QuickNode, Privy, N26: Have your data been leaked after the Metabase hack?

A flaw exposing Metabase clients

Metabase recently revealed that it was the victim of a cyberattack exploiting a previously unknown security vulnerability, known as a "zero-day". This type of vulnerability is particularly sensitive, as hackers can exploit it before a patch is available.

Founded in 2015, Metabase develops software that allows companies to connect and analyze their databases, notably through dashboards. The company claims that its technology is used by over 100,000 organizations worldwide.

Among them are several players in the crypto and fintech sectors, such as QuickNode, Privy, and N26. However, their situations differ: QuickNode and Privy have confirmed they are affected by the incident, while no compromise has been publicly confirmed for N26.

A few days after the flaw was discovered, the cybercriminal group ShinyHunters listed Metabase on its dark web leak site. According to Cybernews, the hackers claim to have recovered approximately 174 GB of source code from 287 private GitHub repositories.

Active since 2019, ShinyHunters is known for attacks against technology providers used by many companies. An effective strategy: by targeting a single intermediary, hackers can potentially reach several of its clients.

QuickNode, Privy, N26: What do we really know?

QuickNode is one of the players that has communicated the most precisely. The blockchain infrastructure provider stated that the intrusion occurred on July 30, between 03:21 and 03:34 UTC. The hackers were able to access full names, email addresses, possible Telegram handles, and IP addresses used to connect to the QuickNode dashboard.

However, no customer accounts, wallets, private keys, passwords, transaction data, or financial information were reportedly compromised. QuickNode's blockchain infrastructure was also said to be unaffected.

On the Privy side, a specialist in wallets integrated into applications and a subsidiary of Stripe, no comment has been made so far.

As for N26, while the neobank is indeed presented as a user of Metabase, there is currently no evidence to suggest that it was affected by the attack. A case study published by Metabase further indicates that N26 uses a version of the software hosted on its own AWS infrastructure.

Phishing risks

For affected users, the main risk is the use of the personal information retrieved to carry out targeted phishing attacks.

A hacker knowing your name, email address, and the services you use can create a much more convincing message. For example, they could impersonate QuickNode support, mention a security issue related to your account, and redirect you to a fake site designed to capture your credentials.

Caution is therefore advised regarding emails and Telegram messages received in the coming weeks. It is better to avoid clicking directly on a link and to navigate to the official site or application of the concerned service yourself. It is also recommended to carefully check the sender's address and enable two-factor authentication when available.

Finally, no legitimate support will ask for your private key or recovery phrase. Any such request, especially when accompanied by an urgent message mentioning the suspension or securing of an account, should be considered particularly suspicious.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.