Crypto.com suspends withdrawals

[OmegaStarScream]

They re-enabled "address whitelisting" around 10 hours ago, but the interesting part is the fact that they just added delayed protection now! I'm quite surprised that a platform of that size, never had such protection in place ^{[there are certain platforms out there that have a 48 to 72-hour hold for withdrawing to new addresses and they're not that popular]} and in addition to that, most of their users are complaining about the added layer of security ^[SMH]!

• Whitelisting of new addresses is now re-enabled.
  
  We introduced an additional layer of security: there is now a 24 hour delay between registration of a new whitelisted address and first withdrawal.

Although Crypto.com didn't make any statements about this, PeckShield (a security-audit company) claims that 16M has been stolen and is currently being laundered using TornadoCash: https://twitter.com/peckshield/status/1483246262371557378

[SFR10]

Although Crypto.com didn't make any statements about this, PeckShield (a security-audit company) claims that 16M has been stolen and is currently being laundered using TornadoCash: https://twitter.com/peckshield/status/1483246262371557378

It's a bit weird that they kept saying "no customer funds were lost" and still continued with that approach, even though their CEO "admitted in this video" that 400 accounts were affected and they "fully reimbursed" them ^{[there's a big difference between those two]}!

• "ErgoBTC" is claiming there's another 444BTC in the equation, so that makes it around "33M" in total!

[bitmover]

More news are coming

The Hackers also stole 444 BTC.
According to the CEO, Already fully refunded.

https://www.protocol.com/bulletins/crypto-com-hack

Marszalek said Crypto.com "very quickly stopped" unauthorized withdrawals and lifted restrictions within 14 hours. All accounts affected were fully reimbursed, he said. Crypto news site the Block reported that withdrawals consisted of 4,830 ether, worth $15 million, and 444 bitcoins, worth $18.5 million, though Marszalek did not confirm the value.

Bloomberg reported that Crypto.com has yet to receive any communication from regulators following the breach, but Marszalek said he was prepared to share information on the theft if regulators do inquire. In the U.S., there are few federal laws governing data breaches except for health-related data, and state laws vary. Federally regulated banking organizations will have to report breaches under a new law that takes effect in April, but crypto exchanges are not yet broadly regulated on the federal level.

“Obviously, it’s (a) great lesson and we are continuously strengthening our infrastructure,” Marszalek told Bloomberg. “Given the scale of the business, these numbers are not particularly material and customer funds were not at risk.”

 

[Darker45]

The security race between hackers and companies are closer than many might be thinking. It seems there is no amount of security that guarantees 100% protection of funds. Passwords, OTPs, 2FAs, and so on are now proven uncapable of providing perfect protection. Even this new multi-factor authentication that crypto.com is talking about could only bolster its security for a certain period of time before hackers would successfully challenge it as well.

Once again, we're provided with another reason to keep our funds under our sole control.