Acceso no autorizado y dos drenajes de fondos reportados por Kontigo

Qué respalda esta fuente

• reports more than 300,000 USDC drained
• reports completed reimbursement
• reports temporary restrictions on external/on-chain withdrawals
• attributes the restrictions to post-incident security protocol

Límites de la evidencia

Credible specialist coverage, but dependent on Kontigo statements and does not independently establish the exact amount, account count or technical cause.

Relación con el caso

Contemporaneous coverage of reimbursement and temporary withdrawal restrictions after the first drain.

Qué respalda esta fuente

• reports 340,905.28 USDC drained
• reports 1,005 affected accounts
• reports isolation of systems and reimbursement

Límites de la evidencia

Independent publisher but substantially dependent on the company’s public statements; no transaction-level or forensic validation.

Relación con el caso

Strong contemporaneous secondary support for first-phase amount, account count and refunds.

Qué respalda esta fuente

• reports 340,905.28 USDC drained from 1,005 accounts
• reports system isolation and 100% reimbursement
• records that Kontigo had not disclosed vector or PII impact at publication

Límites de la evidencia

High-quality financial-sector journalism but dependent on Kontigo’s early statements; later official postmortem supersedes its then-unknown vector/PII status.

Relación con el caso

Strong independent-newsroom corroboration of first-phase amount, user count, containment and reimbursement.

Qué respalda esta fuente

• reports 1,005 affected users
• reports 340,905.28 USDC taken
• reports system isolation and reimbursement commitment

Límites de la evidencia

Contemporaneous crypto reporting, but dependent on company communications and without independent technical evidence. Political context is not incident evidence.

Relación con el caso

Corroborates first-phase amount, affected-user count and reimbursement promise.

Qué respalda esta fuente

• reports unauthorized table access on 28 December and 3 January exposing emails and authentication-provider IDs
• attributes the 5 January attack to Apple OIDC issuer-validation failure and fraudulently minted valid JWTs
• reports 1,005 users and 340,905.28 labelled USDT for the first drain
• reports a second 8 January drain of 56,913 USDC from 258 of the same wallets via reused Thirdweb session JWTs
• states no private keys were stored or accessed
• states all users were reimbursed and OIDC/RLS/session-token controls were remediated

Límites de la evidencia

First-party technical account, not an independently published forensic report. Its USDT label for the first drain conflicts with Kontigo’s contemporaneous USDC graphic and all four early reports.

Relación con el caso

Strongest source for the two phases, technical cause, limited metadata access, remediation and reimbursement.