Upbit hacked | Bitcointalksearch.org

squatter

legendary

Activity: 1666

Merit: 1196

STOP SNITCHIN'

Quote from: Baofeng on November 29, 2019, 06:35:16 PM

Ok there's some movement already:

https://twitter.com/chiachih_wu/status/1200336594022141952

So the hackers is breaking it up into smaller amount and it seems moving to HuobiGlobal according to that tweet.

If you look closer, the transactions to Huobi (and also Binance) were just dust transactions. The hacker was probably just testing to see if/when the exchanges froze the accounts.

So far, PeckShield has identified 5 ETH that flowed into a "smaller exchange platform." That's it.

Baofeng

legendary

Activity: 2576

Merit: 1655

Ok there's some movement already:

https://twitter.com/chiachih_wu/status/1200336594022141952

So the hackers is breaking it up into smaller amount and it seems moving to HuobiGlobal according to that tweet.

joinfree

sr. member

Activity: 1274

Merit: 260

1A6nybMUHYKS6E6Z3eJFm4KpVDdev8BAJL

It's yet another sad event that has occured in the crypto industry which is further going to frustrate prices of currencies for a while. I don't know why they had so much money on their hot wallet in the first place. I think other exchanges need to learn something from this series of hack that occurs in this space.
Does anybody knows whether the management team of Upbit has announced if they are going to refund users of their funds?

squatter

legendary

Activity: 1666

Merit: 1196

STOP SNITCHIN'

Quote from: Yaunfitda on November 27, 2019, 07:22:53 AM

If my memory serves me right, this is not the first time that Upbit was hacked. Or it was targeted by the North Koreans in the past, so I'm sure they should have known better. Anyways, there are reports surfacing that there are some sort of Signs Point to Inside Job in Upbit Crypto Exchange Hack, Says Commentator.

https://twitter.com/iamjosephyoung/status/1199625442312908801?s=20

It's possible the attacker had previously compromised the hot wallets and was just waiting to maximize the booty. Upbit making cold storage transfers would have forced him to act.

Young is arguing an employee took advantage of the timing, but I really don't understand how it would have helped.

stompix

legendary

Activity: 2912

Merit: 6403

Blackjack.fun

Quote from: squatter on November 28, 2019, 12:45:47 PM

Quote from: gentlemand on November 28, 2019, 08:16:08 AM

The ETH is off to Huobi according to that. How many instances of stolen crypto being frozen and returned by exchanges have there been? You rarely seem to hear much about it.

I'd assume in many cases that the money is never returned. A lot probably depends on how quickly the attacker moves, since exchanges don't have the right to indefinitely freeze customer assets. That's why Binance says they'll only freeze funds for up to 24 hours -- by which time there must be a filed police report and law enforcement officials working with the exchange. After that, they release the funds.

I always wonder is this situation if this ain't a double-edged sword.

Of course, it's all nice that the funds are frozen and returned to the exchange but I can't shake the feeling we're toying around a Pandora's box that will ultimately lead to abuse, frozen assets and addresses and users tagged just because of a suspicion that funds from a hack might be in their possession. This is a world where everything can happen and is not beyond the realm of possibilities that small exchanges might claim hacks just so they could screw up some customers which they've lost anyhow.

As for binance, it's just the usual theater play where they try to pose as the good guys knowing all too well they are full of hacked and stolen funds and the only reason a lot of people stick with them is the no KYC below 2 BTC limit.

Quote from: PrimeNumber7 on November 28, 2019, 01:34:21 PM

I believe Upbit has said they are going to cover the losses out of their own money. Based on the high ratio of the value of the stolen coin to the estimated daily earnings of the exchange, I am suspicious of their ability to do this.

Upbit might not be able to reimburse, but the ones running it are.
Their parent company is Kakao, and it was evaluated ar 10 billion before the merger, adding on top the new financial project and others, they would probably be close to 15b.
50 million is peanuts considering they are also running a bank, how would not be able to pay back deposits for them?

