Crypto.com’s Secret? A Breach and a Cover-Up! 🕵️♂️

Key Takeaways: Because Who Doesn’t Love a Good Secret? 🤫

Were Crypto.com customer funds affected? 🧠

No, Crypto.com confirmed that no customer funds were accessed or at risk. Only a very small number of users’ partial personal information was affected. Because nothing says “security” like letting hackers take your grandma’s address. 🏠

Did Crypto.com disclose the breach publicly? 🧐

No, the company did not publicly notify the impacted users, which drew criticism from blockchain investigator ZachXBT. Because who needs transparency when you can have a secret society of data thieves? 🤡

Crypto.com reportedly suffered a previously undisclosed data breach linked to the Scattered Spider hacking group, raising concerns over its security posture. Because nothing says “trust us” like a group of hackers with a catchy name. 🕷️

Details of the attack: A Teenage Dream Gone Wrong 🧑‍🎓

According to a Bloomberg investigation, the attack involved teenage hackers, including 18-year-old Noah Urban from Florida, who specialized in phishing employees at telecom, tech, and cryptocurrency firms. Because nothing says “I’m a hacker” like being 18 and using phishing. 🎉

Urban and his collaborators accessed sensitive user information. The group previously targeted MGM Resorts and other corporations. Because why stop at crypto when you can take down a casino? 🎰

Crypto.com acknowledged that the breach impacted “a very small number of individuals” but emphasized that no customer funds were compromised. Because “very small” is the new “none.” 🤷‍♂️

Crypto.com’s response: Denial is Not Just a River in Egypt 🏺

Despite this, the company did not notify the affected users publicly. Because who needs to worry about a little privacy when you’re a multi-billion-dollar crypto company? 🤑

Remarking on the same, Crypto.com CEO, Kris Marszalek, noted, 

“Any suggestion that we did not report or disclose a security incident is completely unfounded – as we reported in a NMLS Notice of Data Security incident filing and in additional reports with the relevant jurisdictional regulators, we detected a phishing campaign that targeted one of our employees in 2023.”

Marszalek stated that the incident was contained within hours, with no customer funds ever at risk, and only a very limited number of users’ partial personal information was affected. Because “limited” is just a fancy word for “a few people’s data is now on the dark web.” 🌌

He even emphasized the company’s “security-first” culture. Because nothing says “security” like a CEO who’s more concerned about PR than actual protection. 🛡️

What does ZachXBT have to say about this breach? 🧠

However, blockchain investigator ZachXBT took to X to call out Crypto.com for not disclosing the data breach. He said,

“Your team covered up a breach that impacted the personal information of your users.”

He added, 

“They’ve been breached several times.”

That being said, the Crypto.com breach was part of a larger criminal campaign orchestrated by the Scattered Spider group, which had evolved from simple SIM-swapping to sophisticated corporate infiltration. Because hacking is just a hobby for these guys. 🕵️♂️

Florida native Noah Urban, then a teenager, acted as a “caller” inside the group, persuading employees to hand over credentials that unlocked internal systems. Because nothing says “I’m a hacker” like being a teenager and a “caller.” 🎤

Broader criminal campaign: A Tale of Two Hackers 🧑‍💻

The attack happened before March 2023. Urban was arrested nine months later, in January 2024, and charged with hacking 13 companies. Because if you’re going to hack, might as well go big. 🚀

Authorities said the group also misused United Parcel Service data. Because why just steal crypto when you can steal packages too? 📦

Following indictments of Urban and four accomplices, he pled guilty to wire fraud and aggravated identity theft. Because nothing says “I’m sorry” like a 10-year prison sentence. 🛑

It resulted in the seizure of $4.8 million in crypto, $13 million in restitution, and a 10-year prison sentence with additional supervised release. Because justice is served… eventually. 🕊️

Read More

2025-09-22 14:24