CoinsPaid, a crypto payment platform, grapples with its second security breach within six months, as revealed by Web3 security firm Cyvers. The breach, flagged on January 6, led to the detection of multiple unauthorized transactions amounting to nearly $7.5 million.
Cyvers unearthed anomalous activity resulting in the withdrawal of $6.1 million in Tether (USDT), Ether (ETH), USD Coin (USDC), and CoinsPaid’s native CPD token. Notably, around 97 million CPD tokens valued at approximately $368,000 were exchanged for ETH and subsequently moved to external accounts and crypto exchanges, including MEXC, WhiteBit, and ChangeNOW. Further analysis uncovered illicit BNB transactions exceeding $1 million, elevating the total stolen funds to nearly $7.5 million.
Despite this substantial breach, CoinsPaid, an Estonian digital asset payment processor, has refrained from issuing public comments regarding the incident.
The company, boasting of processing over 19 billion euros in crypto transactions, previously encountered a security breach in July 2023, resulting in the theft of more than $37 billion. At that time, CoinsPaid attributed the breach to the North Korean state-backed Lazarus Group, alleging that the group utilized a deceptive job interview tactic to deploy malicious code, granting access to CoinsPaid’s infrastructure.
The Lazarus Group has been linked to various crypto hacks in 2023, with reports from blockchain intelligence firm TRM Labs estimating their total crypto thefts at least $600 million for the year.
