Crypto casino Stake reopens withdrawals just 5 hours after $41M hack

Crypto betting platform Stake has reopened deposits and withdrawals and resumed services for users only five hours after the platform was hacked to the tune of $41.3 million, blockchain security firms estimate.

Stake confirmed that all services resumed at 9:28 pm UTC time on Sept. 4 — a few hours after the platform confirmed that several unauthorized transactions were made on Stake’s ETH/ BSC hot wallets:

All services have resumed! Deposits & withdrawals are processing instantly for all currencies. We apologise for any inconvenience.

— Stake.com (@Stake) September 4, 2023

The betting site said its Bitcoin (BTC), Litecoin (LTC), and XRP (XRP) wallets were not impacted but haven’t yet shared the cause of the exploit or how much was stolen. Stake confirmed, however, that user funds remain safe.

Three hours ago, unauthorised tx’s were made from Stake’s ETH/BSC hot wallets.

We are investigating and will get the wallets up as soon as they’re completely re-secured.

User funds are safe.

BTC, LTC, XRP, EOS, TRX + all other wallets remain fully operational.

— Stake.com (@Stake) September 4, 2023

Analysis by blockchain security firm Beosin calculated the total loss to be $41.35 million, which included $15.7 million on Ethereum, $7.8 million on Polygon and another $17.8 million from the BNB Smart Chain.

@Stake has experienced multiple suspicious outflows on #Ethereum, #BSC and #Polygon.

ETH: ~$15.7M
Polygon: ~$7.8M
BSC: ~$17.8M
The total funds were ~$41.35M.

Stay alert! pic.twitter.com/cKBK3kMeUz

— Beosin Alert (@BeosinAlert) September 4, 2023

An earlier estimate of $15.7 million by fellow blockchain security firm PeckShield didn’t account for the $25.6 million allegedly lost on BSC and Polygon, according to on-chain analyst ZachXBT.

Related: Atomic Wallet faces lawsuit over $100M crypto hack losses: Report

The first transaction occurred at 12:48 pm UTC, transferring approximately $3.9 million worth of stablecoin Tether (USDT) from Stake to the attacker’s account. The next two transactions removed over 6,000 Ether, worth approximately $9.8 million at the current prices.

The attacker continued to remove tokens over the next few minutes, including about $1 million in USD Coin (USDC), $900,000 worth of Dai (DAI) and 333 Stake Classic (STAKE) ($75), which is understood to have made up the first $15.7 million on Ethereum.

Collect this article as an NFT to preserve this moment in history and show your support for independent journalism in the crypto space.

Magazine: How smart people invest in dumb memecoins — 3-point plan for success

Update (Sept. 5, 6:15 am UTC): This article has been updated with a correction that the unauthorized transactions impacted ETH/BSC hot wallets, not ETH/BTC hot wallets.