Cryptocurrency payment platform Alphapo has fallen victim to hackers, losing at least $31 million from its hot wallets. The attack targeted assets on the Ethereum, TRON, and Bitcoin blockchains, though the amount of Bitcoin stolen remains uncertain, reports suggest that the overall losses may surpass $100 million.
The hack was first identified by the popular on-chain sleuth, ZachXBT, who traced the stolen funds as they were moved across various blockchains. It appears the hacker initially stole the funds on the Ethereum network, later converting them to ETH before transferring them to the Avalanche and Bitcoin blockchains.
Earlier today Alphapo hot wallets were drained for $23M+ on ETH, TRON, BTC.
HypeDrop (Alphapo customer) has since had withdrawals disabled.
On Ethereum the stolen funds were swapped for ETH then bridged to Avalanche and Bitcoin. pic.twitter.com/pj7i3ZlBrX
— ZachXBT (@zachxbt) July 23, 2023
Alphapo is a payment processor for more than 30 digital assets, and it is widely known for being the crypto gateway to several gambling platforms, including HypeDrop, Ignition, and Bovada. The company claims to help businesses to use virtual currencies as a payment method.
HypeDrop Suspends Transactions Amidst Alphapo Hot Wallets’ Hack
As a result of the security breach, HypeDrop, one of Alphapo’s customers, suspended its crypto transactions. The platform assured its users that their funds were secure but attributed the issues to disruptions caused by the hack.
🚨 An update!
We apologize for any inconvenience caused recently by the ongoing deposit and withdrawal issues. Please know that your HypeDrop funds are safe, but we encountered an issue on the cryptocurrency provider's side.
Once the provider's operations resume, processing…
— HypeDrop (@HypeDrop) July 23, 2023
As HypeDrop suspended withdrawals, it cited issues with the third-party service provider, explicitly affecting BTC, ETH, and TRX transactions. Despite the inconvenience, the platform assured users that their funds were safe. HypeDrop tweeted,
”Once the provider’s operations resume, processing deposits will be credited accordingly. However, pending crypto withdrawals will remain stuck as ‘Pending’ until the provider resolves the issue and later cancelled, requiring a new request in order to have them processed.”
Meanwhile, blockchain security firm PeckShield collaborated with ZachXBT’s findings, revealing the staggering scale of the stolen assets: the hackers had managed to steal about 12 million USDT, 108,000 USDC, 100.2M FTN, 430K TFL, 2.5K ETH, and 1,700 DAI. Additionally, approximately 5.2 million TRX were moved to specific addresses
The investigation into the Alphapo hack is ongoing, with security experts actively investigating the incident. One potential cause under consideration is the leakage of private keys, but conclusive details are yet to be revealed.
This security breach adds to a string of hacks and exploits that rocked the crypto world in July, with over $100 million stolen across various blockchain projects. A report from TRM Labs shows that as of July 2023, the total amount of cryptocurrency that has been hacked in 2023 is $313 million.
