Blockchain Graveyard
These cryptocurrency institutions have suffered intrusions resulting in stolen financials, or shutdown of the product. Several closed down afterward.

Many of these attacks could have been prevented:
  • Social Engineering / Credential Reuse
  • Account Takeover of Cloud Hosting
  • Application Vulnerability
You can submit a pull request here, and add any breaches that I've missed.

I have estimated the root causes below based on publicly available information, with a link to more information in the breach.

Root Cause Estimates

The data below is roughly gleaned from publicly available data about 94 incidents. This should assist estimation during threat modeling.

    Incident Briefs

  • Paid Network

    In progress. Will update.

  • altsbit

    1. On February 5, 2020 the exchange Altsbit suffered an attack by hackers, in the attack unfortunately a certain quantity of coins were stolen from the platform. After a careful analysis we managed to understand the stolen quantities, fortunately a good part of the coins were kept on cold storage, these coins will be returned to the users of Altsbit exchange not having the possibility to compensate for these losses, they will be distributed among all users of the platform each coin will have its calculation based on the percentage that was saved during the attack

  • Livecoin fully compromised

    Livecoin landing website was overwritten with the following message (with a RU translation underneath)

    ATTENTION!!!

    Dear clients, we ask you to stop using our service in all meanings: don’t deposit funds, don’t trade, don’t use API. We are under a carefully planned attack, which has been prepared, as we assume, over the last few months. We lost control of all of our servers, backend and nodes. Thus, we were not able to stop our service in time. Our news channels were compromised as well. At the moment, we partially control frontend, and so we’re able to place this announcement. We’re fighting hard to get back our servers, nodes and funds, we’re working 24/7. News and next update will come up in the next few days. We’re working in contact with local police authorities. We really do our best to overcome this issue.

  • Exmo hot wallet large withdrawals

    On December 21 2020, some large withdrawals from EXMO hot wallets were detected. EXMO has advised to not deposit into the exchange until further notice. They have ensured their cold storage is safe and only unauthorised access were to their hot wallets

    We are still investigating the incident, but as of now, the security audit report showed that some amounts of BTC, XRP, ZEC, USDT, ETC and ETH in EXMO’s hot wallets were transferred out of the exchange. We reacted immediately and re-deployed hot wallets. The affected hot wallets comprise near 5% of the total assets. Let us stress that all the assets in the cold wallets are safe.

    In the meantime, we ask you NOT TO DEPOSIT ANY FUNDS TO THE EXISTING EXMO WALLETS. All the withdrawals are suspended at the moment.

    • BTC — 1A4PXZE5j8v7UuapYckq6fSegmY5i8uUyq
    • USDT (ERC20) — 0x4BA6B2fF35055aF5406923406442cD3aB29F50Ce
    • ETH — 0x4BA6B2fF35055aF5406923406442cD3aB29F50Ce
    • BCH — qrfrw5q9gag2vp6jc5nlx0haplm2jlhx9vsvxd9u3e
    • ZEC — t1StUQiw1YyHT515xDxwxjfhEcw2iGSq2yL
    • XRP — rwU8rAiE2eyEPz3sikfbHuqCuiAtdXqa2v (tag 2033412069)
    • ETC — 0x4d9EF6846126Da2867AF503448be0508542C971e

  • Cover Protocol

    “The Blacksmith farming contract has been exploited to mint infinite COVER tokens. We have restricted minting access to the farming contract in order to stop the attacker. If you are providing liquidity for COVER token (uniswap or sushiswap) please remove it immediately,”

    Money was given back. See input data:

    Next time, take care of your own shit.

  • origin

    About $7M lost.

    The attack was a reentrancy bug in our contract. Unfortunately, our contract was safe from reentrancy bugs unless one of our supported stablecoins was attacking us. The attacker exploited a missing validation check in mint multiple (when minting OUSD with multiple stablecoins) to pass in a fake “stablecoin” under their control. This “stablecoin” was then called “transferFrom” on by the vault, allowing the hacker to exploit the contract with a reentrancy attack in the middle of the mint. The attacker was able to create a rebase event inside the second mint after funds had moved to OUSD from the first large mint, but before the supply of OUSD increased. This created a massive rebase for everyone in the contract, including the attacker. The attacker then also received their first large OUSD mint, giving them in total more OUSD than the contract had assets. The attacker withdrew most of the stablecoins from OUSD. They were then able to take extra OUSD after withdrawing and sell it on Uniswap and Sushiswap for USDT in subsequent transactions.

  • Cheese Bank

    On November 6 (GMT), hackers used the dydx flashloan to launch an attack on Cheese Bank, resulting in a loss of more than $3.3 million.The hacker transferred 1 ETH on the anonymous platform for the initial handling fee. By calling dydx’s flashloan contract, the hacker borrowed 21000 ETH, and used 50 ETH to purchase 107232 Cheese in Uniswap. 107232 Cheese and 78.8 ETH were added into the Uniswap liquidity pool to obtain Cheese-ETH UNI LP tokens, and all of them were deposited into Cheese Bank. After this operation, hackers continued to use 20000 ETH to attack the Cheese token price in Uniswap, resulting in the instantaneous increase of the value of Cheese-ETH UNI LP tokens by 300 times, and the stable currencies such as USDT/ USDC / Dai of Cheese Bank are all borrowed up. 58812 USDC in the stolen funds were converted into 132 ETH to pay the fees during the attack. After that, all the stolen assets were converted to BTC through multiple DeFi platforms, renBTC and other institutions. The subsequent complex and intensive transfer operations are continued.

