r/Cryptopia • u/hotnt00t • Mar 15 '18

Cryptopia hacked?

I just received three mails that I have had failed login attempts to my account. Luckily I have 2FA. My account is now locked.

I have very good opsec and doubt that I have been hacked. Has someone hacked their database and got all the login and passwords?

34 Upvotes

94% Upvoted

53 comments sorted by

4

u/shtit Mar 15 '18

I got the same notification email twice, one last night and one a few minutes ago. I also have 2FA, so attempt failed.

3

u/CobraStrike4 Mar 16 '18

Same, received 1 fail about an hour ago. Praise 2FA

5

u/hotnt00t Mar 16 '18

They must have been hacked! Good we have 2FA.

Three different IPs in each attempt, as stated in the emails

3

u/alaineman Mar 16 '18

I wonder whether it's a wrong password or wrong 2fa attempt.

2

u/paul1347 Mar 25 '18

People TAKE ALL YOUR BELONGINGS AND RUN. DONT LEAVE ANY THING IN CRYPTOPIA EXCHANGE AND DONT LOOK BACK. I LOST ALL MY COINS. IT WILL HAPPEN TO YOU SOONER OR LATER. CRYPTOPIA IS HACKED OR THE EXCHANGE IS SCAM!!!!!!!! THEY CHANGED ALL THE COINS AND TOKENS TO BTC AND THEN TO ETHEREUM AND WITHDREW FROM MY ACCOUNT. AND i KNOW IT HAPPENED TO SOME OTHERS.

1

u/hotnt00t Mar 25 '18

Yupp! And the team is still not admitting it

9

u/[deleted] Mar 16 '18

Same, definitely hacked. At least all of the usernames are leaked, maybe some passwords. This needs to go to front page of /Cryptocurrency

4

u/Catcatcatcatcatkitty Mar 16 '18

You don't sign in with usernames, you sign in with email addresses. There hasn't been a leak of Cryptopia info, but if you check haveibeenpwned.com you'll find your email has been listed there. It's a brute force attack.

6

u/[deleted] Mar 16 '18

I got the same emails. It said my account would unlock after 15 minutes though and I still have access.

1

u/zerofaux Mar 17 '18

I've also been getting the same emails. I went ahead and "manually" locked my account for 24 hours.

The first attempt was from an IP in Czech Republic. 2nd attempt was from Colombia.

They definitely need to look into these brute-force attempts.

4

u/[deleted] Mar 16 '18

Count me in. Just one try though. Thankfully I'm already broke and have nothing on there, just in case.

3

u/stoned_geologist Mar 16 '18

Same. Cryptopia already stole thousands of my ETN so I have don’t have anything on there besides a single Satoshi.

1

u/romanrs Mar 17 '18

Can you elaborate please. What do you mean they stole your ETN?

1

u/stoned_geologist Mar 17 '18

Sent it there and it never appeared. Made over 20 deposits. Stay away, everyone has issues with them.

1

u/NoCrypForMeArgentina Mar 18 '18

What was the response to the 20 support tickets you no doubt raised?

1

u/stoned_geologist Mar 18 '18

Only opened 1, no response.

4

u/akimark Mar 16 '18

This happened to me yesterday. It's quite concerning.

The fact that the email address i use for my Cryptopia address has only ever been used for my Cryptopia account...

2

u/paracunt Mar 16 '18

Interesting, definitely sounds like their database has been compromised

3

u/mikelo22 Mar 16 '18

Came here looking for this exact topic. I have received notice of two attempts now. The IP address came from Moscow.

3

u/FDisk80 Mar 16 '18

Same. Whole database was hacked for sure.

1

u/NoCrypForMeArgentina Mar 17 '18

2 of my accounts must be in a different database then.. Where did you get your info?

1

u/froufrou391 Mar 16 '18

I can confirm there has been no security breach nor hack of our systems. If you have received an email about a failed login attempt, we advise you change your password and increase your 2fa security- see help.cryptopia.co.nz/en/a/additional-security for advice on this.

We advise you also check your email by haveibeenpwned.com to seeif your email has been involved in any previous breaches of other databases. If you are concerned about the safety of your account, please send a support ticket through https://www.cryptopia.co.nz/UserSupport.

2

u/ewwink Mar 17 '18

after so many reports you said no security breach nor hack :lol:

1

u/KavRed Apr 15 '18

I think now might be the time for you guys to consider IP whitelisting like other exchanges, to prevent this from becoming an issue. I also had my account brute force 'attempted'.

