FixedFloat has been hacked (26M $)

[OmegaStarScream]

So I'm pretty sure lots of you here have already heard of this instant exchange. It got hacked a few hours ago[1][2].

The team did confirm the hack and denied that it was an inside job. They're currently in maintenance mode.

[1] https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum
[2] https://twitter.com/PeckShieldAlert/status/1759399281201733917

[Rikafip]

It got hacked a few hours ago.

As far as I know, they got hacked yesterday. Can't say that I ever heard of them, let alone use them.  

https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum

Huh, in that article they say that eXch is Ethereum mixer  

[dkbit98]

The team did confirm the hack and denied that it was an inside job. They're currently in maintenance mode.

I don't think they are coming back any time soon, like they say on their website.
Even if they come back they are probably going to change to fully kyc, and they will have hard time recovering from this loses.
But I would love to hear what they have to say, last time they logged in and posted was in the end of January:
https://bitcointalk.org/index.php?topic=5482815.msg63576532#msg63576532

As far as I know, they got hacked yesterday. Can't say that I ever heard of them, let alone use them.  

They are all over the forum, and they have registered account here since 2018:
https://bitcointalk.org/index.php?action=profile;u=2387384

[tabas]

I see that's the reason why the website says they're on technical maintenance currently.

It got hacked a few hours ago.

As far as I know, they got hacked yesterday. Can't say that I ever heard of them, let alone use them. 

https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum

Huh, in that article they say that eXch is Ethereum mixer 

The article author don't realize that it's a competitor to their business.

I don't understand if there are funds from their customers telling that they're safe. Are they talking about the recent transactions that were sent to them? because no one can hold funds there as the transactions gets confirmed, the conversion is sent afterwards quickly CMIIW.

[hugeblack]

I've used them about 4 times since the beginning of this year, everything was fast and good, it's unfortunate to see them stop working.
I think, is a small exchnage with about $10 million, but $26 million is not an easy matter to compensate, and most likely the government agencies that will deal with them will demand more stringency regarding customer data.

So I think it will be the last time I will use them (if they come back), even though my experience with them was good.

[LoyceV]

Does anyone have a recent snapshot of their "Reserves" on BestChange? I can only find a snapshot from almost 4 years ago, when their reserves were only $38,489.
How did they go from that to 26 million in a hot wallet?

[Synchronice]

How did they go from that to 26 million in a hot wallet?

Are you seriously asking? It's super simple. You create an exchange, start small, then implement KYC, ask depositors to submit KYC documents on your website, there is a chance that they will refuse it and might give up on their money. Then, over time, you come up with another better solution, that means, you partner with blockchain analysis companies and you confiscate the money of high depositors. At first you confiscate $2000, then $5000, then $8000 and so on. Over time, you go from 38K to 26 Million by keeping deposits in your wallet instead of sending to the receiver.

[Potato Chips]

Nice article. I'm used to news outlets mistakenly referring little to no KYC measures CExes as decentralized exchanges so seeing eXch as ethereum mixer is new lol

and yet another, let's shift the blame for the lack of KYC:

FixedFloat, which advertises itself as an "instant, fully automatic cryptocurrency exchange with Lightning Network," prioritizes privacy over safety, operating without requiring account registration or identity verification. This lack of KYC measures is appealing to privacy-conscious users, but it poses significant risks for both the platform and its users in the event of a hack, as investigators have limited information to work with.

I'm sure the hackers would've given fixedfloat their real name and home address /s

No mention what sort of attack was used so who knows if they even have to trade for this.

Does anyone have a recent snapshot of their "Reserves" on BestChange?

I've looked into snaps from a couple months ago and their reserves were constantly increasing. The final amount at Feb 13th was at $45M, see: https://web.archive.org/web/20240213024353if_/https://www.bestchange.com/list.html

[LoyceV]

The final amount at Feb 13th was at $45M, see: https://web.archive.org/web/20240213024353if_/https://www.bestchange.com/list.html

Thanks, I didn't find it at archive.org.
This means they had more than 50% in their hot wallet. Needless to say: that's incredibly dumb.

[LTU_btc]

Another day - another exchange got hacked. I think I've never heard their name before and it's nothing surprising as it's relatively small exchange. Seems that they didn't put their heads into sand and trying to communicate, that's at least some positive sign. Will be interesting to follow how things will developp further.

I've used them about 4 times since the beginning of this year, everything was fast and good, it's unfortunate to see them stop working.
I think, is a small exchnage with about $10 million, but $26 million is not an easy matter to compensate, and most likely the government agencies that will deal with them will demand more stringency regarding customer data.

So I think it will be the last time I will use them (if they come back), even though my experience with them was good.

Yeah, it's small exchange, but still, $26 million is huge money, no idea how they're going to compensate it. And for scammers it's more than enough money to retire, but probably they're not going to do it.

[Yamane_Keto]

This means they had more than 50% in their hot wallet. Needless to say: that's incredibly dumb.

Their description of the hack indicates that the security structure allowed hackers to access the basic functions of the service. It is a complete failure and appears to be access to cold storage, as I see in the explosion that the 1,700 Ethereum were transferred from one address. If they were in the hot wallet, there would have been a large number of addresses.

“The problem was in our infrastructure, which was compromised due to flaws and insufficient protection,” the company said. “This allowed the attackers to gain access to some of the functions of our service.”

[yhiaali3]

In a subsequent statement, FixedFloat assured customers their funds were safe, clarifying that the financial losses impacted only the service itself and not user-held assets. "FixedFloat does not perform the functions of a custodial service—that is, it does not store user funds. We will provide more information later," the platform tweeted.

