Coincheck Suffers Biggest Hack in Cryptocurrency History; Experty Users Tricked into Buying False ICO

While cryptocurrency is gaining popularity as an investment vessel, recent reports of losses prove that Bitcoin, Ethereum, and its other equivalents are still volatile. Two recent incidents of cryptocurrency theft has affected the price of Bitcoin, resulting in losses for initial coin offering (ICO) investors.

First, Tokyo-based cryptocurrency exchange Coincheck suffered the biggest hack in the history of cryptocurrencies after the exchange lost $532 million in digital assets, or about $420 million in NEM tokens. The hack affected Bitcoin's value, resulting in a 5 percent drop on the morning of January 26.

Coincheck confirmed the incident in a blog post, but did not explain how the tokens were stolen. It abruptly froze most of its services, including deposits, withdrawals, and trade of almost all other cryptocurrencies except Bitcoin. The heist affected about 260,000 users, but Coincheck said that the affected users will be repaid in Japanese Yen through the Coincheck Wallet. As of this writing, Coincheck is working with Japan’s Financial Services Agency to investigate the cause of the missing tokens.  

On January 26 and 27, a hacker tricked Experty ICO (Initial Coin Offering) participants into sending Ethereum funds to the wrong wallet address. The hacker sent emails with a false pre-ICO sale announcement of Experty tokens to users who signed up for notifications. The actual Experty ICO is slated on January 31. The Ethereum wallet address that the perpetrator sent isn’t associated with Experty, who previously announced that they would only handle sales of tokens through Bitcoin Suisse AG, a regulated crypto-financial broker based in Switzerland. An ICO is similar to an Initial Public Offering (IPO), but instead of stocks, the buyer receive tokens in an online platform.

The hacker made off with a presumed $150,000 or more from 71 transactions. Experty and Bitcoin Suisse have sent out warnings to users not to send money to the wallet address in the email sent by the hacker. Moreover, a statement from Experty and Bitcoin Suisse said that the hacker got hold of the email list by compromising the computer of one of the people who carried out Experty’s Proof-of-Care review. Experty said it would give 100 EXY tokens, or the equivalent of US$120, to every person in their email database, but users who sent Ethereum to the hackers' account will not get their money back nor will they receive complimentary EXY tokens.

These recent incidents are certainly not new, and there have been a number of notable incidents involving different methods to steal cryptocurrency over the past year. In December 2017, NiceHash, a Slovenia-based cryptocurrency-mining marketplace suffered a data breach where hackers stole the contents of its Bitcoin wallet. About 4,700 bitcoins were stolen, the equivalent of US$64 million.

The popularity of cryptocurrencies like Bitcoin and Ethereum is a profitable target for cybercriminals. Not only are they employing phishing scams similar to the Experty incident, they are also using means like cryptocurrency-mining malware such as the Digmine bot, which is spread through Facebook Messenger. In another recent incident, a Satori botnet variant was used to hacked into Claymore mining rigs to mine ethereum.

While Bitcoin and other similar cryptocurrencies are relatively new technologies, it's ripe for different kinds of disruptions and threats, and has already proven to be a profitable target. With that said, there is a need for cryptocurrency security such as using a split wallet to protect bitcoins from malware. In unregulated exchanges, bitcoin is stored digitally in wallets, but it invites attention from hackers who believe that they can exploit a vulnerability.

Here are some best practices to prevent falling victim to phishing attacks: 

• Be cautious of individuals or organizations asking for personal information. Most companies will not ask for sensitive data from customers.
• Take a close look at the sender’s display name when checking the legitimacy of an email. Companies will use a single domain for their URLs and emails.
• Avoid clicking links or download files even if it seems to come from a trustworthy source.
• Check for mismatched URLs. An embedded URL might seem valid, but hovering above it might show a different web address.
• Be on the lookout for grammatical errors and spelling mistakes.
• Check if the messages contain a generic subject and greeting, as this is a clear sign of a phishing attempt.
• Use the built-in protection of email clients to filter messages. One example is to set the email client to block all images unless approved.
• Legitimate companies will not send out confirmation emails unless there are specific reasons for doing so. Companies will avoid sending unsolicited messages unless it is for company updates, newsletters, or advertising purposes.
• Take note of unusual information in the text of the message. Mentions of operating systems and software that is not used by consumers can be an indicator of a phishing attempt.
• If it seems suspicious, it probably is. Err on the side of caution when sending out personally identifiable information through messages and emails.