Crypto.com halted withdrawals on Monday and required users to sign back in and reset 2FA; research shows it lost 4,600+ ETH, worth ~$15M, in a presumed hack
The crypto exchange has reportedly lost at least $15 million in Ethereum, and security experts believe the true losses could be much higher.
DecryptAndrew Asmakov
Context & Ripple Effects
Crypto.com’s emergency account-security measures became the opening stage of an incident whose reported scope was later revised: the company said 483 customers were affected and reimbursed after unauthorized withdrawals totaling about $33.84 million.
The episode also followed BitMart’s hot-wallet breach, making custodial security—not just trading access—a visible point of comparison among crypto exchanges.
First-order effects
Crypto.com users faced interrupted withdrawals and had to re-authenticate and reset two-factor authentication while the exchange contained the suspected compromise.
Crypto.com assumed the immediate burden of investigating the Ethereum losses and restoring affected account balances; its subsequent disclosure says customers were reimbursed.
Second-order effects
The later $33.84 million disclosure raised the incident’s reported scope beyond the initial research estimate, increasing the importance of Crypto.com’s reimbursement commitment for customer trust.
BitMart and Crypto.com incidents put centralized exchanges’ wallet controls and incident-response practices under closer scrutiny from customers choosing where to custody crypto assets.
Third-order effects
Repeated exchange breaches strengthen the crypto legitimacy gap: platforms that retain customer assets are judged increasingly on whether security failures are contained and losses are made whole.
If reimbursement becomes the expected response to custodial breaches, exchanges will face greater pressure to fund security and loss-coverage capabilities as part of operating a trusted platform.
The trend: Crypto exchanges are being pushed to treat custody security and rapid customer reimbursement as core competitive infrastructure, not back-office risk management.
We have a small number of users reporting suspicious activity on their accounts. We will be pausing withdrawals shortly, as our team is investigating. All funds are safe.
1/2 Earlier today a small number of users experienced unauthorized activity in their accounts. All funds are safe. In an abundance of caution, security on all accounts is being enhanced, requiring users to: -Sign back into their App & Exchange accounts -Reset their 2FA
The @cryptocom loss is about $15M with at least 4.6K ETHs and half of them are currently being washed via @TornadoCash https://etherscan.io/... https://twitter.com/... https://twitter.com/...
Update: Withdrawal services have been restored. All funds are safe. It will take time to clear the backlogs. We appreciate your patience. https://twitter.com/...
I see odd activity on one of the Ethereum hot wallets on https://crypto.com/ - https://etherscan.io/... It's a pattern, the wallets receiving look like this https://etherscan.io/..., multiple of the same transactions to a new wallet between 2-5 ETH, funds not moved after that. ht…
In an email, Crypto[.]com refused to confirm the Peckshield tweet estimating that $15 million of user funds were stolen yesterday. They stand by what their CEO said, that no user funds were stolen https://twitter.com/...
2/2 This update will be rolled out to users progressively over the next few hours. Once complete, withdrawals will be re-enabled. We understand this may be an inconvenience, but security comes first. Thank you for your support.
also in the news today: “Several users had reported on social media that their cryptocurrencies, at times equating to tens of thousands of dollars, had disappeared from their https://crypto.com/ accounts” https://www.bloomberg.com/... https://twitter.com/...
Withdrawals have been resumed. Please allow us some time to catch up with the backlog accumulated over the last couple of hours. The team also beefed up the 2FA systems to deal with increased traffic. Thank you for your patience. https://twitter.com/...
Some thoughts from me on the last 24 hours: - no customer funds were lost - the downtime of withdrawal infra was ~14 hours - our team has hardened the infrastructure in response to the incident We will share a full post mortem after the internal investigation is completed.
https://t.co/..., which froze withdrawals yesterday, announced that someone hacked the platform for $15 million in ether (4,600 ETH). This money is now being laundered through Ethereum mixer Tornado Cash in batches of 1,000 ETH https://www.coindesk.com/...
The crypto wallet company that now owns the naming rights to the Lakers arena has suspended all withdrawals because MONEY WAS DISAPPEARING from accounts https://twitter.com/...
Can hardly wait for the over-produced commercial with Matt Damon where https://crypto.com/ explains how someone hacked it and got away with $15 million in Ethereum: https://decrypt.co/...