Bitcoin Forum

r/Cryptopia
•Posted byu/toldjahP
1 hour ago
Cryptopia Hack analysis (min. $13,000,000 stolen)

Hi there


I checked etherscan and collected some informations below. In total min $13,000,000 were stolen.


Transfer of 19,390 ETH from Cryptopia ($2,468,043) (Jan-13-2019 01:30:35 PM +UTC): https://etherscan.io/tx/0x8a7c2b34f23eee02401e7c3fa1ea2ce8d3132e7ca3811d673ca35898c9535aae


Transfer of 48,029,305 ($1,072,362) CENNZ (Jan-13-2019 01:40:17 PM +UTC) Wallet is tagged as Cryptopia Wallet by Whale Alert: https://etherscan.io/tx/0x31a58df14ea3420878267e2b9cdd242d983b5298ef48c5cd9a799ed10605f393


Transfer of 3,844,247,574 ($304,181) DAPS (Jan-13-2019 01:40:17 PM +UTC): https://etherscan.io/tx/0x61b2ca4911750eb3278945f80e0c3f8a7f94578ba20b0e9240e5a86faaa166ae


CENNZ and DAPS where transfered to https://etherscan.io/address/0x9007a0421145b06a0345d55a8c0f0327f62a2224 which is not the same adress where the ETH went on. But later this adress made a transfer to the ETH adress https://etherscan.io/address/0xc8b759860149542a98a3eb57c14aadf59d6d89b9 (which is the adress the ETH went).


Token Balance 2. adress: ($11,072,793) https://etherscan.io/address/0x9007a0421145b06a0345d55a8c0f0327f62a2224


Please help to collect further details.

There are topics already created about that.

CRAPTOPIA all ur coins are haX0red (https://bitcointalk.org/index.php?topic=5097523.0)
CRYPTOPIA HACKED 🔥🔥🔥 (https://bitcointalk.org/index.php?topic=5097552.0)

There are topics already created about that.

CRAPTOPIA all ur coins are haX0red (https://bitcointalk.org/index.php?topic=5097523.0)
CRYPTOPIA HACKED 🔥🔥🔥 (https://bitcointalk.org/index.php?topic=5097552.0)

Can't find more useful informations at the moment. I will update this thread as soon as things move.

l8te to the buzz but good break down on the eth trail.

This is my first time that an exchange was supposed to be hacked where i have some port polio in it. Honestly i am scared right now on losing my money on that exchange. Does anybody here know on what would be the future of our money on that exchange if it is true that it was hacked?

This hacker attack should open the eyes of holders how dangerous is to hold their funds on exchanges.
I know it is convenient, especially for traders but it is highly risky as we can see and we can lose our funds and could do anything against it in such situations.

First rules of crypto: NEVER LEAVE YOUR FUNDS ON EXCHANGES OVERNIGHT. USE EXCHANGES ONLY ON THE MOMENT OF TRADING NEEDS. Or, at least, do not store more funds than you can afford to lose on random exchanges.

If you do not own the keys, you do not own the coins.

Well, but if I am a trader, what should I do next? Just everybody keeps funds on exchanges, but I prefer bigger exchanges with good security like binance, okex.
And yeah, if you have big portfolio, then I would split it between cold wallets and several exchanges!

this is a truly shame, an exchange went down again. this is going to end as any other time, no funds will be gathered back nor the exchange will come back online. Luckily I'm not using such shitexchanges since a few years when I dumped all my shitcoins.

I have a lot of issues with them in the past, mainly from support and transactions that take days to confirm. Cryptopia is being beaten by the new exchanges that offered lower fee and cheap listing the only reason I'm here are from a few coins I'm holding that I can only trade here.

On the 14th January 2019 cryptopia exchange suffered a security breach and got hacked.

Still no news have been released about the entity of this loss, both in terms of financial amounts and personal informations.

This thread will follow the events.

Help to collect informations posting here if you have details about the things going on.

http://i67.tinypic.com/330fx1y.png

http://i68.tinypic.com/2vj3fgi.png

This is the type of thing that makes everyday people scared to use crypto. Hopefully Cryptopia has the resources to make this right and can patch up holes in its security.

1) possible exit scam under the excuse of an hack: in this case the service in unlikely to come back online and your funds are very likely to be lost forever.

What can we expect. Every month there are new exchanges. Which do not meet the high standards of protection. Hackers, of course, are young, they skilfully find frays in such exchanges. The losses will not be big. Since this may lead to a further fall in cryptocurrency prices.

