Deribit hack — November 2022

Deribit, a crypto options and futures exchange, disclosed on 2 November 2022 that its hot wallet had been compromised just before midnight UTC on 1 November. In its own incident report the exchange put the loss at USD 28 million spread across its BTC, ETH and USDC hot wallets.

Blockchain security firm PeckShield, quoted by The Record, tracked roughly 9,080 ETH (about $14.2 million) and about 691 BTC (about $14.1 million) leaving the exchange; the USDC component appears to have been swapped into ether by the attacker. Deribit said cold storage addresses, client assets held through Fireblocks, Copper ClearLoop and Cobo Loop, and its insurance fund were untouched, because company procedure keeps 99% of user funds in cold storage. The loss was absorbed by Deribit's own reserves and no customer was asked to bear it.

Withdrawals were suspended while the platform was checked and reopened the following day. Users were instructed to generate new Fireblocks deposit addresses for BTC, ETH and USDC and to stop using their old ones, and Deribit moved all withdrawals to manual administrator confirmation with a target of 60 minutes.

Deribit never published a root cause. The instruction to regenerate every deposit address, and third-party analysis of the incident, point to compromise of the keys controlling the hot wallets rather than a flaw in a smart contract; the exchange itself said only that the hack was isolated and quarantined to those three hot wallets. The stolen ether sat still until 5 November, when it began moving into Tornado Cash. No arrests, recovery or formal attribution has been announced.