Shopin's ICO faced a crisis this month when the investment syndicate handling a major portion of funds got breached. The hack affected hundreds of participants who had pooled money through the syndica
Shopin's ICO faced a crisis this month when the investment syndicate handling a major portion of funds got breached. The hack affected hundreds of participants who had pooled money through the syndicate, putting their initial investments at risk.
The syndicate structure works like this: groups of investors band together, combine their capital, and use the collective amount to buy ICO tokens at discounted rates or gain early access. Japan has embraced this model. In theory, a smart contract handles distribution. Investors deposit crypto, and the smart contract executes payments to each participant. But Shopin's syndicate skipped that automation. Instead, one woman held the funds with responsibility for distributing Shopin coins after the ICO wrapped. Before that distribution happened, someone accessed her wallet.
The breach wiped out 12% of the ICO's tokens (4% of total supply). Shopin announced it would conduct a coin swap to compensate affected investors. The syndicate representative, who lost personal funds in the hack, reported it to Japanese police.
Shopin declined to share the representative's contact information, so I could not verify their account of what happened. The company's opacity raises questions worth asking.
Shopin's token price fell sharply after the hack announcement. A decline that steep requires selling pressure. The alleged hacker hasn't moved coins from their account. Former investors scared by the news might be dumping. Or Shopin could be liquidating its own holdings. The company has reserved tokens for team members, kept in accounts the public cannot view. They could have sold some during the ICO to themselves, or released reserved tokens to the market. That move wouldn't hurt them during a coin swap, since new tokens get created regardless of the swap's size. I found no evidence this happened. But without independent verification of Shopin's story, the possibility exists.
Someone claiming to be the hacker commented on the account saying something else: the private key wasn't stolen, just left publicly accessible online. They offered to return the coins for $1 million in ETH. With Shopin already committed to the coin swap, that deal looks dead.
Etherscan shows one account holding 25.19% of all Shopin tokens. The team should control 24.42% according to the ICO terms. That same account has sent tokens out repeatedly, though team tokens were supposed to stay locked for three years. Even after releasing coins on June 22 alone, the account still exceeds its allocated share. Shopin asks investors to trust the company without allowing them to verify what's happening.
That request runs against crypto's core principle: verify, don't trust. Thousands of buyers bet on a single person's competence. Most understand cryptocurrency well enough to hold wallets. That knowledge didn't prevent them from losing to one person's negligence, and it won't save the project.
CEO Eran Eyal told me shortly after the hack how he sees the situation: "This is a situation where people are negligent and lazy. There is nothing you can do about it. Harrison Hiens' [Token Foundry] does it right, with smart contracts that are irrefutable. The moment they get the tokens, it is out of their hands."
That distinction matters. ICO creators cannot control which syndicates approach them, though they can choose who participates in pre-sales. Shopin's experience should push other projects to vet their syndicate partners with care.