Unless bigger exchanges are hacked all together resulting in a BTC loss over 100k BTC, market won't have any fault because of this kind of hacks.

This is no more 2014. Luckily.

You can't say it is no more 2014. It was mt.gox that hacked.

If you think they were the market leader at that time, it would be like binance hack. And that would crash the markets a lot.

I heard that this exchange was hacked. Today, every time the situation that would really concern the exchanges and hacking begins to resemble cases when the exchanges are breaking into themselves in order to collect the necessary amount of funds.

This is my first time that an exchange was supposed to be hacked where i have some port polio in it. Honestly i am scared right now on losing my money on that exchange. Does anybody here know on what would be the future of our money on that exchange if it is true that it was hacked?

We haven't seen a hack attack in a long time. However, Cryptopia is an experienced exchange. I can't figure out how accurate it is to rely on anyway. I never trust that exchange.

This is my first time that an exchange was supposed to be hacked where i have some port polio in it. Honestly i am scared right now on losing my money on that exchange. Does anybody here know on what would be the future of our money on that exchange if it is true that it was hacked?

Posted byu/spammero
4 hours ago
Stolen ORME from cryptopia going to Bibox wallet...

Sooo after tracking stolen ORME coins from "hacker" wallet, they transferred the ORME coins from cryptopia to Bibox exchange wallet.

It was the transfers in order: hacker wallet - all stolen ORME to random wallet - all stolen ORME from random wallet to many random wallets (splitted in 400k-800k transactions) - all ORME from random wallets to Bibox main wallet.

https://i.imgur.com/I8z2Xrn.png

You can check the last transfers to Bibox exchange wallet on this img or checking it in etherscan.

https://etherscan.io/token/0x516e5436bafdc11083654de7bb9b95382d08d5de --- ORME token

https://ethplorer.io/address/0xf73c3c65bde10bf26c2e1763104e609a41702efe#transfers=2 --- Bibox wallet

Most coins and tokens were sent to BINANCE exchange.
The account is not at freeze, KUDOS to the BINANCE TEAM that they quickly act on the incidents.
What will happen to cryptopia then and to their users.

Police making progress in crypto-currency investigation
Tuesday, 22 January 2019 - 5:23pm
National News

Police continue to investigate the unauthorised transfer of crypto-currency worth a significant sum from Christchurch-based crypto-currency trading company Cryptopia on 13-14 January 2019.

Good progress is being made and positive lines of enquiry are being developed to identify the source of the transfer, and to identify where the crypto-currencies have been sent. The assistance of the crypto currency community is being sought as the investigation progresses.

This is a very complex investigation, involving expert digital forensic investigators from within New Zealand and in various overseas jurisdictions, as well as overseas authorities.

Members of the investigation team met with Cryptopia management and staff yesterday and today and outlined progress in the investigation.

Cryptopia management and staff have been co-operating with Police and providing considerable assistance in the investigation. 

The investigation is expected to take some to time complete, and the digital forensic team will be on-site at Cryptopia’s premises for some days to come.

Anyone with information which could assist the investigation can contact police by email at crypto@police.govt.nz .

ENDS

Issued by Police Media Centre

Some overdue transparency into the Cryptopia exchange hack
20 January 2019

In the five days since the Cryptopia hack was first reported, we've seen surprisingly little information about what actually happened.

Nobody seems to know:

    * How the theft took place: How, when, and where were the funds taken?
    * How much was lost: Cryptopia has not disclosed how much was stolen. Media reports on the total value of stolen assets range from $3m to $13m.
    * The current status of the stolen funds: We've seen a few blips about exchanges freezing stolen funds, but nothing on how much was frozen or where the rest of the funds sit.

This hack impacts thousands of people who have funds in Cryptopia's custody. While Cryptopia may have their reasons for remaining quiet, we think it's important for the facts to be known.

Ironically, definitive answers to all the questions above are hiding in plain sight, encoded in a public database called the Ethereum blockchain, which is unfortunately not well designed for human consumption. However, our technology is designed to enable just that.

Based on data sourced via the Elementus query engine, here is how the Cryptopia hack actually went down.

Edit: As we know there is a lot of bad information going around, we've posted the raw data used in this analysis online so that anyone can validate it for themselves.
What happened?

This case is quite different from other high profile hacks we've seen in the past. But before explaining what makes this case so unusual, here is a brief overview of what's been reported and what we can deduce from the blockchain.

