Xeggex data breach, etc.

[The Sceptical Chymist]

I didn't see this posted anywhere in the Exchange section, and I know Xeggex has become quite popular among those who dabble in some of the more obscure altcoins, so I'm starting a thread on this.

Looks like they had some kind of hack per the announcement on their website:



And here's the "more info""

Incident Status

Current Status: Restoring data

On February 3rd XeggeX experienced a security break and data loss. We are currently working to restore user information and balances.

What happened?
There was a breach onto the laptop of the primary system admin. This laptop had access to all system resources. Database collections were dropped, telegram was deleted, and other things were done on the laptop to make it inoperable.

What are we doing to restore service?
As we were unable to fully restore the database, we had to rebuild peices of of from other sources. Due to this, it has taken some time to collect and parse the data to rebuild parts of the database. There are some user records we were not able to associate with an email address. We will be making an account restore function for these users. Since records such as trade history, deposit history, and withdraw history are missing information we will be starting just from an initial balance on user accounts based on balance information at the time of the incident.

When can I login?
We hope to have user logins restored within the next day. If you have issues accessing your account when we open user logins, then please contact support.

When can I withdraw?
We will start opening assets for withdrawals as we do a security review on them. This will be asset by asset as we finish each review and not all at once. We have no timeline for how long this may take at this time but will work as quickly as we can.

Will the exchange continue to operate?
This is undecided at this time. Our current priority is to getting users access. After this we will decide what we will do next.

Other notes:
We want to make it clear that this affects the XeggeX exchange only. Some users think that XeggeX and NonKYC exchanges are owned by the same people, but in fact they are not. NonKYC is a completely separate system and ownership. The only thing similar is that they are using a version of the XeggeX software for their exchange.

Some other users have asked if Nayiem Willems was an owner of XeggeX. The answer is no, he was never involved with the exchange. There were discussions years ago about collaboration, but nothing was ever agreed to and he went on to work on another project. He has been receiving a lot of undue harrassment since this incident occurred, and we want to make it clear that he has no involvement with anything XeggeX does.

Looks like this was one hell of a clusterfuck.  Not quite the magnitude of Mt. Gox, but apparently their security protocols were similarly lousy.

Hope nobody had a lot of coins on there, because as of right now their future isn't looking too promising.  Curious to hear opinions from the community.

[Z-tight]

They say their ceo account was hacked and that is what led to all of these, so apparently their ceo had access to all their system resources, isn't that a poor way to secure people's data and funds? So many people in the community do not believe that Xeggex is telling the complete truth here, with some people even suspecting a rugpull.

Right now whoever had funds there just has to hope that this comes to a 'good' end, when a service says they are undecided if they will continue operating, you can be sure that something very serious has happened, they might be insolvent right now.

[dkbit98]

I never heard about Xeggex exchange but I it looks like they are trying to clone the binance theme and colors.
They also have their own crap token and I am sure they don't care about safety of customer information, so no surprise they got hacked.
This is exchange I would never use, and I would not even think about sending them my documents and coins.

[Lucius]

The main system admin obviously didn't pay too much attention to his operational security, now the only question is whether someone hacked him remotely, or maybe he lost his laptop somewhere and unfortunately someone with bad intentions found it. Anyway, it's really bad if only one person has full access to everything because it's a big risk - just remember Quadriga and its CEO who disappeared with hundreds of millions of dollars.

[The Sceptical Chymist]

They say their ceo account was hacked and that is what led to all of these, so apparently their ceo had access to all their system resources, isn't that a poor way to secure people's data and funds? So many people in the community do not believe that Xeggex is telling the complete truth here, with some people even suspecting a rugpull.

"Rugpull".  Wow, I haven't heard that term in a year or so.  But yeah, the CEO apparently having access to everything on his laptop is what reminded me of Mt. Gox, because even though I was a little lost lurker on the forum back in 2013-14, I seem to recall that Mark Karpeles created the same situation for himself and thereby lost everyone's money (or a lot of it, anyway).

The main system admin obviously didn't pay too much attention to his operational security, now the only question is whether someone hacked him remotely, or maybe he lost his laptop somewhere and unfortunately someone with bad intentions found it. Anyway, it's really bad if only one person has full access to everything because it's a big risk - just remember Quadriga and its CEO who disappeared with hundreds of millions of dollars.

Yeah, and although I'm not familiar with Quadriga, that reminds me of Cryptsy.  Remember them?  And I'm sure there are at least a dozen similar cases like that.  I'm not saying anything about Xeggex scamming people, because they ran a pretty smooth operation for a while and did become popular with the altcoin crowd.  There was nothing about how they conducted business that pointed to an exit scam or some such thing, at least as far as I can tell. 

