Liquid cryptocurrency exchange loses $94 million following hack

Japan-based cryptocurrency exchange Liquid has suspended deposits and withdrawals after attackers have compromised its warm wallets.

Liquid is one of the largest cryptocurrency-fiat exchange platforms worldwide (based on daily traded spot volume).

The exchange has more than 800,000 customers from over 100 countries and says that it reached a $1.1B+ daily trade volume this year.

After discovering that its warm wallets were hacked, the crypto exchange moved its assets into a cold wallet.

“We are currently investigating and will provide regular updates. In the meantime deposits and withdrawals will be suspended,” Liquid said.

Important Notice:

We are sorry to announce that #LiquidGlobal warm wallets were compromised, we are moving assets into the cold wallet.

We are currently investigating and will provide regular updates. In the meantime deposits and withdrawals will be suspended.

— Liquid Global Official (@Liquid_Global) August 19, 2021

$94 million worth of assets stolen

According to blockchain analytics firm Elliptic, who is helping Liquid trace the stolen funds, the hackers stole roughly $94 million worth of cryptocurrency assets in the attack.

“The stolen funds include $45 million in Ethereum tokens, which are currently being exchanged for ETH on DEXs such as Uniswap and SushiSwap,” Elliptic stated.

“This enables the hacker to avoid having these assets frozen – as is possible with many Ethereum tokens.”

Liquid previously reported a data breach in November 2020 after GoDaddy, the exchange’s domain hosting provider, transferred control of its account and domain to a malicious actor.

A subsequent security notice issued in January revealed that the threat actor breached Liquid’s infrastructure and gained access to customer personal information including emails, names, addresses, encrypted passwords, and API keys.

Today’s incident follows the biggest cryptocurrency hack ever, the theft of over $611 million after an unknown threat actor hacked Poly Network’s cross-chain interoperability protocol last week.

In a weird twist of events, Poly Network first threatened the attacker (known as Mr. White Hat) to return the stolen cryptocurrency to avoid landing on law enforcement’s radar. It then awarded him a $500,000 bounty and invited him to be the company’s Chief Security Advisor. 

Since the attack took place, Mr. White Hat has gradually transferred the stolen assets to Poly Network’s wallets.

In July, the FBI issued a Private Industry Notification warning cryptocurrency owners, exchanges, and third-party payment platforms of threat actors actively targeting virtual assets in attacks that can lead to significant financial losses.

This is a developing story …