Vircurex Hack

On the 10th of May, a security breach led to an unauthorized withdrawal from our hot and warm wallet, the following are the withdrawn amounts and the respective destination addresses and transaction IDs:

1. 17gPdCyzEMRXdNTBpHrUhsM4FaiWMHhx2Q

cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf

2. 1PWQJu9AskoXEBYMod1KqPE6TTG4VYNz1P

85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9

3. 1Mu1wbyfkcrRarPveiihy5iuceLGC91Z4T

33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64

4. 1MeY3VVudFUV91gxVZsaY92TguRWy7eQbE

90239779a08243883f54bdb2503f4f40be2541487c2ef2383ef4d8277660e88b

5. LV8VnCDYJzd3FYNwn6n3Kyi1i7PB2MvXPo

30231aee25900b9cb1fba16f1a8923a0cd866d60b01e542be1a4b26f92d9d10f

The total losses of the security breach are:

1454 BTC

225,263 TRC

23,400 LTC

The attacker has acquired login credentials to the Vircurex VPS control account with their hosting service provider and has then asked for the root password reset of all servers which – unfortunately – the service provider has then done and posted the credentials in their helpdesk ticket, rather than the standard process of sending it to Vircurex email address (which had 2FA protection), also the security setup of allowing only Vircurex IP range to login to the management console was not working. It was an additional security feature the provider offered but was obviously circumvented by the attacker.