost 58 billion yen, approximately $530 billion, worth of XEM cryptocurrency. This surpasses the 48 billion yen worth of Bitcoin lost by the Mt. Gox Bitcoin exchange in 2014.  

XEM (or NEM coins), created by the Singapore-based NEM Foundation, is one of the most popular cryptocurrencies in the world, according to Reuters. Coincheck acknowledged its security practices on XEM were insufficient, however. As Money reports

Coincheck said it used different security standards for different currencies, and that unlike customers' Bitcoin holdings, their XEM funds were stored in a "hot wallet" online instead of a "cold wallet" offline—a scenario ripe for hackers.

The company also failed to use multi-signature authentication on XEM funds, which would require at least two people for access.

Although blockchain technology has enabled Coincheck to identify the 11 addresses where the stolen coins ended up, and set up a tool for exchanges to automatically reject purchases made with them, hackers may still be able to use the funds via "tumblers" - exchanges that act like cryptocurrency laundering services. Coincheck has promised to reimburse 90 percent of the losses.

Read more about the incident here.  

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
8 Security Tips to Gift Your Loved Ones For the Holidays
Steve Zurier, Freelance Writer,  12/18/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20228
PUBLISHED: 2018-12-19
Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
CVE-2018-20230
PUBLISHED: 2018-12-19
An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVE-2018-20231
PUBLISHED: 2018-12-19
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
CVE-2018-20227
PUBLISHED: 2018-12-19
RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...