I wonder if they got hit by regulators, because I could swear I saw a new notice on their site about no longer being able to service US customers.  Anyway, it'll be interesting to see what transpires.

[CreepyUncleJoe]

Yeah, and although I'm not familiar with Quadriga, that reminds me of Cryptsy.  Remember them? 

Yes, if it reminds you of Cryptsy, it's because the same scammer who was behind Cryptsy is also behind Xegges.

https://docs.google.com/document/d/1CI-Aat0y9oL2clS81QAHDzFULPm2xLO2aM3d98rWME4/edit?tab=t.0

[Lucius]

Yeah, and although I'm not familiar with Quadriga, that reminds me of Cryptsy.  Remember them?  And I'm sure there are at least a dozen similar cases like that. 
~snip~

This was a well-known case, considering that it was the largest CEX from Canada, whose owner allegedly went to India and died there - but his body was not seen by anyone relevant who could confirm his death - while the investigation led to the fact that the death certificate was issued by a doctor who could not really remember the case - which is not surprising, because such a certificate costs very little in India. Gerald Cotten was a scammer his whole life, and he disappeared (died as such).

As for Cryptsy, I remember that scandal too, although I remember Quadriga better since NF made a documentary about it that exposed the whole thing pretty well. If you can, watch the documentary - or read it for more information Quadriga

[IdMineThat]

I thought I was going to make it out alive. They seemed to be restoring wallets as time progressed. They properly showed my Kaspa and USDT balance with Withdraw and Trade disabled, but it's since been replaced with "Promissory Token".

From their site:
"What are these Promissory Tokens?
In order to bring the system fully back online we had to create some temporary promissory tokens. If you have a balance in these tokens, then they will be replaced with the actual asset as funds are raised and brought back into the system. In the meantime, these tokens will earn a monthly interest of 0.5%. We will work to resolve these as quickly as possible."

I had that Kaspa on the exchange for 1.5 days.

"As funds are raised"...

[The Sceptical Chymist]

<snip>
I remember Quadriga better since NF made a documentary about it that exposed the whole thing pretty well. If you can, watch the documentary - or read it for more information Quadriga

Might be a stupid question, but I'm a stupid person--where's the documentary available to watch?  I've been trying to de-googlify my life and don't frequent youtube much anymore, so I haven't checked there.

I had that Kaspa on the exchange for 1.5 days.

"As funds are raised"...

Did you have a lot on there?  Sounds like it, but I'm hoping not.  And yeah, that phrase is so vague as to how fundraising is going to be accomplished that it's meaningless. 

Yes, if it reminds you of Cryptsy, it's because the same scammer who was behind Cryptsy is also behind Xegges.

https://docs.google.com/document/d/1CI-Aat0y9oL2clS81QAHDzFULPm2xLO2aM3d98rWME4/edit?tab=t.0

Whaaaahh?  Can someone verify this (see above statement about not using google)?  I'll give you some merit if that's true.

[paid2]

--snip-- I've been trying to de-googlify my life and don't frequent youtube much anymore, so I haven't checked there.

Have you tried FreeTube? https://freetubeapp.io/
It's open source, you won't give any data to Google, no ads, and is (as far as I know) one of the best solution to access Youtube's content privately.

Yes, if it reminds you of Cryptsy, it's because the same scammer who was behind Cryptsy is also behind Xegges.

https://docs.google.com/document/d/1CI-Aat0y9oL2clS81QAHDzFULPm2xLO2aM3d98rWME4/edit?tab=t.0

Whaaaahh?  Can someone verify this (see above statement about not using google)?  I'll give you some merit if that's true.

I have uploaded the pdf elsewhere if you want to read it: https://dev.pdfhost.io/v/AH9vbD5Vea_Follow-Up_on_the_Xeggex_Story

[The Sceptical Chymist]

Have you tried FreeTube? https://freetubeapp.io/
It's open source, you won't give any data to Google, no ads, and is (as far as I know) one of the best solution to access Youtube's content privately.

No, and I appreciate you suggesting that!  The curiosity dongle attached to the conjoined bunny rabbit on my forehead hasn't been working for a few years now, and I'm really out of touch with what's going on in the world, on the internet, and even in my living room.

I have uploaded the pdf elsewhere if you want to read it: https://dev.pdfhost.io/v/AH9vbD5Vea_Follow-Up_on_the_Xeggex_Story

I've not looked at that yet *edit: I'm slowly going through the document now, and it's as crazy as it is long*, but the Xeggex people are the same scummy scumbaggios who ran Cryptsy and then ran away with their customers' funds?  That's mind-blowingly eye-popping, no joke.

