Cryptocurrency payment processor Alphapo hacked for $23 million

[Carding]

The company is trying to recover the stolen funds.

Blockchain security specialist ZachXBT was the first to detect an attack on the company's Ethereum, Bitcoin and TRON hot wallets.

Experts from PeckShield, a blockchain security firm, confirmed the hack. According to their report, the attackers stole 6.074 million USDT, 108 thousand USDC, 100.2 million FTN, 430 thousand TFL, 2.5 thousand ETH and 1.700 DAI, transferring all funds to address 0x040a.

During the operation, the criminals exchanged the stolen stablecoins for 5.73 ETH, which were then converted into BTC through the Avalanche Bridge. Approximately 12 million USDT and 5.2 million TRX were also withdrawn, listed consecutively on TKSitn and TDoNAZHa7.

Since Alphapo provides payment services for a number of well-known cryptocurrency playgrounds, including HypeDrop, Ignition, and Bovada, the impact of a hack could be significant.

Due to this incident, HypeDrop has temporarily suspended deposit and withdrawal operations for certain cryptocurrencies. In response to questions from users, the company attributed the issues to the actions of an unspecified third party. At the same time, HypeDrop emphasized that a third party had difficulties with BTC, ETH and TRX operations, assuring its customers that the funds are safe.

 

[Carding]

ZachXBT discovered an additional $37 million stolen in a recent hack into cryptocurrency payment provider Alphapo. The total loss was $60 million.

He also admitted the involvement of the North Korean hacker group Lazarus Group in the incident, as they "leave a clear fingerprint on the network." The attack affected addresses in the Bitcoin, Tron and Ethereum networks.

Alphapo managed transactions for the online gambling platforms HypeDrop, Bovada and Ignition, from which the bulk of the funds were stolen.

Given that hot protocol wallets had a constant internet connection, it was easier for attackers to gain access to them. Some platforms have already suspended withdrawals to prevent further damage.

According to DeDotFi experts, the hackers who attacked the Alphapo.eth address converted the stolen funds into ETH, and then redirected them through the Bitcoin and Avalanche networks.

Analysts suggested that a possible cause of the incident is the leakage of private keys.