Jack Kong, former chairman of China-based computer hardware manufacturer Canaan, has disclosed a hack of a cryptocurrency project that he has invested in.
The hacker was reportedly an insider from the crypto project and fled to Thailand following the crime. “The hacker fled to Thailand but he was arrested and returned to China within 48 hours after working with the Chinese police,” a Tweet by Wu Blockchain read.
“The insider hacker has been lurking for a long time, secretly photographing passwords and changing hardware wallets.”
Kong wrote on Oct. 1 that the crypto project imToken immediately investigated the issue and initially believed that it might have been phished.
“At first, there was no suspicion that it was an internal crime. Even if imtoken gives a conclusion that it excludes the possibility of fake wallet clients, authorized fraud, and Lido phishing, it is impossible the team has no particular target of suspicion.”
Kong personally received the information from the project team regarding the attack and immediately assisted the team in contacting several institutions.
“However, due to the uncertainty about the recovery of the funds, I decided to reduce the investment in full,” he added.
An Insider Threat
Kong noted that a few hours later, another breach was reported from “another large wallet.” Only after this, the project team began to further investigate the possibility of an insider hack and reported the case, he added.
A case was filed by the police the next day, Kong’s translated Tweet read. With the help of crypto exchange Bitmart and blockchain security platform Slow Mist, the crypto project assisted the police by issuing substantiation letters to different platforms.
“The suspect tried to cash out some Thai baht through a website, thinking that no one would be able to find out. The suspect has been detained by the Chinese police in the mainland.”
Kong warned the hackers that as long as they try to cash out stolen funds, there would be a way to track them down, “unless you take these coins to the grave!”
He further suggested that whenever a theft occurs, companies should explore the possibility of both internal and external crime at the same time.
Safety Education for Users
Kong urged crypto firms to establish safety education, including a practical “real theft simulation training and prevention.”
“When it comes to security education, many people have no personal experience.”
He suggested that capable institutions and individuals should come together to form a “security DAO.” This would help experienced teams participate in education, training and tracing, which can speed up the investigation process and recover stolen assets before the hackers attempt to cash out.
His post further confirmed that nearly 100% of the stolen funds were recovered. “A very small part and the GAS lost during the coin laundering process were not recovered,” Kong added.