Is this true, does FixedFloat really “do not store user funds”? As far as I know, all centralized exchanges use user funds and do not isolate exchange assets from user assets, especially those that are not subject to regulatory laws.

FixedFloat said that it will fulfill all payment obligations as soon as it resumes its operations, but of course they did not specify a time for that, and until that time, user funds will remain stuck. I hope that the exchange’s words are true and that user funds have not been affected.

[LoyceV]

Their description of the hack indicates that the security structure allowed hackers to access the basic functions of the service. It is a complete failure and appears to be access to cold storage

That is by definition impossible. If hackers can access it without physically breaking into the building, it wasn't cold storage.
Unless it was in cold storage and an employee manually approved a withdrawal from cold storage that was made without an deposit. That would be a new level of stupidity.

Is this true, does FixedFloat really “do not store user funds”? As far as I know, all centralized exchanges use user funds and do not isolate exchange assets from user assets, especially those that are not subject to regulatory laws.

In an ideal scenario, an instant exchange only holds the user's funds until it has enough confirmations to complete the transaction and send back the other coin.

[FinneysTrueVision]

In a subsequent statement, FixedFloat assured customers their funds were safe, clarifying that the financial losses impacted only the service itself and not user-held assets. "FixedFloat does not perform the functions of a custodial service—that is, it does not store user funds. We will provide more information later," the platform tweeted.

Is this true, does FixedFloat really “do not store user funds”? As far as I know, all centralized exchanges use user funds and do not isolate exchange assets from user assets, especially those that are not subject to regulatory laws.

FixedFloat said that it will fulfill all payment obligations as soon as it resumes its operations, but of course they did not specify a time for that, and until that time, user funds will remain stuck. I hope that the exchange’s words are true and that user funds have not been affected.

FixedFloat is an instant exchange like exch.cx. You can use it without creating an account. The only users who would have lost money would be those who were in the process of swapping or receiving a refund.

I’ve used them several times since they are one of the few exchanges with lightning support but the recent controversy they had with a user on the forum, where they were asking invasive questions about the source of their funds, made me skeptical about using them again.

[un_rank]

I’ve used them several times since they are one of the few exchanges with lightning support but the recent controversy they had with a user on the forum, where they were asking invasive questions about the source of their funds, made me skeptical about using them again.

They have had several of such complaints off the forum before now which leads me to think that this was always coming with the kind of service they offered. Some users who tried to trade on an 'instant' exchange 2 days before the hacked still had funds stored in it till it closed withdrawals.

Requests for private info for no apparent reason also increased recently before the hack.

- Jay -

[dkbit98]

Their description of the hack indicates that the security structure allowed hackers to access the basic functions of the service. It is a complete failure and appears to be access to cold storage, as I see in the explosion that the 1,700 Ethereum were transferred from one address. If they were in the hot wallet, there would have been a large number of addresses.

There is no real difference between using cold and hot wallet addresses.
Only difference for cold wallets is that keys/phrases are stored offline, everything else is the same looking from outside.
Cold storage access can only happen with leak from the inside.

In an ideal scenario, an instant exchange only holds the user's funds until it has enough confirmations to complete the transaction and send back the other coin.

That would operate in snail speed especially for larger transactions, and someone for sure owned $26 million worth of Bitcoin and ethereum that was hacked.

[arabspaceship123]

Have ppl heard of instant exchanges getting hacked it's first time I've seen this. Hackers must've been given inside info. They've lost $26M from instant exchange last month so why'd they delay their announcement.

So I'm pretty sure lots of you here have already heard of this instant exchange. It got hacked a few hours ago[1][2].

The team did confirm the hack and denied that it was an inside job. They're currently in maintenance mode.

[1] https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum
[2] https://twitter.com/PeckShieldAlert/status/1759399281201733917

[stompix]

"it was an external attack caused by vulnerabilities in our security structure.”
“The problem was in our infrastructure, which was compromised due to flaws and insufficient protection,” the company said.

Is this the first one in a while that comes out with a clear statement like this, we had flaws, our infrastructure security was rubbish, we know we screwed up, it's a miracles it lasted that long? Anyhow, at $26M and with bad publicity I can't see them making a real comeback, even if there will be no customers loss people will be warry of it, such a loss might trigger some extra fleecing on clients to recoup some of that!

In an ideal scenario, an instant exchange only holds the user's funds until it has enough confirmations to complete the transaction and send back the other coin.

I don't get it. If I send Bitcoins and want monero, the moment I sent a coin it's not mine anymore, it's the property of the exchange and they release my monero coins, why would there be a limit on how long they can hold that?

[LoyceV]

In an ideal scenario, an instant exchange only holds the user's funds until it has enough confirmations to complete the transaction and send back the other coin.

I don't get it. If I send Bitcoins and want monero, the moment I sent a coin it's not mine anymore, it's the property of the exchange and they release my monero coins, why would there be a limit on how long they can hold that?

The question was if they really don't store user funds. My answer was related to the short time between depositing and receiving your exchanged coins. It could be up to about an hour to get enough confirmations. What they do with the coins after that is indeed not your concern.

[Potato Chips]

Have ppl heard of instant exchanges getting hacked it's first time I've seen this. Hackers must've been given inside info. They've lost $26M from instant exchange last month so why'd they delay their announcement.

Did you mean 'this' month?

But I'm not that surprised since instant exchanges like fixedfloat are pretty much a simplified version of the custodial and centralized exchanges we're used to -- e.g. kucoin, binance etc.-- created for quick trades. We may not leave our coins there for long but they do have the attack prone hot wallets for daily transactions.