Not your keys, not your Crypto – Kucoin Hacked! $150m Stolen.

[nelson4lov]

This is yet another reason why storing large amount of funds on exchanges is a bad idea.

It appears Kucoin exchange has been hacked. For the past 7 hours, Over $150m in Ethereum and other erc20 tokens have been withdrawn to an unknown wallet here: https://etherscan.io/address/0xeB31973E0FeBF3e3D7058234a5eBbAe1aB4B8c23

Bitcoin outflows were moved to Bitfinix.

Kucoin's Responses

Their telegram chat has gone haywire since then as worried users have been asking about an update. Alicia (Head of VIP at Kucoin) replied:

 

Things doesn't add up here. If the funds were being moved by Kucoin, they wouldn't be investigating. It's either you or not. Users have reported seeing empty balances and currently withdrawal and deposits has been disabled. Since we have different DeXs available now, the hacker can easily unload all those funds.


While this isn't a "confirmed" hack yet, this is a friendly reminder to everyone who still stores loads of funds on exchanges. Your funds are a lot more safer when they're stored in your private wallet. I will keep updating the thread.

Update 1:

Looks like the hacker is cashing out using shitcoins  available in decentralized exchanges. If this is a joke by Kucoin, then it's an interesting one

Update 2: – Hack Confirmation

Kucoin just confirmed the hack:

We detected some large withdrawals since September 26, 2020 at 03:05:37 (UTC+8). According to the latest internal security audit report, part of Bitcoin, ERC-20 and other tokens in KuCoin’s hot wallets were transferred out of the exchange, which contained few parts of our total assets holdings. The assets in our cold wallets are safe and unharmed, and hot wallets have been re-deployed.

We are locating the reason for the incident, and will keep you updated once it is confirmed. Please rest assured that if any user fund is affected by this incident, it will be covered completely by KuCoin and our insurance fund.

To ensure the security of users’ assets, we will conduct a thorough security review. The deposit and withdrawal service will be suspended during the period. We will restore the service gradually after ensuring a safe state. We will keep you updated.

As "The People’s Exchange", we will take full responsibility and maintain transparency. To keep you updated regarding the latest updates, our CEO Johnny Lyu will update more details through a livestream at 12:30 (UTC+8), September 26, 2020. Please submit your questions here if you have any.

We greatly appreciate your understanding and support.

The KuCoin Team

Update 3:
More funds are being moved. Hack still on.

Update 4:

In response to the hack, Kucoin's CEO hosted a livestream to discuss details of the hack: https://www.kucoin.com/news/en-kucoin-ceo-livestream-recap-latest-updates-about-security-incident

Update 5:

Tether Treasury has frozen over $20M tethers that were stolen. They're still about $120M of movable funds + some projects have agreed to invalidate some stolen tokens from their supply: https://www.kucoin.com/news/en-kucoin-ceo-livestream-recap-latest-updates-about-security-incident



The bottom line is, Kucoin will refund the stolen funds thanks to their insurance.

[1714193643]

1714193643

[1714193643]

1714193643

[Poker Player]

I can understand that some people have part of their funds in the exchanges, especially if they trade.

If someone has all the funds in an exchange he has to be a newbie. If not, he deserves what he gets.

[meanwords]

I've been using kucoin for the last couple of months and I've never had problems with it. Good thing I only trade Bitcoin there or else I might have been a victim too. Since they are one of the reputable exchange out there, they will most likely compensate those who lost their coins as they said. They are probably hiding the fact that they got hacked since they are known to have never been hacked before.

[nelson4lov]

I can understand that some people have part of their funds in the exchanges, especially if they trade.

If someone has all the funds in an exchange he has to be a newbie. If not, he deserves what he gets.

Many (if not all) traders usually have funds left on exchanges. It has been a common practice but it is always recommended not to keep huge amount on exchanges. This isn't the first time exchanges has been hacked with huge amount of users funds being stolen so if anyone hasn't learnt from that, then it's their fact. The ideal way of using exchanges would be to buy there and move them to a personal wallet. That's what most whales do at least.

I've been using kucoin for the last couple of months and I've never had problems with it. Good thing I only trade Bitcoin there or else I might have been a victim too. Since they are one of the reputable exchange out there, they will most likely compensate those who lost their coins as they said. They are probably hiding the fact that they got hacked since they are known to have never been hacked before.

