On 17 January 2022 Crypto.com’s risk monitoring detected unauthorised activity on a small number of accounts in which transactions were being approved without the two-factor authentication control having been entered by the user. Withdrawals were suspended and resumed the following day after additional hardening.
The company reported 483 accounts affected and unauthorised withdrawals of approximately $34 million — reported as 4,836.26 ETH, 443.93 BTC and around $66,200 in other currencies. It stated that unauthorised withdrawals were prevented in most cases and that customers were fully reimbursed in the rest, so no customer lost funds.
A Fourth Way To Defeat A Second Factor
We have recorded three familiar modes. The factor is approved under pressure, at 22-0915. The code is relayed to an attacker in real time, at 22-1101. The session is stolen after authentication and replayed, at 23-0404.
This is a fourth and the most fundamental: the check did not run. A control that the server can be persuaded to skip is not a second factor, it is a user interface convention, and no amount of user diligence addresses it. We filed the same category confusion at 22-0930 and 22-0801 — the mechanism was present and the enforcement was not.
Detection Was The Thing That Worked
The incident was found by the company’s own risk monitoring, not by a customer complaint or a public listing.
That is worth stating against 22-0323, where $620 million left a bridge and it took six days and a user complaint to notice, and against 23-0119. Same asset class, same year: one organisation was watching the transaction pattern and one was not.
Reimbursement Is A Decision, Not A Property
No customer lost money. We have recorded that plainly because it is rare, and records equally plainly that it happened because a company chose to absorb the loss.
The same pattern is at 22-0202, where a trading firm covered $320 million to protect a product it owned. There was no deposit insurance behind either. When the corpus says users were made whole, it is describing a corporate decision that was available and was taken, not a protection that existed.
Compiled from the company’s own incident report and contemporaneous coverage, listed below. The underlying flaw was not described in technical detail publicly and none is asserted here. No actor is named — none was identified. Dollar values reflect prices reported at the time. Graded high on the events as disclosed. Corrections: corrections@forensicpost.com.