Crypto thefts: SEAL records more than $68 million in losses in one week (excluding Binance)

Coin Encyclopedia Improve your knowledge of cryptos

This count covers files received by the organization, not all attacks in the sector. Eleven reports concerned requests for tracing or information linked to Binance, and not eleven additional thefts.

In its weekly report, SEAL classifies nine reports as protocol compromises, amounting to $57.2 million and 2.42 BTC in reported losses. The main case concerns the connected wallet of an exchange platform: $49 million stolen, with an undisclosed initial cause.

The report also mentions a theft of $5 million from a signature infrastructure, exploitation of a deposit box on TON and a flaw in a loan protocol.

These files illustrate different mechanisms. On TON, the attacker would have obtained vault shares without depositing the corresponding assets. In another case, an intrusion into the signing environment allowed private keys to be extracted via the cloud key management service. Shutting down the servers was no longer enough to protect the funds.

SEAL also reports injections of theft software into web interfaces, notably that of Polymarket via a third-party service provider. However, these incidents do not make it possible to precisely quantify the total share attributable to smart contract bugs alone.

SEAL awards four cases worth around $3 million to North Korean campaigns, again outside Binance.

Three concern UNC1069 and machines running macOS. In one case, a Safe wallet requiring two out of three signatures lost $2 million after several months of malware being present. Another victim was robbed of $640,000 seven weeks after a fake Teams invitation.

The organization thus emphasizes that an infection can remain discreet before the diversion. The absence of immediate loss does not demonstrate that a device is healthy.

Recovery phrase compromises account for thirteen reports, for $3.62 million and 0.91 BTC. A single file concerns a loss of 3.5 million from a hardware wallet holder, without sufficient precision to attribute a failure to the manufacturer.

Three fake support calls also cost $1.57 million and 1.12 BTC. In the biggest case, a purported Apple advisor obtained the credentials of a victim whose recovery phrase was in cloud storage.

During the week, SEAL indicated that it identified 5,137 phishing domains and published 5,185 threat indicators. Its balance sheet also mentions 0.1 BTC and 6,200 DAI frozen: these immobilized sums do not necessarily constitute funds already returned.

Machine-translated from French