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: bakasabo on November 28, 2019, 01:24:05 PM

How will these 2 week pause on deposit/withdrawal will affect Upbit exchange? I guess people will run from it as soon as it will be possible.

These 342,000 ETH - are these users funds or this ethereum was just on the balance of the exchange? If first - is exchange planning to repay losses to users?

I believe Upbit has said they are going to cover the losses out of their own money. Based on the high ratio of the value of the stolen coin to the estimated daily earnings of the exchange, I am suspicious of their ability to do this.

I would consider it more likely they will use the two week delay to try to get their customers less interested in withdrawing ether in masse, and operate as an insolvent exchange until they can either earn their way out of the hole, seize coin from certain customers under shady circumstances, or somehow recover the coin.

bakasabo

legendary

Activity: 2492

Merit: 1215

How will these 2 week pause on deposit/withdrawal will affect Upbit exchange? I guess people will run from it as soon as it will be possible.

These 342,000 ETH - are these users funds or this ethereum was just on the balance of the exchange? If first - is exchange planning to repay losses to users?

Lanatsa

hero member

Activity: 2968

Merit: 687

Quote from: gentlemand on November 28, 2019, 08:16:08 AM

https://ihodl.com/topnews/2019-11-28/stolen-ethers-upbit-are-being-transferred-huobi/

The ETH is off to Huobi according to that. How many instances of stolen crypto being frozen and returned by exchanges have there been? You rarely seem to hear much about it.

Wondering on how much of those ETH being transferred on big exchangers would be held up. Grin

Hacker is impatient too much and no matter how he do split up those coins it would really be still hot in the eyes of the community.

squatter

legendary

Activity: 1666

Merit: 1196

STOP SNITCHIN'

Quote from: gentlemand on November 28, 2019, 08:16:08 AM

https://ihodl.com/topnews/2019-11-28/stolen-ethers-upbit-are-being-transferred-huobi/

The ETH is off to Huobi according to that. How many instances of stolen crypto being frozen and returned by exchanges have there been? You rarely seem to hear much about it.

Apparently, those were just small test transactions. The hacker sent some tiny deposits to both Huobi Global and Binance but as of a few hours ago:

Quote

342k #ETH from #UpbitHack are split into multiple addresses. Fortunately, no large xfer into exchanges so far.

I'd assume in many cases that the money is never returned. A lot probably depends on how quickly the attacker moves, since exchanges don't have the right to indefinitely freeze customer assets. That's why Binance says they'll only freeze funds for up to 24 hours -- by which time there must be a filed police report and law enforcement officials working with the exchange. After that, they release the funds.

Smart hackers will immediately be moving the funds through false verified accounts to quickly wash the proceeds. The hack outputs will be publicly tagged, but any outputs laundered through other exchanges won't be. I think this is pretty tough to stop in real time, but the longer the hacker waits around and lets the money sit, the more worthless it becomes.

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: gentlemand on November 28, 2019, 08:16:08 AM

https://ihodl.com/topnews/2019-11-28/stolen-ethers-upbit-are-being-transferred-huobi/

The ETH is off to Huobi according to that. How many instances of stolen crypto being frozen and returned by exchanges have there been? You rarely seem to hear much about it.

It is unusual for large amounts of stolen coin to get transferred to exchanges because hackers know the risk of the deposit being confiscated.

It is typical for hackers to send small amounts to various exchanges to see if they can successfully process a withdrawal, or to send stolen coin to various mixers in small batches if any exist. I believe the majority of coin stolen from large businesses in large heists ends up idol.

gentlemand

legendary

Activity: 2590

Merit: 3015

Welt Am Draht

https://ihodl.com/topnews/2019-11-28/stolen-ethers-upbit-are-being-transferred-huobi/

The ETH is off to Huobi according to that. How many instances of stolen crypto being frozen and returned by exchanges have there been? You rarely seem to hear much about it.

stompix

legendary

Activity: 2912

Merit: 6403

Blackjack.fun

Quote from: The Sceptical Chymist on November 27, 2019, 02:05:58 PM

Quote from: stompix on November 27, 2019, 12:45:39 PM

Oh, so this caused the dip in the morning?