  • Value DeFi

    On Nov 14th 2020 at 03:36:30 PM UTC, a hacker performed a flash-loan exploit on the MultiStables vault of ValueDeFi protocol, which resulted in a net loss of roughly 6mil$.

  • akropolis

    Started at 11:50:41 AM +UTC, 12 November 2020, Akropolis was attacked by exploiting its flawed handling of the deposit logic in its SavingsModule smart contract. The hack results in a loss of 2,030,841.0177 DAI from the affected YCurve and sUSD pools. The stolen funds are currently held here: https://etherscan.io/address/0x9f26ae5cd245bfeeb5926d61497550f79d9c6c1c. The account has been blacklisted.

    This incident was due to a bug in the protocol without (1) validating the supported tokens and (2) enforcing reentrancy protection on the deposit logic. The exploitation leads to a large number of pooltokens minted without being backed by valuable assets. The redemption of these minted pooltokens is then exercised to drain about 2.0mn DAI from the affected Curve Y and Curve sUSD pools.

  • Liquid Exchange

    On the 13th of November 2020, a domain name hosting provider that manages one of our core domain names incorrectly transferred control of the account and domain to a malicious actor. This gave the actor the ability to change DNS records and in turn, take control of a number of internal email accounts. In due course, the malicious actor was able to partially compromise our infrastructure, and gain access to document storage.

    We believe the malicious actor was able to obtain personal information from our user database.
    This may include data such as your email, name, address and encrypted password.

  • harvest

    On October 26, 02:53:31 AM +UTC, an attacker executed a theft of funds from the USDC and USDT vaults of Harvest Finance. The attacker exploited an arbitrage and impermanent loss that influences the value of individual assets inside the Y pool of Curve.fi, which is where the funds of Harvest’s vaults were invested. The following mechanics of the protocol allowed for executing such an attack:

  • eminence

    $15M lost in smart contract.

    “The exploit itself was a very simple one, mint a lot of EMN at the tight curve, burn the EMN for one of the other currency, sell the currency for EMN”

  • KuCoin

    KuCoin acknowledges their hot wallets drained of over $150,000,000 worth of assets, including ETH, ERC20 tokens, and Bitcoin. Tether company has frozen 20,000,000 USDT withdrawn from KuCoin to prevent bad actors from moving those tokens around.

    Suspicious addresses listed below:

    • ETH: 0xeb31973e0febf3e3d7058234a5ebbae1ab4b8c23

    • BTC: 1NRsEQRg5EjmJHbPUX7YADVPcPzCQBkyU7

    • LTC: LQtFoidy5TmLrPP77MZzgMRffqPsmRfMXE

    • XRP: r3mZvvHVLPtRWAujzBsAoXqH11jhwQZvzY

    • BCHSV: 15mC7zKbLyErSKzGRHpy6gyqS7GyRpWjEi

    • XLM: GBM3PJWNB5VKNOFXCDTTNXPMUNBMYTLAAPYDIIKLHUGMKX7ZGN2FNGFU

    • USDT: 1NRsEQRg5EjmJHbPUX7YADVPcPzCQBkyU7

    • TRX: TB3j1gUXaLXXq2bstiSMfjQ9R7Yh9DdDgK

  • eterbase

  • Opyn ETH Put Exploit

    This morning, at approximately 4:00 AM PT, we became aware of an exploit on the Opyn ETH Put contracts via a user report in our Discord chat. This exploit allowed an attacker to “double exercise” oTokens and steal the collateral posted by certain sellers of these puts. At the time of this post, we’ve found 371,260 USDC that has been stolen from these contracts, but this amount may change as our investigation continues. 439,170 USDC from outstanding vaults was successfully recovered by a white hat hack that the Opyn team conducted on the Convexity Protocol to mitigate further loss. (Update: Working with samczsun we were able to whitehack an additional 132,995 USDC.)

  • balancer

    An incident occurred on Balancer today which allowed an attacker to drain funds from 2 pools that contained tokens with transfer fees (sometimes referred to as deflationary tokens). STA and STONK were the tokens in each pool. Note: this only affects pools where a token has these transfer fees.

    “We were not aware this specific type of attack was possible.”

  • dforce

    $25 Million with smart contract exploit. Strangely, returned.

    We know that the hackers utilized a vulnerability with the combination of using ERC777 tokens and DeFi smart contracts to execute a reentrancy attack. The callback mechanism enabled the hacker to supply and withdraw ERC777 tokens repeatedly before the balance was updated. More analysis on the hack can be viewed from PeckShield’s report.

