Twice the Risk of Most Crypto Leaks: The BitCoinRush Plaintext Dump

HEROIC analysts uncovered a dark web credential dump tied to BitCoinRush, a U.S.-based cryptocurrency and forex trading platform, when monitoring underground forums in August 2023. The dump contained 4,432 records with usernames and plaintext passwords stored without any hashing or encryption. The data was recieved by threat actors on a private forum, limiting initial exposure but not eliminating risk for affected users.

Plaintext Passwords Give Attackers Instant Account Access

With usernames and unencrypted passwords in hand, an attacker does not need to crack anything. They can log directly into BitCoinRush accounts and attempt the same credentials on cryptocurrency wallets, exchanges, and email providers. Password reuse is common, and on a financial platform, the consequence of a single successful login can mean drained funds or a compromised identity.

What Was Exposed in the BitCoinRush Breach

• Usernames
• Plaintext passwords (no hashing or salting)

Why Plaintext Passwords Make This Breach Worse Than Most

Most database breaches expose hashed passwords, which take time and resources to crack. This breach is different. The passwords were stored in plain text, meaning they are accessable to anyone who obtained the file. Credential stuffing tools can run these pairs against dozens of platforms in minutes, turning a small 4,400-record leak into a much larger account takeover campaign across the web.

How a Database Breach Works

A database breach typically occured when an attacker exploits a vulnerability, such as SQL injection, in a web application to extract records directly from the underlying database. In cases like BitCoinRush, the attacker likely targeted the user authentication table where login credentials are stored. If those credentials were not hashed, the attacker walks away with immediately usable data. The dump is then sold or shared on underground forums where other criminals use it for account takeover attempts.

Check If Your Data Was Exposed

HEROIC offers a free breach scanner that checks your email against more than 400 billion exposed records, including breaches like this one from BitCoinRush. If your credentials were part of this dump, you will want to know as soon as possible so you can change passwords and secure your accounts before an attacker gets there first.