Update About Security incident Cryptohopper, 18-01-2024
We would like to bring your attention to the recent breach that occurred on Thursday, January 18, 2024, and provide you with an update on the situation.
On Thursday morning Amsterdam time (18 Jan), our security system alerted us to an unusual login. Subsequently, we discovered that an access token was compromised.
Upon detecting the unusual login, we took immediate action on Thursday morning by revoking all access tokens and refresh tokens. Additionally, we removed all login credentials from all programs accessible to the affected colleague and fully reset the infected computer.
Regrettably, around 4 PM Amsterdam time, phishing emails were sent containing a link for connecting to a crypto wallet to purportedly receive an airdrop. As soon as we became aware of these emails, we posted updates on our social channels, placed a banner on our website, sent an email, and halted all similar emails.
Later, around 10 PM Amsterdam time, a second batch of emails with a malicious link was sent. We promptly secured this on Thursday at 11:27 PM Amsterdam time.
The incident did not impact our trading operations; however, some users experienced difficulties with receiving device authorization and password reset emails. These can be received again. Our email provider, AWS, follows strict rules for sending large volumes of emails, and it took some time for us to restore the normal operation of automated emails.
Upon assessing the impact, we assume that the following user-specific information had been accessed: name, username, register date, and last visit date.
As a precaution, we strongly recommend the following:
Change your password on Cryptohopper.
Clear your browser cookies.
Always keep 2FA enabled.
(optional / in general) Separate important accounts on email and exchanges and visit them using a browser that you don't use for your regular browsing and emailing.
Rest assured, we take this matter seriously, and while a fix has been implemented, we are committed to preventing such incidents in the future. Further details on our preventive measures will be shared, and a full-scale investigation of the attack will be conducted and reported to the authorities.
As email addresses have been compromised, please be cautious of phishing emails and never share your account or API Key details or connect your wallet.
For guidance on disconnecting your crypto wallet, please refer to online resources. For additional information on safeguarding your accounts, please consult our blog: How to secure your account from cyber attacks.
We will keep you informed of any developments. Thank you for your continued support, trust, and valuable suggestions.
We are humbled by your support in this difficult time.
Thank you for your understanding and cooperation.
Best regards,
Team Cryptohopper
