Cyber Incident Victim: CoinPouch
Date:
Nov 2017
Location:
United States of America
Summary
Hackers stole over $655,000 worth of Verge cryptocurrency from a digital wallet service, with both the service provider and the cryptocurrency project confirming the breach but disputing its origin—the former attributing it to a compromised node and the latter citing inadequate security practices by the wallet. The incident began after initial user reports of stolen funds, prompting collaborative investigations and security adjustments that failed to prevent further unauthorized access. The stolen assets, totaling 126 million Verge coins, remained in a traced wallet post-theft, though the exact attack vector remained unclear to both parties. Independent auditors investigated the breach, which was later characterized as a third-party security failure, marking the second major cryptocurrency wallet compromise within weeks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 9, 2017, a CoinPouch wallet user reported unauthorized theft of funds, prompting CoinPouch to initiate an investigation in collaboration with Justin, the Verge project lead. Initial assessments concluded the incident "did not look like a hack," though Verge recommended security modifications to CoinPouch's Verge node infrastructure. Despite implementing these changes, CoinPouch subsequently received additional user reports of malfunctioning Verge wallets within its platform. The breach was later confirmed by both parties, with hackers stealing 126 million Verge coins valued at over $655,000 (£490,000). Verge traced the stolen funds to a specific wallet address where they remained inactive, though the reason for the hackers' inactivity was unspecified. CoinPouch attributed the breach to vulnerabilities in Verge's node system, while Verge countered that CoinPouch's application lacked proper security measures. Neither party conclusively determined the attack vector during initial investigations.
CoinPouch publicly disclosed the incident via Twitter, notifying users of law enforcement engagement and forensic analysis delays due to the U.S. Thanksgiving holiday impacting investigators and legal teams. Independent auditors were enlisted to examine the breach, with CoinPouch emphasizing that affected users had assumed risk by entrusting private keys to a third-party wallet. The company acknowledged the hack originated from inadequate security protocols on their operational side, contradicting their earlier allegations against Verge. This marked the second major cryptocurrency wallet compromise reported in November 2017, following the Tether exchange breach. No fund recovery or further technical explanations were provided in available updates, leaving the final disposition of the stolen assets unresolved.