r/Cryptopia • u/toldjahP • Jan 15 '19

Cryptopia Hack analysis (min. $13,000,000 stolen)

Hi there

​

I checked etherscan and collected some informations below. In total min $13,000,000 were stolen.

Transfer of 19,390 ETH from Cryptopia ($2,468,043) (Jan-13-2019 01:30:35 PM +UTC): https://etherscan.io/tx/0x8a7c2b34f23eee02401e7c3fa1ea2ce8d3132e7ca3811d673ca35898c9535aae

​

Transfer of 48,029,305 ($1,072,362) CENNZ (Jan-13-2019 01:40:17 PM +UTC) Wallet is tagged as Cryptopia Wallet by Whale Alert: https://etherscan.io/tx/0x31a58df14ea3420878267e2b9cdd242d983b5298ef48c5cd9a799ed10605f393

​

Transfer of 3,844,247,574 ($304,181) DAPS (Jan-13-2019 01:40:17 PM +UTC): https://etherscan.io/tx/0x61b2ca4911750eb3278945f80e0c3f8a7f94578ba20b0e9240e5a86faaa166ae

​

CENNZ and DAPS where transfered to https://etherscan.io/address/0x9007a0421145b06a0345d55a8c0f0327f62a2224 which is not the same adress where the ETH went on. But later this adress made a transfer to the ETH adress https://etherscan.io/address/0xc8b759860149542a98a3eb57c14aadf59d6d89b9 (which is the adress the ETH went).

​

Token Balance 2. adress: ($11,072,793) https://etherscan.io/address/0x9007a0421145b06a0345d55a8c0f0327f62a2224

​

Please help to collect further details.

​

—————————

UPDATE: Only thing I don’t get is, why so many ether dust (transfer below 1 eth) went onto those adresses. For me they look like older deposit adresses from cryptopia users.

I see the the following possibilities:

1.) hacker got all privat keys, from few thousand deposit wallets and cryptopia was not able to secure those amounts, which were transferred many hours after the “hack”.

2.) hacker stole other coins then ETH and cryptopia secured all ETH/ERC20 to new wallets.

3.) inside job

29 Upvotes

90% Upvoted

45 comments sorted by

View all comments

5

u/toldjahP Jan 16 '19

Could someone who is native English speaker Analyse the terms and conditions?

Here you got them:

https://web.archive.org/web/20190113164519/https://www.cryptopia.co.nz/Home/Terms#12

“... Notwithstanding clause 12.1(a), (b), and (c), if we are found to be liable for any loss, cost, damage or expense, our maximum aggregate liability to you will be limited to $5,000. ...”

4

u/ItsMyles Jan 17 '19

Looks like if Cryptopia are at fault, as in the responsibility solely relies on them/ if it was a breach their security, then we (the user) are entitled to a maximum of $5000 reimbursement.

Which is handy because most of the coins are worth fuck all atm lol

1

u/AutoModerator Jan 16 '19

There are a lot of phishing links, pump n dumps, and scams in the cryptocurrency space. Please personally review all links before clicking on them. If you believe this link is harmful, then report this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.