Hack details revealed: immediate reaction of CoinsPaid prevented clients’ losses
As a result of a hybrid attack on our company, which involved elements of social engineering, aggressive bribery attempts of critical personnel, and attacks on numerous internet-accessible applications, the attackers managed to identify a vulnerable application that was not directly involved in service provision. By exploiting this vulnerability, some components of our infrastructure in the transactions chain were compromised, and attempts were made to alter data in transactions.
We want to assure our clients that while the vulnerability has been successfully fixed, and security has been restored, specific technical details will not be publicly disclosed due to security reasons.
Currently, CoinsPaid payment gateway is operating normally. All transactions that were queued during the downtime period are being processed manually to ensure accuracy and prevent any potential losses. We apologize for any inconveniences caused.
In response to the attack attempt, the CoinsPaid team took immediate and comprehensive security actions to safeguard our clients’ funds, including:
- Temporarily stopping automatic transactions and transitioning withdrawals to manual processing.
- Moving the company’s unaffected operational funds to cold wallets.
- Transferring the system to a new isolated environment on a new server infrastructure.
- Changing all secret keys and wallet addresses.
- Implementing continuous AI monitoring to detect any anomalous activities.
- Conducting full system and company security audits, and more.
For the long term, we have devised a robust security plan to ensure top-notch protection, including:
- Implementing best practices and obtaining ISO27001 certification.
- Aligning applications with OWASP ASVS requirements and adapting development processes to OWASP SAM requirements.
- Implementing enhanced authentication with FIDO2 standards.
- Conducting a full hardware security review, including employees’ hardware.
- Conducting external security audits by White Hackers and Bug Bounty programs.
- Deploying new tools for continuous traffic analysis and immediate response to possible infrastructure attacks.
- Ensuring continuous team training and compliance with the highest safety standards, and more.
Despite this significant incident, which has affected our profits, CoinsPaid remains a resilient business committed to delivering first-class innovative payment solutions while upholding the highest security standards. We will continue to prioritize the safety of our clients and their assets.
About CoinsPaid
CoinsPaid is a crypto payment ecosystem enabling businesses to accept cryptocurrencies. Aside from a crypto payment gateway, the ecosystem includes a business wallet, OTC desk, SaaS solution, and CoinsPaid Media. CoinsPaid counts over 230 employees from 30 countries and operates in Europe and Latin America.
