{"investigation":{"slug":"cryptocom","entity_name":"Crypto.com","trust_score":58,"severity_base":null,"score_modifier":30,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Crypto.com is a Singapore-headquartered centralized cryptocurrency exchange founded in 2016 (originally as Monaco) by Kris Marszalek, Bobby Bao, Gary Or, and Rafael Melo. The platform has been subject to multiple serious security incidents, including a confirmed January 2022 hack in which $34 million was stolen via a 2FA bypass and laundered through Tornado Cash, and an alleged 2023 data breach linked to the Scattered Spider hacking group that the company did not publicly disclose to affected users. Blockchain investigator ZachXBT has publicly accused Crypto.com of governance manipulation and tokenomics fraud, citing the March 2025 reissuance of 70 billion CRO tokens that had been permanently burned in 2021, and the company's controversial 2020 forced swap from its original MCO token to CRO at unfavorable rates.","sections":[{"content":"On January 17, 2022, Crypto.com confirmed that 483 customer accounts were compromised in a security breach that resulted in unauthorized withdrawals totaling approximately $34 million. Stolen assets comprised 4,836.26 ETH (approximately $15.1 million), 443.93 BTC (approximately $18.6 million), and $66,200 in other cryptocurrencies. The attack exploited a vulnerability in the exchange's two-factor authentication infrastructure, allowing the attackers to perform withdrawals without users entering valid 2FA codes. The exact mechanism of the bypass was not publicly disclosed by the company. On-chain security firm PeckShield identified at least 4,600 ETH being routed through Tornado Cash, an Ethereum mixing protocol, in batches of 100 ETH — a common obfuscation pattern used to launder stolen funds. The Ethereum address 0x6e1218c55f1acb588fc5e55b721f1183d7d29d3d was identified in connection with the stolen fund flows. Crypto.com suspended withdrawals for approximately 14 hours, revoked all 2FA tokens globally, and stated it fully reimbursed affected users. The company subsequently launched its Worldwide Account Protection Program (WAPP), providing up to $250,000 in coverage for qualifying users against unauthorized withdrawals.","heading":"January 2022 Exchange Hack (2FA Bypass)","sources":[],"severity":"medium"},{"content":"On-chain analysis performed by PeckShield shortly after the January 2022 hack showed that approximately 4,600 ETH stolen from Crypto.com was being laundered through Tornado Cash, an Ethereum transaction mixer. PeckShield publicly reported that at least half of the stolen ETH was actively being mixed at the time of its initial alert. The use of Tornado Cash to launder funds stolen from Crypto.com was subsequently cited among the broader body of evidence that led the U.S. Treasury's Office of Foreign Assets Control (OFAC) to sanction Tornado Cash in August 2022, designating it a Specially Designated National. The Crypto.com hack represented one of the most prominent individual cases of Tornado Cash being used to obfuscate proceeds from a major exchange breach.","heading":"Tornado Cash Laundering of Stolen Funds","sources":[],"severity":"medium"},{"content":"A Bloomberg investigation reported in September 2025 that Crypto.com suffered a data breach in 2023 linked to the Scattered Spider hacking collective — a group of primarily young English-speaking attackers who specialize in social engineering and identity-based intrusions. According to the reporting, the attackers used social engineering techniques, including impersonating IT security personnel, to extract login credentials from Crypto.com employees. The breach allegedly exposed personal information belonging to a small number of users. Crypto.com confirmed the breach had occurred but disputed that it failed to disclose the incident, stating it had filed formal disclosures with regulators in the United States and relevant international jurisdictions. However, the company did not notify affected users publicly. One of the individuals connected to Scattered Spider's campaign against Crypto.com, Noah Urban (age 18 at the time), was arrested in January 2024, charged in connection with breaches of 13 companies, subsequently pleaded guilty, and was sentenced to 10 years in prison. No customer funds were reported to have been accessed during the 2023 breach.","heading":"Scattered Spider Data Breach (2023, Unreported to Public)","sources":[],"severity":"medium"},{"content":"In March 2025, Crypto.com proposed and passed a governance vote on the Cronos blockchain to reissue 70 billion CRO tokens that had been declared permanently burned in February 2021. At the time of the original burn, Crypto.com publicly described the destruction of 70 billion CRO as 'the largest token burn in history,' reducing total supply from 100 billion to 30 billion. The February 2021 announcement was later deleted from Crypto.com's blog. In March 2025, a governance proposal was submitted to reintroduce the burned supply. On-chain data cited by analysts indicated that Crypto.com-affiliated validators — identified as 'Falcon Heavy' and 'Starship' — controlled between 70% and 80% of total voting power on the Cronos chain. The governance vote showed 77.97% of participating token holders voted against the reissuance and only 11.86% in favor; however, because the