All times below are Eastern Time (GMT-5).

    - Sunday 13-Jan, 8:28am: Funds begin moving out of Cryptopia's two core hot wallets, one holding ether and the other holding tokens.
    - Sunday 13-Jan, 11:58pm: With the core wallets empty, residual quantities of funds begin leaving Cryptopia's 76k+ secondary wallets, a process that would continue for several days.
    - Monday 14-Jan, 6:00am: Cryptopia suspends trading, announcing they are undergoing unscheduled maintenance.
    - Tuesday 15-Jan, 3:00am: Cryptopia discloses the security breach and New Zealand law enforcement steps in.
    - Thursday 17-Jan, 5:58am: The last of Cryptopia's funds are drained.

By our calculations, the total value of the stolen crypto (ether and various tokens), at current market prices, comes out to about $16 million. This number includes only what's on the Ethereum blockchain (ether and ERC20 tokens). We have not examined the Bitcoin blockchain or other blockchains to see if funds were stolen there as well.
The thieves took ether and ERC20 tokens valued at about $16 million

Cryptopia hack - market value of losses by coin

The breakdown of losses by cryptoasset is shown below.
Asset    Value (USD)
ETH           $3,570,124
Dentacoin   $2,446,212
Oyster Pearl   $1,948,223
Lisk ML   $1,718,610
Centrality   $1,148,144
Mothership   $880,141
Ormeus   $452,841
DAPS           $384,425
Zap           $147,158
Pillar           $254,521
Other tokens   $3,051,709
Total           $16,002,108

Market value of crypto assets stolen from Cryptopia, valued at 19-Jan-2019 market prices. For more detail, see the full breakout by token / full list of transactions out of Cryptopia into the hackers' wallets
Where are the stolen funds now?

For the last few days, the hackers have been shuffling the funds around in small pieces and gradually moving them into exchanges to cash out. The table below shows how much has been sent to each exchange.

How much have the thieves attempted to cash-out at exchanges?

Exchange    Deposits    Value (USD)
Bibox   44   $326,581
Binance   63   $279,525
Huobi   21   $147,715
HitBTC   23   $56,648
CoinExchange   9   $22,908
Digifinex   6   $13,017
Bittrex   2   $11,865
Changelly   8   $8,152
Kucoin   4   $6,597
ABCC   6   $4,978
Mercatox   2   $3,199
LAToken   1   $1,381
Bitmart   1   $66
Gate   2   $0
Total   192   $882,632

Market value of stolen crypto assets that have been sent to exchanges

Of the $16m that was stolen, the vast majority (~$15m) remains in two wallets controlled by the thieves:

    0x9007a0421145b06a0345d55a8c0f0327f62a2224
    0xaa923cd02364bb8a4c3d6f894178d2e12231655c

We are continuing to watch the movement of the funds and will keep the figures in this post updated.

What makes this hack so unusual?

This hack is quite different from other high-profile heists on the blockchain. Normally, they fit one of two profiles:

    * Smart contract exploits (e.g. Parity, The DAO, SpankChain): Hackers discover a vulnerability in a wallet's smart contract code, which allows them to empty its funds. These cases may involve many wallets, if the same vulnerability is present in all of them. But once the first wallet is breached, things come to a head rather quickly, as it typically becomes a race between the hackers and the wallet owners (sometimes assisted by white hat hackers) to get to the money first.

    * Unauthorized access credentials (e.g. Coinrail, Tether, Gatecoin): Someone outside (or perhaps inside) the company manages to get a hold of a wallet's private key and simply withdraws the funds into their own blockchain wallet. These cases typically involve the breach of a single wallet, and by the time the theft becomes publicly known, the funds are long gone.

The Cryptopia hack differs from these profiles in two glaring ways.

The hack involved a large number of wallets.

The funds were taken from more than 76k different wallets, none of which were smart contracts. The thieves must have gained access to not one private key, but thousands of them.

The hack continued for days after Cryptopia discovered the breach.

The lack of urgency on the part of the thieves is striking. Rather than withdrawing the funds as fast as possible, as is the case in most crypto hacks, they took their time extracting the assets over the course of nearly five days.

After Cryptopia discovered the hack, they watched the funds continue to flow out of their wallets for four more days, seemingly powerless to stop it. As these wallets were not smart contracts, there should have been no technical complications preventing Cryptopia from securing the funds.

The only plausible explanation for Cryptopia's inaction is that they no longer had access to their own wallets.

