Cryptospot Data Breach Exposes 6,993 UK Crypto Investor Records

HEROIC's DarkHive intelligence system discovered the Cryptospot data breach, exposing 6,993 records from a UK-based online cryptocurrency investment platform in April 2022. The breach leaked email addresses, MD5 password hashes, usernames, full names, and IP addresses, putting investors at risk of both account takeover and targeted physical or cyber threats based on thier location data.

Why This Is Dangerous

This breach combines several especially dangerous data types for a cryptocurrency platform. MD5-hashed passwords can be cracked rapidly using modern tools and precomputed lookup tables, giving attackers direct access to accounts. IP addresses reveal where users accessed the platform from, which can be used to bypass geolocation-based security checks or to identify the physical locations of high-value investors. Criminals who know someone holds cryptocurrency are motivated to conduct targeted attacks, including physical intimidation and social engineering to extract wallet credentials.

What Was Exposed

• Email Address
• Password Hash (MD5)
• Username
• First Name
• Last Name
• IP Address

Why This Matters

Cryptocurrency investors are prime targets for attackers because thier assets are often held in self-custodied wallets where there is no bank to call for recovery. Attackers use breached crypto platform data to conduct credential stuffing against other exchanges and wallets. They also use names and email addresses to impersonate support staff and trick users into revealing seed phrases. The IP addresses in this dataset enable attackers to target users more precisely and to tailor attacks to recieve maximum impact from each victim.

How Database Leaks Work

Cryptocurrency platforms are among the most targeted industries for database attacks because of the direct financial reward. Attackers exploit SQL injection vulnerabilities, API flaws, or compromised administrative credentials to gain access to user databases. Once inside, they extract all user records and immediately begin testing credentials against multiple exchanges. MD5-hashed passwords are cracked within hours of obtaining the database, using tools that can test billions of password combinations per second against the hashes.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Cryptospot. Visit heroic.com to scan your email address and find out if your information was exposed.