I'm also a Kucoin user but I have used it since july as I only used it to buy an asset that was traded on only kucoin at the time. About users funds, Kucoin has made a bold claim about having an insurance fund to cover for user's losses ($150m). But then, an event like this doesn't go away quickly.

[mk4]

If $150m was hacked, it's probably safe to assume that it's probably their hot wallets that got accessed.

With that said though, let's not come to conclusions immediately and wait for an actual announcement regardless how shady things currently are. But yea, definitely don't leave funds unnecessarily on exchanges.


EDIT: So, it really is their hot wallet lol. At least they're going to cover the lost funds, I guess?

https://www.kucoin.com/news/en-kucoin-security-incident-update

[Darker45]

This has been repeatedly advised to everyone. Your exchange wallet is not a storage place. You use your exchange wallet if you are trading. If not, pull it out from there.

But I'm guilty of this. Personally I find it too much of a hassle and costly, too, if I make a deposit and withdrawal every time I trade. I seldom do but I just see to it that I have enough funds in my exchange wallet so that I could easily make an order whenever I want to.

Anyway, $150 million is a huge amount. Let's wait and see how KuCoin would handle this. 

[PonZZ]

I really admire with Kucoin administration's reaction. Looks like they cares about the users and try to do their best to recover lost funds.

[hatshepsut93]

No way they would compensate $150m, where would they get such funds? I wonder if this might even be the end of this exchange. Or will they just try to shrug it off, give some small consolation funds to investors to at least try to appease them and then continue like nothing happened.

The frequency of exchange hacks means that traders need to account for it in their calculations - if they make 5% profit per month, but risk all their crypto actives in the process, is it really worth it?

[Wexnident]

Sadly, people still don't understand how storing coins in exchange isn't the safest, especially if you're going all-in in investing crypto. Heck, afaik, traders who go all-in in investing should know that exchanges aren't safe places to store coins, I know fees are a hassle, but having a plan for it could significantly lessen the hassle while still providing you ways to trade easily.

No way they would compensate $150m, where would they get such funds? I wonder if this might even be the end of this exchange. Or will they just try to shrug it off, give some small consolation funds to investors to at least try to appease them and then continue like nothing happened.

If they are going to compensate, it'd probably take a long amount of time to even finish doing so, especially since the transfers are still going on right now, and them not being able to stop it immediately shows t hat $150m might just be the start. Plus, they themselves gave their word about it, so if they really don't offer compensation, their reputation would take quite a huge hit.

[bitsurfer2014]

This problem could become worst if Kucoin don't have the financial capability or any kind of insurance to refund any lost fund that could amount to $150 million dollars, assuming the hacking incident proved successful.

Moreover, we should expect a mass withdrawal of customers assets and could be fatal to the exchange since it could result to them having diminished liquidity.

Perhaps it could be more wiser now to send our funds to bigger exchanges that cannot be easily shaken down by these kinds of hacks to keep our funds more secure and with a high chance of recovery.

[Tipstar]

Kucoin is not a localized exchange but an popular international exchange often compared to binance. They are also famous for providing trinkets of coins for holding KCS token in the exchange.
They have forced KYC and 2FA authentication but seems like those things have not been helpful in anyway to stop such large scale hacks. These reoccurring hacks shouts out to both the exchanges and users to rethink how they keep the coins and how they let users withdraw.

[gabbie2010]

Its quite unfortunate that Hack of such magnitude could happen with such a reputable exchange like Kucoin, big lesson to newbies and all of us to always avoid storing coins our any exchange,they are not safe now, there are affordable cold wallets and online wallets where with your key secured, I believed this will not be the last hack, as hackers are getting more sophisticated and easily penetrate any exchange firewall to steal coins.

[cryptomaniac_xxx]

No way they would compensate $150m, where would they get such funds? I wonder if this might even be the end of this exchange. Or will they just try to shrug it off, give some small consolation funds to investors to at least try to appease them and then continue like nothing happened.

As per their blog:

We are locating the reason for the incident, and will keep you updated once it is confirmed. Please rest assured that if any user fund is affected by this incident, it will be covered completely by KuCoin and our insurance fund.

https://www.kucoin.com/news/en-kucoin-security-incident-update

So they say they are going to cover it, so let's see. It's a huge amount of money and we do hope that they have enough liquidity to cover such. It's one of the biggest exchanges, but definitely it will put a dent on their credibility and it might take sometime before they get back the confidence as majority might shift to other exchanges because of the incident.

