Cryptohack Roundup: $26 Million FixedFloat Hack

This week, FixedFloat lost $26 million in a hack, the U.K. Financial Conduct Authority found illegal promotions of cryptocurrency, GoFundMe shuttered a Tornado Cash fundraiser, and an Australian cop allegedly stole $4 million worth of bitcoins.

See Also: User Entity & Behavior Analytics 101: Strategies to Detect Unusual Security Behaviors

Decentralized crypto exchange FixedFloat experienced a security breach, resulting in the theft of approximately $26 million worth of bitcoin and ether, according to a Web3 threat researcher. The exchange team confirmed the attack and attributed the massive outflows to “minor technical problems” and a temporary switch to maintenance mode.

On the exchange’s social media page, users have been reporting frozen transactions and missing funds since Saturday. On-chain data shows that the hacker drained over 400 bitcoin worth around $21 million and more than 1,700 ether worth about $5 million from the platform. The specifics of the attack are unclear; the exchange team said it is investigating the incident. FixedFloat’s website currently displays an error message. The company operates as an automated cryptocurrency exchange that does not require user registration or “know your customer” verification.

The U.K. Financial Conduct Authority said in a review of 2023 financial promotions data that cryptocurrencies suffer from legal flaws in their promotion, including generic risk summaries, risk warnings published in tiny fonts or in hard-to-read coloring, and unsubstantiated claims of safety and security. The authority also flagged the use of affiliates and “finflunencers” to promote digital money.

The FCA during the last three months of 2023 issued 450 consumer alerts against digital asset companies promoting crypto illegally. The independent financial regulatory body collaborated with tech companies to remove 35 illegal promotion apps from stores.

Crowdfunding platform GoFundMe canceled a fundraiser intended to collect legal fees for Roman Storm, the co-founder of cryptocurrency mixer Tornado Cash, and its developer, Alexey Pertsev. Storm had sought community support for legal expenses related to a court battle against U.S. authorities, who alleged that Tornado Cash had facilitated the bypass of sanctions and allowed hackers to launder illicit funds. GoFundMe terminated the fundraiser on Feb. 14, citing a breach of its terms of service. While active, the campaign garnered $30,000 in donations. Storm and Pertsev now rely on the crypto fundraising platform Juicebox, where they have collected about $1 million so far (see: Cryptohack Roundup: Tornado Cash in the Eye of the Storm).

The National Anti-Corruption Commission of Australia accused a federal police officer of wiping a Trezor hardware wallet containing 81.62 bitcoin at a crime scene, reported News.com Australia. The authorities, using digital asset-tracing software, said that the officer, identified as William Wheatley, had transferred the bitcoin into his possession. During a drug raid at a residence, the Australian police discovered the hardware wallet, but they waited approximately three weeks to obtain court permission to access it, during which time Wheatley allegedly stole the money. The police officer is accused of moving the digital assets shortly after the raid.

The hardware wallet initially held 81.62 bitcoin, valued at $309,000 during the raid. Its current value stands at around $4.2 million. An investigation, including the analysis of IP addresses linked to the stolen BTC through digital assets-tracing software, allegedly revealed a connection to Wheatley.