Hacker steals more than $7 million in digital currency by switching a mere link

By Kevin Parrish July 20, 2017

A render of virtual currency.

Security firm Tripwire reports that a hacker managed to steal more than $7 million in digital currency by simply replacing a single link. The hack took place on Monday during an event called an Initial Coin Offering (ICO) to reel in investors of a cryptocurrency app called CoinDash. However, early investors quickly discovered that a link for depositing digital currency on the CoinDash website was not legitimate.

According to Tripwire, trading platform CoinDash began its ICO at 1 p.m. (GMT). Three minutes later, investors figured out that the link for sending Ether, a type of digital currency, was taking them to the wrong deposit location. Within those three minutes, the hacker managed to accumulate more than $7 million before CoinDash terminated the ICO and removed the page.

Related Videos

“The moment the token sale went public, the CoinDash website was hacked and a malicious address replaced the CoinDash Token Sale address,” CoinDash said. “As a result, more than 2,000 investors sent ETH to the malicious address. The stolen ETH amounted to a total of 37,000 ETH.”

Ether is the digital currency of the world’s second most popular cryptocurrency network, Ethereum. This platform consists of smart contracts, which are essentially bits of code that will execute when certain requirements are fulfilled. These “apps” are listed on the Ethereum network using what is called a blockchain, which serves as a registry that records all transactions. Ether, abbreviated as ETH, is what’s used to pay for things and services listed on the Ethereum network.

So why not just use real world cash? Because digital currency is decentralized. It’s not managed by banks or the government. Plus, both the merchant and buyer can remain completely anonymous, with a transaction digitally signed and verified by an unknown miner on the associated network. Ether is similar to Bitcoin in purpose although technically they are completely different digital currencies.

Individuals who successfully participated in a private “heads up” for whitelist contributors 15 minutes prior to the public ICO received “tokens” as proof of their CoinDash app investment. However, those who invested Ether using the hacked address are reportedly now demanding a refund. After all, the CoinDash website was not locked down tight, enabling a hacker to insert a simple link that collected millions in stolen digital currency.

However, many Ether users reportedly flocked to social networks and questioned the theft. Was this a genuine hack, or a simple scam using a hack as a cover story? As Tripwire states, there is no evidence to suggest foul play.

CoinDash is currently providing an online form for victims to complete as part of the company’s forensic investigation into the hack. Victims are asked to provide their email address, wallet address, a proven transaction number, and the amount of Ether sent.

“This was a damaging event to both our contributors and our company but it is surely not the end of our project,” CoinDash added. “We are looking into the security breach and will update you all as soon as possible about the findings. We are still under attack. Please do not send any ETH to any address, as the Token Sale has been terminated.”

Despite the hack, CoinDash said that it managed to secure $6.4 million from early contributors and whitelist participants in the 15-minute “heads up” prior to the ICO. Those who sent digital currency to the wrong Ether address during the hack will still receive tokens. Otherwise, investors who sent Ether to the wrong address after CoinDash removed the ICO page will not receive investment tokens.

Update: Added new information provided by CoinDash.

Editors' Recommendations

Topics

Computing

The most common Microsoft Teams problems, and how to fix them

A close-up of someone using Microsoft Teams on a laptop for a videoconference.

Microsoft Teams was introduced in 2017 as a unified communication and collaboration platform, helping businesses and organizations get things done. Microsoft leveraged the company's existing Office software experience and created a unified experience between Teams, Office 365, and Skype for Business. However, as with all software, things don't always go according to plan. If you're having Microsoft Teams issues, here's how to fix some of the most common problems.

Do you use Zoom too? If you ever run into any Zoom problems, there are ways to fix them too.

Computing

This creepy Mac app can record every moment of your online life

The Rewind app on an iMac with a pink background, showing a grid of faces from a Zoom call

A new app for your Mac claims it can record every moment of your online life and store it for retrieval. We're talking about every moment, from your emails to your chats to your FaceTime and Zoom calls.

Rewind is a work in progress from Brett Bejcek and Dan Siroker, two American entrepreneurs who between them have worked with Spotify and Optimizely. They claim Rewind is like a search engine for your life.

Computing

How your boss can spy on you with Slack, Zoom, and Teams

Good Morning GIF in Slack on a laptop.

Slack and Teams are both super useful: They enable quick communication around the office, allow for remote work and work-from-home situations, and let employees easily share a variety of content. The downside to that is that bosses can also use them to keep an eye on what you're doing and how active you are during your workday.

How bad can this boss monitoring get? Let’s take a look at what bosses can view on these apps and what you can keep private.
Slack