Share this article
Bitfinex was recently in the spotlight when a ransomware group called “FSOCIETY” claimed to have access to 2.5TB of data on the exchange. that much Personal information of 400,000 users. In response to these claims, Bitfinex CTO Paolo Ardoino clarified that the database hacking claims are true. seems to be “Fake” and guaranteed user funds remain safe.
Ardoino discovered It was outside Data inconsistencies in hacker posts and user data inconsistencies.
The hacker posted 22,500 sample data. Email and password history. but, According to Paolo, Bitfinex does not store plaintext passwords or two-factor authentication (2FA) secrets in plaintext. Additionally, out of the 22,500 emails in the leaked data, only 5,000 matched Bitfinex users.
According to him, this could be a general problem in data security. Users often reuse the same email and password across multiple sites, which may be why some Bitfinex-related emails exist in our dataset.
Another characteristic is the lack of communication with hackers. They did not contact Bitfinex directly to report or contact us about this data breach. negotiate, which This is atypical behavior for ransomware attacks, which typically include some form of ransom demand or contact.
Additionally, although information about the suspected hacking was posted on April 25, Bitfinex only recently became aware of it. Paolo said that if there had been a genuine threat or demand, the hackers would likely have used Bitfinex’s bug bounty program or customer support channels. contact, None of that happened.
“The alleged hackers did not contact us. If I had real information, I would have contacted Ramson via bug bounty, customer support ticket, etc. can’t find anything request,” I wrote Ardoino.
Bitfinex has conducted a thorough analysis of its systems and has found no evidence of a breach so far. Paolo said the team will continue to review and analyze all available data to ensure: that Nothing is overlooked in a security assessment.
When news of the potential breach broke, Shinoji Research X user, Confirmed The authenticity of the leak. The user said he received a text message trying one of the passwords included in the leaked information. all 2FA.
However, at press time, he had deleted his post and corrected his previous information.
I deleted the original BFX hack post because I couldn’t edit it. What appears to have happened is that this “Flocker” group has cherry-picked a list of BitFinex logins from other breaches.
They then made the site look like a ransom demand for a large-scale breach.
— Alice(e/nya)🐈⬛(@Alice_comfy) May 4, 2024
In a separate post to
The idea is to create buzz around these high-profile hacks (Bitfinex, SBC Global, Rutgers, Coinmoma) to promote their tools. They claim this could allow others to carry out similar attacks and potentially make a lot of money.
Here’s a message from a security researcher (instead of panicking, I’m trying to find out more):
“I believe I am now starting to understand what is happening and why they are sending messages claiming to have been hacked.
The message in the screenshot on the ticket came from: pic.twitter.com/YjwG2eeXw2— Paolo Ardoino 🍐 (@paoloardoino) May 4, 2024
He also questioned why hacking tools should be sold for $299 if hackers actually accessed Bitfinex and obtained valuable data.
Share this article