Brazilian Exchange Foxbit Has Updated Its Login Process

In a recent release, Brazilian cryptocurrency exchange Foxbit, through the BlinkTrade trading platform, announced that it has updated its login process which keeps users protected. But this upgrade might have come a little bit too late as recent reports show that the bug has resulted in users losing close to 58 BTC.

The amount which is about $540,000 according to cybersecurity expert Leandro Trindade, who had alerted that something was not right with its security practices on March 29. The expert came to notice that something was not right when he discovered local portal Reclame Aqui was bring folded with Foxbit-related content.

Through further investigation, he discovered that several users were complaining of missing funds from the platform. It was noticed that, on Foxbit, users could change their two-factor authentication (2FA) while making use of only one password.

This gave fraudsters access to the private information of users and enabled them to change their 2FA settings to block them out of their own accounts. Given that there was no email confirmation, no security check or any sort of verification, all they had to do was to steal the user’s fund.

Trindade stated in a local publication that, “I could be rich right now. But my code of ethics won’t let me.”

He noted that he had attempted to send a warning to the exchange that there was a threat to their users. The company was sent two emails, a support ticket and a message on Facebook. However, it took two weeks for BlinkTrade to make a response. In the response, it was stated that it was unfortunate that it will take a week to fix the problem.

Per Portal do Bitcoin, the company spent 25 days to handle the risk. According to Foxbit and BlinkTrade, they had noticed the issue even before Trindade sent a warning and went on to explain that a “new login and withdrawal procedure was being planned for early February.

Foxbit’s statement reads (roughly translated):

“The company was informed of the first occurrences in December and has since worked with BlinkTrade to strengthen security and guide users, as shown in our blog post in this regard.”