Skip to content
KripZen

Crypto.com

Failure type
Hack
Date
January 2022
Reported loss
~$34M withdrawn from 483 accounts (publicly reported estimate)

What happened

On 20 January 2022 roughly $34 million in bitcoin, ether and other assets was withdrawn from 483 Crypto.com customer accounts. The withdrawals were approved without two-factor authentication being properly enforced. The company paused withdrawals, rebuilt the authentication flow, and reimbursed every affected user.

What to take from it

Two-factor authentication only protects you where the platform actually enforces it. The control existed here; the gap in enforcing it on the withdrawal path is what cost money.

Dates and figures are widely reported public estimates from coverage at the time, not KripZen's own audited data.

Where it sits on the record

The documented exchange failures we track, in the order they happened.

  1. 2014Mt. Gox
  2. 2015Bitstamp
  3. 2016Bitfinex
  4. 2016The DAO
  5. 2017Parity Multisig Wallet Freeze
  6. 2018BitConnect
  7. 2018Coincheck
  8. 2019Binance
  9. 2019Bitfinex / Crypto Capital
  10. 2019QuadrigaCX
  11. 2020KuCoin
  12. 2022Celsius Network
  13. 2022Crypto.com (You are here)
  14. 2022FTX
  15. 2022Ronin Bridge
  16. 2022Terra / LUNA
  17. 2022Three Arrows Capital
  18. 2022Wormhole
  19. 2023HTX (formerly Huobi)
  20. 2024DMM Bitcoin
  21. 2025Bybit