It seems Cryptopia not only lost their funds, they also lost access to all, or nearly all, of their 76k+ Ethereum wallets.

One possible explanation is that Cryptopia had their private keys stored in a single server with no redundancy. If the thieves managed to gain access to this server, they could have downloaded the private keys before wiping them from the server, leaving Cryptopia unable to access their own wallets.
Conclusions

Our conclusions from the investigation.

2,000 Ethereum wallets and $46k in Ether remain at risk.

We count about 2,000 remaining Cryptopia wallets holding a combined balance of ~380 ETH (about $46k). Most of these funds were deposited by Cryptopia users after the initial hack took place, apparently unaware of the security breach.

Assuming the thieves have access to these wallets, and Cryptopia does not, recovering the funds is a lost cause. However, if Cryptopia knows the identities of these users, hopefully they've had the foresight to contact them and let them know not to send any more funds.

It's likely Cryptopia has additional funds safely stashed away somewhere.

The value of stolen ETH amounts to "only" about $3.5m. While this is by no means a small amount in absolute terms, it is small relative to what we would expect Cryptopia to hold in user deposits. This leads us to think Cryptopia must have a cache of ether stashed away.

If these funds are out there, they would either be stored on-chain in a cold wallet or off-chain in the custody of another exchange.

Exchanges should be freezing these funds as soon as they arrive.

No excuses. On the blockchain there is nowhere to hide, and no reason 100% of these transfers should not have been frozen immediately.

Any exchanges who care about compliance and want to block these illicit funds are encouraged to get in touch. We will set up a real-time alert to notify you the moment any of these stolen funds hit your accounts, free of charge.

No excuses.

Most coins and tokens were sent to BINANCE exchange.
The account is not at freeze, KUDOS to the BINANCE TEAM that they quickly act on the incidents.
What will happen to cryptopia then and to their users.

So it was really Cryptopia exit scam? Or it was another successful hacker attack?

There is a golden rule how to protect yourself: Do not safe your cryptocurrencies on CEXs (centralized exchanges)!

There is still no confirmation if this is an exit scam but I doubt if it is, they reported it to police and tech authority if this is an exit scam by Cryptopia then they will be caught, but of course, the police have to be that good to trace if it is an exit scam.

they are digging their own grave if they reported it to police and if they did it themselves, the hack was probably an inside job, probably an employee put some backdoor in the code and exploit it, it's a shame this exchange got hacked i actually like this exchange because of fast withdrawal, i usually use doge and the withdrawal will come out 1 second later, i probably still haven't seen all maybe just the tip of the iceberg.

Some updates from NZ POLICE:

https://www.police.govt.nz/news/release/police-making-progress-crypto-currency-investigation

unless you have a proof that it was an inside job it is not a great idea to spread rumor based on your intuition as it will scare more people away from crypto and it will reflect on the price. It would be beneficial to wait for few weeks to see what really happened. I don't really use that exchange but I've heard many people use it.

I have never traded on CRYPTOPIA exchange, we should trade on reliable exchanges such as binance, OKEx ... it will be safer and the percentage of being attacked and losing money is very low

In fact any centralized  exchange can be hacked because of human factors. For example binance kyc's docs leak was confirmed recently https://www.ccn.com/dark-web-hacker-proves-leak-of-customer-data-from-worlds-leading-cryptocurrency-exchanges/

People. @Cryptopia_NZ didn't get hacked *again*. The nature of the compromise is, the attacker stole their ETH privkey and deleted topia's copy.
Same hack, just new histrionic-newsable point to steal your attention if you never learned the basics of how private keys work.

well it's not confirmed unless you see logs of the hack.

This is the downside in crypto currency exchange since it is not regulated yet the security of each exchange varies and not standardized which became prone to be hack if your exchange is not that fully secured and the investors are the one carrying the burden everytime this happen i hope they can fix this and we can fet all our coins there. :( So sad this happen in this bearish market. ;(

Your coins are not there anymore, cryptopia team has lost access to private keys, keys are in possession of hackers.

Another hacked exchange.... I didn't notice this news before... that's why I don't leave my coins on any exchange.... most of them will be hacked soon  it's just a matter of time..

Is this related only ethereum and ethereum tokens or all other coins keys were stolen too?
It seems there are not any news about other coins!

That's the real risk in crypto, just choosing an exchange without considering its security and safety will be risky as it is prone to hackers and frauds. Maybe the owner or the developers might expose the vulnerability of it that results to that kind of worse situation in the mean time.