A significant data breach has occurred at the large crypto exchange Bitfinex, resulting in the leakage of 2.5 TB of data, affecting 400,000 users' personal information and account passwords. Hackers have accessed customer data and are currently trying to log into various user accounts. Bitfinex has issued a warning to all users to change their passwords promptly for security reasons.
Currently, Bitfinex has not yet made a public statement; however, Paolo Ardoino, CEO of related company Tether, has tweeted that the data leak might be false news.
He wrote: "Everyone is panicking about a potential database hack at Bitfinex, but it seems to be fake. The so-called hackers have released two large links containing a sample data of 225,000 emails and passwords."
He continued: "We do not store passwords in plaintext, nor do we store two-factor authentication keys in plaintext. Of the 225,000 emails, only 5,000 match Bitfinex users. If it were part of our database, we would expect a 100% match."
"The so-called hackers have not contacted us."
"Their tweet was posted on April 25, giving 7 days to contact them."
"However, we only recently discovered this claim. If they had any real information, they would have approached us through our bug bounty program, customer support tickets, email, Twitter, and other channels to demand a ransom."
"We can't find any demands."
"Different security researchers are eager to hype this hacking incident, yet from the information we've gathered, the hackers have collected an email/password database, likely from various crypto-related hacking incidents."
"Unfortunately, most users tend to use the same email/password across multiple sites."
"We are conducting a thorough analysis of our systems and have so far found no wrongdoing."
"Additionally, our KYC platform has strict rate limits to prevent bulk downloading."
"Although we believe this to be purely fear, misinformation, we will continue to review the information to ensure nothing is overlooked."
"The funds are safe."
However, as Ardoino also seems unable to confirm definitively that the news is false, it is advisable for users to change their passwords as a precautionary measure.
Ardoino later added: "We tested various combinations of these emails/passwords, and they were valid on at least two other exchanges."
"Many of the shared passwords do not even meet our minimum password strength requirements."
"Some users have used the same email/password on five different exchanges."