[Mpamaegbu]

Many (if not all) traders usually have funds left on exchanges. It has been a common practice but it is always recommended not to keep huge amount on exchanges. This isn't the first time exchanges has been hacked with huge amount of users funds being stolen so if anyone hasn't learnt from that, then it's their fact. The ideal way of using exchanges would be to buy there and move them to a personal wallet. That's what most whales do at least.

Most whales aren't day traders. They are swing traders. Swing traders don't frequent exchanges to check and execute trades and are commonsensically not expected to leave huge chunks of coins on exchanges. We really can't blame those who leave their crypto on exchanges as it saves them the hassle of moving coins around. Moving coins also cost money too in form of transaction charges. It's also time consuming as you wait for time of confirmation for any transfer, to and fro. I am a day trader and I know it can be hectic doing all that. However, I do get your point on this. However, we should also remember that no where is completely safe in this world of the Internet. We have also had cases of private wallets getting hacked too. It's a sad situation, really.

[Yaunfitda]

Its quite unfortunate that Hack of such magnitude could happen with such a reputable exchange like Kucoin, big lesson to newbies and all of us to always avoid storing coins our any exchange,they are not safe now, there are affordable cold wallets and online wallets where with your key secured, I believed this will not be the last hack, as hackers are getting more sophisticated and easily penetrate any exchange firewall to steal coins.

It also goes to show that no one is really safe, not Binance, not Kucoin and any other exchanges for that matter. That's why we always promote the old but very effective adage, not your keys not your coins. And we have a thread before about staking our bitcoin for a 4% APY in an exchange. It create a lot of controversy specially about leaving our BTC to an exchange because of an event of a hack, they could be stolen. So this is what we are afraid of. Although they said that it is insured, but still, the dangers and the threat are always present. So it's really be a good practice to just keep a small amount of BTC in an exchange for our trading activity and not our life-savings.

[adzino]

That is a really bad news! One of the prime reason why people shouldn't be using an exchange wallet as their personal wallet. At least Kucoin is taking responsibility and has admitted getting hacked. Lets see if they really refund their users.

Kucoin is not a localized exchange but an popular international exchange often compared to binance. They are also famous for providing trinkets of coins for holding KCS token in the exchange.
They have forced KYC and 2FA authentication but seems like those things have not been helpful in anyway to stop such large scale hacks. These reoccurring hacks shouts out to both the exchanges and users to rethink how they keep the coins and how they let users withdraw.

They disabled deposit and withdrawals, but coins are still being moved. So the exchange itself is hacked (the cold wallets). So user 2FA (and KYC. Not sure what this has to do with user security) has no use. And yeah, all exchanges does have some sort of vulnerability that they aren't aware of.

[tbct_mt2]

With each hack event, people have another new lesson to learn from and I am happy to share with readers my topic Newbies - Read before using exchanges or investing. Experts can ignore my topic.

[GUIDE] How to Create a Strong/Secure Password. I know exchange is hacked by compromises on their sercurity flaws but people who store funds on exchanges should take advantage of the Kucoin hack check their password strength and if they feel it is not good, it is time to change to a new password (stronger).

[joniboini]

So user 2FA (and KYC. Not sure what this has to do with user security) has no use.

Obviously it doesn't matter since the hacker got the seed/private key that allows them to access the wallets directly. 2FA and stuff like that only protect individual users and not the whole wallet.

[mk4]

They disabled deposit and withdrawals, but coins are still being moved. So the exchange itself is hacked (the cold wallets). So user 2FA (and KYC. Not sure what this has to do with user security) has no use. And yeah, all exchanges does have some sort of vulnerability that they aren't aware of.

It has already been confirmed by them that it was their hot wallets. A hack of an exchange cold wallet is obviously going to be FAR more disastrous than this.

https://www.kucoin.com/news/en-kucoin-security-incident-update

And yea, what joniboini said. 2FA didn't matter because the hacker/s went straight for the wallets and not their user's accounts. Doesn't mean you should stop using 2FA, obviously.

[dothebeats]

I really admire with Kucoin administration's reaction. Looks like they cares about the users and try to do their best to recover lost funds.

The last thing you want to have if you are in KuCoin's position are angry investors and users demanding their money and threatening you that they'll file legal charges against you if you do not comply to their demands. Of course they will, as much as possible, avoid this from happening and just try to calm those user who lost funds on the exchange. Whether they'll reimburse the lost funds or not is up for debate, though if they didn't they'll face legal consequences for sure.