Enigma, a decentralized cryptocurrency marketplace was compromised by hackers ahead of its ICO date with hackers nabbing over 1,500 Ethereum valued at over $500,000.
As recently as last month, a breach in CoinDash’s ICO was reported. The attackers were able to change the address of the website and make over $9 million. By comparison, the losses accrued by the Enigma community are not as severe, but the attacks itself was sophisticated enough to take over Enigma’s website, admin passwords, email newsletter and Slack account. A fake pre-sale page was created by the attacker, which linked to a bogus ETH address, tricking users into sending their funds.
Enigma is a project started by MIT graduates whose ICO was scheduled for September. The company itself did not lose any money, the attacker having only managed to get his hands on the company’s website, mailing list, and Slack group.
Enigma Hacked
Once Enigma was compromised along with its social accounts, the attacker proceeded to distribute emails and post slack messages, urging Enigma’s community to send their funds to his Ethereum address. Claiming their pre-ICO is opened for its community, furthermore coming from a reputable and trustworthy source as Enigma itself, the hacker had provided an effective incentive for people to fiddle with their funds. The emails that were initially sent stated its ICO had a hard cap of $20 million:
Enigma took adequate actions accordingly with the ETH address being altered to display a warning message urging users not to use the link and let their funds be stolen. The message was quickly distributed around the community via Enigma’s social media. Nonetheless, 200 transactions had already taken place and soon after the hacker had initiated relocating its Ether booty to various other addresses.
Furthermore, in response to the incident Enigma took their websites and Slack group offline, updating their community through Telegram and Twitter. Funnily enough, once the website was taken offline, the hacker attempted to justify why it was taken down with the reason being that it was receiving a lot of traffic.
How Did Enigma Get Compromised?
In a Reddit post, a user going by the username of “iCantHack” found out that Enigma CEO Guy Zyskind’s email had been compromised by the attacker and had led to the whole intrusion taking place. According to reports, his email had been compromised and obtained by hackers in the past, hence dumped on the internet due to other services having been infiltrated in the past. Allegedly, Zyskind never changed his password after these occurrences and neither did he enable his two-factor authentication security process.
In an attempt to reassure its users, the company has added that extra precautions and security measures have been implemented, including sophisticated and complex passwords as well as two-factor authentication. Nevertheless, the intrusion has stained Enigma with embarrassment considering that as recently as last month, one of Enigma’s co-founders wrote an article for Business Insider elaborating on his “one way” tip in preventing cyberattacks occurring during initial coin offerings (ICO). An estimated $1.2 have been made by ICOs. A logical deduction would be to consider cyber-attacks as an inevitable aspect of such a large-scale cryptocurrency business.
This is the fourth Ethereum and cryptocurrency related data breach in the last month. Previous compromised cryptocurrency dealing platforms include $7 million worth of Ethereum from CoinDash token sale site; $32 million worth of Ethereum from 3 Multisig Wallets; and $8.4 worth of Ethereum from ICO stolen in Veritseum hack. Final word of advice, if you are dealing in digital currency, always confirm with other before sending your funds away