[Lucius]

<snip>
I remember Quadriga better since NF made a documentary about it that exposed the whole thing pretty well. If you can, watch the documentary - or read it for more information Quadriga

Might be a stupid question, but I'm a stupid person--where's the documentary available to watch?  I've been trying to de-googlify my life and don't frequent youtube much anymore, so I haven't checked there.
~snip~

Far from what you say, I think only a few would agree with you because most consider you one of the more intelligent people on the forum

The documentary was available on What Netflix’s QuadrigaCX Documentary Gets Right – and Wrong – About One of Crypto’s Worst Scandals, and most likely still is, and if you don't have it or if the @paid2 suggestion doesn't work for some reason, there are some forum members who sell cheap NF profiles/accounts, so something can always be worked out.

[dkbit98]

Have you tried FreeTube? https://freetubeapp.io/
It's open source, you won't give any data to Google, no ads, and is (as far as I know) one of the best solution to access Youtube's content privately.

Freetube is great so far and they accept Bitcoin donmations, but g00gle constantly makes changes in code, so freetube have some bugs from time to time that luckily gets updated and fixed.
Another alternative for web browser is Invidious, but there are no so many Instances available like before.
g00gle recently started banning IP address from people who download videos from YT, so watch out for that...

If you enjoy using FreeTube, you're welcome to leave a donation using the following method.

Bitcoin Address: 1Lih7Ho5gnxb1CwPD4o59ss78pwo2T91eS

https://github.com/FreeTubeApp/FreeTube

[The Sceptical Chymist]

<snip>
The documentary was available on What Netflix’s QuadrigaCX Documentary Gets Right – and Wrong – About One of Crypto’s Worst Scandals
<snip>

Merits to you for the above info, not for the compliment that I'll just have to stay silent on.  I do indeed have a Netflix subscription, but I've never seen that doc listed anywhere--their UI is absolutely laughable, and I also think the selection of titles I'm shown is severely restricted because I use a VPN (but I don't know that for sure).  And some things are restricted by geography regardless of a VPN that apparently every single website can identify me as using.  Is it available in the US?

g00gle recently started banning IP address from people who download videos from YT, so watch out for that...

And now they want me to log in every time I want to watch a video, which sometimes I need to do.  Fuck them.  They're gnawing their own feet off by doing that and by IP banning pirates--Christ, their motto used to be "Don't be evil" and look at how things turned out.

[Lucius]

Merits to you for the above info, not for the compliment that I'll just have to stay silent on.  I do indeed have a Netflix subscription, but I've never seen that doc listed anywhere--their UI is absolutely laughable, and I also think the selection of titles I'm shown is severely restricted because I use a VPN (but I don't know that for sure).  And some things are restricted by geography regardless of a VPN that apparently every single website can identify me as using.  Is it available in the US?
~snip~

As far as I can see, the documentary is still available in Europe, so I don't see why it wouldn't be available in the US. Maybe the reason why you don't see it is that you are using a VPN from a country that has restrictions on some content, and is there a special reason why you are using a VPN for that streaming service at all?

As for UI, I don't know what device you're watching on, maybe you have an old version of their app - because I personally like their interface, especially since it has an automatic live preview of every content. I don't know what the situation is about using IPTV in the US, maybe you should try something like that - the better ones have literally everything you can imagine.

[IdMineThat]

Is it available in the US?

Yes, it's available in US on Netflix.

Did you have a lot on there?  Sounds like it, but I'm hoping not.  And yeah, that phrase is so vague as to how fundraising is going to be accomplished that it's meaningless. 

I had around 12K KAS. Not terrible, it just hurts. It was the remnants of my original Kaspa wallet that I mined when Kaspa first came out... was worth $0.0002 at that point. I was just trying to clean up some VMs and get some more BTC while the market was down. I get they weren't the most respectable exchange in the universe, but as someone said, they had a lot of altcoins, which I enjoy tinkering with, and respectable volume. Circle of life. Get lucky with Kaspa then Unlucky.

[ogrvar]

scam exchange xeggex transferred part of the stolen coins HTN.

exchange nonkyc successfully froze the stolen deposit.

the community hoosat network thanks the team of the exchange nonkyc

[joniboini]

-snip-

You seem to have posted the same messages over multiple threads. If you're accusing them of working together to steal your coins, consider creating a new thread specifically addressing that issue (although it likely requires more than just a single line of accusation). From what has been posted above, it appears that they had many troublesome "issues" even before that, though.