Thunder Terminal Claims Security After $192,000 Exploit, Hacker Demands Ransom in Dispute

Author

Hongji Feng

Author

Hongji Feng

About Author

Hongji is a crypto and tech reporter. He graduated from Northwestern University's Medill School of Journalism with a Bachelor's and a Master's. He has previously interned at HTX (Huobi Global),...

Author Profile

Share

Copied

Last updated:

December 27, 2023 00:45 EST

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Ad Disclosure

We believe in full transparency with our readers. Some of our content includes affiliate links, and we may earn a commission through these partnerships. Read more

Thunder Terminal has recently encountered an exploit. Despite the severity of the incident, the platform has assured users of the security of their funds. Yet the hacker claimed differently and demanded ransom.

In a recent post published by the decentralized platform Thunder Terminal, the company has faced an external exploit of $192,000, resulted in unauthorized access to 114 out of over 14,000 wallets on its network.

Thunder Terminal said when they detected the breach, “Seems like a 3rd-party service we were using was compromised.” Later they claimed that the exploit was rapidly contained, having been halted within nine minutes of detection.

Seems like a 3rd-party service we were using was compromised.

Investigating actively – please give us some time.

Funds are safe and refunds will be handled shortly.

— Thunder (@ThunderTerminal) December 27, 2023

Exploit, Refund, Resolution

“At 12:11:47 AM UTC, suspicious withdrawals started getting sent through Thunder wallets. A malicious actor got access to a MongoDB connection URL which they used to pull session tokens and execute withdrawals on behalf of users,” Thunder Terminal wrote in a following post.

“No private keys nor wallets were compromised. The exploit happened through withdrawal requests our server considered as authorized because of leaked session tokens,” wrote the post.

The platform further explained the mechanism and how the wallets were protected, saying, “We do not store any private keys, so the attacker does not have access to any wallets. Desktop wallets were not affected.”

As a result of the incident, around 86 Ethereum (ETH) and 439 Solana (SOL) tokens were lost.

Thunder Terminal promised that “all funds lost will be refunded in full” and “affected users will be given 0% fees and $100k in credits each,” as the team moved on to necessary procedures.

According to the post, the company has contacted the Federal Bureau of Investigation (FBI), planned to add two-factor authentication for withdrawals, and been undergoing a comprehensive technical audit.

“Access to the platform will be restored as soon as possible,” said Thunder Terminal.

Hacker Counters Thunder Terminal and Demands Ransom

However, the hacker claimed differently, countering the platform’s security statement. “All lies,” said the exploiter. “Also we have all the user data. 50 ETH and we will delete the data.”

Some users have expressed their concerns, replying to Thunder Terminal’s post and questioning that “how did the 114 wallets get compromised if their private keys were safe?” Another replied, “Funds are safe in someone else’s wallet.”

In the meantime, the platform said, “We are willing to negotiate with the exploiter if they return user funds. Otherwise, we intend to pursue this crime to the fullest extent of the US judicial system.”