CoinStats publishes incident report after $2.2 million security breach

CoinStats, a leading cryptocurrency portfolio tracking app, revealed details of a major security breach that resulted in the theft of digital assets worth around $2.2 million.

As crypto.news reported, the incident was discovered on June 22, 2024. Now, a security incident report published by CoinStats on Friday, July 12, provided deeper insights into the breach.

The attackers are believed to be linked to a sophisticated government group. They gained access to private keys, enabling unauthorized transfers from compromised wallets.

According to Narek Gevorgyan, CEO of CoinStats, the attack targeted 1,590 CoinStats wallets by exploiting vulnerabilities in several services.

Following the incident, CoinStats secured the remaining assets and immediately shut down its platform to conduct an investigation. The Federal Bureau of Investigation and other security experts, including ZachXBT and Tay from MetaMask, assisted in recovering the stolen funds.

“We are continuously working with security researchers and law enforcement to understand the full extent of the breach,” Gevorgyan explained. Although the theft involved cryptocurrency funds, there was no evidence of compromised user data beyond the financial loss, Gevorgyan added.

According to the report, CoinStats resumed full operations on July 3 after implementing enhanced security protocols and comprehensive infrastructure audits.

The company said it will continue to monitor for signs of further malicious activity and made recommendations for additional security measures, including:

• Mandatory password update: The company announced it would enforce a stricter password policy that would require all users to update their passwords if they do not meet new standards.
• Enable 2FA: It also said all users would be encouraged to enable two-factor authentication for their accounts.

CoinStats also pledged to maintain transparency throughout the investigation and provide regular updates on progress and security improvements. In addition, the company said it is actively looking for ways to assist users.

What’s next: Users can report their losses and request possible assistance. The submission deadline is August 15.