Stake.com Hot wallet robbed for 40Million + usd (Confirmed by stake)

[Woodie]

Ouch that should sting, and this is the ugly side of hot wallets and a price to pay for convenience in serving its customers!

Otherwise if Stake are saying clients funds are safe, I really don't see any loss of business for them as their reputation supersedes them to keep clients playing their favorite games.

But going forward,  how do you merge security, hot wallets and convenience when it come to payouts to avoid such hacks Because going the multisig way could mean delayed payouts or potential to create backlogs of people to pay...

[1715426171]

1715426171

[1715426171]

1715426171

[1715426171]

1715426171

[rat03gopoh]

Or does this mean 41 million is like pocket change to them?

The number of withdrawals per user may not be limited. If you look at the input output transactions on pages 1k back in the txexplorer, Stake's hot wallet can handle more than 100 ETH transactions per day, for example: https://etherscan.io/tx/0x66c8a36d9ed6542cdc6cd5f24ec06d6bfb1deb27eed8500595169e75c2b91ed5.
That's really pocket change to them, Stake is a big company.

[Synchronice]

Of course they are going to say "User funds are safe". If they came out and said "Uhhh, we no longer have enough money to pay everyone back", then they trigger a bank run which rapidly leads to insolvency. So whether or not users funds are actually safe, that is what they are going to say.

If they don't say so, then there will be a total panic, everyone will try to withdraw and the casino will disappear like the tall building demolitions. You are true, they aren't transparent but can' really blame them, sometimes it's better to lie than to be 100% honest.

It's the exact same as when the likes of FTX, BlockFi, Celsius, Voyager, et al. said "Everything is fine" in the days and weeks before going bankrupt. If they are honest then all they do is speed up their own demise.

You will probably find it funny that Binance has posted this article: Know Your Scam: How to Spot, Report, and Avoid Acquaintance Scams.

Why are legit casinos buying stolen email addresses in the first place? They are not supposed to be sketchy.

Because it's cheaper way to promote your service.

Still, it has to be cleared up: Why were they keeping millions of dollars in a hot wallet in the first place? I generally do not mind withdrawals taking a few hours or a day in order to fill the hot wallet and to double/triple check. This just feels like needless negligence on the part of funds security.

Stake is a huge casino with a lot of customers and you know, people gamble with a lot of money. Just check their casino page, scroll down and you'll see a live list of highrollers. People bet 100K USDT, 2 Ethereum, 0.3 Bitcoin very frequently absolutely every second. I think they probably have such a big active and highroller userbase that probably 40 million in hot wallet was okay for them. So, not a huge loss too, probably.

[o_e_l_e_o]

Why are legit casinos buying stolen email addresses in the first place? They are not supposed to be sketchy.

The casinos themselves probably didn't know. A data broker will have got their hands on the data in the first place, then started selling it to advertising companies as "Crypto users who are also interested in gambling". The ad companies which these casinos employ will have bought the data and used it.

CZ's best bet is to freeze those output addresses and have Stake negotiate with those hackers (Ramson, as usual), since I don't believe it's feasible to reverse already confirmed transactions (which I haven't seen before).

It's completely feasible. There are only a handful of BSC "nodes" (if you can even call them that), and all of them are owned and operated by Binance. Binance can do anything they like with the BSC network and all the assets on it. Reverse transactions, seize coins, burn coins, shut the whole thing down.

[FatFork]

And for all the coins stolen on BSC, could Binance not just reverse those transactions since BSC is 100% centralized?

CZ's best bet is to freeze those output addresses and have Stake negotiate with those hackers (Ramson, as usual), since I don't believe it's feasible to reverse already confirmed transactions (which I haven't seen before).

There is no need to reverse already confirmed transactions, as Binance can simply freeze the funds and use the BNB Auto-Burn feature to cover the hacked funds back to the Stake. I believe they have already taken similar actions following some major hacks/exploits on the BSC network.

Keeping such a large sum in a hot wallet is a rookie error for an old casino (Stake). It appears to be an insider hack.

I agree. I don't know the exact daily withdrawal numbers, but seriously, did they really need that much in one hot wallet? And it wasn't even a multisig, apparently. I mean, every large transaction from the platform goes through a manual verification process anyway.

[Igebotz]

CZ's best bet is to freeze those output addresses and have Stake negotiate with those hackers (Ramson, as usual), since I don't believe it's feasible to reverse already confirmed transactions (which I haven't seen before).

It's completely feasible. There are only a handful of BSC "nodes" (if you can even call them that), and all of them are owned and operated by Binance. Binance can do anything they like with the BSC network and all the assets on it. Reverse transactions, seize coins, burn coins, shut the whole thing down.

