Hackers keep successfully targeting crypto platforms, with another one losing millions this July and promising to cover all losses.
Crypto trading platform WOO X confirmed that nine clients had unauthorized withdrawals placed, resulting in a loss of around $14 million worth of crypto assets on Thursday.
“The incident was quickly detected and, as a precaution, withdrawals were paused and many of the withdrawals were blocked. We’ve already contacted the affected users, and all unauthorized withdrawals will be covered,” the team said, adding that they’re working with external security teams and other exchanges to halt the flow of funds. The team didn’t provide an estimate of when withdrawals might be reopened.
According to the platform, a team member’s device was compromised in a phishing attack, allowing the exploiter to gain access to the development environment.
“Many security measures limited the access but gave the exploiter time to coordinate a series of withdrawals from the user accounts mentioned in the previous message,” they said.
Blockchain analysts from Cyvers found that the hacker stole cryptoassets across the bitcoin (BTC), ethereum (ETH), BNB, tron (TRX), and arbitrum (ARB) networks before swapping them and moving to new addresses.
How to Prevent Phishing-Based Crypto Frauds……cybersathhi.com
For Individuals & Crypto Users:
- Enable Two-Factor Authentication (2FA):
Use authenticator apps (like Google Authenticator or Authy), not SMS-based codes. - NEVER click unknown links or download files in emails, Discord, Telegram, or DMs—even if they seem official.
- Verify URLs and logins carefully:
Always double-check the domain of websites, especially those mimicking crypto platforms. - Use hardware wallets (cold wallets):
For large sums, always store your crypto offline using a hardware wallet (e.g., Ledger or Trezor). - Rotate passwords and store them securely:
Use password managers and avoid reusing passwords across sites. - Stay updated with breach alerts:
Tools like HaveIBeenPwned, Cybersathhi alerts, or Crypto Twitter feeds help you react faster.
For Exchanges and Crypto Companies:
- Strict internal access controls:
Use role-based permissions. Never allow full access to sensitive systems from a single compromised account. - Continuous phishing simulation training:
Employees should undergo quarterly red-team phishing simulations. - Monitor for abnormal wallet behavior:
Tools like Chainalysis, CipherTrace, and Hypernative can detect suspicious transactions in real-time. - Use whitelisting for withdrawals:
Only allow withdrawals to pre-approved wallets after multi-layer verification. - Deploy multi-sig wallets for large transactions:
This ensures no single actor can move large funds without team consensus. - Have a crypto incident response team ready:
Partner with forensic firms like Seal911 or SlowMist for real-time containment and analysis.
Education Is Key – cybersathhi.com
“The best firewall is an informed mind. No tool is effective if the human behind the screen is vulnerable.”
– CyberSathhi Security Insights Team
CyberSathhi.com recommends launching a Crypto Hygiene Campaign where:
- Individuals are taught to identify phishing links.
- Crypto users are warned about fake airdrops, giveaways, and support impersonators.
- Security health checks are conducted monthly.