  • iota

    Early analysis and investigations (attack patterns, in-depth scans of affected users systems, extensive code dependency scans/reviews, different types of user-comparisons), as well as process of elimination, allowed the teams to identify a likely cause: the integration of a third-party service (Moonpay), which enabled users to directly purchase IOTA tokens within Trinity. We immediately informed MoonPay about the possible exploit.

  • bzx (multiple incidents)

    Three unique incidents involving smart contracts.

  • Upbit

    342,000 ETH was stolen from Upbit hot wallet on November 27, 2019. A full post mortem has not been released yet, though it looks like the unauthorized transaction was signed from a different process as; hot <-> cold wallet reassignment and user withdrawals due to onchain variables: input data, gas limit, gas price.

    Popular service (whale_alert) tweeted the transaction on November 27, 2019 very shortly after the transaction was confirmed on the Ethereum (ETH) Network.

    Upbit took an impressive 50 minutes to be notified and roll out a plan to secure their remaining funds and issue an announcement.

  • Idax

    Idax has confirmed that since November 24, 2019, the Idax CEO went missing with sole access to the exchanges cold wallets.

    Since we have announced the announcement on November 24, IDAX Global CEO have gone missing with unknown cause and IDAX Global staffs were out of touch with IDAX Global CEO.

    For this reason, access to Cold wallet which is stored almost all cryptocurrency balances on IDAX has been restricted so in effect, deposit/withdrawal service cannot be provided.

  • vindax

    No available causal information.

  • bitpoint

  • Bitrue

    9.3 million XRP and 2.5 million ADA stolen from 90 individuals. The root cause seems to be described here:

    At approximately 1am June 27 (GMT+8), a hacker exploited a vulnerability in our Risk Control team’s 2nd review process to access the personal funds of about 90 Bitrue users.

    The hacker used what they learned from this breach to then access the Bitrue hot wallet and move 9.3 million XRP and 2.5 million ADA to different exchanges.

    This is described as an issue that depleted a hot wallet, but doesn’t seem to have compromised the key material backing it. It describes malicious usage of a tool which can transfer funds from a hot wallet. It’s not described how this tool was accessed.

    They note that cold storage was a useful mitigation.

    It’s not clear how this tool was accessed, I will update if new information comes out.

  • Komodo hacks itself

    Of note, they may have recovered their funds through novel means.

    Today, Komodo were made aware of an issue with one of the libraries used by the Agama wallet, potentially putting some user funds at risk.

  • Binance

    Estimates put this breach squarely at 7000 BTC, given it is in a single transaction. There is not a lot of technical details released in the multiple follow ups from Binance.

    I can’t make a strong estimation on root cause regardless of the number of statements made by Binance. The most informative statements are below:

    We are making significant changes to the API, 2FA, and withdrawal validation areas, which was an area exploited by hackers during this incident. We are improving our risk management, user behavior analysis, and KYC procedures. We are working on more innovative ways to fight phishing. We also have a number of additional security measures being implemented not directly visible on the front end.

    This suggests normal application withdrawal flows were used as opposed to a hot wallet or key material breach, but doesn’t explain the volume or necessity for a blog post if these came from common attacks on customers. It’s unclear how these were gathered, which leaves open the possibility of a backend database breach or attacks on the customers directly.

    Impact-wise, the single BTC transaction of about 7000 BTC is the only transaction in which funds were stolen, and it’s quite simple to verify this on the blockchain.

    This might suggest that transactions are batched up and somehow the attack bypassed security policy this way by performing several application actions resulting in one complex withdrawal, which might indicate that these transactions happened suddenly. This leaves further uncertainty about how the breach occurred.

    Hackers were able to obtain a large number of user API keys, 2FA codes, and potentially other info. The hackers used a variety of techniques, including phishing, viruses and other attacks. We are still concluding all possible methods used. There may also be additional affected accounts that have not been identified yet.

    It’s hard to say whether these were obtained from attacks on consumers directly or by a backend attack on Binance. The details released are more narrative than technical, so we’re not left with much to learn from.

    I’m categorizing this as unknown. I’d be willing to change this with better post mortem data, or, perhaps making a new category for a coordinated account takeover against customers.

  • DragonEx

    DragonEx is a cryptocurrency exchange based out of Singapore. On March 24th, they suffered a breach:

    On March 24th, DragonEx has encountered attacks from hackers, our users’ crypto assets and Platform crypto assets were transferred and stolen. Part of the assets were retrieved back, and we will do our best to retrieve back the rest of stolen assets. Several Judicial administrations were informed about this cyber crime case including Estonia, Thailand, Singapore, HongKong etc. and we’re assisting policemen to do investigation. All platform services will be closed and the accurate assets loss recovery situation will be announced in a week. For the loss caused to our users, DragonEx will take the responsibility no matter what.

    At least part of the assets were recovered as the exchange enlisted other exchanges to freeze wallets that received the stolen tokens. Estimates put the losses at $7m.

  • Cryptopia

    Cryptopia is a cryptocurrency exchange based out of New Zealand. On January 14th, 2019, they suffered a breach:

    Yesterday 14th January 2019, the Cryptopia Exchange suffered a security breach which resulted in significant losses. Once identified by staff, the exchange was put into maintenance while we assessed damages.

