GateHub gatehub.net GateHub data breach: what happened and what to do
In October 2019, 1.4 million accounts from the cryptocurrency wallet service GateHub were posted to a hacking forum, after GateHub acknowledged a breach in June 2019. Have I Been Pwned counts 1,408,078 accounts, with emails, mnemonic phrases, encrypted keys and bcrypt-hashed passwords.
View all 13,115 breaches- Breach date
- 4 Jun 2019
- Affected
- 1,408,078
- Data exposed
- Email addresses, Encrypted keys, Mnemonic phrases, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
GateHub is a cryptocurrency wallet service. It acknowledged a data breach in June 2019, with a smaller number of affected accounts. In October 2019, 1.4 million GateHub accounts were posted to a popular hacking forum. Have I Been Pwned dates the breach to 4 June 2019, added it on 20 November 2019 and counts 1,408,078 accounts.
GateHub's own update on 7 June 2019 estimated 18,473 accounts were affected, 5,045 of them with active XRP balances. It said it saw no suspicious logins, but did see more API calls with valid access tokens from a small number of IP addresses, and disabled all access tokens on 1 June. It told affected users how to protect their funds and informed law enforcement. These details come from coverage of the update.
What was exposed
Email addresses, mnemonic phrases, encrypted master keys, encrypted recovery keys and passwords stored as bcrypt hashes.
Why it matters
Mnemonic phrases and keys control crypto wallets, so this isn't an ordinary password leak. Encryption and bcrypt hashing make the data hard to use, but a weak password gives an attacker a way in. Phishing aimed at wallet owners is common after a breach like this.
What to do
Move funds to a new wallet if you can't be sure the old one is safe, change your password, and never share a recovery phrase with anyone.
What to do if you were in it
- 1
Consider moving funds to a new wallet
If your wallet keys or mnemonic phrase were in the data, create a new wallet with fresh keys and move your funds there.
- 2
Change the password, and every reuse of it
Use a long, unique password. Bcrypt makes hashes hard to crack, but short or common passwords still fall.
- 3
Never share a recovery phrase
No support team, exchange or website needs your phrase. Treat any message asking for it as a scam.
- 4
Turn on two-factor login
Add an authenticator app or security key on your email and every exchange or wallet account.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't delete breach data, but it tells you what to change.
Frequently asked
Was I affected by the GateHub data breach?
Enter your email address on Have I Been Pwned to check, or run a free Serus scan. GateHub also contacted users it believed were affected.
What was exposed in the GateHub breach?
Email addresses, mnemonic phrases, encrypted master keys, encrypted recovery keys and bcrypt-hashed passwords, per Have I Been Pwned.
Should I change my password?
Yes, and use a unique one. If your keys or phrase were exposed, moving funds to a new wallet is the safer choice.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