This is terrifying; you've just destroyed my affection for the BUSD token and the entire BSC Blockchain. Well, I'm not certain the hackers are stupid enough to leave those coins in the BSC Blockchain knowing they could be reversed or frozen..

I agree. I don't know the exact daily withdrawal numbers, but seriously, did they really need that much in one hot wallet? And it wasn't even a multisig, apparently. I mean, every large transaction from the platform goes through a manual verification process anyway.

There is no daily withdrawal limit on stake but if you want to withdraw a large sum then you will be ask to do KYC.

[cabron]

CZ's best bet is to freeze those output addresses and have Stake negotiate with those hackers (Ramson, as usual), since I don't believe it's feasible to reverse already confirmed transactions (which I haven't seen before).

It's completely feasible. There are only a handful of BSC "nodes" (if you can even call them that), and all of them are owned and operated by Binance. Binance can do anything they like with the BSC network and all the assets on it. Reverse transactions, seize coins, burn coins, shut the whole thing down.

This is terrifying; you've just destroyed my affection for the BUSD token and the entire BSC Blockchain. Well, I'm not certain the hackers are stupid enough to leave those coins in the BSC Blockchain knowing they could be reversed or frozen..

I agree. I don't know the exact daily withdrawal numbers, but seriously, did they really need that much in one hot wallet? And it wasn't even a multisig, apparently. I mean, every large transaction from the platform goes through a manual verification process anyway.

There is no daily withdrawal limit on stake but if you want to withdraw a large sum then you will be ask to do KYC.

LOL well it's a known fact though of what a centralized platform can do. It wouldn't help Stake recover so I'm curious if CZ would really be doing it.
Stake is the richest among the casinos in crypto, certainly, the amount is just peanuts to them Eddie will just refund all affected users and go on again to enjoy his stay where ever he is. There is nothing to worry about but there will be preventive measures. What that might be is probably worse than KYC.

[dkbit98]

I think I recently saw more than usual number of reports against Stake casino in Scam Accusations board, so maybe that was connected with this hack.
Whenever news like this is released I am a bit suspicious if that wasn't some type of insider job, and I really don't understand why they are keeping so much coins in hot wallet.

There is no need to reverse already confirmed transactions, as Binance can simply freeze the funds and use the BNB Auto-Burn feature to cover the hacked funds back to the Stake. I believe they have already taken similar actions following some major hacks/exploits on the BSC network.

Yeah but boss CZ first needs to give them the green light for that... just showing how ''decentralized'' whole thing is. 

[LoyceMobile]

Whenever news like this is released I am a bit suspicious if that wasn't some type of insider job, and I really don't understand why they are keeping so much coins in hot wallet.

If it was an inside job, could it be they accessed more than just the hot wallet? It sounds dumb thought: not many people will have access to those wallets, in which case it shouldn't be long to find the thief.

[Igebotz]

LOL well it's a known fact though of what a centralized platform can do. It wouldn't help Stake recover so I'm curious if CZ would really be doing it.
Stake is the richest among the casinos in crypto, certainly, the amount is just peanuts to them Ed will just refund all affected users and go on again to enjoy his stay where ever he is. There is nothing to worry about but there will be preventive measures. What that might be is probably worse than KYC.

He will if all of the coins are still in his Blockchain and they have a strong relationship with CZ. I'm not sure if the number is inflated, but I spoke with a stake insider, who informed me that everything is back on track, that the stake vault was not compromised, that Ed is handling things, and that no player coin was taken. My $64 is still lying there.

Stake made $2.6b in revenue last year so $40m is drop in the ocean for Ed.

If it was an inside job, could it be they accessed more than just the hot wallet? It sounds dumb thought: not many people will have access to those wallets, in which case it shouldn't be long to find the thief.

My source said only the hot wallet was accessed.

[BoXXoB]

Whenever news like this is released I am a bit suspicious if that wasn't some type of insider job, and I really don't understand why they are keeping so much coins in hot wallet.

If it was an inside job, could it be they accessed more than just the hot wallet? It sounds dumb thought: not many people will have access to those wallets, in which case it shouldn't be long to find the thief.

If it was an inside job and proper access control was in place, it should be trivial to find out who it was. Who knows until we get confirmation.

[EarnOnVictor]

Whenever news like this is released I am a bit suspicious if that wasn't some type of insider job, and I really don't understand why they are keeping so much coins in hot wallet.

If it was an inside job, could it be they accessed more than just the hot wallet? It sounds dumb thought: not many people will have access to those wallets, in which case it shouldn't be long to find the thief.

