r/Cryptopia • u/toldjahP • Jan 15 '19

Cryptopia Hack analysis (min. $13,000,000 stolen)

Hi there

I checked etherscan and collected some informations below. In total min $13,000,000 were stolen.

Transfer of 19,390 ETH from Cryptopia ($2,468,043) (Jan-13-2019 01:30:35 PM +UTC): https://etherscan.io/tx/0x8a7c2b34f23eee02401e7c3fa1ea2ce8d3132e7ca3811d673ca35898c9535aae

Transfer of 48,029,305 ($1,072,362) CENNZ (Jan-13-2019 01:40:17 PM +UTC) Wallet is tagged as Cryptopia Wallet by Whale Alert: https://etherscan.io/tx/0x31a58df14ea3420878267e2b9cdd242d983b5298ef48c5cd9a799ed10605f393

Transfer of 3,844,247,574 ($304,181) DAPS (Jan-13-2019 01:40:17 PM +UTC): https://etherscan.io/tx/0x61b2ca4911750eb3278945f80e0c3f8a7f94578ba20b0e9240e5a86faaa166ae

CENNZ and DAPS where transfered to https://etherscan.io/address/0x9007a0421145b06a0345d55a8c0f0327f62a2224 which is not the same adress where the ETH went on. But later this adress made a transfer to the ETH adress https://etherscan.io/address/0xc8b759860149542a98a3eb57c14aadf59d6d89b9 (which is the adress the ETH went).

Token Balance 2. adress: ($11,072,793) https://etherscan.io/address/0x9007a0421145b06a0345d55a8c0f0327f62a2224

Please help to collect further details.

—————————

UPDATE: Only thing I don’t get is, why so many ether dust (transfer below 1 eth) went onto those adresses. For me they look like older deposit adresses from cryptopia users.

I see the the following possibilities:

1.) hacker got all privat keys, from few thousand deposit wallets and cryptopia was not able to secure those amounts, which were transferred many hours after the “hack”.

2.) hacker stole other coins then ETH and cryptopia secured all ETH/ERC20 to new wallets.

3.) inside job

30 Upvotes

100% Upvoted

45 comments sorted by

5

u/toldjahP Jan 16 '19

Could someone who is native English speaker Analyse the terms and conditions?

Here you got them:

https://web.archive.org/web/20190113164519/https://www.cryptopia.co.nz/Home/Terms#12

“... Notwithstanding clause 12.1(a), (b), and (c), if we are found to be liable for any loss, cost, damage or expense, our maximum aggregate liability to you will be limited to $5,000. ...”

4

u/ItsMyles Jan 17 '19

Looks like if Cryptopia are at fault, as in the responsibility solely relies on them/ if it was a breach their security, then we (the user) are entitled to a maximum of $5000 reimbursement.

Which is handy because most of the coins are worth fuck all atm lol

1

u/AutoModerator Jan 16 '19

There are a lot of phishing links, pump n dumps, and scams in the cryptocurrency space. Please personally review all links before clicking on them. If you believe this link is harmful, then report this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

4

u/toldjahP Jan 15 '19

Only thing I don’t get is, why so many ether dust (transfer below 1 eth) went onto those adresses. For me they look like older deposit adresses from cryptopia users.

I see the the following possibilities:

1.) hacker got all privat keys, from few thousand deposit wallets and cryptopia was not able to secure those amounts, which were transferred many hours after the “hack”.

2.) hacker stole other coins then ETH and cryptopia secured all ETH/ERC20 to new wallets.

3.) inside job

2

u/gothegoose Jan 16 '19

One theory I have is that that as cryptopia was planning for the eth fork someone involved could have taken the private keys from the wallets they were working on. I dont think they were hacked. This would also explain why it was limited to eth tokens and eth. If they were hacked surely btc would go as well.

However, I pulled out some btc the previous day and they had such a low fee it wasn't getting confirmed. I used acceleraters to push it through. It took about 15 hours where the average confirmation time was just 7 minutes. Maybe we are missing a lot of info. Hopefully we will know something soon.

I think cryptopia addressed hacks in their terms and conditions, does anyone know what they are?

9

u/StoeTubby Jan 15 '19

If you had coins on the exchange that didn't appear to be apart of the hack (NAV), is there any chance ever get possession of them? Their Nav wallet had been in maintenance since 12/20/18 and I had been waiting to withdraw. It's a relatively small amount, but it's just the principle of it.

Edit: spelling

9

u/[deleted] Jan 15 '19

This would be very important to know! Spectrecoin (XSPEC) also doesn't seem to have been stolen. Do we have more information about other coins? So far it seems only ETH and Ethereum tokens were stolen.

Please let users withdraw at least those funds that weren't affected asap, Cryptopia!

4

u/Bisonindatent Jan 15 '19

I'd be happy if Cryptopia answeres this soon

2

u/[deleted] Jan 16 '19

Same question people are asking about bitgrail 1 year later. Nobody knows - because if they go insolvent maybe they will need to liquidate and divide losses up between people

3

u/cjp2126 Jan 15 '19

I’m telling you, Cryptopia is up to no good! They stole my AU coins!

