Hackers Steal Customer Data of Circle, BlockFi and Other Large Encryption Companies Through a Third Party
This article comes fromDecrypt, original author: Jeff John Roberts
Odaily Translator | Nian Yin Si Tang
Odaily Translator | Nian Yin Si Tang
Cryptocurrency companies invest heavily in cybersecurity, but hackers can still "succeed" by attacking third-party providers. That’s what happened when Circle, BlockFi, Pantera Capital, NYDIG, and other high-profile crypto companies disclosed over the weekend that their customer data had been hacked.
In an email to customers, the companies disclosed that they were notified by marketing and sales platform Hubspot that a hacker had accessed customers' personal data.
"Pantera uses Hubspot as a customer relationship management platform...information that may have been accessed includes name, email address, mailing address, phone number, and regulatory classification," Pantera Capital wrote.
HubSpot's article on the weekendblog postblog post
Calling the attack a "targeted incident against clients in the cryptocurrency industry," it said a "bad actor" had compromised an employee's account.
Hubspot added that "data was exported from less than 30 Hubspot portals," without providing a list of which customer accounts were compromised.
The identities of some of the affected companies were made public because the companies themselves alerted their customers—a common practice to alert those customers while reducing the legal risk of such incidents. Such incidents could end up with some class-action lawsuits and fines from regulators like the Federal Trade Commission.
It's unclear how comprehensive the hack was, in part because HubSpot hasn't disclosed how much data was stolen. But considering companies like BlockFi and Circle have millions of customers, the hack could be significant.
In the case of Circle, the company said: "Neither customer funds, financial transaction data, nor KYC data were affected," but added that customer contact information was stolen.
At the same time, BlockFi and Swan Bitcoin clarified that their operations were not affected, the Treasury was not at risk, and passwords and other content information were not affected because of Hubspot’s data breach. is an external tool so hackers cannot gain access to internal systems.
It's unclear what the hackers intended to do with the data. In many cases, hackers sell stolen customer data on darknet forums, where criminals buy it for further hacking or phishing scams.
In the case of HubSpot, hackers or other scammers may have used contact information such as email addresses to guess victims' passwords and steal their cryptocurrency.
Circle also mentioned phishing in an email to customers, but it didn't directly say it would lead to an attack.
Oren Falkowitz, founder of Area 1, an anti-phishing service recently acquired by Cloudflare, believes phishing was the source of the incident.