    Estimates put the losses at $2.5m-$13m USD in Ethereum and ERC20 tokens being stolen. Two law enforcement press releases were issued. Funds were seen to be exfiltrated to several exchanges for laundering, as noted in this Binance tweet.

    Not much else is known.

  • Gate.io

    A web analytics platform called StatCounter was compromised and impacted over 700k of its customers. However, only one company was discovered to be targeted, Gate.io, which embedded the script.

    According to ESET, the malicious code wouldn’t actually do anything unless the link contained a specific string: “myaccount/withdraw/BTC.” Researchers identified Gate.io to be the only website using a URL that contained this string.

    This attack evaded blockchain analysis, so a total loss is not available:

    ESET notes the script automatically generated a new Bitcoin address each time it was run. This effectively neutralizes the ability to link Bitcoin transactions together in a meaningful way, which frustratingly protects the identity of the attackers.

  • Trade.io

    The Trade.io breach was widely reported as a cold storage issue, losing about $7.5 million. A fork was discussed as a result:

    Preissler says the company is considering a fork of the TIO token codebase to invalidate the stolen funds, and “[protect] the value of TIO for everyone else.”

    More information on the Trade.io blog post.

    At 08:40 EST 20 October 2018, the trade.io security team was alerted to a large transaction originating from our wallet holding 50M Trade Tokens (TIO) owned by trade.io reserved for the liquidity pool. Immediately following the alert, our trade monitoring observed abnormal trading of TIO on external exchanges. These exchanges were immediately alerted to disable deposits/withdrawals and trading of TIO, and our security team began its investigation. The responsiveness by the various teams within trade.io prevented the situation from deteriorating and helped quarantine the issue.

    At no point was the trade.io exchange or liquidity pool accessed or affected, and both remain operational. The breach was limited to one particular hardware wallet that was purchased directly from the manufacturer. Consequently, no customer accounts were directly affected, or customer funds lost. Investigations are ongoing, but have so far concluded that there was no technical hack on the cold storage unit, and trade.io systems remain secure and unbreached. There is also nothing to indicate theft by internal actors.

    The “cold storage” term should not be taken lightly, and it is claimed to be breached. It is possible to improperly create cold storage with a compromised key. There is a likelihood that the cold storage was improperly created, a likelihood of an insider, and a compromised piece of offline hardware. With so much uncertainty it is difficult to categorize this breach without more information.

  • MapleChange

    There are heavy accusation of an exit scam, so I delayed the posting of this breach.

    Due to a bug, some people have managed to withdraw all the funds from our exchange. We are in the process of a thorough investigation for this. We are extremely sorry that it has to come to end like this. Until the investigation is over, we cannot refund anything.

    A follow up tweet includes a post mortem:

    The method unlock_and_sub_funds has proper conditionals, immediately raising exceptions if the sub amount goes below the balance of the user. In this case, even if the malformed/exploited order did get processed, it would stop here, properly throwing an error in our logs and allowing us to properly investigate. However, the perpetuators knew exactly how this code would run, and as a result abused it using a series of accounts, as you notice in order.rb (https://github.com/peatio/peatio/blob/6fe7e960a12c40053370cb25cdd0968b67041aa0/app/models/order.rb), the call strike both calls hold_account.unlock_and_sub_funds (removing funds from one account) and adding it onto expect_account. If properly executed, this exploit could continue to subtract funds from one account and add onto the other one with no limitations. This is primarily the cause of the bug.

    So, the best estimate is that it is an application vulnerability (if it indeed was not an exit scam). This would be typical of the occurrences of race conditions and other ledger related application bugs in the graveyard.

  • Zaif

    Zaif, a Japanese cryptocurrency exchange, lost approximately $59 million USD of BTC, MONA, and BCH according to reporting and a press release. They specifically mention a hot wallet on a server being breached “from the outside” which I take as a remote compromise of infrastructure. Additionally, they mention that they use cold storage, which may have prevented this from being far larger.

    In order to respond to customer’s deposit / withdrawal, we are keeping it in hot wallet (part cold wallet) of kept virtual currency from customer. Unauthorized access from the outside was conducted from around 17 o’clock on July 14, 1900 to around 19 o’clock on the server managing the hot wallet for the deposit and withdrawal, and the virtual wallet managed by the hot wallet Currency (BTC, MONA, BCH) was illegally remitted.

    Regarding specific concrete methods of unauthorized access, etc., this case is a criminal case, it has already been requested to investigate by filing a damage report to the investigation authorities, and also in order to prevent the same kind of crime in the future I would like you to withhold me. We understand that detailed explanation is as much as possible, but I am pleased if you acknowledge it in any way.

  • Fomo3d

    This contract is owned / maintained by pseudonyms I guess. First winner took advantage of an attack against the smart contract.

  • KICKICO

    KICKICO posted details of a breach regarding their smart contract. An attacker managed to obtain the private key to the smart contract and used that to transfer $7.7M in funds into their possession.

