- Key insight: The theft occurred shortly after the startup lost access to the U.S. banking system, with former partners like Checkbook and JPMorgan Chase citing compliance risks.
- Supporting data: Attackers drained nearly $341,000 in USDC from 1,005 user accounts, though the company says it has now processed refunds for 100% of the impacted amounts.
- What’s at stake: Kontigo’s operations face heightened uncertainty as U.S. military actions and the recent arrest of Nicolás Maduro complicate the already difficult compliance landscape in Venezuela.
Overview bullets generated by AI with editorial review
Processing Content
Attackers recently stole the equivalent of $341,000 in stablecoin from Kontigo, a financial app serving Latin America, forcing the company this week to reimburse more than 1,000 affected users.
The theft comes after the fintech startup lost some of its access to the U.S. banking system last month due to compliance risks, and U.S. military operations have heightened political instability in Venezuela, Kontigo’s primary market.
Kontigo said a threat actor drained a total of 340,905.28 USDC from 1,005 user accounts, according to Monday posts on the company’s X account. The company said later that day that it processed refunds for 100% of the impacted amounts.
“We detected an unauthorized access that affected funds of some users,” the company said, adding that its team isolated the involved systems and activated security protocols. The statements from Kontigo, issued in Spanish, have been translated.
Kontigo did not respond to a request for comment from American Banker.
Kontigo has not indicated the specific attack vector at the heart of the incident nor whether the breach compromised any customers’ personally identifiable information.
It is also unclear what funds Kontigo used to refund affected customers, such as whether it used corporate treasury funds or a cyber insurance payout. The company has not indicated whether it has reported the breach to U.S. or international financial regulators.
Kontigo markets itself as a “financial super app” and “neobank” that allows users in Venezuela, Colombia and Mexico to save and transact in digital dollars to avoid local inflation. The company facilitates cross-border payments and offers yield-bearing savings products it calls “Piggy Banks.”
Despite its branding, Kontigo lacks a bank charter. The company states explicitly in its terms and conditions that it “does not provide or offer financial services nor carry out any type of activity typical of financial institutions that require authorization to operate.”
Instead, the firm relies on self-custodial wallets and partners with licensed providers for fiat currency rails. However, those partners have started to pull back.
Kontigo loses a banking partner
The theft this week comes less than a month after a report that JPMorganChase froze accounts used by Kontigo and other stablecoin firms, citing a rise in disputed transactions and compliance risks associated with Venezuela, according to
Checkbook, a digital payments firm backed by JPMorgan, had provided Kontigo the virtual accounts. The company’s CEO, PJ Gupta, told The Information that Kontigo and similar firms needed to ensure legitimate transactions and verify customer identities.
Kontigo CEO Jesus Castillo disputed the chargeback narrative in a post on X, claiming the company “never had chargeback issues with Checkbook” and alleging that Checkbook and JPMorgan cut the company off with zero notice.
Venezuela loses a president
The disruptions coincide with major geopolitical upheaval in Kontigo’s key market of Venezuela.
U.S. military forces captured the country’s president Nicolás Maduro in a raid on Jan. 3. Prosecutors arraigned him in a New York federal court on drug trafficking charges on Monday; he pleaded not guilty.
Prior to Maduro’s capture, the U.S. maintained heavy sanctions on the Venezuelan government and a number of companies in the country, which created the complex compliance environment that U.S. banks cite when offboarding fintechs operating in the region.