Crypto prime brokerage FPG halts withdrawals following $15 million cyber attack

Floating Point Group (FPG), a crypto prime brokerage whose customers manage over $50 billion worth of assets, has ceased trading, deposits and withdrawals following a "cyber security incident" on Sunday.

Upon discovering the incident, FPG started working with third-party forensics experts and law enforcement, a source with direct knowledge of the matter told The Block.

An FPG spokesperson confirmed the incident, saying that the firm locked all third-party accounts and migrated and secured all wallets until it better understands the scope and circumstances of the incident. The company has also confirmed the incident on Twitter.

FPG's account segregation limited the overall impact of the attack, the spokesperson said, adding that while the loss at this point is still being investigated and analyzed, the number as of today is between $15 million and $20 million in cryptocurrencies lost.

"We are working with the FBI, the Department of Homeland Security, our regulators, and Chainalysis to understand how this occurred and to recover assets," the spokesperson said. "As this is an ongoing investigation with law enforcement, we cannot share specifics at this time. We will provide updates as they become available."

The cyber security incident comes six months after FPG said it has earned a SOC 2 (Service Organization Control 2) certification — a recognized standard that verifies a service organization's implementation of security, privacy and other controls, ensuring reliability in handling sensitive data and systems.

What is FPG?

FPG, formed at the Massachusetts Institute of Technology in 2018, is a crypto prime brokerage platform and agency trading desk for asset managers, providing access to liquidity across markets. In December, FPG said its blockchain foundation customers represent 5% of the total treasury management market.

FPG is backed by high-profile investors, including Coinbase Ventures, SkyBridge Capital's Anthony Scaramucci and AngelList founder Naval Ravikant, having raised $12 million in total funding to date. 

Last August, FPG said it secured registration as a virtual asset service provider (VASP) in the Cayman Islands. The registration meant the firm was "able to hold customer assets safely and ensure that its customer's assets are protected from its own creditors in the unlikely event that the company becomes bankrupt." FPG at the time said it had about 100 customers.