pro-reissuance bloc controlled the majority of staked voting power, the proposal passed with 62.18% approval by weight. Blockchain investigator ZachXBT publicly stated on X that the reissuance was 'no different from a scam,' accusing Crypto.com of betraying community trust and calling the conduct 'borderline fraud.' ZachXBT specifically cited that Crypto.com controls the majority of CRO supply and acted against the stated wishes of token holders. The reissuance of the 70 billion tokens was valued at approximately $5 billion at prevailing prices and followed a non-binding announcement of a partnership with Trump Media & Technology Group (TMTG) for potential crypto ETF products. Community speculation arose that the reminting indicated undisclosed financial pressure, though no direct evidence of insolvency has been published.","heading":"CRO Token Reissuance and Governance Manipulation (ZachXBT Accusation)","sources":[],"severity":"medium"},{"content":"In August 2020, Crypto.com announced the discontinuation of its original MCO token and mandated that all holders swap to CRO at a fixed conversion rate of 1 MCO to 27.6439 CRO, with a 20% bonus for users who swapped before September 2, 2020. MCO holders had until November 2, 2020 to complete the swap or lose access to their assets on the platform. Community backlash was significant: early MCO investors had received no prior indication that the token would be discontinued, and the forced conversion was timed during a period of MCO price weakness, meaning many holders who had purchased MCO above approximately $5.50 USD experienced net losses at the conversion rate. Critics alleged that Crypto.com engineered the deprecation in a manner that disproportionately benefited the company, as it retained a dominant share of the new CRO supply. The Messari research platform documented the launch of the swap 'amid concerns from token users.' ZachXBT later cited the MCO swap as part of a pattern of conduct reflecting disregard for community interests.","heading":"MCO to CRO Forced Token Swap (2020)","sources":[],"severity":"medium"},{"content":"Crypto.com received a Wells notice from the U.S. Securities and Exchange Commission, indicating the SEC intended to bring an enforcement action. In October 2024, Crypto.com filed suit against the SEC in response. The company dropped its lawsuit in December 2024. In March 2025, the SEC formally closed its investigation into Crypto.com and announced it would file no enforcement action against the company. The closure was consistent with a broader shift in the SEC's approach to cryptocurrency enforcement under the 2025 Trump administration, during which multiple pending crypto enforcement actions were withdrawn or dismissed. No formal findings of wrongdoing were published in connection with the Crypto.com investigation.","heading":"SEC Investigation and Resolution","sources":[],"severity":"medium"},{"content":"Crypto.com has conducted multiple rounds of significant staff reductions since 2022. In October 2022, the company laid off approximately 2,000 employees, representing roughly 30% of its workforce, citing market conditions following the collapse of the Terra/LUNA ecosystem and hedge fund Three Arrows Capital. In January 2023, Crypto.com laid off approximately 20% of its remaining workforce (approximately 490 employees), with CEO Kris Marszalek attributing the cuts to the impact of the FTX collapse on growth projections. In March 2026, the company announced an additional 12% workforce reduction, citing a pivot to enterprise AI integration. Following the FTX collapse in late 2022, Crypto.com briefly published a proof-of-reserves report audited by Mazars; however, Mazars subsequently distanced itself from the report, stating it did not sufficiently account for liabilities. No audited financial statements have been published by Crypto.com since 2022.","heading":"Layoffs and Financial Stability Concerns","sources":[],"severity":"medium"},{"content":"Crypto.com CEO Kris Marszalek is a Polish-born serial entrepreneur who co-founded the platform in 2016 alongside Bobby Bao, Gary Or, and Rafael Melo. Before entering the cryptocurrency space, Marszalek served as CEO of Ensogo, a Southeast Asian discount retail platform. Ensogo abruptly ceased operations in 2016, leaving merchants and staff with unpaid debts and drawing criticism regarding the company's financial management during his tenure. This prior history has been cited by community members and critics, including ZachXBT, as relevant context when evaluating Marszalek's stewardship of Crypto.com.","heading":"CEO Background: Kris Marszalek","sources":[],"severity":"medium"}],"timeline":[{"date":"2016","event":"Crypto.com (then called Monaco) founded in Hong Kong by Kris Marszalek, Bobby Bao, Gary Or, and Rafael Melo.","source":"","source_url":"https://en.wikipedia.org/wiki/Crypto.com","date_original":"2016-01-01"},{"date":"2016","event":"CEO Kris Marszalek's prior company Ensogo abruptly ceases operations, leaving merchants and staff with unpaid debts.","source":"","source_url":"https://99bitcoins.com/news/who-is-kris-marszalek-cro-holders-hit-in-major-scam-is-crypto-com-insolvent/","date_original":"2016-01-01"},{"date":"2018-07","event":"Monaco rebrands to Crypto.com after acquiring the domain from Matt Blaze.","source":"","source_url":"https://en.wikipedia.org/wiki/Crypto.com","date_original":"2018-07-01"},{"date":"2020-08-03","event":"Crypto.com announces discontinuation of MCO token and forced MCO-to-CRO swap at 1:27.64 ratio, triggering widespread community backlash.","source":"","source_url":"https://www.cryptovantage.com/news/opinion-the-crypto-com-mco-swap-has-outraged-investors/"},{"date":"2021-02","event":"Crypto.com burns 70 billion CRO tokens in what it calls 'the largest token burn in history,' reducing total supply from 100 billion to 30 billion. Blog post later deleted.","source":"","source_url":"https://beincrypto.com/crypto-com-cro-token-reissuance-trump-partnership/","date_original":"2021-02-01"},{"date":"2022-01-17","event":"Crypto.com exchange hacked via 2FA bypass. 