Don't know if you're referring to ETH or bitcoin, but bitcoin jumped since last I checked it and is sitting above $7500 right now. I wouldn't expect any particular coin to be reacting to this hack and bitcoin in particular has proven to be resilient in the face of exchanges going kablooey.

In the morning (GMT+1 time) it dropped to 6878 and then a few hours later it jumped back above 7200 and to 7500

Of course, it was a small one but it was also a small "hack" Grin

Bttzed03

legendary

Activity: 2114

Merit: 1150

https://bitcoincleanup.com/

Quote from: PrimeNumber7 on November 27, 2019, 01:47:45 PM

Quote from: Bttzed03 on November 27, 2019, 06:15:34 AM

This is what happens when exchanges feel so confident with their internal security and keeping a lot of held assets in their hot wallet.

I think they most probably are displaying fake volumes. I don’t know how much they have in cold storage but if the volume displayed is correct, they were holding about two days worth of trading volume in their hot wallet. At 0.002% commission, this works out to over three years of what they would earn in trading fees on ETH based pairs.

If it was late 2017, it might make sense to have that much in their hot wallet, but not today with volume having declined as much as it did.

Assuming what you said is true and that they are trying to make their exchange look bigger than what it actually is, we will know sooner or later if they can really refund the losses without going into bankruptcy and liquidation. The fact still remains that those 342K eth were move out from their hot wallet though.

Quote from: milewilda on November 27, 2019, 11:13:18 AM

When i do hear out that SAFU thing, i do directly think off about Binance.lol.

Can't blame you Grin

Quote

Does anyone have any thoughts about for this to be an inside job?

It could be. There is always that possibility.

1Referee

legendary

Activity: 2170

Merit: 1427

Quote from: Palider on November 27, 2019, 09:44:09 AM

So it is always the reminder of experts that we should not give full trust to centralize exchanges especially since it is prone to hacking incidents.

How many exchanges have been 'hacked' thus far? Too many to remember every individual exchange, that's for sure. It taught people absolutely nothing.

Some don't want to take care of their own storage whatever the reason might be, and others purposely keep their coins on an exchange because they want to sell as fast as possible whenever they panic. This is far worse than "trusting" banks with your fiat. Right now people are "trusting" shady and incompetent exchange operators with their precious Bitcoins.

On top of that, it's yet another Asian exchange. It can't be considered coincidence anymore. Asian exchanges are structurally flawed, and so are their operators.

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: The Sceptical Chymist on November 27, 2019, 02:05:58 PM

Quote from: PrimeNumber7 on November 27, 2019, 01:47:45 PM

I think they most probably are displaying fake volumes.

I don't know if that's true or false, but it wouldn't surprise me. I've heard lots of stories about exchanges, especially smaller ones, inflating their trading volume to make it look like they're way more successful than they actually are--or at least I'm assuming that's the reason for it.

Anyway, this shit never ends. Either the security of these exchanges is really piss-poor or they're stealing their customers' funds and claiming they got hacked. I'll be very interested to see how this all plays out.

Upbit has a history of allegedly inflating its trading volumes, and even had some of its executives indicted for doing so.

One problem with saying that 'smaller exchanges' often inflate their volume is the exchanges who inflate their volume are trying to make their exchange appear to be larger than it really is, by a factor of sometimes thousands.

Quote from: coupable on November 27, 2019, 05:02:38 PM

Quote from: PrimeNumber7 on November 27, 2019, 01:47:45 PM

I think they most probably are displaying fake volumes.

Infortunetly, there is no way to prove this with 99% shitcoins in the Market.

You can look at what happens to the volume when there are large moves in the market, and you can check for patterns such as indications that a large part of an exchange's customer base is sleeping (and not trading).

