Australian Crypto Exchange CoinSpot rocked by a major security breach that saw cybercriminals make off with a staggering $2.4 million. A recent report from CertiK shared with BSC News revealed the shocking details of this massive exploit.

Red flags were raised on November 8 when CertiK observed dubious transactions from CoinSpot's hot wallets. Two CoinSpot wallets reportedly sent 1,282 ETH to an External Owned Account (EOA), amounting to about $2.4 million.

Blockchain security firm CertiK has pointed fingers at a "probable private key compromise" as the root cause of this security nightmare. This compromise likely occurred within at least one of CoinSpot's hot wallets.

"There is strong evidence of a private key compromise based on the on-chain data. Private key compromises on centralized exchanges occur when an external threat actor has compromised the victim's systems," Joe Green, Senior OSINT & Blockchain Analyst at CertiK, told BSC News. "It is difficult to say how this could’ve been prevented because we do not have any insight into how CoinSpot stores their private keys."

‍

The Trail of Digital Heist

Blockchain investigator ZachXBT picked up the trail, exposing two transactions into the hacker's wallet. To cover their tracks, the hackers transferred the ill-gotten funds to the Bitcoin network using ThorChain and Wan Bridge.

According to reports, 831 ETH were converted into BTC via THORChain. Furthermore, the hacker transformed 451.7 ETH into Wrapped Bitcoin (WBTC) before being dispatched via Wan Bridge.

The stolen assets made their escape as they were skillfully converted into 24 Wrapped Bitcoin (WBTC) via Uniswap. From there, the ill-gotten WBTC was further transformed into Bitcoin and dispersed across four distinct addresses.

CoinSpot, a long-established player in the crypto space since 2013, serves a vast user base of approximately 2.5 million, with support for over 400 cryptocurrencies. The exchange operates under the vigilant watch of the Australian financial regulatory institution, AUSTRAC.