Coding vulnerability may cost a crypto company $100M
The Federal Trade Commission (FTC) wants a crypto company that was attacked by hackers to reimburse $100 million to its customers.
Utah-based tech company Illusory Systems Inc., which does business under the name Nomad, failed to implement adequate security measures, leading to a major data breach in June 2022, the market supervisor claims.
According to the FTC, Nomad had developed a service called xApp, also known as the “Nomad Token Bridge,” which allowed users to exchange tokens between different blockchain platforms.
xApp was advertised and offered as a “security-first” service. In practice, however, it was poorly tested and included a large vulnerability. Hackers got wind of this and began exploiting the vulnerability, leading to a loss of $186 million.
Luckily, the company was able to recover some of the money. However, consumers lost approximately $100 million.
In its complaint, the FTC alleges that Nomad failed to meet its promises. The company failed to implement secure coding practices, offer the option to submit vulnerability reports, respond to security incidents, and utilize technologies that could have helped mitigate consumer losses.
Furthermore, Nomad knew about the dangers of inadequate code testing, as well as the need to ensure it had skilled staff members and security in place. Additionally, the company failed to implement basic safety measures, which ultimately led to the incident.
To address these shortcomings, the FTC requires the company to repay its clients $100 million and implement a comprehensive information security program designed to protect consumers from theft or other unauthorized access.
“The FTC Act requires companies to take reasonable security measures. It’s important that companies live up to their security promises to consumers,” Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, said in a statement.
The public now has thirty days to respond to the proposal, after which the FTC can finalize it.
Unlock more exclusive Cybernews content on YouTube.