    The hackers gained access to the private key of the owner of the KickCoin smart contract. In order to hide the results of their activities, they employed methods used by the KickCoin smart contract in integration with the Bancor network: hackers destroyed tokens at approximately 40 addresses and created tokens at the other 40 addresses in the corresponding amount. In result, the total number of tokens in the network has not changed.

    The attackers circumvented security checks by deleting and then recreating coins, avoiding a large set of suspicious transfers. This may lead to future Blockchain Graveyard categorizations around smart contracts. In this case, the contract owner was compromised.

    It’s important to note:

    We were able to regain control over the tokens and prevent further possible losses by replacing the compromised private key with the private key of the cold storage.

  • Bancor

    Bancor posted early details of an investigation into a security breach regarding a smart contract. A wallet used to upgrade smart contracts was used to steal somewhere in the range of $23M. Some amount of this was mitigated by protocol level features that allow the freezing of BNT tokens.

    A wallet used to upgrade some smart contracts was compromised. This compromised wallet was then used to withdraw ETH from the BNT smart contract in the amount of 24,984 ETH ($12.5M). The same wallet also stole: 229,356,645 NPXS (~$1M) 3,200,000 BNT (~$10M)

    Note: Charting as “unknown” until the method used to compromise the method is described.

  • Coinrail

    Coinrail is a South Korean cryptocurrency exchange. It is reported to have lost $40 million in cryptocurrency in a post on their website.

    On June 10, there was a system check due to the hacking attempt at dawn. At present, we have confirmed that 70% of the coin rail total coin / token reserves are safely stored I moved to a cold wallet and it’s being saved. About 80% of coins that have been confirmed to be leaked have been frozen / withdrawn / redeemed or equivalent, in consultation with their co-workers and related exchanges, while the remainder are under investigation with investigators, related exchanges and coin developers.

    Interestingly, South Korean Law Enforcement worked pretty quickly to help contain the issue with maintainers of the coins that had theft.

  • Bithumb

    This is Bithumb’s second appearance in the graveyard. 35 billion Korean won (around $31 million) is estimated to have been stolen, and data about root cause is sparse.

  • Taylor

    Taylor is described as a “smart cryptocurrency trading assistant” which allows people to day trade cryptocurrency.

    Today we arrived at the office and found out that we’ve been hacked and all of our funds have been stolen. Not only the balance in ETH (2,578.98 ETH), but also the TAY tokens from the Team and Bounty pools.

    Lots of write ups from their executives shed light on their incident (1, 2, 3). The root cause appears to be a 1Password file theft. It is not clear how the file was accessed, how a hacker had positioning to view it, or whether it contained cryptographic secrets or infrastructure secrets.

    Somehow the hacker got access to one of our devices and took control of one of our 1Password files.

    The following is also interesting:

    Although we are all aware of the good practices, we confess that we may have neglected some very important details — we know that the devil is in the details. As far as we know, the hacker is same person/group that supposedly hacked CypheriumChain (more than 17,000 ETH were stolen). The hacker collected the amount from multiple sources in a single wallet, then transferred it to a bigger one. What we can say is that it was not a smart contract exploit.

  • Coinsecure

    A failed cold storage restoration exercise seems to have exposed private keys intended for offline storage (effectively making them online). However, the CEO has expressed an insider’s involvement. Police found private keys exposed online for more than 12 hours.

    Our system itself has never been compromised or hacked, and the current issue points towards losses caused during an exercise to extract BTG to distribute to our customers. Our CSO, Dr. Amitabh Saxena, was extracting BTG and he claims that funds have been lost in the process during the extraction of the private keys.

  • Bitgrail

    This is one of the harder breaches to decipher, as there are a lot of conspiracy articles and accusations by all parties involved. Underlying the Bitgrail breach seems to be some kind of application error of some sort, as opposed to a fully hijacked wallet, but this doesn’t have a lot of certainty involved. The Nano core team (the currency involved) announced suspicion of the exchange and their claims.

    We now have sufficient reason to believe that Firano has been misleading the Nano Core Team and the community regarding the solvency of the BitGrail exchange for a significant period of time.

    However, the Bitgrail accusations have pointed towards a thief, and blockchain viewing software developed by Nano.

    BitGrail Srl once again confirms that it was the victim of a theft, which took advantage of malfunctions of the software made available by the NANO team (rai_node and official block explorer) and, therefore, also for these reasons and according to the law, is not absolutely responsible, for any reason, of the incident. .

  • Coincheck

    Coincheck is a Japanese exchange that works with multiple blockchains, including NEM. Around January 26, 2018, XEM valued at approximately $400m USD were stolen. Initial cause was unclear to Coincheck according to their statements.

    After hours of speculation Friday night, Coincheck Inc. said the coins were sent “illicitly” outside the venue. Co-founder Yusuke Otsuka said the company didn’t know how the 500 million tokens went missing, and the firm is working to ensure the safety of all client assets. Coincheck said earlier it had suspended all withdrawals, halted trading in all tokens except Bitcoin, and stopped deposits into NEM coins.

    Follow up reporting based on a press conference cite a breached hot wallet. Marking this as a basic “server” breach as a result of a “hot wallet” being referenced.

