Livecoin Hack

Reported loss $3.3M
Multiple
API Key Compromised

What happened

Overnight on 23-24 December 2020, attackers took over the Russian exchange Livecoin. The exchange said it had completely lost control of its servers, backend and nodes, as well as its news channels, in what it called a carefully planned attack that it believed had been prepared for months. The attackers set absurd prices on the exchange, including bitcoin at about $450,000 against a market price near $23,000, ether at $15,000 and XRP at $17, and cashed out accounts at those prices. Livecoin told users to stop depositing, trading and using its API.

Reported losses were 106 BTC, 380 ETH, 236 BCH, 567,012 XRP, 66.8 million DOGE, about 56,000 USDT and an undisclosed amount of ERC-20 tokens. Decrypt reported that the stolen Ethereum-based funds were swapped for DAI on Uniswap and other coins were sent to KuCoin. On 16 January 2021 Livecoin said restoring operations was not feasible and announced its closure. Users had until 17 March 2021 to claim balances through an identity check that required passport scans and video verification. Some users suspected an exit scam, partly because a director deleted her Telegram account before the hack was announced; this was never confirmed.

How it happened

  1. Attackers gained control of Livecoin's servers, backend and nodes. How they got in was never disclosed.
  2. From 23 December they changed the exchange's internal prices, for example valuing BTC at about $450,000 and ETH at $15,000.
  3. They traded and withdrew at these inflated rates, taking BTC, ETH, BCH, XRP, DOGE, USDT and ERC-20 tokens.
  4. The Ethereum-based proceeds were swapped for DAI on Uniswap and other coins were sent to KuCoin, according to Decrypt.

Protocol details

Classification Frontend & Infrastructure
Protocol Type CEX

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.