In what must have felt like forever for the people affected by the hack, having lost everything. The day has finally come when Atomic Wallet addresses the situation after staying completely silent for a week and a half. Let us take a look at what they have to say.
It speaks
Atomic has put out a larger statement in the form of a post on their website, the link is below. And in this, they start off by telling us how proactive they have been. They say that as soon as they notice something strange was going on, the whole team was alarmed and they immediately warned all their users via their social media channels. The whole team was alarmed, I thought they would be used to this by now, I mean seeing this is far from the first time this sort of thing has happened *sigh*. But at least they warned all their users, this is good and what you expect. But to tweet about it, or put a message on Facebook or Instagram. What the actual f-ck. Why not warn people in the wallet, and put out a message there warning people? I guess that would potentially do more damage than the actual hack. And by now I assume their lawyers got the minimum requirements to stay legally compliant down to an art form.
Next, they tell us how proactive they have been in that they immediately stopped new people from downloading the app, and they also stopped all updates. I guess you do not want any new potential customers being affected and hacked as the very first experience using your shitty subpar product. I give you that is smart at least. Stopping all updates, I guess is also smart. Because if you know you can only put out a subpar product, updating it during a hack could actually make the whole thing much worse. Better just to let the hack play out its course.
Now the company lets us know just how much of an effort they have put into this. Letting us know that since June 3ed, everyone has worked nonstop with no days off. And they try to make it sound like this somehow has prevented any new hacks from taking place. Because stopping downloads and not updating the faulty wallet will have just that effect. Also, working nonstop does not seem to be true for everyone, as the communication person appears to have been incognito until now. Well, they worked the first five days and then took some vacation time I guess.
They tell us how they are tracing the stolen funds via transactions, and ultimately asking exchanges to freeze suspicious transactions. Also, they take in user reports, as well as they have engaged "the leading Crypto Investigators - Chainalysis and Crystal". Not sure why they engage two crypto investigation firms, only for them to also do the very thing, tracking the funds, these companies do. But I guess it can't hurt to do things three times, right? Seems efficient use of time and resources. No wonder these guys don't get any weekends off.
Next is the section where they try and claim 0 responsibility for what happened by telling us that since day one they have pored time and money and worked with experts on every update to prevent these sorts of things from happening. It can't possibly be their fault, right? They have been so diligent.
The team has researched various potential causes, the most probable of which are virus targeting on local users devices, infrastructure breach, malware code injection, or a man-in-the-middle attack. At the moment, none of the possible issues are confirmed as potentially causing massive breaches, as such types of attacks are very hard to recognize.
Wait a minute. The way they said this they make it sound like they looked into the possibility of these various scenarios being the culprit behind the attack. But then rule it out because these are hard to recognize? This sounds like an episode of House, where the doctors list possible reasons for the symptom and House rules them out because they are boring or uninteresting. It's hard to see if one of these is the cause of the hack so we just say it is hard and people will understand why we stopped exploring these venues. I guess all the time, money and expertise poured in distance day one really paid off here with them being able to identify these hacks and how they are done. I mean seeing how often they get hacked all those times should have alone let them build up a solid response and detection system. But I guess that also is hard, so they skipped that as well.
They also have changed access to their servers in case that was the hacker's way in. This is good. But if it was how they gained access changing "access" to their servers would just mean the hackers need to look a bit for the new access point and do it again. If an employee's computer is affected with malware this I assume would only temporarily help address the issue. But I guess it is all a frantic effort to buy as much time as possible when it is happening. So I can't really fault them for doing any of this, looks like all the proper things to do to me. So good for them. But the next part piqued my interest. They talk about how they "switched our internal processes to 'under attack mode'". I so hope this just means they have one of those rotating red lights mounted on the wall with a sign under it reading "UNDER ATTACK". Please let it be true.
Actual photo from inside Atomic Wallets office just before the hack on June 3ed
Next is a boring section about how it might be the user's fault for being sloppy with the seed phrases. And according to other previous victims who got their Atom Wallet hacked, this appears to be the number one play to go to. Looks like it's your fault mate. But I want to make it clear they don't say this, they only hint at it. Next, they let us know they are working on ways to try and retrieve the suspicious assets that have been frozen by the exchanges mentioned above. And they end with a summation:
To summarize, less than 0.1% of Atomic Wallet app users have been affected. No new cases have been reported since June 3rd. None of the possible issues are confirmed as potentially causing massive breaches, at least in the latest Atomic app versions. Builds are verified by external auditors. Our security infrastructure has been updated, and the investigation is still ongoing.
It is great to know that if you were affected the odds of it are so low that you really should feel special, so try not to be so upset you lost everything now. Cheer up, you're special. But the best part I think is the next, non of the issues (the ones listed above that were hard to detect) have been confirmed to cause massive breaches, in the latest app version. So they have caused issues in previous versions, I guess that accounts for all those previous hacks. Also how large percentage of your userbase counts as massive?
All in all the company seems to again show they are only interested in doing what is best for business, at least to the largest extent. That and doing some damage control as well. They actually have not really let us know anything about what caused the hack. And by the looks of things, they do not know or have not been able to figure it out. If I were to venture a guess tho, using the massive computer skill I have accrued by amateurishly trying to fix my computer when it doesn't do what I want it to. That and googling. I would guess the breach was facilitated with the help of another program that has a know flay. A program that is rarely used. So rarely that people might miss updating it or it is simply a flawed program. Seeing that the attack was more or less draining the over 5000 wallets and then nothing. If they would have had access to more wallets those would have been drained simultaneously as well, unless the hackers were sitting and manually draining them a few at a time. Which I highly doubt.
The fourth best thing to come from North Korea, the top three are fake US dollars, counterfeit Viagra (apparently it is good) and the third is statues for fellow dictators. Apparently, they are very good at making those, go figure
I also find it curious how they did not mention a word about the Lazarus Group being behind the attack. Is this because they do not want to acknowledge it, or is it because it is not a 100% certainty, despite the MO fitting with how they operate, and how they launder the funds? If you have any insight into this I would love to hear it.
Last I would like to end by saying that any opinion here is just that, my opinion. Sure I base them somewhat on what I see and how I interpret things. And I do think Atomic Wallet by all accounts is a shitty company with a shitty product. And I would recommend you switch wallets immediately if you are using them still. If you have a large amount of crypto then ffs buy a hardware wallet and put your crypto there. But if you are like me, poor, then stop using Atomic Wallet and switch to some other wallet app, save your crypto, and keep stacking it up until it makes sense to buy a hardware wallet.
I hope that the company's ineptitude, or my comments, have provided you with some entertainment. Because that seems to be the only thing they are good for. they are definitely not good for keeping your crypto safe, they have shown that over and over again. But I would like to hear from you, dear reader. What do you make of the company's effort? Do they match with what you expect, or would want a company you use, to do? The comment section is all yours.
If you would like to support me and the content I make, please consider following me, reading my other posts, or why not do both instead. I have also just become a partner at Medium, signing up using my referral link or just following me there is also a great way to support me.
https://medium.com/@bo.daniel.jensen/membership
See you on the interwebs!
Picture provided by: https://unsplash.com/, fair use