    According to the exchange’s representatives, the hackers have managed to steal the private key for the hot wallet where NEM coins were stored, enabling them to drain the funds.

  • BlackWallet

    BlackWallet is a wallet used to send and receive Lumens (XLM) on the Stellar network. The creator of BlackWallet announced on Reddit an infrastructure compromise resulting in in a hacked website that attacked users who entered private keys into it. It should be noted that BlackWallet was not in possession of user private keys, but it was a more of a wallet client that could be used to view a wallet.

    BlackWallet appears to have existed since August 2017, with a DNS hijack on January 13 pointing traffic towards Cloudflare, and a malicious browser based wallet. BlackWallet only existed for five months before being victimized.

    I am the creator of Blackwallet. Blackwallet was compromised today, after someone accessed my hosting provider account. He then changed the dns settings to those of its fraudulent website (which was a copy of blackwallet).

  • Youbit

    Youbit was hacked on December 19th at 4:35 am. They had previously been breached earlier in the year, with South Korean officials indicating North Korean involvement. Their hot wallet containing 17% of their assets, was breached and stolen, indicating that cold storage was useful. Assuming server breach of some kind.

    After the accident in April, we have done our best to improve the security, recruitment and system maintenance, and have managed to lower the hot wallet rate.

    Then, at 4:35 am, we lost our coin purse due to our hacking.

    1. The coin loss at 4:35 am is about 17% of total assets. The other coins were kept in the cold wallet and there were no additional > losses.

    2. Loss ratio is low compared to last April, but the management of Yaffian Co. , Ltd. is going to proceed with the process of stopping the transaction, stopping deposit and withdrawal, and bankruptcy on December 19, 2013 ,

    3. Accordingly, all coins and cash withdrawals and withdrawals will be suspended at 12:00 pm on December 19, 2017.

    4. Due to bankruptcy, the settlement of cash and coins will be carried out in accordance with all bankruptcy procedures.

    5. However, in order to minimize the damage to our members, we will arrange for the withdrawal of approximately 75% of the balance at > 4:00 am on December 19, The rest of the unpaid portion will be paid after the final settlement is completed.

    6. We will do our best to minimize the loss of our members by 17% , through various methods such as cyber comprehensive insurance (3 > billion) and selling the operating rights of the company.
    7. After the announcement date, your assets will be adjusted to 75% at 4:00 pm on December 19 , 2017. Cash and coins deposited after 4:00 pm will be 100% refunded.

  • Nicehash

    Nicehash was a cryptocurrency mining service and marketplace, allowing users to buy and sell their own mining power. While not necessarily a mining pool of its own, it still maintained a wallet for customer funds. Nicehash appears to have shuttered their website with a notice saying “a security breach involving NiceHash website” and “our payment system was compromised and the contents of the NiceHash Bitcoin wallet have been stolen”.

    A Facebook livestream has further notes on the issue. This is hard to archive so I will transcribe useful points. Overall, this was lateral movement from a remote IP address, gaining access to a VPN, possibly through an employee computer, and moving laterally into production systems. This appeared to all have happened within a couple of hours, when the attacker decided to work actively.

    1. “We became a target and someone really wanted to bring us down.”
    2. “We are cooperating with local and international law enforcement”.
    3. ~4700 BTC stolen on early morning 12-06-2017
    4. Can’t discuss everything due to investigation.
    5. Hacker(s) were able to infiltrate our internal systems through a compromised company computer.
    6. Unknown how company computer was compromised.
    7. VPN had visibility into abusive behavior, IP address was outside of European Union.
    8. “Made a crucial VPN login using an engineer’s credentials”
    9. After VPN login, learned and simulated the workings of our payment system.
    10. Managed to steal funds from accounts (indicates that the active attack timeline was only a couple hours)

    Shortly after the hack was made public, NiceHash head of marketing Andrej P. Škraba told Reuters that the hack was “a highly professional attack with sophisticated social engineering” and that about 4,700 bitcoin, worth about $63.92 million at current prices, were lost. With this insight, one could assume that the initial access was gained via spear phishing, and then combined with lateral movement or escalation of privledges to ultimately steal the bitcoin.

    Update 1: In the aftermath, the CEO resigned and the company decided to return the stolen funds through a Repayment program. 71% of the old funds was already reimbursed by January 2019. Nicehash is still operating as of October 2019.

    Update 2: In October of 2019, news broke that the CTO of Nicehash was arrested for hacking-related crimes, though the indictment makes no mention of Nicehash..

    Matjaz Skorjanec is wanted in the U.S. for founding and running the cybercrime forum Darkode from 2008 to 2013, as well as for the creation and deployment of one of the largest botnets ever, Mariposa.

  • Tether

    Tether lost $31 million in “tokens”. Tether tokens allow you to “store, send and receive digital tokens pegged to dollars, euros, and yen person-to-person, globally”. Based on wording in Tether blog posts, a “treasury wallet” was drained by an external attacker. This infers that some sort of key material, or signature generating process was misused, so I estimate this ultimately required the breach of a high risk server. This estimation is low confidence and could change with new information, for instance, if the treasury wallet was cold, or held on a compromised endpoint by an employee. Remote access requires some aspect of wallet “warmth” which makes me believe it was online on a server. The Tether team claims high confidence in identifying their root cause so this is not an “unknown” root cause.

