Crypto.com Finally Admits It Lost $30 Million in a Hack (2024)

As Russia continues to teeter on the brink of invading Ukraine, IT administrators in the beleaguered country and researchers have discovered destructive data wiping malware posing as ransomware and lurking in a number of Ukrainian networks. The situation evokes past devastating Russian malware campaigns against Ukraine—including the infamous NotPetya attack in 2017.

Elsewhere on the continent, Austria’s data regulator recently concluded that using Google Analytics is a breach of the European Union's GDPR privacy regulations. The decision could set the tone in other countries and for other analytics services, and could send ripples throughout the entire cloud.

A pair of vulnerabilities in Zoom, now patched, could have exposed the ubiquitous video conferencing service and its users to zero-click, or interactionless, malware attacks. And a flaw in iOS 15 that Apple has known about since November has been exposing users' web browsing activity. On the other hand, though, Apple's new iCloud Private Relay feature, that can shield your browsing activity from prying eyes, is in beta and you can try it now.

And there's more. Each week we round up all the security news WIRED didn’t cover in depth. Click on the headlines to read the full stories.

Crypto.com Finally Confirms That Hackers Stole $30 Million Worth of Cryptocurrency

The massive international cryptocurrency exchange Crypto.com finally confirmed this week that a hacker made off with $30 million-worth of cryptocurrency stolen from 483 users' digital wallets. The company initially called the situation “an incident" and said that "no customer funds were lost." Hackers stole 4,836.26 ETH, roughly $13 million, 443.93 BTC, roughly $16 million, and about $66,200-worth of other currencies. The exchange said that in most cases it “prevented the unauthorized withdrawal,” and added that in the other cases it reimbursed customers for their losses. Crypto.com says it has implemented additional security protections and has called in third-party auditors to further assess its security. The company did not provide specific details about the improvements.

Israeli Police Allegedly Used NSO Spyware Against Citizens

The Israeli business and technology news site Calcalist published an investigation this week alleging that Israeli law enforcement used NSO Group’s Pegasus spyware to surveil citizens including prominent members of a protest movement opposed to former Israeli Prime Minister Benjamin Netanyahu, former government employees, and mayors. The police broadly denied the report, but on Thursday, Israeli attorney general Avichai Mandelblit told the chief of police that he is launching an investigation into the claims. “It is difficult to overstate the severity of the alleged harm to basic rights” if Calcalist's conclusions are found to be true, Mandelblit wrote to Israel Police Commissioner Kobi Shabtai.

Nigerian Police Arrest 11 Alleged Business Email Compromise Scammers

Interpol announced this week that Nigerian law enforcement arrested 11 suspected business email compromise scammers in mid-December. Some are allegedly members of the notorious SilverTerrier BEC group. BEC is a dominant type of online scamming in which attackers use lookalike email accounts, fake personas, and phishing to trick businesses into sending money to the wrong places. Often this is done by compromising an email account within a target organization to make a ruse look more legitimate. Interpol said this week that after evaluating the devices of the 11 suspects, it has linked them to scams that victimized more than 50,000 targets. One suspect alone allegedly possessed more than 800,000 potential victim website credentials, Interpol said, while had access inside 16 companies that were actively sending money to SilverTerrier-linked accounts.

Biden Administration Leans on NSA to Help Secure Sensitive Federal Networks

President Joseph Biden signed a memorandum this week to broaden the National Security Agency’s responsibilities for defending United States government computer networks. The directive particularly focused on sensitive federal IT infrastructure among the Department of Defense, intelligence agencies, and their contractors. The measure mandates security best practices like implementing encryption, supporting two-factor authentication, adding network detection capabilities, and using other cloud defense mechanisms. The memo essentially syncs requirements for national security agencies with an executive order from May that set security standards for civilian agencies.