Hackers stole $41M worth of crypto assets from crypto gambling firm Stake

Crypto gambling site Stake suffered a security breach, and threat actors withdrew $41M of funds stolen including Tether and Ether.

Researchers reported abnormally large withdrawals made from the crypto gambling site Stake to an account with no previous activity, a circumstance that suggests that threat actors have hacked the platform and stolen crypto assets, including Tether and Ether.

Stake.com offers traditional casino games (such as slots, blackjack and roulette) and sports betting. It offers video streams with live dealers. Users on Stake.com typically do not deal with traditional currencies, instead they deposit and withdraw cryptocurrencies to and from their betting account. Account balances can be withdrawn in the equivalent value of cryptocurrency and then deposited back into the user’s personal cryptocurrency wallet.

The crypto gambling site confirmed the attack on Twitter:

“Three hours ago, unauthorised tx’s were made from Stake’s ETH/BSC hot wallets” reads the statement. “We are investigating and will get the wallets up as soon as they’re completely re-secured. User funds are safe. BTC, LTC, XRP, EOS, TRX + all other wallets remain fully operational.”

The withdrawals were made on September 4, and the account used by the threat actors was called “Stake.com Hacker” by Etherscan.

“Crypto gambling site Stake experienced $41 million in withdrawals on Sept. 4 in what blockchain security analysts have called “suspicious outflows.” The withdrawing account has been labeled “Stake.com Hacker” by Etherscan, implying that the drained funds may be the result of a stolen private key.” reads the report published by the CoinTelegraph.

Smart contract audit service Beosin reported that the attackers also drained funds using other chains, including 17.8 M from BNB Smart Chain (BSC) and 7.8M from Polygon.

The analysis of the Blockchain data reveals that threat actors performed very large withdrawals from Stake.com contracts into the alleged attacker’s account.

Once the attackers drained the funds, they distributed them to multiple accounts.

Ed Craven, Stake co-founder, attempted to reassure their clients explaining that only a small portion of its crypto reserves is maintained in hot wallets.

The company will restore the affected wallets shortly.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, crypto gambling)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.