    On Sunday, November 19th, $30,950,010.00 in Tether tokens were stolen from our treasury wallet through malicious action by an external attacker. While we are in the process of co-ordinating and co-operating with law enforcement on this matter, we are satisfied that we have found the cause of the breach of Tether’s systems. We are taking measures to recover the Tethers and are migrating the platform to a new infrastructure. More information about our initial response to this breach is here.

  • Parity

    A “critical” vulnerability in Parity led to at least three accounts being compromised by a hacker for a total loss of $31,725,019 USD worth of ether. The vulnerability affected the contract used to create multi-signature ethereum wallets in Parity 1.5.

    The bug was in a pair of extremely sensitive functions designed to allow the set-up of “multi-sig” wallets in the Parity Wallet software.

    The functions should have been protected in order that they be usable only in one specific circumstance, as the contract was being created. However, they were entirely unguarded, which allowed the attacker to reset the ownership and usage parameters of existing wallets arbitrarily.

    Of note, another issue followed this breach creating $280 million in frozen funds. So far it appears accidental and only intrusion / malicious actors in the Graveyard at the time being.

  • Coindash

    CoinDash appears to be victimized by a hacked website, which a supposed adversary swapped out a funding address with a malicious address immediately after a token sale was launched. Marking this as a protocol vulnerability and server vulnerability.

    Contributors that sent ETH to the fraudulent Ethereum address, which was maliciously placed on our website, and sent ETH to the CoinDash.io official address will receive their CDT tokens accordingly. Transactions sent to any fraudulent address after our website was shut down will not be compensated.

    It is unfortunate for us to announce that we have suffered a hacking attack during our Token Sale event. During the attack $7 Million were stolen by a currently unknown perpetrator. The CoinDash Token Sale secured $6.4 Million from our early contributors and whitelist participants and we are grateful for your support and contribution.

  • Bithumb

    (Will update post when more thorough information is available. For now, view bravenewcoin.com

    “The employee PC, not the head office server, was hacked. Personal information such as mobile phone and email address of some users were leaked. However, some customers were found to have been stolen from because of the disposable password used in electronic financial transactions.”

  • ZCoin

    Due to a programming error in the implementation of Zerocoin, an attacker was able to exploit a single proof to generate multiple spends they could send to an exchange, in which the attackers then sold and withdrew funds.

    Significant documentation on the breach is available.

    From what we can see, the attacker (or attackers) is very sophisticated and from our investigations, he (or she) did many things to camouflage his tracks through the generation of lots of exchange accounts and carefully spread out deposits and withdrawals over several weeks. We estimate the attacker has created about 370,000 Zcoins which has been almost completely sold except for about 20,000+ Zcoin and absorbed on the market with a profit of around 410 BTC. In other words, the damage has already been mostly absorbed by the markets.

  • Bitcurex

    Most information related to this breach is in Polish. Bitcurex warned users not to use previous deposit addresses, which indicates a server breach. No information on a root cause is easily available.

    Follow up investigation of the blockchain is mostly done by Polish bitcoin press, which estimates a 2300BTC loss.

  • Bitfinex

    This is Bitfinex’s second appearance in the graveyard.

    All below information is inferred or directly from reddit comments of Bitfinex employees. Employees repeatedly offer insight in comments that an internal breach allowed an attacker to interact with their BitGo implementation, and that BitGo’s security was not compromised.

    Bitfinex suggests in these comments that several withdrawal limits existed per user and system wide, and employees are unsure how they were bypassed.

    BitGo is a multisignature solution that heavily protects loss from a single key material breach. This approach greatly mitigates many of the risks associated with BTC, but still has a burden of securely storing API secrets or taking advantage of mitigations available to them in API implementation.

    At the end of the day, an application interacts with an API that signs transactions.

    The victims have strongly cleared BitGo of fault, it appears Bitfinex may not have taken advantage of (or incorrectly used) the security controls available to them through the BitGo API.

    Employees have also stated that per user, HD wallets backed by the BitGo API were used in lieu of any truly offline cold storage solution. This implementation suggests that authentication to BitGo’s API was “warm” or “hot” leaving API and signing keys to reside on servers that could be remotely accessed by an attacker. It was also suggested that every Bitfinex BTC holder used this approach, meaning vulnerability carried 100% risk of bitcoin loss across the board.

    It’s not currently suggested how servers were accessed for an attacker to position themselves into an attack like this, but will update if that becomes available.

    We are investigating the breach to determine what happened, but we know that some of our users have had their bitcoins stolen. We are undertaking a review to determine which users have been affected by the breach. While we conduct this initial investigation and secure our environment, bitfinex.com will be taken down and the maintenance page will be left up.

  • The DAO

    While technically an application vulnerability, this breach is interesting in that the vulnerability was within an Ethereum Contract. This has made the ability to patch or restore funds a very dramatic and unique situation involving miner consensus and the philosophy of ethereum’s purpose as a technology. Hard and Soft forks were considered with contention to reverse the attack.

