Crypto Exchange Liquid Says User Data Possibly Exposed in Security Breach

The exchange said customer funds are safe.

AccessTimeIconNov 18, 2020 at 10:13 a.m. UTC
Updated Sep 14, 2021 at 10:32 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Customers registered with the Liquid exchange may have had their data exposed to bad actors, the company said Wednesday.

  • In a notice on its website, Liquid CEO Mike Kayamori said the attack occurred on Friday, Nov. 13.
  • "A domain name hosting provider that manages one of our core domain names incorrectly transferred control of the account and domain to a malicious actor," he said.
  • The access allowed the intruders to change DNS records and then take control of "a number of internal email accounts."
  • Ultimately, they were able to "partially compromise" the exchange's infrastructure and access stored documents.
  • Kayamori said the attackers may have been able to obtain data such as users' emails, names, addresses and encrypted passwords.
  • Liquid is currently investigating whether the attacker also accessed identity documents and photos submitted for know-your-customer verification.
  • As soon as the intrusion was noticed, Liquid "intercepted and contained the attack," the CEO said.
  • It also regained control of its domain and carried out a "comprehensive review of our infrastructure."
  • "We can confirm client funds are accounted for, and remain safe and secure. MPC-based and cold storage crypto wallets are secured and were not compromised," Kayamori said.
  • He recommended users change their passwords and 2FA credentials, and be wary of possible phishing attempts to use their data.

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.