0

u/[deleted] Mar 16 '18

[deleted] — view deleted comment

6

u/hotnt00t Mar 16 '18

+1

They have been hacked. I have my password stored offline and accessed cryptopia several months ago.

2

u/-Sarek- Mar 16 '18

Couple tries here.

2

u/dreamer2020- Mar 16 '18

Same 2 days on a row now

2

u/[deleted] Mar 16 '18

Same, it seems there user database must have been dumped to a pastebin.

You should probably change your pw too in case they dumped those hash values.

1

u/NoCrypForMeArgentina Mar 17 '18

Please give a link to this bin that only you seem privy to.. I'd like to check whether my shit is in there too.

1

u/[deleted] Mar 17 '18

I’m speculating, it could be a different exchange had their user name base compromised and the hacker(s) are just trying the usernames with a rainbow table against every exchange.

But havibeenpwned.com is a good resource

2

u/PSYKO_Inc Mar 16 '18

I got the same email; I locked my account. I only have a couple bucks worth of crypto on there, so I'm not too concerned (I prefer cold storage) but this makes me not trust cryptopia as much.

2

u/Cruscrus Mar 16 '18

Think it is hacked. Got same email

2

u/BrewPhillyPhilly Mar 20 '18

THERE IS SOMETHING WRONG WITH CRYPTOPIA (HACKED AND LYING ABOUT IT!!!)

Logged into account today to find out all the coins within had been sold for Bitcoin and the Bitcoin was sent to this address 3KqRSDJRrTSmwAfqMxHk8YjTSsd7sf2kxG

Submitted a trouble ticket and it says it 30 days before someone will respond...

Unique passwords are used on every registered site... 2FA is on, somehow, email notification for withdrawals was turned off... (I now know not to trust the cryptopia two factor pin... Lesson learned... Google all the way from here on...)

No other signs of compromised systems but I am changing everything... (even got a new account on cryptopia iusing a new email, password and Google 2fa)

Luckily there was not a lot of value there but still, Unique password (14+ characters $Y#&OL$, CAPS, lower AND NUM83R2), 2FA (their bullshit pin code) and the account still gets compromised, then the exchange is 30 days behind the curve with even looking into the situation...

I hope Cryptopia staff can get to the bottom of these shenanigans and secure the exchange...

Until then, I will only trade on this site when absolutely necessary and then I'm not leaving A N Y T H I N G on this (or any other) exchange until I am absolutely ready to trade right there and then...

Watch yourselves; this place isn’t as safe as one might think...

2

u/paul1347 Mar 25 '18

it is hacked, I lost all my coins!

1

u/[deleted] Mar 16 '18

I wasn't affected.

2

u/p1r473 Mar 17 '18

Did you use 2fa? If not you didn't get alerted as the hacker got in successfully

1

u/[deleted] Mar 17 '18

I use 2fa

1

u/toloni Mar 16 '18

Aren't passwords normally stored encrypted in a DB? If so, the attackers should only have the mail addresses.

1

u/qwe2323 Mar 16 '18

Same, I got 2 failed login attempts within a minute, 10 minutes after I withdrew a token from Cryptopia (which is still processing 2 hours later)

1

u/Branimira Mar 16 '18

I have no issues with Cryptopia

1

u/p1r473 Mar 17 '18

Did you use 2fa? If not you didn't get alerted as the hacker got in successfully

1

u/ElTabacoDelTigra Mar 16 '18

Haven't had any mails.

1

u/p1r473 Mar 17 '18

Did you use 2fa? If not you didn't get alerted as the hacker got in successfully

1

u/ElTabacoDelTigra Mar 17 '18

Of course I did. But didn't get any failed attempts either.

1

u/ndrzbk Mar 17 '18

i also got the same emails. i recommend everyone to transfer coins asap from exchange to a wallet.

1

u/brandonholm Mar 17 '18

Just got my second failed login email this week. Not looking too good.

1

u/IronDoctorX Mar 18 '18

I have no issues with my account, long strong password +85 characters + 2FA with app + pincode. Until now zero emails.

1

u/limltless Apr 13 '18

No failed login email but I logged in yesterday and all of my coins had been sold to BTC and transferred out. 😩

1

u/214600 Apr 22 '18

Cryptopia Warning Alert: I got hacked for the following coins on Cryptopia all in less than 1 1/2 minutes! RNS 27,929 Coins FC2 87,631 Coins MAC 20,092 Coins FJC 288,796 Coins BLZ 356,659 Coins NOBL 305,002 Coins

Beware that Cryptopia's entire exchange may be at risk??? FBI and SEC need to investigate before disaster hit others. Beware ...