Atomic Wallet, a service where users can store cryptocurrency, says on its Twitter bio it’s “trusted” by more than 5 million. However, on Saturday, its users had a rude awakening: Over $35 million in cryptocurrency, according to noted blockchain sleuth ZachXBT, had suddenly been siphoned from their accounts.
“We have received reports of wallets being compromised,” Atomic wrote on Twitter. “We are doing all we can to investigate and analyze the situation. As we have more information, we will share it accordingly.”
Fewer than 1% of its “monthly active users” were affected by the hack, it reported. Roland Säde, Atomic’s CMO, clarified in an email to Fortune that approximately 1,000 users have reported lost funds and told account holders to notify Atomic ASAP if their wallets have been drained and to track transfers to the most popular exchanges. (If exchanges are notified, he said, then this could prevent “scammers from exchanging their funds.”)
“We are working around the clock to get it all resolved and come out of this crisis stronger than before,” he added.
In his own Twitter thread, ZachXBT said that the largest individual loss was approximately $8 million. While the five largest individual losses amounted to $17 million, per ZachXBT, the hack also had an outsize impact on users with less crypto tied up in the wallet, including Hossein Ahmaid, who goes by the Twitter handle @Christomos03.
Update: A new largest victim was found on Tron with 7.95M USDT stolen,
— ZachXBT (@zachxbt) June 4, 2023
The five biggest losses account for $17M.
My graph has now surpassed $35M in total stolen. pic.twitter.com/eqfXkm9vlL
For over a year, Ahmadi, 27, worked as web developer in Turkey. Originally from Iran, he had stored up approximately $21,000 in Tether, a stablecoin pegged to the U.S. dollar, in Atomic. When he logged into his account on Saturday, his life savings had disappeared. “I worked tirelessly, sacrificing sleep and putting in great effort to earn this amount of money,” he told Fortune over Twitter. “However, it has been stolen without any fault on my part.”
Since then, he’s scoured the internet for updates day and night. “Unfortunately, with the occurrence of this terrifying hack, my life has been disrupted,” he told Fortune. He said he reached out to ZachXBT, the blockchain sleuth, but didn’t immediately receive a response.
Originally launched in 2018 as Atomic Swap, per its website, Atomic Wallet is a decentralized wallet, which ostensibly gives users control over their crypto, as opposed to a centralized wallet, where users’ funds are held by a third party.
In 2021, Least Security, a Web3 auditing firm, issued a report detailing that it considers “the Atomic Wallet to be insufficiently secure in protecting user assets and private data.”
The first quarter of 2023 saw a marked increase in hacks, according to a recent report by Immunefi, rising from 25 in 2022 to 73 this year, but the funds stolen over that span declined from approximately $1.23 billion in 2022 to $440 million.