Crypto platform 3Commas confirms major API breach, FBI to investigate

Cryptocurrency trading platform 3Commas has confirmed it suffered a data breach that saw API data stolen.

As per the announcement, an unknown threat actor posted 3Commas’ API database to Pastebin, on December 28. 

After analyzing the database, the company confirmed its authenticity, saying “at this point, 3Commas can unfortunately confirm that some of 3Commas’ users’ API data (API keys, secrets and passphrases) have been disclosed by a third party”. 

Stolen money

While the leaks revolve around API data at the moment, 3Commas’ does not exclude the possibility of other data being taken, as well: “Currently and to the best of our knowledge only API data have been disclosed as part of this incident. As a likely consequence the hacker(s) may use or may have used the API data to connect your exchange accounts to his/their account and/or initiate unauthorized trades,” it says.

In a notice sent to its users via email and a blog post, the company says it has made strides to protect its users and their funds, and reported the issue to relevant law enforcement agencies, including the FBI. 

As per a BleepingComputer report, a set of 10,000 API keys were leaked, which is just 10% of the 100,000-big database. These keys are usually used by 3Commas bots to automatically interact with crypto exchange platforms, make trades and generate profit, without user interaction.

Reacting to the news, 3Commas urged all supported exchanges (including some of the biggest ones - Binance, Coinbase, and Kucoin) to revoke all API keys connected to the platform. The company also urged all users to reissue their keys on all linked endpoints personally.

Read more

> Huge crypto exchange hack sees $600m stolen

 > Binance says at least $100 million stolen in blockchain attack

 > Check out the best ID theft protection solutions right now

Investigating the leak further, the company eliminated the possibility of this being an inside job: “Only a small number of technical employees had access to the infrastructure, and we have taken steps since November 19 to remove their access,” the company said in a Twitter post. 

“Since then, we have implemented new security measures, and we will not stop there; we are launching a full investigation in which law enforcement will be involved,” the company added.

But the damage has already been done. Apparently, threat actors have been abusing leaked API keys since November, and have managed to steal some $6 million worth of cryptocurrencies so far. 

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/peb8U1r

Comments

Post a Comment

Popular posts from this blog

F1 live stream: how to watch every 2021 Grand Prix online from anywhere

Image
The 2021 season is in full swing, but even after just four races we're already seeing a pattern emerging – will the winner be Verstappen or Hamilton? Well, we've got plenty of time to find out, as this year we've got a full house of 23 events, a welcome relief from last year's truncated calendar. Read on as our guide explains how to watch an F1 live stream online from all over the world - and where you can watch absolutely free! 2021 F1 live stream Season dates: March 28 - December 12 Next race: Monaco Grand Prix, Circuit de Monaco (May 23) Live streams: Sky Sports (UK) | ABC/ Sling TV (US) | Fox/ Kayo Sports (AU) | F1 TV (selected regions) Watch anywhere: try No. 1 overall VPN 100% risk-free In terms of positioning, last week's Spanish GP was much the same as the Portuguese GP before it, with Hamilton, Verstappen, and Bottas all gracing the podium in the same order for the second time - but that's not to say we were bored seeing it happen. Ver...
Read more

Best blogging sites of 2021: Free and paid blog platforms

Image
Best free blogging site 1. Wix 2. WordPress 3. Blogger 4. Weebly 5. Penzu Read on for our detailed analysis of each service Free blogging sites have come a long way in recent years, and it’s now easier than ever to create a professional-looking blog to share a hobby with like-minded people, express your opinions, and establish an online presence.  These free blogging sites are aimed at hobbyist bloggers – blogs are created and managed online, and hosted on the blogging platform’s own servers. If you want to create a self-hosted blog, the downloadable version of WordPress is an excellent option, with total flexibility, support for third-party plugins , and as much storage as your hosting plan allows. If you're interested in making a static website rather than an online journal, take a look at our guide to the best free website builders . Our advice would be to steer clear of free blogging sites if you can, as it isn't always a good option for the majority . How...
Read more

Tableau launches new enterprise plans, big data tools

The cloud analytics firm Tableau has unveiled a number of new data and analytics platform capabilities in addition to new enterprise subscription plans designed to help customers' digital transformation efforts. The Salesforce -owned company aims to empower everyone in an organization by giving them access to trusted and governed data at a time when 87 percent of IT and business leaders are concerned that security and governance are slowing the pace of innovation according to a new report from Mulesoft . Tableau's new enterprise subscription plans will also make it easier to procure and deploy its analytics platform across an entire organization. This is because the company has made the decision to bundle analytics with Data Management and Server Management. We've built a list of the best cloud analytics available These are the best cloud computing services on the market Also check out our roundup of the best online collaboration tools Chief product officer at...
Read more