CoinStats Hack

On June 22, 2024, CoinStats detected an active attack on its infrastructure. The attacker extracted private keys for 1,590 CoinStats Wallets, about 1.3% of all such wallets, and stole about $2.2 million. CEO Narek Gevorgyan said the AWS infrastructure was likely breached through an employee who had been socially engineered into downloading malicious software onto a work computer. CoinStats' July 12 incident report says the attackers reached parts of its infrastructure and third-party providers, including a HashiCorp Vault that stored 2FA keys and wallet APIs. Some affected users had received messages in the app pointing to a malicious website, though not every victim got one. SecurityWeek reported that $800,000 of the loss came from two wallets that had imported their seed phrases into CoinStats Wallet. Connected wallets (such as MetaMask or Phantom) and exchange accounts were not affected, because CoinStats had only read-only access to them. CoinStats shut the platform down, rebuilt its production environment from scratch, notified the FBI and fully restored service on July 3. It attributed the attack to the Lazarus Group or a related organization.

Example theft transaction: 0x8d0360632bc385171e20c12aa3152933bb041402bb3e06ab29136985a4745e57