Hot Wallet Incident Report
kwa LCX Team · January 9, 2022
Final Update
January 28th 2022
We are happy to announce that all deposit and withdrawal services have resumed 100% operations. Also services in collaboration with Monerium have resumed.
We would like to once again thank our clients, customers, partners, and the broader crypto community for your support during this period.
Update January 27th, 2022
All deposit and withdrawal services of crypto-assets have resumed. LCX platform in full operations mode.
Withdrawals of ETH, USDC and all supported ERC20 tokens have resumed. Supported ERC20 tokens are AMP, ATRI, BAT, CEL, ENJ, HOT, INXT, LCX, LINK, MANA, MATIC, MKR, OGN, POLK, QNT, REP, REVV, SAND, UNI and USDC.
We will be resuming deposit and withdrawal services in collaboration with our partner Monerium in the coming days, stay tuned for more updates.
Update January 19th, 2022
Deposits of ETH, USDC and all supported ERC20 tokens have resumed. Supported ERC20 tokens are AMP, ATRI, BAT, CEL, ENJ, HOT, INXT, LCX, LINK, MANA, MATIC, MKR, OGN, POLK, QNT, REP, REVV, SAND, UNI and USDC.
Deposits and Withdrawals of ADA, BCH, BTC, CELO, DAG, DGB, DOGE, DOT, HBAR and LTC is fully operational and has resumed Jan. 12th 2022 already.
We will be resuming withdrawal services for all remaining cryptocurrencies in the coming days, stay tuned for more updates.
Update January 12th, 2022
On the day of the attack, we identified the attack vector used to gain unauthorized access to only one of our hot wallets. Our tech team was able to take actions immediately to secure our platform and additional assets. The early incident analysis shows that our cyber security efforts are well structured and secure. Our main server infrastructure, data storages, wallet management and vaults have not been accessed and have not been compromised. The investigation and the identification of the responsible parties is ongoing. We also have identified additional wallet addresses used by the unauthorized party. However, we have been advised to not publicly disclose the ongoing tracking activities at this point in time.
In the past days we have completed setting up a new infrastructure with heightened security. The process of migrating our assets to the new secure vaults has been concluded.
We have begun the gradual rollout of service resumption across our platform. Our main priority was to make certain we resumed in a safe and secure manner, and we appreciate your patience in this regard.
Today, we have resumed deposits and withdrawals for the following crypto assets:
ADA, BCH, BTC, CELO, DAG, DGB, DOGE, DOT, HBAR and LTC.
In addition we are opening deposits for the following crypto assets today:AMP, ATRI, BAT, CEL, ENJ, ETH, HOT, INXT, LCX, LINK, MANA, MATIC, MKR, OGN, POLK, QNT, REP, REVV, SAND, UNI and USDC.
EUR deposit and withdrawal are still on hold. We expect to restore all services within the next few days.
We would like to once again thank our community for your continued support. And we truly appreciate the positive feedback and help from our clients, customers, partners, and the broader crypto community as we continue to work through this challenging time. We also continue to be in contact with authorities.
Update January 10th, 2022
In response to this incident, LCX has completed initial security checks. We want to assure our users that they will not suffer any loss due to the incident that took place on the 8th of January.
LCX will use our own funds to cover the incident and compensate affected users. There will be no impact on user balances at LCX.
We continue to work diligently to gradually restore crypto deposit and withdrawal services. We started preparations to resume full operations with several new layers of security structures.
In addition we want to confirm to our customers that personal data was not compromised in any manner during the incident.
And lastly, we also continue to work with authorities and external cyber security firms. Additional updates will be published here.
Update January 9th, 2022
At roughly 11:23 PM CET on January 9th, LCX’s Technology team detected unauthorized access of one crypto wallet at the LCX platform. A total of approx. 7.94M USD of crypto assets were stolen. 0.70M USD have been frozen. All other LCX wallets are not impacted.
During this difficult period we greatly appreciate the support from our customers, other exchanges, security experts, and the broader crypto community. LCX will continue to do everything in its power to mitigate the impact from this incident and restore full service as soon as possible.
Incident Details
The hacker wallet address is 0x165402279f2c081c54b00f0e08812f3fd4560a05.
The theft took place yesterday evening, January 8th 2022 between 11:23 PM and 11:37 PM CET.
During this period, the following cryptocurrencies were stolen:
Cryptocurrency (approx. USD value according to Coingecko):
- 162.68 ETH (502,671 USD)
- 3,437,783.23 USDC (3,437,783 USD)
- 761,236.94 EURe (864,840 USD)
- 101,249.71 SAND Token (485,995 USD)
- 1,847.65 LINK (48,557 USD)
- 17,251,192.30 LCX Token (2,466,558 USD)
- 669.00 QNT (115,609 USD)
- 4,819.74 ENJ (10,890 USD)
- 4.76 MKR (9,885 USD)
A total of approx. 7.94M USD of crypto assets were moved out of one LCX Ethereum wallet by an unauthorized party. Approx. 611,000 EURe have been frozen (disabled for onchain movement) due to the assistance of our partner Monerium. Other LCX wallets such as Bitcoin, HBAR, ADA, DGB, TIA or DGMV are not impacted.
To further reduce any damages we have taken immediate measures:
- Pausing deposit and withdrawal functionality LCX platform.
- Start of internal analysis and evaluation.
- First public report @LCX Twitter.
- Second public report @LCX Twitter.
- Informed Monerium, Liquid Global and other partners, action has been taken.
- Informed our compliance partner Elliptic.
- Informed Etherscan. Hacker Wallet has been marked.
- Detailed report sent to several Liechtenstein authorities.
To ensure safety of funds, please do not deposit any crypto assets to your LCX wallets until further notice. LCX has halted all crypto withdrawals while we assess the impact. Other services on LCX remain available.
The analysis of the impact is ongoing and is subject to change.