Hacker steals more than $7 million in digital currency by switching a mere link

By Kevin Parrish July 20, 2017

Image used with permission by copyright holder

A render of virtual currency. — Image used with permission by copyright holder

Security firm Tripwire reports that a hacker managed to steal more than $7 million in digital currency by simply replacing a single link. The hack took place on Monday during an event called an Initial Coin Offering (ICO) to reel in investors of a cryptocurrency app called CoinDash. However, early investors quickly discovered that a link for depositing digital currency on the CoinDash website was not legitimate.

According to Tripwire, trading platform CoinDash began its ICO at 1 p.m. (GMT). Three minutes later, investors figured out that the link for sending Ether, a type of digital currency, was taking them to the wrong deposit location. Within those three minutes, the hacker managed to accumulate more than $7 million before CoinDash terminated the ICO and removed the page.

Recommended Videos

“The moment the token sale went public, the CoinDash website was hacked and a malicious address replaced the CoinDash Token Sale address,” CoinDash said. “As a result, more than 2,000 investors sent ETH to the malicious address. The stolen ETH amounted to a total of 37,000 ETH.”

Ether is the digital currency of the world’s second most popular cryptocurrency network, Ethereum. This platform consists of smart contracts, which are essentially bits of code that will execute when certain requirements are fulfilled. These “apps” are listed on the Ethereum network using what is called a blockchain, which serves as a registry that records all transactions. Ether, abbreviated as ETH, is what’s used to pay for things and services listed on the Ethereum network.

So why not just use real world cash? Because digital currency is decentralized. It’s not managed by banks or the government. Plus, both the merchant and buyer can remain completely anonymous, with a transaction digitally signed and verified by an unknown miner on the associated network. Ether is similar to Bitcoin in purpose although technically they are completely different digital currencies.

Individuals who successfully participated in a private “heads up” for whitelist contributors 15 minutes prior to the public ICO received “tokens” as proof of their CoinDash app investment. However, those who invested Ether using the hacked address are reportedly now demanding a refund. After all, the CoinDash website was not locked down tight, enabling a hacker to insert a simple link that collected millions in stolen digital currency.

However, many Ether users reportedly flocked to social networks and questioned the theft. Was this a genuine hack, or a simple scam using a hack as a cover story? As Tripwire states, there is no evidence to suggest foul play.

CoinDash is currently providing an online form for victims to complete as part of the company’s forensic investigation into the hack. Victims are asked to provide their email address, wallet address, a proven transaction number, and the amount of Ether sent.

“This was a damaging event to both our contributors and our company but it is surely not the end of our project,” CoinDash added. “We are looking into the security breach and will update you all as soon as possible about the findings. We are still under attack. Please do not send any ETH to any address, as the Token Sale has been terminated.”

Despite the hack, CoinDash said that it managed to secure $6.4 million from early contributors and whitelist participants in the 15-minute “heads up” prior to the ICO. Those who sent digital currency to the wrong Ether address during the hack will still receive tokens. Otherwise, investors who sent Ether to the wrong address after CoinDash removed the ICO page will not receive investment tokens.

Update: Added new information provided by CoinDash.

Topics

Former Digital Trends Contributor

Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…

Computing

Best Buy laptop deals: Cheap laptops starting at $139

With Best Buy almost always among the best places to buy a laptop online, it’s worth checking out what sort of laptop deals the retail giant currently has taking place. It regularly discounts laptop models by top laptop brands like Dell, HP, Lenovo, and even Apple. We’ve tracked down all of the Best Buy laptop deals worth shopping right now, and you can read more about them below. They include some massive savings on an Acer Chromebook, as well as some discounts on new MacBook Airs. If you’re uncertain what sort of laptop best suit your needs, you can also consult our laptop buying guide.
Acer Chromebook 315 — $139, was $199

The Acer Chromebook 315 is one of the larger Chromebooks you’ll find, as its display comes in at an impressive 15.6 inches. This makes it a great option for people who want some extra screen real estate, but who still like to do their work on the go. The Acer Chromebook 315 has plenty of power for a Chromebook, and is made as much for comfort as functionality. Its slightly larger size will come in handy when doing creative work and an integrated numeric keyboard gives it the feel of working on a desktop. The Acer Chromebook 315 is able to reach up to 10 hours of battery life on a single charge, meaning you can work on the go all day without needing to take a charger with you.

Computing

The latest Windows update is breaking VPN connections

Microsoft has acknowledged that the Windows security updates for April 2024 (KB5036893 for Windows 11, KB5036892 for Windows 10) are causing disruptions to virtual private network (VPN) connections across various client and server platforms. According to information on the Windows health dashboard, devices running Windows may experience VPN connection failures following the installation of either the April 2024 security update or the April 2024 non-security preview update.

The company has also stated that it is actively investigating user reports regarding these issues and will share more details in the coming days. The impacted Windows versions include Windows 11, Windows 10, and Windows Server 2008 onward.

Computing

Delidding your CPU: What it is and why you should do it

Delidding a CPU is the process of removing its integrated heat spreader, or IHS. This is quite a drastic procedure and runs the risk of damaging or even breaking your processor. But -- and it's a big but -- the temperature improvements, especially for CPUs that typically run hot, can be massive. The result is a processor that runs cooler, quieter, and often faster, too.

It's not something you should go into without due care, but it's not as dangerous as it once was. With dedicated tools to make the process easier and safer, delidding your CPU is no longer only reserved for the most die-hard of overclockers.
What is delidding your CPU?
You might think of the large, silver metal surface of your CPU as the processor itself, but that's not exactly true. In fact, the real brains of the chip lie under that hunk of nickel-plated copper or aluminium. That miniature die is what you actually need to run a PC -- the integrated heat spreader on top of it is purely there to make sure it stays cool during operation. It's also there to ensure compatibility with a range of coolers, and to make it less likely that you'll accidentally break your chip by overtightening the cooler's mounting mechanism.