Feb 2024 (first theft; exact day not stated in FixedFloat post)
FixedFloat: Hosting Compromise, $26.1M Then a Second Intrusion
FixedFloat: in February 2024 an attacker exploited its security structure and stole $26.1M. FixedFloat later says the same actor returned via Time4VPS hosting on 31 Mar. Service later resumed.
- Event date
- Incident typeExchange infrastructure compromise
- Bug classThird-party access
- Published
Loss, as sourced
$26.1 million stolen in the February incident, per FixedFloat. FixedFloat says a second attack by the same actor followed on 31 Mar via Time4VPS; the February figure is the one it quantifies.
Traceability
Primary sources
In brief
Root cause: Per FixedFloat: February attacker found a technical server IP on Time4VPS; March 31 unauthorized login across Time4VPS-hosted servers; FixedFloat alleges hoster-level access including password resets and email takeover, and says Time4VPS support was slow over a holiday.
Timeline, as sourced: Per FixedFloat: February first theft $26.1M; 31 Mar second intrusion; April 1 account email changed; service suspended ~2 months then resumed.
Account, as sourced
Claimed (FixedFloat) (post (opens in a new tab)): client obligations after the hack fulfilled; most currencies available again.
Unknown: independent confirmation of Time4VPS's role; FixedFloat says it never received a hoster incident report.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/fixedfloat-hosting-compromise-2024