Rain

Documented and closed events. They stay on file: an operator’s past is data, not a verdict.

1. Apr 29, 2024 Hack / funds theft Severe $15M ✓ resolved

   14.8 million dollars stolen from Rain's wallets on 29 April 2024, kept quiet for two weeks and made public by an outside investigator rather than by the exchange: Rain admitted it only on 13 May, stating that customer funds are «under custody, fully accounted for and held on a 1:1 basis» and that the group has «covered any potential losses resulting from this incident». The stolen bitcoin and ether were never recovered

   WHAT HAPPENED. On 29 April 2024 roughly 14.8 million dollars left the wallets of Rain, the exchange run by Bahrain-based Rain Management W.L.L. Whoever carried out the attack converted the proceeds almost at once: the funds were «quickly transferred to instant exchanges and swapped for BTC and ETH», for a total of 137.9 BTC and 1,881 ETH that ended up in two wallets which then stayed inactive. On the technical cause Halborn's analysis is careful but clear within its scope: the attacker «must have had the ability to generate valid digital signatures for the attack transactions», so this is most likely COMPROMISED PRIVATE KEYS — a failure of key management, not a smart-contract flaw. THE PART THAT WEIGHS MORE THAN THE THEFT: WHO TOLD THE STORY. For two weeks Rain said nothing. The news broke on 13 May 2024, when on-chain investigator ZachXBT flagged on his channel the anomalous outflows from the exchange's BitGo wallets. Only after that did Rain publish a statement on its own site. On 13 May CoinDesk wrote that «Rain did not immediately respond to CoinDesk's request for comment». For an operator whose sales argument is its licence, this is not a side point: the market learned of a 14.8 million dollar loss from an independent researcher, two weeks after the fact. WHAT RAIN SAID, AND IN WHAT WORDS. In the 13 May statement the exchange acknowledged the incident, said it had taken «immediate steps» to strengthen platform security and that it was cooperating with the relevant legal and regulatory authorities. On customer money the wording reported by several outlets is this: funds are «under custody, fully accounted for and held on a 1:1 basis», and the Rain Group has «covered any potential losses resulting from this incident, ensuring that our customers' interests remain protected». In other words the company absorbed the loss out of its own resources, with no haircut to balances: the same pattern as Bitstamp in 2015, the opposite of Bitfinex in 2016. ⚠️ ON THE AMOUNT, THE RANGE MUST BE STATED. This card carries 14.8 million dollars, which is ZachXBT's measurement as reported by CoinDesk and Halborn and is the most circumstantial (it breaks down per asset: 137.9 BTC and 1,881 ETH). Other sources report «about 15 million» and some later accounts speak of 16 or 16.13 million dollars. Rain has NEVER published a figure of its own, so no number here is the company's: they are all third-party estimates of proceeds converted into two assets while the price moved. ⚠️ ON ATTRIBUTION, WHAT WE DO NOT ASSERT. There is a circulating attribution, carried by an encyclopaedia entry and by a Forbes article of 4 December 2024, of the theft to the North Korean Lazarus group, with access obtained by contacting an employee on LinkedIn with a fake job offer and a fake coding exercise that installed the TraderTraitor malware; the link would be documented in a US Department of Justice seizure warrant and in a Mandiant analysis. We do not write it as fact: the Forbes article returns 403 to our access and we could open neither the warrant nor the analysis. If a source does not open, the data does not exist — it stays noted as an attribution to be verified, not as an established cause. WHY THIS ENTRY IS MARKED CLOSED. Not because the money came back: the 137.9 BTC and 1,881 ETH were never recovered and the destination wallets were already inactive in the following days. It is closed on the side that concerns anyone who held an account: the company states in the past tense that it covered the loss, operations never stopped, and in over two years not a single public report has emerged of customers left out of pocket over this incident. It remains a company statement, not an independent verification, and this card says so.

   ↗ source

verified on Oct 2, 2026

Weighted average across 2 public review platforms (10,942 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.