Breached wallets should ‘move funds immediately’

Cryptocurrency portfolio management platform CoinStats has reported a security breach affecting many user wallets.

On June 22, CoinStats reported a security incident affecting wallets created directly within the app. The company assures users that externally connected wallets and centralized exchanges (CEXs) will not be affected.

CoinStats urged users whose private keys were exported to move their funds immediately. See below.

We are currently experiencing a security incident directly affecting wallets created on CoinStats; This does not affect externally connected wallets.

If you exported your private key, move your funds as soon as possible.

— CoinStats (@CoinStats) June 22, 2024

According to the CoinStats team, only 1,590 of all CoinStats wallets were affected, or 1.3%.

Although the list of affected wallets may change as the investigation continues, no significant changes are expected.

Update on Security Incident

The attack has been mitigated and we have temporarily shut down the application to isolate the security incident.

1. None of the connected wallets and CEXs are affected.

2. Thanks to the immediate response of the CoinStats team to the incident…

— CoinStats (@CoinStats) June 22, 2024

CoinStats suspended user activity and took the app offline to fully investigate the incident. The company assured users that the attack was contained and that it would continue to provide updates as more information became available.

The attack allowed bad actors to send fake notifications to iOS and Android users, promising fake rewards and encouraging them to access the CoinStats AirScout wallet.

Clicking the link redirected users to a boring website, promoted via a push notification from CoinStats and an official in-app alert on the home screen.

Although the company did not disclose the reason for the attack, the incident raised concerns about the security of private keys stored on its servers and the randomness of wallets created within the app.

CoinStats also uploaded a Google document with a list of all crypto wallets affected by the attack. Owners whose wallet addresses appear in this list are advised to immediately transfer their funds using the exported private keys.

The company is actively investigating the extent of funds moved and will provide updates as soon as possible. Coinstat expressed its gratitude for the patience of users during this period.

The security breach shook the cryptocurrency community, with leading industry experts advising victims to be wary of fraudulent recovery efforts.

Update on Security Incident

The attack has been mitigated and we have temporarily shut down the application to isolate the security incident.

1. None of the connected wallets and CEXs are affected.

2. Thanks to the immediate response of the CoinStats team to the incident…

— CoinStats (@CoinStats) June 22, 2024

Crypto security issues continue

On June 5, CoinGecko confirmed that third-party email management platform GetResponse suffered a data breach.

The hack exposed the personal information of 1.9 million CoinGecko users.

A compromised employee account allowed attackers to access users’ names, email addresses, IP addresses, email open locations, and additional metadata such as registration dates and subscription plans.

While CoinGecko ensured that user accounts and passwords remained secure, the attackers used the compromised data to send 23,723 phishing emails to affected individuals.

Phishing attacks are commonly used by cybercriminals to steal sensitive information such as cryptocurrency wallet private keys or trick users into sending funds to fake addresses.

The CoinGecko data breach adds to a series of security incidents affecting the cryptocurrency industry.

Another major threat to investors is “rug pulling” scams, which occur when developers abandon a cryptocurrency project after raising funds from investors.

Earlier this month, Yang Qichao, a university student in China, was sentenced to 4.6 years in prison for orchestrating a $300,000 rug-pulling scam in the cryptocurrency market. Yang created a token called BFF and lured investors with the promise of high returns.

The fraud scheme was exposed, leading to Yang being held accountable for his actions and sentenced to a significant prison sentence.

This case highlights the serious consequences of fraudulent activities in the crypto industry.