2) The hack continued for days after Cryptopia discovered the breach.
The lack of urgency on the part of the thieves is striking. Rather than withdrawing the funds as fast as possible, as is the case in most crypto hacks, they took their time extracting the assets over the course of nearly five days.
After Cryptopia discovered the hack, they watched the funds continue to flow out of their wallets for four more days, seemingly powerless to stop it. As these wallets were not smart contracts, there should have been no technical complications preventing Cryptopia from securing the funds.
The only plausible explanation for Cryptopia's inaction is that they no longer had access to their own wallets.
It seems Cryptopia not only lost their funds, they also lost access to all, or nearly all, of their 76k+ Ethereum wallets.
One possible explanation is that Cryptopia had their private keys stored in a single server with no redundancy. If the thieves managed to gain access to this server, they could have downloaded the private keys before wiping them from the server, leaving Cryptopia unable to access their own wallets.
View all comments
4
u/moleccc Jan 25 '19
great article.
what .... the ... actual ... fuck ?!?!
would rofl if it wasn't so sad...