Trust Wallet halts Transak onramp after data breach

Trust Wallet temporarily suspended Transak’s fiat-to-crypto payment service after the Miami-based firm suffered a data breach.

According to Transak’s official statement, hackers gained compromised credentials through “unauthorized access” to a third-party employee’s laptop. The sophisticated phishing tactic used against a Transak KYC vendor allowed criminals to obtain personal data like names belonging to over 92,554 users.

Due to the recent security incident with @Transak, we’ve taken precaution and temporarily removed their onramp service from Trust Wallet for your protection. Rest assured, user’s funds remain safe as no sensitive wallet information is exposed to any of our onramp providers. Stay… https://t.co/xRB1ZB1Dtt

— Trust Wallet (@TrustWallet) October 21, 2024

More than 5 million people use Transak’s service, and less than 2% of its users were impacted, per the company’s blog post on Oct. 21. The firm said it has engaged law enforcement to help in the investigation and disclosed plans to contact all affected users.

You might also like: FBI arrests ‘AGiantSchnauzer’, the Alabama man behind SEC Bitcoin hack

Several digital asset storage providers like Trust Wallet, Metamask, Ledge, and Coinbase employ Transak’s fiat-to-crypto or onramp payment corridor to ferry value from currencies like U.S. dollars to Bitcoin (BTC) or Ethereum (ETH).

More crypto wallet companies may pause support till the situation is rectified. Still, the firm stressed that the stolen KYC materials have not emerged as part of nefarious activities. A leading cybersecurity firm

Currently, there is no indication that the data has been misused. However, we advise affected users to remain vigilant and monitor for suspicious activity. We will be reaching out to affected users with advice and resources on protecting themselves from potential misuse of the information and offering resources such as identity monitoring services.

Transak blog post

As the startup probed the incident, ransomware syndicate Stormous claimed responsibility for the breach. Stormous apparently stole over 300 gigabytes of user data and posted illegally obtained personally identifiable information on its website. The ransomware gang also took credit for hacking web3 identity protocol Fractal ID back in July.

Read more: BlackRock’s $26b Bitcoin ETF crowned fastest growing fund

Source