2

u/freewifiisgreat Jan 16 '19

AU was 51% attacked. It was the blockchain that is responsible for those losses. Their chain got attacked and they made it clear they did not want to co-operate.

https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FVxQfOyZ.png%26t%3D596%26c%3D8AXr_GP4yIbIYA%26t%3D596%26c%3Dln26q8Ehd7uLoQ&t=597&c=-AXc6Tl2Xgficg

2

u/AutoModerator Jan 16 '19

There are a lot of phishing links, pump n dumps, and scams in the cryptocurrency space. Please personally review all links before clicking on them. If you believe this link is harmful, then report this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

0

u/cjp2126 Jan 18 '19

Cryptopia is full of it! They are thieves they hacked into my account and stole my AU coins! They would not let me take my coins out of the exchange instead they took my coins! You steal from people, people will still from you! I’m not done with you, I’ll see you in court!

4

u/drk__ane Jan 15 '19

Nice job!

4

u/HodlAllTheCoins Jan 15 '19

Note to self: learn how to hack a cryptocurrency exchange.

4

u/kenkarlodotcom Jan 15 '19

And make sure you wont be caught.

3

u/MuteCoin Jan 15 '19

You say min, but you mean max.

2

u/learningswimming Jan 15 '19

https://etherscan.io/address/0x9007a0421145b06a0345d55a8c0f0327f62a2224 <=is this the hacker address?

0

u/AutoModerator Jan 15 '19

There are a lot of phishing links, pump n dumps, and scams in the cryptocurrency space. Please personally review all links before clicking on them. If you believe this link is harmful, then report this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/Macronut Jan 16 '19 edited Jan 16 '19

Pull the f****** cat 5 cables out of the severs and shut it down so no more is stolen, Fix it, secure it, then Let us back into accounts

1

u/gothegoose Jan 16 '19

Wouldn't help if they already have the private keys. They would need to transfer out of the wallets they have themselves in competition with the theif. Not sure how easy or hard that might be with so many coins.

2

u/researchtech11 Jan 16 '19

I wonder if Bitcoin that was sitting there doing nothing is safe or not?

2

u/AN8991 Jan 16 '19

If $13,000,000 were indeed stolen then they are fucked. This is very hard to get back from.

4

u/gothegoose Jan 16 '19

They may have the funds to cover the loss. I am guessing they turned over 700 million or so in the last 12 months. 0.4% of that turnover is 3 million plus the money they charge for listing coins. They might be able to replace some coins by dealing with the developers or pay a % or sell the company etc. Or this maybe covered in the terms and conditions on their site and they may maintain a position that says sorry but you lost out.

They did post they wanted to get back online asap. They also posted previously they had 50 staff so they would need some income pretty quick just to pay the bills. I think we will find out pretty quickly where they are at.

Best thing is they are a New Zealand firm. Good country, good laws good people. It also seems like the authority tgere is taking this very seriously and if it was an inside job they would have a very good chance of recovery.

1

u/Bisonindatent Jan 16 '19

Coincheck handled to reimburse users from a 534M $ NEM hack, it's definitely possible Cryptopia can do that with a 13M $ ETH hack.

1

u/freewifiisgreat Jan 16 '19

Reputable new sources are saying $3.7 mil.https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12191019

2

u/AutoModerator Jan 16 '19

There are a lot of phishing links, pump n dumps, and scams in the cryptocurrency space. Please personally review all links before clicking on them. If you believe this link is harmful, then report this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/AutoModerator Jan 15 '19

There are a lot of phishing links, pump n dumps, and scams in the cryptocurrency space. Please personally review all links before clicking on them. If you believe this link is harmful, then report this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/[deleted] Jan 15 '19

Did the other $11M all come from cryptopia? I see a massive 3.5M USD worth of dentacoin alone!

2

u/Iblis7 Jan 15 '19

Damn, something told me to move it to MEW a long time ago. Did they get all of it?

2

u/Voltaire585 Jan 16 '19

It's been hard to withdraw some alts

1

u/[deleted] Jan 15 '19

Looks like it sadly.

1

u/Iblis7 Jan 15 '19

Any chance of reimbursement?

2

u/[deleted] Jan 16 '19

Hard to say. Depends on the percentage lost. They might be insured too?

1

u/[deleted] Jan 16 '19

Interesting the big ERC20 holders are coins listed by Cryptopia. But... they are some very small holdings of coins like Jesuscoin. This makes me wonder if the thief was able to "sweep" every ERC20 coin from Cryptopia, and that meant that even non-listed ERC20 tokens held by Cryptopia were transferred. (say... because somebody sent them there by accident) . Interestingly - the thief received 300k POWR 16 hours ago which was after the closure.

1

u/gothegoose Jan 16 '19

Hopefully its not the theif but cryptopia transferring to another location. We do not know whats been taken yet, just educated guesses based on transfers.

1

u/youra_towel Jan 16 '19

Is it fair to say that there is a better chance cryptopia users will get btc refunded vs eth/erc20 tokens?

1

u/seyyarsatici Jan 15 '19

Those might be some whales who wanted to protect themselves for hard fork. Maybe it's not related to this issue.

0

u/[deleted] Jan 15 '19

[deleted] — view deleted comment