Crypto betting site Stake suffered a significant security breach on September 4, leading to “suspicious outflows” of $41 million, according to blockchain security experts. The funds were funneled to a previously inactive account, involving substantial amounts of cryptocurrencies like Tether and Ether.
Blockchain analysts noticed that unusually large withdrawals were initiated from Stake contracts to an account which had no previous activity. This account, later flagged as “Stake.com Hacker” by Etherscan, suggests that the cyber attack might have occurred due to a compromised private key.
Three hours ago, unauthorised tx’s were made from Stake’s ETH/BSC hot wallets.
We are investigating and will get the wallets up as soon as they’re completely re-secured.
User funds are safe.
BTC, LTC, XRP, EOS, TRX + all other wallets remain fully operational.
— Stake.com (@Stake) September 4, 2023
The initial transaction was recorded on the Ethereum blockchain at 12:48 PM, seeing a transfer of roughly $3.9 million in Tether (USDT) from Stake to the alleged hacker’s wallet. In successive transactions, the hacker drained 6,001 Ether (ETH), amounting to nearly $9.8 million given the currency’s valuation at the time of the attack. The rapid succession of transactions also involved the extraction of other cryptocurrencies, such as $1 million in USD Coin (USDC), $900,000 in Dai (DAI), and 333 Stake Classic tokens, summing up to a total drain value estimated at $16 million by Cyvers.
Post the exfiltration of the funds, the hacker dispersed the stolen assets across several accounts. Stake acknowledged the breach publicly, assuring users of the safety of their assets and stating that the ongoing investigation aims to swiftly secure the affected wallets. Ed Craven, Stake’s co-founder, emphasized that only a minimal portion of the site’s crypto assets, stored in hot wallets, were affected, mitigating potential repercussions on users.
🚨@Stake has experienced multiple suspicious outflows on #Ethereum, #BSC and #Polygon.
ETH: ~$15.7M
Polygon: ~$7.8M
BSC: ~$17.8M
The total funds were ~$41.35M.Stay alert! pic.twitter.com/cKBK3kMeUz
— Beosin Alert (@BeosinAlert) September 4, 2023
In a subsequent update, Beosin, a smart contract auditing firm, highlighted that the breach extended beyond the Ethereum chain, impacting BNB Smart Chain (BSC) and Polygon networks as well. The additional losses tallied up to $7.8 million on Polygon and $17.8 million on BSC, bringing the cumulative loss to a staggering $41 million.
Source: Cointelegraph.com
