On Thursday, Liquid, a Japanese cryptocurrency exchange announced to be a victim of a hack. The hackers stole $97 million worth of digital coins. According to the company, some of Liquid’s digital currency wallets were “compromised,” and hackers were transferring assets to four different wallets. Liquid tweeted the following regarding the incident:
While the entire amount stolen has yet to be determined, Eddie Wang, senior researcher at OKLink, told CoinDesk that the value seized in bitcoin, ether, ripple, tron, and other cryptocurrencies might be worth upwards of $90 million.
This attack comes weeks after the Polygon attack worth $600 mn. After Mt. Gox and Coincheck, this is the third-largest cryptocurrency exchange hack in Japan, and the second to successfully target Liquid. In 2020, Liquid was the victim of a DNS hijacking incident. The attackers used social engineering to persuade Godaddy staff to move Liquid’s domain. This is at least the second major hacking of exchange as a result of a DNS hijacking assault.
Details of the incident
Liquid Global claimed the hack targeted a multi-party computation (MPC) wallet in a blog post about the event.
“This time, our Singapore affiliate QUOINE PTE’s MPC wallet (used for warehousing/delivery management of cryptographic assets) was hacked.”
MPC is a sophisticated cryptographic technique in which a group of parties generates a private key that controls cash. None of the parties can see the fragments calculated by the others. The blog article by Liquid Global did not explain how this security setup was thwarted.
According to Liquid, the attacker was able to steal 107 bitcoins, 9,000,000 TRON, 11,000,000 Ripple, and about $60 million in ERC-20 tokens. Analysis by TRM (a blochain analytics Company) revealed that the attacker acted rapidly and swapped stolen USDT-on-TRON to TRON utilizing a decentralized exchange in a couple of minutes. The rapid switches could be the consequence of lessons from the Poly Network hack, in which Tether froze stolen USDT.
Crypto exchange KuCoin’s CEO, Johnny Lyu, tweeted his platform was aware of the incident. Further, KuCoin blacklisted the hacker’s wallet addresses.
Do subscribe to our Telegram channel for more resources and discussions on tech-law. To receive weekly updates, don’t forget to subscribe to our Newsletter.