Crypto Retirement Account Platforms Hit by Data Breaches Resulting in $5 Million Stolen
Two of the largest crypto retirement account platforms, Bitcoin IRA and iTrustCapital, have fallen victim to data breaches that enabled a wave of targeted social engineering attacks. According to on-chain sleuth ZachXBT, at least $5 million in cryptocurrency has been stolen as a result.
The breach is linked to US-based threat actor Tiffany Milanovich, who allegedly gained unauthorized access to customer databases and used the information to impersonate customer support representatives via email and phone calls. The goal was to trick victims into revealing their private keys and seed phrases.
One victim lost $1.2 million in Bitcoin and Ethereum after receiving a spoofed email that appeared to come from Bitcoin IRA. Neither company has publicly acknowledged or commented on the breaches, sparking questions about their handling of cybersecurity.
The breach is part of a growing epidemic of impersonation fraud, with the FBI logging 80,000 complaints related to tech-support impersonation in 2022, resulting in $2.9 billion in losses. Chainalysis has tracked a staggering 1,400% increase in such scams over recent years.