Crypto.com unauthorized withdrawals bypassing 2FA
In January 2022 attackers made unauthorized withdrawals from 483 Crypto.com accounts, with transactions approved without the user entering the 2FA code. Crypto.com paused withdrawals on January 17, 2022, revoked all customer 2FA tokens, moved to new 2FA infrastructure and added a 24-hour delay for new withdrawal addresses. The company did not publish the exact bypass mechanism.
- Victim
- Crypto.com
- Industry
- Crypto and Web3
- Country
- Singapore
- Intrusion began
- Jan 17, 2022
- First disclosed
- Jan 17, 2022
- Actor
- Financially motivated
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- 483 (483 user accounts, per Crypto.com.)
- Disclosed cost
- $34 million (Approximate value of unauthorized withdrawals reported by Crypto.com (about $15 million in ETH, $19 million in BTC and $66,200 in other currencies); affected customers were reimbursed.)
The identity lesson
Step-up authentication on high-risk actions such as adding withdrawal addresses must be enforced server side, and a delay on new payees limits what any authentication flaw can drain.
Sources
- 2FA compromise led to $34M Crypto.com hack, TechCrunch, Jan 20, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Coinbase account takeovers via SMS account recovery flaw 2021 · Identity infrastructure vulnerability
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Crypto.com unauthorized withdrawals bypassing 2FA. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-crypto-com-2fa-bypass/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.