If it was an inside job and proper access control was in place, it should be trivial to find out who it was. Who knows until we get confirmation.

Pointing an accusing finger doesn't translate to finding the thief, and of course, the investigation would point accusing fingers at a tiny circle of people, but it would be a mere allegation unless they can truly solve the puzzle which I predict a slim chance of success for. A hack/fraud of this magnitude will be a well-organized crime that will be foolproof to avoid pointing to the insider unless they are idiots.

[BoXXoB]

Pointing an accusing finger doesn't translate to finding the thief, and of course, the investigation would point accusing fingers at a tiny circle of people, but it would be a mere allegation unless they can truly solve the puzzle which I predict a slim chance of success for. A hack/fraud of this magnitude will be a well-organized crime that will be foolproof to avoid pointing to the insider unless they are idiots.

True. I hope Stake did not blindly give wallet access to employees without having some system in between to keep access logs.

I just hope Stake gives us more information so we can stop speculating.

[decodx]

I just hope Stake gives us more information so we can stop speculating.

Well, I highly doubt we'll ever see that day. These kinds of secrets are usually locked up tighter than a bank vault. They'll wrap it up in the 'for our safety and to prevent future hacks' excuse, but let's be real, they're really just covering their tracks and hiding any slip-ups they might have had.

[dkbit98]

If it was an inside job, could it be they accessed more than just the hot wallet? It sounds dumb thought: not many people will have access to those wallets, in which case it shouldn't be long to find the thief.

I don't know really, I just speculated about inside job, and I don't really believe anything I hear in news anymore.
It is stupid to lose coins like this, and it's even more stupid when it happens to someone more than once 

If it was an inside job and proper access control was in place, it should be trivial to find out who it was. Who knows until we get confirmation.

Nothing is trivial wit crypto businesses and shitcoins 

[robelneo]

I just hope Stake gives us more information so we can stop speculating.

It's to their disadvantage if they show or tell us it's because of negligence, We expect them to have tight security, so they will pick the right words that are acceptable to the community and stakeholders but they will keep the real picture onto themselves, until one of them spill it.
The whole gambling community is looking at how they handle it as long as they ensure that their users' funds are safe and they are good, there's no need to panic.

[Darker45]

I just hope Stake gives us more information so we can stop speculating.

It's to their disadvantage if they show or tell us it's because of negligence, We expect them to have tight security, so they will pick the right words that are acceptable to the community and stakeholders but they will keep the real picture onto themselves, until one of them spill it.
The whole gambling community is looking at how they handle it as long as they ensure that their users' funds are safe and they are good, there's no need to panic.

Stake probably prefers that we merely speculate on this while facts are kept hidden from anybody. They won't be speaking about this as much as possible. That's bad for business. They have already issued assurances that user funds are safe. That's enough. So, from this moment forward they would act as if nothing has happened. Business as usual. The smoke will eventually die down. It's enough that they report of an "unauthorized transactions."

[Dave1]

I just hope Stake gives us more information so we can stop speculating.

It's to their disadvantage if they show or tell us it's because of negligence, We expect them to have tight security, so they will pick the right words that are acceptable to the community and stakeholders but they will keep the real picture onto themselves, until one of them spill it.
The whole gambling community is looking at how they handle it as long as they ensure that their users' funds are safe and they are good, there's no need to panic.

Stake probably prefers that we merely speculate on this while facts are kept hidden from anybody. They won't be speaking about this as much as possible. That's bad for business. They have already issued assurances that user funds are safe. That's enough. So, from this moment forward they would act as if nothing has happened. Business as usual. The smoke will eventually die down. It's enough that they report of an "unauthorized transactions."

Yes, they even said that this is only a small amount, but it's scary to think that now we have heard a top crypto gambling website being attack by hackers, whether it was state sponsored attack or just some random guy in the basement of their parents.

Nevertheless, another lesson from all of us, although funds are safe, still we can't just leave anything in any platforms that involves our crypto. And as far as Stake goes, this is already a close case.

[Saisher]

I just hope Stake gives us more information so we can stop speculating.

I don't think they will give more They already assured users funds and internal investigations will be kept confidential Stakes will never announce any information that will compromise the site security and reputation in fact they want to kill the news and they want to treat it as minor problems, the amount is just pocket change, small casinos with that amount will announced bankruptcy but with Stake's status its back to normal.

[rohang]

FBI posted an update regarding this

https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom

They identified the hackers as a known organisation from north korea,

I still however am skeptical that this happened without any inside access , also shows how big stake is now that fbi is involved so fast, especially because stake.com does not operate in US and the hackers arent from US either, allegedly.