‘My Coins Vanished Without Warning’: Crypto Exchange Hit by $72,000 Theft Leaves Users Reeling

Crypto exchange hacked again as about $72,000 is drained from digital wallet

Attacks targeting financial firms continue

Virtual-asset theft hits Prabang

Bithumb, Gopax also face repeated data leaks

"Targets now extend from personal data to assets"

A string of hacking attacks targeting South Korea’s financial sector has now led to the actual theft of customer assets from a cryptocurrency exchange. Recent cyber incidents in the industry had mainly involved intrusions into internal systems or leaks of personal information. This time, however, coins were withdrawn from an internet-connected crypto wallet. The incident is heightening concern over security at virtual-asset exchanges.

Hackers Stole Coins Too

Prabang said on its website on Oct. 29 that an unauthorized external party had stolen customer assets. The exchange said it found that virtual assets worth about $72,000 had been withdrawn from its hot wallet, an online wallet, on Oct. 24. Prabang is a crypto-only exchange rather than one that trades against the Korean won. Earlier this month, it also suffered a personal data breach. Now customer assets have been stolen as well. A Prabang official said the company plans to determine the exact extent of the losses and fully compensate affected customers.

A hot wallet is operated in an internet-connected environment so virtual-asset deposits and withdrawals can be processed quickly. That leaves it relatively more exposed to cyberattacks than a cold wallet, which is kept offline and separated from external networks. If access rights to wallet management systems or transaction approval procedures are compromised, attackers can move virtual assets to external wallet addresses. It remains unclear how the hacker gained access and stole the assets in this case.

Security incidents have also continued at larger exchanges. Bithumb, South Korea’s second-largest cryptocurrency exchange, said on Oct. 28 that an unauthorized external party had accessed its internal mobile groupware system, exposing personal information and prompting an investigation. Groupware is an internal business platform used by employees to share work materials and process electronic approvals. It is separate from wallet systems that directly manage customer assets, but leaked internal accounts or work-related information could be exploited in follow-on attacks. A security industry official said companies also need to prepare for the possibility of lateral movement, in which hackers use stolen credentials to try to access other internal systems.

Hacking Threat Spreads Across the Sector

The number of hacking incidents reported in South Korea’s financial industry this year is already close to the total submitted to the Financial Supervisory Service over the past several years. According to data that People Power Party lawmaker Park Sung-hoon received from the Financial Supervisory Service, hacking incidents reported by banks, securities firms, insurers, card companies and savings banks totaled 19 from 2022 through last year, including multiple cases involving the same company. Seven of those cases occurred last year.

Security experts said blocking an initial intrusion is only part of the response. It is also important to identify traces that attackers may have left behind in internal systems. Once hackers succeed in breaking in, they may attempt further attacks using malware or stolen account privileges. Kwak Jin, a professor in the Department of Cybersecurity at Ajou University, said companies should check whether malware was planted or privileges were compromised and consider strengthening administrator access controls.

Park Si-on, Hankyung.com reporter ushire908@hankyung.com