Investigating $200 Million BitMart Hack

by Arthur · August 11, 2022

The Federal Trade Commission [FTC] is investigating the operators of crypto exchange BitMart over the December 2021 hack that led to consumer losses of around $200 million.

According to reports, this case makes it the agency’s first known investigation into crypto markets. Bloomberg revealed,

“The investigation was revealed Wednesday in an FTC order denying a bid by BitMart operators Bachi.Tech Corporation and Spread Technologies LLC to block the agency’s attempt to compel them to hand over information.

The companies, for their part, had argued that the FTC’s document request was “much too broad” and that some of the information was located overseas.

Notably, the regulatory body had issued civil summonses to BitMart operators in May. They had sought information about how the companies have handled customer complaints and what they told consumers about the security of crypto assets. Using these details, the agency is likely to take a call on whether the firms are engaging in unfair/deceptive business practices.

Alongside, the Bloomberg report also revealed,

“The FTC also said it was investigating whether the BitMart operators complied with another federal law that requires financial institutions to protect sensitive customer data.”

BitMart Hack: Quick Review

The hack essentially materialized when the perpetrators stole a private key who opened two hot wallets. The stole $100 million worth of various cryptos on the Ethereum blockchain, and $96 million on the Binance Smart Chain.

1/4 In response to this incident, BitMart has completed initial security checks and identified affected assets. This security breach was mainly caused by a stolen private key that compromised two of our hot wallets. Other assets with BitMart are safe and undamaged.

— Sheldon Xia (@sheldonbitmart) 6 December 2021

The hackers had used decentralized exchange aggregator 1inch to exchange stolen tokens for Ethereum. They had then deposited the said funds into privacy mixer Tornado Cash to hide their identity.

Footnote

Per Bloomberg, if the FTC finds that the companies misled users about their cybersecurity protections or failed to comply with financial services laws,

“… it can impose fines and place them under a consent decree requiring them to change their practices.”

Also Read: Hotbit Crypto Exchange Suspends Service After Subpoena