Hacker steals more than $7 million in digital currency by switching a mere link

By Kevin Parrish Updated October 28, 2020

A render of virtual currency. — Image used with permission by copyright holder

Security firm Tripwire reports that a hacker managed to steal more than $7 million in digital currency by simply replacing a single link. The hack took place on Monday during an event called an Initial Coin Offering (ICO) to reel in investors of a cryptocurrency app called CoinDash. However, early investors quickly discovered that a link for depositing digital currency on the CoinDash website was not legitimate.

According to Tripwire, trading platform CoinDash began its ICO at 1 p.m. (GMT). Three minutes later, investors figured out that the link for sending Ether, a type of digital currency, was taking them to the wrong deposit location. Within those three minutes, the hacker managed to accumulate more than $7 million before CoinDash terminated the ICO and removed the page.

Recommended Videos

“The moment the token sale went public, the CoinDash website was hacked and a malicious address replaced the CoinDash Token Sale address,” CoinDash said. “As a result, more than 2,000 investors sent ETH to the malicious address. The stolen ETH amounted to a total of 37,000 ETH.”

Ether is the digital currency of the world’s second most popular cryptocurrency network, Ethereum. This platform consists of smart contracts, which are essentially bits of code that will execute when certain requirements are fulfilled. These “apps” are listed on the Ethereum network using what is called a blockchain, which serves as a registry that records all transactions. Ether, abbreviated as ETH, is what’s used to pay for things and services listed on the Ethereum network.

So why not just use real world cash? Because digital currency is decentralized. It’s not managed by banks or the government. Plus, both the merchant and buyer can remain completely anonymous, with a transaction digitally signed and verified by an unknown miner on the associated network. Ether is similar to Bitcoin in purpose although technically they are completely different digital currencies.

Individuals who successfully participated in a private “heads up” for whitelist contributors 15 minutes prior to the public ICO received “tokens” as proof of their CoinDash app investment. However, those who invested Ether using the hacked address are reportedly now demanding a refund. After all, the CoinDash website was not locked down tight, enabling a hacker to insert a simple link that collected millions in stolen digital currency.

However, many Ether users reportedly flocked to social networks and questioned the theft. Was this a genuine hack, or a simple scam using a hack as a cover story? As Tripwire states, there is no evidence to suggest foul play.

CoinDash is currently providing an online form for victims to complete as part of the company’s forensic investigation into the hack. Victims are asked to provide their email address, wallet address, a proven transaction number, and the amount of Ether sent.

“This was a damaging event to both our contributors and our company but it is surely not the end of our project,” CoinDash added. “We are looking into the security breach and will update you all as soon as possible about the findings. We are still under attack. Please do not send any ETH to any address, as the Token Sale has been terminated.”

Despite the hack, CoinDash said that it managed to secure $6.4 million from early contributors and whitelist participants in the 15-minute “heads up” prior to the ICO. Those who sent digital currency to the wrong Ether address during the hack will still receive tokens. Otherwise, investors who sent Ether to the wrong address after CoinDash removed the ICO page will not receive investment tokens.

Update: Added new information provided by CoinDash.

Topics

Former Digital Trends Contributor

Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…

Computing

Understandably, Stalker 2 is a bit of a mess on PC

Key art for Stalker 2. A character in a lit-up gas mask and a gun on their back.

Stalker 2 is one of those games I never thought would actually release. Originally announced 14 years ago, the project was shelved after developer GSC Game World closed its doors, only to be reignited in 2018. Then, as the originally announced 2022 release of the game approached, Ukraine, where the developer was based, was invaded by Russia.

There are plenty of games that suffer in development hell, but they pale in comparison to the struggles Stalker 2 has gone through. The fact that the game is even here is nothing short of a miracle. Like other titles stuck in development hell, though, Stalker 2 is far from perfect, particularly when it comes to PC performance.

Computing

Nvidia may keep producing one RTX 40 GPU, and it’s not the one we want

The Alienware m16 R2 on a white desk.

The last few weeks brought us a slew of rumors about Nvidia potentially sunsetting most of the RTX 40-series graphics cards. However, a new update reveals that one GPU might remain in production long after other GPUs are no longer being produced. Unfortunately, it's a GPU that would struggle to rank among Nvidia's best graphics cards. I'm talking about the RTX 4050 -- a card that only appears in laptops.

The scoop comes from a leaker on Weibo and was first spotted by Wccftech. The leaker states that the RTX 4050 is "the only 40-series laptop GPU that Nvidia will continue to supply" after the highly anticipated launch of the RTX 50-series. Unsurprisingly, the tipster also reveals that the fact that both the RTX 4050 and the RTX 5050 will be readily available at the same time will also impact the pricing of the next-gen card.

Computing

Valve adds DLSS 3 to SteamOS backend, but don’t expect an Nvidia Steam Deck

Ghost of Tsushima running on the Steam Deck.

Valve has made a significant update to its Proton compatibility layer, which is the basis of the Linux-based SteamOS operating system on the Steam Deck. The update brings several improvements and bug fixes, but it also adds support for Nvidia's coveted DLSS 3 Frame Generation.

The update for Proton Experimental rolled out on November 12, and it was spotted by Wccftech. Proton is the bedrock for gaming on Linux, and up to this point, Nvidia users haven't had access to some of the best features of Team Green's latest graphics cards on Linux. The latest update not only supports DLSS 3 Frame Generation, but also Nvidia's Optical Flow API. Optical Flow is critical for DLSS 3 Frame Generation, though the dedicated hardware for the feature has been around since Nvidia's Turing GPUs.