What happened
Vulnerability fixed, losses compensated
On July 18, 2022, Dolphin {anty} announced in its official channel that browser profiles had been leaked from cloud storage. According to the company, about 15% of all profiles were compromised. Users reported funds being withdrawn from exchange accounts and crypto wallets. The company did not disclose the technical cause. It said most affected users had contacted support before the announcement. One media-buying publication reported that the vulnerability was fixed on the night of July 14–15, three to four days before the announcement; the company itself did not provide that date.
Who was affected
≈ 15% of profiles
About 15% of all browser profiles, according to the company. The number of affected users was not disclosed.
Losses
amount not disclosed
The company did not disclose the total amount. A media-buying publication with an affiliate link to Dolphin {anty} counted $8,500 in compensation based on public messages in chats. Based on the wallet the payouts came from, it put them at about $20,000 (without giving the wallet address) and suggested that the final total could reach ~$100,000. Two affected users reported losses of $3,000 and $3,300 and said the company had reimbursed them in full.
What the company did
It fixed the vulnerability and advised users to sign back in to important accounts, enable 2FA, and change their passwords and 2FA keys saved in profile notes. It paid compensation for lost funds and accepted claims until July 27, 2022. According to the company, by that point it had begun receiving requests that appeared to be attempts to fraudulently obtain compensation. Later, without a direct connection to the leak, it added 2FA to the client (March 2023), the option to store profiles only on the user’s computer (March 2025), and active-session management (September 2026).
Our editors collected and checked the sources; the text says who gives each figure.