Cyber Incident Victim: Taylor
Date:
May 2018
Location:
United States of America
Summary
A hacker compromised a cryptocurrency trading platform by gaining unauthorized access to one of its devices and a secured password file, resulting in the theft of approximately $1.35 million worth of Ether and an undisclosed quantity of proprietary tokens. The stolen assets were funneled through multiple addresses to a centralized wallet previously linked to another high-value cryptocurrency theft. Following the breach, the attacker attempted to liquidate stolen tokens on a trading platform, prompting developers to temporarily suspend trading to prevent further monetization—a measure that also restricted legitimate token holders from accessing their investments. The incident impacted both the company’s operational funds and its token reserves, excluding only vested holdings.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 22, 2018, an unidentified hacker compromised the cryptocurrency trading application Taylor by gaining unauthorized access to one of the company's devices and seizing control of a 1Password file containing sensitive credentials. This breach resulted in the theft of 2,578.98 Ether (valued at approximately $1.35 million at the time) from Taylor's wallets. Additionally, the attacker stole TAY tokens allocated to the project's Team and Bounty pools, though the exact quantity of stolen tokens was not disclosed by the developers. Only tokens in the Founders’ and Advisors' pools remained secure due to vesting contracts that temporarily restricted access. The stolen funds were systematically transferred through multiple intermediary addresses before consolidating into a primary wallet identified as 0x94f20ccff70d82d1579d8B11f2985F8dE9B287Cf.
Taylor developers discovered the breach shortly after its occurrence and observed subsequent attempts by the attacker to liquidate portions of the stolen TAY tokens on cryptocurrency exchanges. In response, the team contacted the IDEX trading platform to request an immediate delisting of TAY tokens, aiming to obstruct the hacker's ability to convert the remaining stolen assets into other cryptocurrencies. This action inadvertently froze all legitimate trading activity, preventing investors who participated in Taylor's initial coin offering from accessing or exchanging their holdings. The company publicly linked the attack to a previous March 2018 theft of over 17,000 Ether ($9 million) from the CypheriumChain project, citing the identical destination wallet address as evidence of a potential connection between the two incidents. The breach left Taylor's operational funds depleted and created uncertainty regarding the recoverability of both Ether and TAY tokens, significantly disrupting the project's financial infrastructure and investor ecosystem.