- Coinspaid has remained silent amid reports of a second hack in six months, where nearly $7.5 million was stolen
- The recent breach echoes a July attack where hackers, attributed to the North Korean Lazarus Group, stole $37 million
- Supporters and users are eagerly awaiting news from the project
Estonian crypto payment gateway Coinspaid is yet to respond to claims that it has been hacked for the second time in six months. Nearly $7.5 million was siphoned off the exchange over the weekend, with web3 security firm Cyvers reporting the breach. An earlier attack in July saw hackers use unauthorized transactions to enable the withdrawal of a staggering $37 million in various cryptocurrencies, a hack that was traced to North Korean group Lazarus, which allegedly used sophisticated social engineering techniques to manipulate employees.
Has Second Hack Killed Coinspaid?
Cyvers revealed that the attacker made off with millions in USDT, ETH, USDC, and 97 million CPD tokens, Coinspaid’s native token, valued at around $368,000, which they then swapped for ETH. The funds were then moved to externally owned accounts and crypto exchanges MEXC, Whitebit, and ChangenOW. Upon further analysis, Cyvers identified additional unauthorized transactions involving BNB, exceeding $1 million, pushing the total stolen amount close to $7.5 million.
As a result of the hack, CPD dropped 40% to $0.0006.
🚨ALERT🚨Our AI powered system has detected multiple unauthorized transactions with @Coinspaid
Hacker was able to gain more than $6.1M worth of digital assets involving 4.8M $USDT, 500 $ETH 97M $CPD and 106K $USDC.
All $CPD has been swapped for $ETH and rest of the digital… pic.twitter.com/pIDS1pkh5m
— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) January 6, 2024
Coinspaid is yet to issue a statement regarding the recent attack, with only one X post having been made in 2024 regarding an IMF survey last Friday, the day before the exploit was detected.
Lazarus Behind First Attack
This latest incident follows an earlier security breach in July 2023, where over $37 million was stolen by North Korean state-backed Lazarus Group. In its report of that hack, Coinspad explained how the hackers employed sophisticated social engineering techniques to target employees rather than the company itself.
The hackers allegedly used a fake job interview, convincing an employee to download malicious code, providing unauthorized access to Coinspaid’s infrastructure. This is a trick that is becoming more and more common, with LinkedIn starting to be used for this purpose.
Coinspaid users and supporters will be eagerly awaiting news as to the future of the project, but with no word coming more than 48 hours after the hack, it doesn’t look good.
