Mixin suspends deposits and withdrawals after $200m cryptocurrency heist
- Reference: 1695666848
- News link: https://www.theregister.co.uk/2023/09/25/mixin_200m_heist/
- Source link:
In a [1]statement posted on the social media platform formerly known as Twitter, the digital biz said the incident happened early Saturday morning, when "the database of Mixin Network's cloud service provider was attacked by hackers. After initial verification, the funds involved are approximately US$200 million."
Mixin, which is a decentralized exchange, did not identify the cloud service provider.
[2]
The statement said the firm had contacted Google and blockchain security company SlowMist to help with the investigation. SlowMist [3]confirmed its role, and the amount stolen, in a separate social media post. And Google-owned Mandiant confirmed to The Register that its incident responders were assisting with the cleanup.
[4]
[5]
"After discussion and consensus among all nodes, these services will be reopened once the vulnerabilities are confirmed and fixed," the Mixin statement promised. "During this period, transfers are not affected. Regarding how to deal with the lost assets, the Mixin team will announce the solution afterward."
The crypto firm also noted that Mixin founder Feng Xiaodong will discuss the breach in a Mandarin livestream on Monday, which will be summarized in English after the broadcast.
[6]
"We will try our best to minimize the losses and deeply apologize for this," the cryptocurrency exchange said.
[7]North Korea may be itching to sell $40m of purloined Bitcoin
[8]North Korea's Lazarus Group linked to Atomic Wallet heist
[9]TransUnion reckons big dump of stolen customer data came from someone else
[10]Feds raise alarm over Snatch ransomware as extortion crew brags of Veterans Affairs hit
Mixin's platform uses open-source software and its wallet supports 48 public blockchains, according to its website. It also claims a million users and about $1 billion in assets, although presumably less now.
The heist highlights "inherent vulnerabilities" in open-source banking, KnowBe4 Security Awareness Advocate James McQuiggan told The Register .
"With open-source banking, cybercriminals will always go after the money, whether a crypto or natural currency," McQuiggan said. "When a breach occurs, the effects can run deep. Not only do they face immediate financial repercussions, but the damage focuses on the erosion of trust, which can take years to rebuild."
The Mixin intrusion comes about a week after Elliptic [11]blamed North Korea's Lazarus Group for the [12]$54 million CoinEx heist against another Hong Kong exchange earlier this month. Over the previous 104 days, the criminals stole almost $240 million from five separate hacks, according to the blockchain analysis firm.
[13]
Victims included [14]Atomic Wallet ($100 million) CoinsPaid ($37.3 million), Alphapo ($60 million), and Stake.com ($41 million), some of which attacks have also been linked to the North Koreans.
And in August, the FBI issued an alert that the same gang of government-backed cryptocurrency thieves may try to liquidate a stash of [15]stolen Bitcoin worth more than $40 million from several recent robberies. ®
Get our [16]Tech Resources
[1] https://twitter.com/MixinKernel/status/1706139175018529139
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZRIDChMnL-Phmln0bZX0UgAAANU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://twitter.com/SlowMist_Team/status/1706133260869468503
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZRIDChMnL-Phmln0bZX0UgAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZRIDChMnL-Phmln0bZX0UgAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZRIDChMnL-Phmln0bZX0UgAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/08/23/fbi_dprk_cyber_crooks/
[8] https://www.theregister.com/2023/06/08/lazarus_link_atomic_wallet/
[9] https://www.theregister.com/2023/09/21/transunion_data_dump/
[10] https://www.theregister.com/2023/09/20/feds_issue_snatch_ransomware_alert/
[11] https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics
[12] https://www.theregister.com/2023/09/18/sk_hynix_vicechair_denies_selling/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZRIDChMnL-Phmln0bZX0UgAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://www.theregister.com/2023/06/08/lazarus_link_atomic_wallet/
[15] https://www.theregister.com/2023/08/23/fbi_dprk_cyber_crooks/
[16] https://whitepapers.theregister.com/
Re: Insider again?
The US has $11 trillion of reserves in gold bullion so about 8,000 tonnes of gold. Roughly 5,600 tonnes of this are in the NY Fereral Reserve building but unlike the plot in Die Hard 3 its physically quite hard to steal as you would need 280 20 ton trucks..
Re: Insider again?
As much as people like to malign traditional banks, the usual threats to them are not simple theft. Electronic banking generally practices defense in depth, and, while there have certainly been some woeful security lapses, there are usually multiple safeguards to prevent exfiltration of funds by simple money transfer. There seems to be a large segment of cryptobros who resolutely refuse to recognize the centuries, if not millennia, of lessons accumulated in traditional banking.
What luck, I get to use the quote by Stockton Rush, the late CEO of OceanGate:
"You know, at some point, safety just is pure waste . . . . I think I can do this just as safely by breaking the rules."
When will people learn?
with quotes from the article like: "...the damage focuses on the erosion of trust, which can take years to rebuild." I'm not sure they ever will.
"the Mixin team will announce the solution afterward"
Guys, stop being so pessimistic! They have a solution. Wait for the solution
I'm not usually a hedonist when it comes to schadenfreude, but when it comes to crypto I make an exception. What great joy I keep getting out of saying to the world, I told you so. You're buying nothing backed by nothing. Sure, our national monetary systems are also nothing -- but they're backed by at least intent and a promise. Something is infinitely bigger than nothing.
Heist n. (cryptocurrency) Removal of assets by outsiders before the custodians of these assets can steal them.
Insider again?
How come we don't here about such heists in non crypto banking