On-chain analyst claims that crypto.com’s loss in the latest security breach may have been worth more than the reported $15 million reported by the exchange, which recently launched its blockchain, the Crypto.com chain.
Pseudonymous ‘ErgoBTC’, an on-chain analyst at Bitcoin (BTC) research firm OXT Research, claims that the Crypto.com security breach that was said to have resulted in the loss of 4.6K ETH ($15 million), may be worth up to $33 million.
Backstory
Crypto.com yesterday, reportedly suffered a hack, with at least $15 million worth of Ethereum stolen. The issue began when users began reporting that their funds were missing, even those with two-factor authorization enabled.
Crypto.com tweeted that it was pausing withdrawals on Monday after it received complaints from users.
Read: BitMart pledges to payback victims of its recent $196 million hack
These issues led PeckShield, a blockchain security firm, to look at the blockchain data. The firm revealed that at least 4600ETH is being laundered through Tornado Cash, which is an Ethereum privacy protocol that breaks the link between source and destination addresses.
The firm tweeted, “The @crypto.com loss is about $15M with at least 4.6K ETHs and half of them are currently being washed via @TornadoCash.”
After shutting down withdrawals due to suspicious activity, Crypto.com’s CEO Kris Marszalek confirmed to Bloomberg that the exchange experienced a security breach affecting 400 accounts on Tuesday.
Marszalek said Crypto.com “very quickly stopped” unauthorized withdrawals and lifted restrictions within 14 hours. According to him, all accounts affected were fully reimbursed.
Read: Crypto criminals stole $14 billion in 2021
What you should know
ErgoBTC tweeted on Tuesday suggesting that another 444 BTC ($18.5 million) had been stolen from Crypto.com’s payout wallet. ErgoBTC said that OXT Research discovered a suspicious transaction of 52.55 BTC ($2.18 million) from Crypto.com’s custodial wallet.
Following the transaction, according to ErgoBTC, “several hundred withdrawals” were made which were then combined into four outputs worth 67.75 BTC ($2.81 million) each. The four batches amounted to 271 BTC ($11.25 million), all of which were laundered via Bitcoin tumbler, a service that allows customers to combine several transactions and make it more difficult for investigators to trace Bitcoin transfers.
According to ErgoBTC’s tweet, the Bitcoin tumbler allegedly utilized by the perpetrators to wash the 271 BTC is a well-known tool employed by the North Korean cybercrime syndicate, Lazarus.
Read: How to protect your Crypto assets from thefts, hacks and frauds
According to ErgoBTC, the criminals behind the Crypto.com security breach also controlled another address holding 172.9 BTC ($7.25 million). Blockchain data reveals that the address received the funds at about the same time as the other transactions linked to the Crypto.com hack.
However, as of the publishing of this article, the purported hacker has not transferred the funds through a bitcoin tumbling service yet.
ErgoBTC is not the only one making these allegations as Crypto news site the Block also reported that withdrawals consisted of 4,830 ether, worth $15 million, and 444 bitcoins, worth $18.5 million.
Crypto.com’s CRO token, the native token of its blockchain network, is down 0.83% as of the time of this writing, currently trading at $0.43.