‘My Coins Vanished Without Me Knowing’: About $72,000 Stolen From Pravang Exchange Leaves Users Reeling

Crypto exchange hacked again as about $72,000 is drained from digital wallet

Attacks targeting financial firms keep coming

Digital-asset theft reported at Pravang

Bithumb and Gopax also face repeated data leaks

“The target is expanding from personal data to assets”

A string of cyberattacks targeting South Korea’s financial sector has now led to the theft of customer assets from a cryptocurrency exchange. While recent breaches in the industry had largely involved intrusions into internal systems or leaks of personal information, this case involved coins being withdrawn from an internet-connected crypto wallet. The incident is heightening concern over security at digital-asset exchanges after hackers moved beyond data theft and took customer funds.

Hackers Stole the Coins Too

Pravang said on its website on Oct. 29 that an unauthorized external party had stolen customer assets. The exchange confirmed that digital assets worth about 100 million won ($72,000) were withdrawn from its hot wallet on Oct. 24. Pravang is a crypto-only exchange that does not handle won-denominated trading. Earlier this month, it suffered a hack that exposed personal information, and now customer assets have also been stolen. A Pravang official said the company plans to determine the exact amount of the loss and fully compensate customers.

A hot wallet is operated in an internet-connected environment so that crypto deposits and withdrawals can be processed quickly. That makes it more vulnerable to cyberattacks than a cold wallet, which is kept offline and separated from external networks. If access permissions for the wallet management system or transaction approval procedures are compromised, attackers can divert digital assets to external wallet addresses. It has not yet been confirmed how the hacker entered the system and stole the assets in this case.

Security incidents are continuing at larger exchanges as well. Bithumb, South Korea’s second-largest crypto exchange, said on Oct. 28 that an unauthorized external party had accessed its internal mobile groupware system, exposing personal information, and that it had started an investigation. Groupware is an internal business system employees use to share work materials and process electronic approvals. It is distinct from the wallet system that directly manages customer assets, but leaked internal account credentials or business information could still be used for follow-on attacks. A security industry official said companies also need to prepare for the possibility of “lateral movement,” in which hackers use stolen account information to try to access other internal systems.

Hacking Threat Spreads Across the Sector

The number of hacking incidents reported this year in the financial sector is already approaching the total number submitted to the Financial Supervisory Service over the past several years. According to data that ruling People Power Party lawmaker Park Sung-hoon obtained from the regulator, 19 hacking incidents involving banks, securities firms, insurers, card companies and savings banks were reported to the Financial Supervisory Service from 2022 through last year, including multiple cases involving the same company. There were seven cases last year.

Security experts said blocking the initial intrusion is only part of the response and that identifying traces left behind in internal systems is equally important. Once hackers successfully breach a system, they can use malware or stolen account privileges to launch additional attacks. Kwak Jin, a professor in the Department of Cyber Security at Ajou University, said companies should check for malware or compromised privileges and consider ways to strengthen administrator access controls.

Park Si-on, Hankyung.com reporter ushire908@hankyung.com