Crypto.com Hack

What happened

Crypto.com reported unauthorized withdrawals in January 2022 affecting 483 user accounts. Its later incident account put the value of the affected cryptocurrency and cash at about $34 million, including BTC and ETH. The exchange said it reimbursed affected customers.

Technical root cause

The withdrawal authorization process permitted transfers without the expected two-factor-authentication approval. The precise bypass mechanism was not publicly established.

How it happened

1. Crypto.com detected unauthorized withdrawals on January 17, 2022.
2. It suspended withdrawals and investigated activity affecting 483 accounts.
3. The exchange reset two-factor authentication and required users to enroll again.
4. Crypto.com said affected customers were fully reimbursed.

Protocol details

Classification Infrastructure / CeFi / Frontend & Infrastructure

Protocol Type CEX

Protocol links Website @cryptocom

Funds Recovery

100.0%

Recovered

$34.4M

Net Loss

$0

Evidence

• report Post-mortem rekt.news
• report @cryptocom incident report twitter.com
• report Crypto.com security report and next steps crypto.com
• report Crypto.com security report: operator statement excerpt cryptocraft.com
• analysis DeFiLlama defillama.com
• analysis Bloomberg Law: Crypto.com says breached accounts held $34 million news.bloomberglaw.com

Understand the attack patterns

Compare incidents →

Access Control Attacks