483 accounts compromised; 4,836.26 ETH, 443.93 BTC, and $66,200 in other assets stolen — approximately $34 million total.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/cryptocom-confirms-483-accounts-hacked-34-million-withdrawn/"},{"date":"2022-01-18","event":"PeckShield reports at least 4,600 ETH from the hack being laundered through Tornado Cash in 100 ETH batches.","source":"","source_url":"https://fortune.com/2022/01/18/crypto-com-alleged-hacking-15-million-ether-may-be-gone/"},{"date":"2022-01-20","event":"Crypto.com publicly confirms hack details, launches WAPP (Worldwide Account Protection Program) with up to $250,000 reimbursement for qualifying users.","source":"","source_url":"https://www.itpro.com/technology/cryptocurrencies/362037/cryptocom-confirms-34-million-hack-caused-by-2fa-bypass-exploit"},{"date":"2022-08-08","event":"U.S. Treasury OFAC sanctions Tornado Cash, citing its use to launder stolen crypto — including proceeds from the Crypto.com hack.","source":"","source_url":"https://techcrunch.com/2022/08/08/treasury-tornado-cash-laundering-stolen-crypto/"},{"date":"2022-10-06","event":"Crypto.com lays off approximately 2,000 employees (30% of workforce) amid crypto market downturn.","source":"","source_url":"https://www.sunsethq.com/layoff-tracker/crypto-com"},{"date":"2022-12","event":"Crypto.com publishes Mazars proof-of-reserves report. Mazars later distances itself from the report citing incomplete accounting of liabilities.","source":"","source_url":"https://cryptoslate.com/crypto-com-discloses-partial-reserves-in-bid-to-counter-insolvency-rumors/","date_original":"2022-12-01"},{"date":"2023-01-13","event":"Crypto.com lays off approximately 20% of remaining workforce (around 490 employees) following the FTX collapse.","source":"","source_url":"https://www.cnbc.com/2023/01/13/cryptocom-lays-off-20percent-of-workforce-after-ftx-collapse.html"},{"date":"2023","event":"Alleged Scattered Spider social engineering breach of Crypto.com employee credentials. Personal data of a small number of users reportedly exposed. Not publicly disclosed to affected users.","source":"","source_url":"https://unchainedcrypto.com/scattered-spider-crypto-breach-exposed-users-personal-data-report/","date_original":"2023-01-01"},{"date":"2024","event":"Scattered Spider member Noah Urban arrested, charged in connection with breaches at 13 companies including alleged Crypto.com breach.","source":"","source_url":"https://finance.yahoo.com/news/crypto-com-suffered-unreported-data-113413260.html","date_original":"2024-01-01"},{"date":"2024-10","event":"Crypto.com files lawsuit against the SEC after receiving Wells notice indicating pending enforcement action.","source":"","source_url":"https://crypto.com/en/company-news/sec-closes-crypto-com-investigation-with-no-action","date_original":"2024-10-01"},{"date":"2024-12","event":"Crypto.com drops its lawsuit against the SEC.","source":"","source_url":"https://crypto.com/en/company-news/sec-closes-crypto-com-investigation-with-no-action","date_original":"2024-12-01"},{"date":"2025-03-02","event":"Crypto.com submits governance proposal on Cronos blockchain to reissue 70 billion previously burned CRO tokens. Community vote shows 77.97% against, but proposal passes due to Crypto.com-affiliated validators controlling ~70-80% of voting power.","source":"","source_url":"https://cryptonews.com/news/crypto-com-controversial-5b-token-mint-raises-insolvency-fears/"},{"date":"2025-03-25","event":"ZachXBT publicly accuses Crypto.com of CRO supply manipulation, calling the token reissuance 'no different from a scam' and conduct 'borderline fraud.'","source":"","source_url":"https://beincrypto.com/crypto-com-cro-token-reissuance-trump-partnership/"},{"date":"2025-03-27","event":"SEC formally closes its investigation into Crypto.com with no enforcement action filed.","source":"","source_url":"https://crypto.com/en/company-news/sec-closes-crypto-com-investigation-with-no-action"},{"date":"2025-09","event":"Bloomberg publishes investigation revealing Crypto.com's 2023 Scattered Spider data breach was not publicly disclosed to affected users.","source":"","source_url":"https://finance.yahoo.com/news/crypto-com-suffered-unreported-data-113413260.html","date_original":"2025-09-01"},{"date":"2026-03-19","event":"Crypto.com announces 12% workforce reduction citing enterprise AI integration pivot.","source":"","source_url":"https://www.cnbc.com/2026/03/19/crypto-com-layoffs-12percent-ai-job-loss.html"}],"sources_used":[],"source_tags":["defillama","etherscan","zachxbt"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:11.427536+00:00","updated_at":"2026-08-29T01:35:52.899+00:00"}}