|
|
Hacker Allegedly Steals $7.4 Million in Ethereum with Incredibly Simple Trick
Someone tricked would be investors during an ethereum ICO into sending their cryptocurrency to the wrong address.
A hacker has allegedly just stolen around $7.4 million dollars worth of ether, the cryptocurrency that underpins the app platform ethereum, by tricking victims into sending money to the wrong address during an Initial Coin Offering, or ICO. This is according to a company called Coindash that says its investors were sending their funds to a hacker.
On Monday, Coindash, which offers a trading platform for ether, was slated to launch its Initial Coin Offering. These are essentially crowdfunding drives that allow investors to own a stake in the app by buying digital assets called tokens. Initial Coin Offerings are an incredibly popular method of funding an app on ethereum, and some ICOs have raked in millions of dollars within minutes of going live. Even the silliest apps have been able to raise thousands of dollars in token investments during recent ICOs.
Coindash's ICO, like many others, launched simply by posting a string of text representing an ethereum address for investors to send money to on the app's website. However, mere minutes into what was supposed to be another successful ICO, Coindash warned that its website had been hacked and asked people not to send ethereum to the posted address.
ADVERTISEMENT
It's still unclear exactly what happened, but it seems like the hack was incredibly simple: The hacker allegedly took control of the Coindash official website and changed the text on the site, publishing their own ether wallet address instead of Coindash's. When people went to "invest" in Coindash, they actually sent their ether to the hacker, not the company.
Even though Coindash noticed the hack and warned investors quickly—just three minutes after the ICO launch—the damage was done.
A screenshot of the official Coindash channel on the chat app Slack.
"WEBSITE HACKED," Emmanuel Gimenez, an employee of Coindash, wrote in the company's official Slack account, which Motherboard obtained access to.
"GUYS WEBSITE IS HACKED! Don't send your ETH!!!," the Coindash account on the popular Bitcointalk forum wrote at roughly 9:06 AM EDT, six minutes after the ICO launch.
"The Token Sale is done, do not send any ETH to any address," Coindash announced on Twitter on Monday morning.
At the time of writing, would-be investors have sent 43,438.45 ether (around $7.4 million USD at the current exchange rate) to the Coindash address that the company says belongs to a hacker. Etherscan, a web tool for tracking ethereum transactions, is warning that "there are reports that the Coindash Crowdsale address has been compromised."
"All we know now is that an outside attacker changed the address right after the sale started," Ram Avissar, the marketing director of Coindash, told Motherboard via Slack. "We have halted the Token Sale contract and trying to understand the best way to compensate those who were affected."
In response, some users on social media are crying foul. On Reddit, for example, users are speculating that the hack was really an "inside job" that allowed Coindash's creators to run off with millions of dollars while blaming an anonymous hacker who will likely never be found. There's no proof of any foul play on Coindash's part, however, and Occam's Razor may favour Coindash's own explanation: A hacker simply took advantage of the weakest security link in the ICO. That is, the Coindash website itself. |
|