The Japan-based cryptocurrency exchange Liquid was reportedly compromised, which led to an amount of over 90 million USD stolen from warm wallets.
The following assets had been transferred to hacker's following addresses (Further investigation to come):
BTC: 1Fx1bhbCwp5LU2gHxfRNiSHi1QSHwZLf7q
ETH/EWT: 0x5578840aae68682a9779623fa9e8714802b59946
TRX: TSpcue3bDfZNTP1CutrRrDxRPeEvWhuXbp
XRP: rfapBqj7rUkGju7oHTwBwhEyXgwkEM4yby— Liquid Global Official (@Liquid_Global) August 19, 2021
Aftermath of the Attack
Liquid confirmed the attack on August 19, 2021 and temporarily suspended all deposits and withdrawals. Also, the exchanged moved the remaining funds into cold storage to prevent any further theft.
According to Liquid’s post-mortem report, the exchange’s security team is still investigating the attack vectors the hacker used. So far, the only known fact is that the attacker somehow managed to gain unauthorized access to the exchange and withdrew at least 69 different assets from Liquid’s warm wallets. Funds that were supplied to Liquid’s earning platform were left untouched.
Liquid published a list of addresses the attacker used to withdraw the funds and stated that they are tracking the whereabouts of the stolen assets. Liquid also calls for other exchanges to block the attacker’s addresses. According to their estimation, over 16 million USD have already been frozen this way.
Are Crypto Assets held on Exchanges secure?
Once again, the question arises if users can safely trust exchanges to keep their money in custody. Many of the old-school crypto investors can still remember the infamous Mt. Gox hack, which bankrupted what once was the leading Bitcoin exchange in 2014.
Since then, several best practices have evolved to ensure that exchanges remain able to pay back the deposited assets, even in the event of a large-scale hack. The most important cornerstone of cybersecurity is that exchanges hold the vast majority of their funds in cold storage. This mean wallets that are not run on any internet-connected device.
Subsequently, hackers who manage to gain unauthorized access to an exchange can only steal a small percentage of the exchange’s total funds. Usually, this should not lead to an insolvency, even if all funds are drained from the warm wallets.
Furthermore, exchanges often take out an insurance, which covers the event of funds being stolen or otherwise lost. In general, crypto exchange insolvencies have become rare events since the establishment of these security practices.
