Crypto casino Stake reopens withdrawals just 5 hours after $41M hack

  cointelegraph.com 24 m

Crypto betting platform Stake has reopened deposits and withdrawals and resumed services for users only five hours after the platform was hacked to the tune of $41.3 million, blockchain security firms estimate.

Stake confirmed that all services resumed at 9:28pm UTC time on Sept. 4 — a few hours after the platform confirmed that several unauthorized transactions were made on Stake’s ETH/ BTC hot wallets:

All services have resumed! Deposits & withdrawals are processing instantly for all currencies. We apologise for any inconvenience.

— Stake.com (@Stake) September 4, 2023

The betting site said its Bitcoin (BTC), Litecoin (LTC), and XRP wallets were not impacted but hasn’t yet shared the cause of the exploit or how much was stolen. Stake however confirmed that user funds remain safe.

Three hours ago, unauthorised tx’s were made from Stake’s ETH/BSC hot wallets.

We are investigating and will get the wallets up as soon as they’re completely re-secured.

User funds are safe.

BTC, LTC, XRP, EOS, TRX + all other wallets remain fully operational.

— Stake.com (@Stake) September 4, 2023

Recent analysis by blockchain security firm Beosin calculated the total loss to be $41.35 million, which included $15.7 million on Ethereum (ETH), $7.8 million on Polygon (MATIC) and another $17.8 million from the Binance Smart Chain.

@Stake has experienced multiple suspicious outflows on #Ethereum, #BSC and #Polygon.

ETH: ~$15.7M
Polygon: ~$7.8M
BSC: ~$17.8M
The total funds were ~$41.35M.

Stay alert! pic.twitter.com/cKBK3kMeUz

— Beosin Alert (@BeosinAlert) September 4, 2023

An earlier estimate of $15.7 million by fellow blockchain security firm PeckShield didn’t account for the $25.6 million allegedly lost on BSC and Polygon, according to on-chain analyst ZachXBT.

The first transaction occurred at 12:48 pm UTC, transferring approximately $3.9 million worth of stablecoin Tether (USDT) from Stake to the attacker’s account. The next two transactions removed over 6,000 Ether, worth approximately $9.8 million at the current prices.

The attacker continued to remove tokens over the next few minutes, including about $1 million in USD Coin (USDC), $900,000 worth of Dai (DAI) and 333 Stake Classic (STAKE) ($75) which is understood to have made up the first $15.7 million on Ethereum.

Source