This is not the first time Upbit has been hacked, under suspicious circumstances.

coupable

hero member

Activity: 2338

Merit: 757

Quote from: PrimeNumber7 on November 27, 2019, 01:47:45 PM

I think they most probably are displaying fake volumes.

Infortunetly, there is no way to prove this with 99% shitcoins in the Market. This lead to ask how centralised (regulated) exchanges are managed? What i mean in simple words is that a regulated company shouldn't face such a funny cases. I can't understand why/how they can't explain the fact. Something or someone who have access to the hot wallet keys should be the first suspect , when upbit is asking community to block the suspected address and help to find the stealer !

Quote from: Palider on November 27, 2019, 09:44:09 AM

So it is always the reminder of experts that we should not give full trust to centralize exchanges especially since it is prone to hacking incidents.

Don't give full trust to anything, especially The Exchanges. Even those we called Decentralised .

The Sceptical Chymist

legendary

Activity: 3500

Merit: 6981

Top Crypto Casino

Quote from: stompix on November 27, 2019, 12:45:39 PM

Oh, so this caused the dip in the morning?

Don't know if you're referring to ETH or bitcoin, but bitcoin jumped since last I checked it and is sitting above $7500 right now. I wouldn't expect any particular coin to be reacting to this hack and bitcoin in particular has proven to be resilient in the face of exchanges going kablooey.

Quote from: PrimeNumber7 on November 27, 2019, 01:47:45 PM

I think they most probably are displaying fake volumes.

I don't know if that's true or false, but it wouldn't surprise me. I've heard lots of stories about exchanges, especially smaller ones, inflating their trading volume to make it look like they're way more successful than they actually are--or at least I'm assuming that's the reason for it.

Anyway, this shit never ends. Either the security of these exchanges is really piss-poor or they're stealing their customers' funds and claiming they got hacked. I'll be very interested to see how this all plays out.

PrimeNumber7

copper member

Activity: 1652

Merit: 1901

Amazon Prime Member #7

Quote from: Bttzed03 on November 27, 2019, 06:15:34 AM

This is what happens when exchanges feel so confident with their internal security and keeping a lot of held assets in their hot wallet.

I think they most probably are displaying fake volumes. I don’t know how much they have in cold storage but if the volume displayed is correct, they were holding about two days worth of trading volume in their hot wallet. At 0.002% commission, this works out to over three years of what they would earn in trading fees on ETH based pairs.

If it was late 2017, it might make sense to have that much in their hot wallet, but not today with volume having declined as much as it did.

stompix

legendary

Activity: 2912

Merit: 6403

Blackjack.fun

Oh, so this caused the dip in the morning?

Quote from: gentlemand on November 27, 2019, 06:46:16 AM

ANOTHER Korean hack? Do they all have DPRK agents embedded in them who siphon stuff off whenever the wallets are looking particularly healthy? My guess is that every exchange operator over there is permanently drunk.

Hahaha:

Quote from: milewilda on November 27, 2019, 11:13:18 AM

When i do hear out that SAFU thing, i do directly think off about Binance.lol.

I'm always thinking of this:
https://www.youtube.com/watch?v=DelF6zEHXpE

milewilda

legendary

Activity: 3094

Merit: 1127

Quote from: Bttzed03 on November 27, 2019, 06:15:34 AM

This is what happens when exchanges feel so confident with their internal security and keeping a lot of held assets in their hot wallet.

Funds are not safu on all centralized exchanges. I don't know how many times we should be reminded of this.

It's good that Upbit has enough assets to cover the hacked amount. If it was others, they would have shutdown like what happened to Cryptopia.

When i do hear out that SAFU thing, i do directly think off about Binance.lol.

Its odd that they do held off that big amount on a hotwallet yet we know that majority of top tier exchangers would really keep big allocation of entire balance on an offline.
Good thing that they would cover the hacked amount. Does anyone have any thoughts about for this to be an inside job?

Topic: Upbit hacked (Read 301 times)