The Crypto.com Hack Explained: 2FA Bypass, $34M

Video transcript

In January 2022, withdrawals passed without 2FA on 483 Crypto.com accounts, even though 2FA was mandatory. The control existed, and it did not hold.

On January 17, monitoring flagged unauthorized activity and Crypto.com halted withdrawals for about 14 hours. The CEO confirmed the breach on January 19, and the report followed a day later.

The report listed over 4,800 ether, about 444 bitcoin and other currencies, which TechCrunch valued at over 34 million dollars. Crypto.com's net loss after reimbursing customers is not public.

Crypto.com said withdrawals were approved without users entering 2FA. It never said how, and named no attacker.

It revoked every 2FA token, moved to new 2FA infrastructure, and added a 24-hour delay on new withdrawal addresses. It also alerted users to new addresses and hired third-party security firms.

This is a general lesson, not a diagnosis. A second factor protects only the requests where the server checks it.

Testers confirm the final withdrawal is re-checked and that 2FA results cannot be reused across actions. They also test address whitelisting, parallel request races, recovery flows and token expiry.

Guardian's WebApp Pentest maps your app function by function at every privilege level, then attacks authentication, access control, value-moving flows and business logic.

Crypto.com's monitoring and address delay are worth copying. Read the full article, or talk to Guardian at guardian.security about testing your withdrawal flows.

The Crypto.com hack is a clear case of a security control that existed and did not hold.

Two-factor authentication (2FA) was mandatory for all Crypto.com users, TechCrunch reported. Yet in January 2022, the company found withdrawals approved on 483 users' accounts without the second factor.

Here is what Crypto.com and reporters published, and what it means for any team that runs login and withdrawal flows.

What Happened

On Monday, January 17, 2022, Crypto.com's risk monitoring flagged unauthorized activity on a small number of accounts.

In its words, "transactions were being approved without the 2FA authentication control being inputted by the user."

It halted all withdrawals. Its withdrawal infrastructure was down for about 14 hours, it later said.

Users said online that funds had been taken. The company at first referred only to an "incident," TechCrunch reported.

On January 19, CEO Kris Marszalek confirmed the breach on Bloomberg TV. He said around 400 accounts were affected, Decrypt reported.

On January 20, Crypto.com published an incident report. It put the count at 483 users, TechCrunch and The Register reported.

That report is no longer on Crypto.com's site. This post quotes it as TechCrunch, The Register, Decrypt and Cointelegraph reported it.

What Crypto.com Disclosed

Crypto.com's report did not say how the attacker got past 2FA. The company declined to comment further to The Register, and it named no attacker.

The report did describe the fixes, on the 2FA layer and the withdrawal address step:

• It revoked every customer 2FA token, so all users had to set up 2FA again.
• It moved to "an entirely new 2FA infrastructure," Decrypt reported.
• It added a 24-hour delay between adding a whitelisted address and the first withdrawal to it.
• It began notifying account holders when a withdrawal address is added.
• It ran an internal audit and hired third-party security firms, TechCrunch reported.

It also said it would move toward "true multi-factor authentication," with no timeline given, TechCrunch reported.

Timeline and Loss

The report listed unauthorized withdrawals of 4,836.26 ETH, 443.93 BTC and about $66,200 in other currencies, The Register and Decrypt reported.

TechCrunch valued the total at over $34 million at then-current prices. Decrypt put it at roughly $33.84 million.

Before the report, PeckShield had estimated at least 4,600 ETH, about $15 million, Decrypt reported. PeckShield said half of the stolen funds went to the Tornado Cash mixer.

Crypto.com said it stopped "the majority" of the unauthorized withdrawals and fully reimbursed customers in all other cases, The Register reported.

It did not tell The Register how much it spent on reimbursements, so its net loss is not public.

What It Shows

The root cause is not public. What follows is a general test list, not a diagnosis of this incident.

A second factor protects only the requests where the server checks it. These are the places testers look when 2FA exists but may not hold:

• The final withdrawal request is not re-checked for the second factor on the server.
• A 2FA result from one action is accepted for another.
• Adding a withdrawal address and withdrawing check different things.
• Two parallel requests race past a single check.
• Recovery or reset flows issue a new factor without strong proof.
• Session or 2FA tokens stay valid after they should expire.

Two of Crypto.com's own measures are worth copying. Its monitoring flagged the activity, and it added a 24-hour wait on new withdrawal addresses.

Our guide to exchange withdrawal security controls walks each check between request and signature.

For credentials that stayed valid after they were stolen, see the 3Commas API key leak.

How Guardian's WebApp Pentest Tests This

Guardian's WebApp Pentest starts from this premise: "Your app decides who is authenticated and whether a withdrawal proceeds."

Guardian attacks those decisions in the flows where being wrong costs money. The engagement covers:

• Authentication: login and recovery, session lifetime, token handling, and server-side 2FA on the actions that matter.
• Authorization: horizontal and vertical access control, and whether one user can reach another's resources.
• Value-moving flows: withdrawals, transfers and settings changes, tested for step order, replay, races and confirmations.
• Business logic: steps skipped, reordered or run twice, and limits enforced only in the interface.

Guardian maps the application function by function at every privilege level, then tests each one. Source access is strongly recommended so nothing user-reachable is missed.

Guardian's Pentests page cites this incident for the WebApp Pentest: "The control existed and did not hold."

For the wider exchange picture, read our guide to crypto exchange pentesting.

Frequently Asked Questions

How did hackers bypass 2FA at Crypto.com?

Crypto.com's report did not say. It said only that transactions were approved without users entering 2FA. The company then revoked every 2FA token, moved to new 2FA infrastructure and added a 24-hour delay on new withdrawal addresses.

How much was stolen in the Crypto.com hack?

Crypto.com's report listed 4,836.26 ETH, 443.93 BTC and about $66,200 in other currencies taken from 483 users, The Register and Decrypt reported. TechCrunch valued the total at over $34 million at the time.

Did Crypto.com customers lose money?

Crypto.com said no. It said it stopped most of the unauthorized withdrawals and fully reimbursed customers in all other cases. It did not tell The Register what reimbursement cost, so its net loss is not public.

How do you test for a 2FA bypass on withdrawals?

Check that the server, not the interface, requires the second factor on every value-moving request. Then try to skip, replay, reorder and race each step, including address whitelisting, recovery and session renewal.

Sources

• TechCrunch: 2FA compromise led to $34M Crypto.com hack (January 20, 2022)
• The Register: Crypto.com now says someone tried to drain $34m from hundreds of accounts (January 20, 2022)
• Decrypt: Crypto.com Confirms Exchange Lost Nearly $34M to Hackers (January 20, 2022)
• Cointelegraph: Crypto.com shares details on security breach: 483 accounts compromised (January 20, 2022)