Crypto exchange CoinSpot reportedly suffers $2M hot wallet hack
Blockchain security firm CertiK believes the $2.4 million draining of a CoinSpot hot wallet is likely the result of a “private key compromise.”
investograph 
Despite CoinSpot's regulatory compliance and status as Australia's largest cryptocurrency exchange, it reportedly suffered a significant breach, resulting in the loss of $2.4 million from one of its hot wallets. The hacker successfully compromised at least one of CoinSpot's hot wallets, with CertiK attributing the incident to a "probable private key compromise." The attacker orchestrated a series of transactions, starting with the receipt of 1,262 Ether (ETH) from a known CoinSpot wallet.
The presumed attacker stole 1,262 ETH from a known CoinSpot wallet. Source: ZachXBT The stolen funds were subsequently moved across various blockchain networks, including THORChain and Wan Bridge, to obscure their origins and complicate tracking efforts.
After obtaining the stolen Ether, the hacker initiated swaps for Wrapped Bitcoin (WBTC) via Uniswap and Bitcoin via THORChain.
The list of transactions made from the alleged attackers’ wallet. Source: DeBank CertiK's investigative data revealed the owner of the hacker's wallet conducted multiple transactions, exchanging Ether for WBTC and Bitcoin, and distributing the ill-gained Bitcoin across four different wallet addresses. The tactic of distributing funds across numerous wallets is commonly employed by attackers to hinder tracking and investigations. CoinSpot, with a reported user base of approximately 2.5 million customers, is regulated by the Australian Transaction Reports and Analysis Centre and holds an Australian Digital Currency Exchange License. The exchange's security breach raises concerns about the vulnerability of even well-established platforms in the cryptocurrency space.
