Crypto.com published a postmortem on Thursday revealing that 483 user accounts were compromised in a security breach that occurred on January 17. The unauthorized withdrawals totaled 4,836.26 ETH, 443.93 BTC, and approximately $66,200 in other cryptocurrencies. Based on market prices at the time of writing (Bitcoin at $42,083.95, Ether at $3,178.94), the stolen crypto assets were worth over $34 million. Despite the significant value, the company stressed that all affected users have been fully reimbursed and that customer funds were never at risk.
CEO Comments and Security Measures
CEO Kris Marszalek discussed the incident in a Bloomberg interview, noting that Crypto.com invests heavily in cybersecurity with 200 professionals worldwide who built a multi-layered infrastructure. However, some of those layers were breached in this particular attack. He stated that the platform was back online within 13 to 14 hours, and all affected accounts were fully refunded the same day. "One has to remember that given the scale of the business, these numbers are not particularly material and customer funds were never at risk," Marszalek added.
Worldwide Account Protection Program (WAPP)
To bolster trust, Crypto.com announced the Worldwide Account Protection Program (WAPP) alongside the postmortem. The program offers additional protection for user funds held in the Crypto.com app and exchange, restoring up to $250,000 for qualified users. The CEO emphasized that this is one of several new security layers being implemented, along with new programs designed to prevent future breaches.
Regulatory and Future Outlook
When asked about regulator involvement, Marszalek said that at this stage, Crypto.com has not received any outreach from the Monetary Authority of Singapore (MAS). However, as a regulated business in multiple jurisdictions, the company is preparing a report to share with regulators upon inquiry. He concluded that the incident served as a valuable lesson and that Crypto.com will continue strengthening its infrastructure. The hack, while quickly contained, highlights the persistent security challenges faced by centralized cryptocurrency exchanges.