Summary # On December 31, 2023, Orbit Chain, a South Korean cross-chain project, experienced a significant security breach involving their Orbit Bridge. The attacker exploited the Orbit Bridge through a private key compromise and drained approximately $81.54 million worth of assets from the Orbit Bridge’s ETH Vault. The stolen funds were converted into ETH and DAI and then distributed across several addresses.
Attackers # The identity of the attacker remains unknown.
...
Summary # On December 25, 2023, Telcoin, experienced a security breach due to incorrect initialization of wallet contracts, which resulted from a mismatch between the actual implementation of the wallet and the corresponding proxy server, the attacker was able to transfer $TEL from user wallets for $1.2 million.
Attackers # The identity of the hackers who attacked Telcoin is unknown.
Hacker ETH Wallets:
0x35d2775e5f95596509951b140d68fc5b9185ff98 0xdb4b84f0e601e40a02b54497f26e03ef33f3a5b7 Losses # Telcoin estimated the losses from the hack to be $1.
...
Summary # On September 14, 2023, Remitano, a cryptocurrency exchange, fell victim to a security breach, resulting in unauthorized transactions on the Ethereum and TRON blockchains and a significant financial loss of $2.7 million. This incident was primarily a hack of the exchange’s hot wallet, triggered by a data leak from a third-party source. Tether’s prompt intervention helped freeze the attacker’s addresses, securing 1.9 million USDT and averting further potential losses.
...
Summary # On September 12, 2023, CoinEx, a crypto trading platform operating on various chains, experienced a massive security breach due to a private key compromise. The attacker exploited CoinEx’s hot wallets and extracted approximately $52.8 million worth of assets across 9 different chains. The stolen funds were transferred to the attacker’s addresses and then laundered via distribution between multiple addresses and smart contracts. Lazarus Group is suspected to be behind the theft, as multiple sources have confirmed an onchain connection between Stake.
...
Summary # On September 4, 2023, Stake.com, a crypto gambling protocol offering casino games and sports betting, was targeted by the Lazarus Group (also known as APT38), a group of DPRK cyber actors. The group exploited access control vulnerabilities and extracted approximately $41.4 million worth of various digital assets from the platform’s hot wallets across Ethereum, Binance Smart Chain (BSC), and Polygon networks. Stake.com reassured users that their funds were safe, and all other wallets remained operational.
...
Summary # AlphaPo, a crypto payment platform that processes payments for various gambling services, suffered a loss of more than $60 million due to a private key compromise that affected their hot wallets across Bitcoin, Tron, and Ethereum. The stolen funds were transferred to other blockchains, including Avalanche and Bitcoin. The funds on Bitcoin were deposited into the crypto mixer service Sinbad. The loss also includes the losses suffered by CoinsPaid, an entity related to AlphaPo.
...
Summary # On June 2, 2023, Atomic Wallet, a non-custodial multichain DeFi wallet, experienced an exploit resulting in the loss of over $100 million worth of various assets from its users. The largest affected wallet lost a total of 7,950,000 USDT. The suspected perpetrator of this attack is the Lazarus Group, a known North Korean hacking group. The hackers moved the stolen funds to Ethereum and TRON addresses. The part of the stolen assets were laundered through Sinbad mixer and Russia-based exchange Garantex.
...
Summary: # On April 14, 2023, cryptocurrency exchange Bitrue was hacked, resulting in the theft of cryptocurrencies worth approximately $23 million. Hackers gained access to the exchange’s hot wallets and stole various cryptocurrencies, including ETH, SHIB, QNT, HOT, MATIC, and GALA.
Attackers: # The identity of the hackers who carried out the attack on Bitrue is unknown.
Bitrue Drainer wallet: 0x1819ede3b8411ebc613f3603813bf42ae09ba5a5
Losses: # Bitrue estimated the losses from the hack to be approximately $23 million.
...
Summary # On April 9, 2023, South Korean cryptocurrency exchange GDAC was hacked, resulting in the theft of cryptocurrencies worth approximately $13 million. Hackers gained access to the exchange’s hot wallets and stole various cryptocurrencies, including Bitcoin (BTC), Ethereum (ETH), and Wemix (WEMIX).
Attackers # The attackers behind the GDAC hack remain unidentified.
GDAC Hacker ETH wallets:
0x244615D99684175d31369332039b2D84ce925EC5 0x57192cca8b8e4beb77f3466c6d0550e64cc53b0f Losses # GDAC lost approximately $13 million:
10,000,000 WEMIX 220,000 USDT 350 ETH 60.
...
Summary # On November 1, 2022, Deribit, a cryptocurrency derivatives exchange, was hacked for $28 million. The attacker gained access to the exchange’s hot wallet, which contains a small portion of the exchange’s user funds that are kept online for fast withdrawals.
Attackers # The identity of the attacker(s) is unknown.
BTC
Deribit hacker 1: bc1q2dequzmk5vk8nmmrata8nq4y0zgqn4vc0n2h8y Deribit hacker 2: bc1qw5g8lw4kzltpdcraehy2dt6dqda8080xd6vhl4kg4wwsypwerg9s3x6pvk ETH and USDC
Deribit hacker 1: 0xb0606f433496bf66338b8ad6b6d51fc4d84a44cd Deribit hacker 2: 0x8d08aad4b2bac2bb761ac4781cf62468c9ec47b4 Losses # The attackers managed to steal ~691 Bitcoin (BTC) and ~6,947 Ether (ETH) and ~$3,394,823 USDC from the hot wallet, worth approximately $28 million at the time of the attack.
...