CoinStats, the cryptocurrency portfolio app, has temporarily halted its services due to a security breach. According to the company, the breach affected 1,590 wallets, representing 1.3% of all CoinStats wallets. CoinStats clarified that wallets connected to centralized exchanges (CEXes) were not impacted. Additionally, CoinStats is investigating reports of a scam notification received by some iOS and Android users.

The author, who has been a supporter of CoinStats for a long time, disclosed having funds in a CoinStats wallet created in 2022. These funds were transferred out of the wallet, which was not linked to any external apps, shortly before the scam notification was sent to users. The Ethereum and Polygon wallet funds are now with the attacker.

CoinStats mentioned that the list of affected wallets may be updated as their investigation progresses, but significant changes are not anticipated. Users with affected wallets are advised to move their funds immediately using exported private keys if they had been exported previously. CoinStats provided a link to the list of affected wallets for reference.

The scam notification falsely promised users a reward of 14.2 ETH and directed them to log into the CoinStats AirScout wallet. Clicking the link led users to a malicious website, promoted through a CoinStats push notification and an official in-app notification. CoinStats acknowledged the issue and apologized for any inconvenience, promising updates as soon as more information becomes available.

The notification falsely claimed that users had won 14.2 ETH as part of an event celebrating 2 million CoinStats users and the launch of CoinStats AirScout. It also falsely stated that users' crypto had been moved to the CoinStats AirScout Wallet.

CoinStats is actively investigating the extent of the compromised funds and plans to provide further updates as their investigation progresses. They are working to restore app functionality promptly and appreciate users' patience during this period.

CryptoSlate reached out to CoinStats immediately after the notification was sent but has not yet received a response.

While CoinStats has not publicly disclosed the exact cause of the attack, questions have been raised about whether private keys were stored on their servers and the randomness of wallets generated within the app. The fact that only CoinStats-generated wallets were targeted suggests potential vulnerabilities in the wallet generation process, such as weaknesses in random number generation that could have enabled attackers to predict private keys and access user funds.

At present, there is no indication that wallets or API connections associated with CoinStats portfolio applications were affected. However, there are unconfirmed reports from users that other wallets connected for DeFi purposes have been drained.

CoinStats acted swiftly by suspending access to the app shortly after the incident. As of now, the app remains offline while investigations continue.

Users are advised to remain cautious of unexpected competitions or rewards in the cryptocurrency space and to consider using hardware wallets to secure significant funds.