    An attack has been found and exploited in the DAO, and the attacker is currently in the process of draining the ether contained in the DAO into a child DAO. The attack is a recursive calling vulnerability, where an attacker called the “split” function, and then calls the split function recursively inside of the split, thereby collecting ether many times over in a single transaction.

  • GateCoin

    This breach is unique in that it attacked Cold Storage.

    It is just as important to protect the deposits into cold storage as much as the cold storage itself. If cold storage deposit is modified, it’s as if you don’t have cold storage at all.

    We have previously communicated the fact that most clients’ crypto-asset funds are stored in multi-signature cold wallets. However, the malicious external party involved in this breach, managed to alter our system so that ETH and BTC deposit transfers by-passed the multi-sig cold storage and went directly to the hot wallet during the breach period. This means that losses of ETH funds exceed the 5% limit that we imposed on our hot wallets.

  • CoinKite

    Not much data available, but in a transition to shut down their wallet product, they somehow leaked a password database.

    While we were turning off servers, disabling firewalls and cleaning up backup systems today, we may have leaked a copy of our database. Although passwords into Coinkite.com are not useful anymore, you can rest assured that passwords were salted and SHA256 hashed with 131,072 rounds. If you used the same password on other sites, as a precaution, you may want to consider changing those other accounts. It’s possible you will see spam to your related email addresses.

  • CoinWallet

    Application vulnerability due to a lack of input sanitation, type unknown, though it does reference a “database call” which implies some form of database injection like SQLi.

    Strangely, they claim that no coins were lost, though CoinWallet shut down anyway.

    It is with great regret that we announce the closure of CoinWallet.co. Our decision to close is based on several factors. Primarily, on the 6th of April we suffered a data breach.

    Despite our best efforts there was a small error in a part of our code that should have checked and sanitized user input on a recently added function. Checks were in place but the check was then subsequently not used to block the database call.

    Our backup security system kicked in as it was designed to and no coins were lost. We have since patched the vulnerability but are still trying to determine the extent of the breach. However it would be advised to change passwords on any other crypto related websites where you use the same password and username as coinwallet.co. We used encrypted and salted passwords but given enough time these should be assumed compromised.

    Effective immediately, we have reset all passwords, deleted all API keys, and halted the twitter Tip Bot.

    This incident prompted us to reassess the viability of running coinwallet.co and it was decided it is just not viable taking into consideration the risk, costs and time involved.

  • CoinTrader

    Not much data available, other than that it has completely shut down after a suspected breach.

    This issue is currently under investigation and it is our intention to have the balance of your account settled as soon as possible. We sincerely apologize for this unfortunate inconvenience and will keep you posted on the progress of this issue. In the meantime, we have halted deposits, withdrawals and trading activity until this matter has been resolved.

  • BitQuick

    Not much detail provided, and appears damage was fairly limited for unknown reasons.

    On Monday, March 14, 2016, our server fell victim to an attack that gave the attacker unauthorized administrative access. The breach was immediately noticed, and the server was shutdown to prevent any further damage. We are still performing a formal investigation to determine the attack vector, and specifically what information was obtained from the server. Due to additional security mechanisms in place, no funds were taken, and all ID’s (driver’s licenses, passports, etc.) and emails remain secured. Sellers were emailed withdrawal instructions Tuesday evening. All outstanding orders and withdrawals have been processed. Only 3% of all funds remain unclaimed.

  • ShapeShift.io

    Extremely detailed post-mortem’s available from this breach, involving an external hacker collaborating with an insider threat.

    On March 14th, ShapeShift had 315 Bitcoin stolen from its hot wallet. It was quickly discovered that an employee at that time had committed the theft. It was reported to relevant authorities, and a civil suit was opened against the individual. As we had quickly figured out who it was, and how to resolve it internally, we were able to keep the site running uninterrupted. We planned to get the stolen property returned, and thought that was the end of it.

  • Cryptsy

    Maliciously placed Application vulnerability after a dependency (Lucky7Coin) was backdoored by a malicious developer, and abused for months to pull off an attack.

    After a period of time of investigation it was found that the developer of Lucky7Coin had placed an IRC backdoor into the code of wallet, which allowed it to act as a sort of a Trojan, or command and control unit. This Trojan had likely been there for months before it was able to collect enough information to perform the attack.

  • Bips.me

    Very little information, other than that wallets were compromised.

    BIPS has been a target of a coordinated attack and subsequent security breached. Several consumer wallets have been compromised and BIPS will be contacting the affected users.

    Most of what was recoverable from our servers and backups has now been restored and we are currently working on retrieving more information to get a better understanding of what exactly happened, and most of all what can be done to track down who did it.

  • BitPay

    The attacker spearphished the CFO (with what looks to be a compromised email / server of someone else, this is unclear) and successfully acquired his credentials with a phishing page.

    These credentials were then used to communicate with the CEO and request multiple large transfers to the amount of $1.8 Million USD. A customer pointed out the fraud.

    Below is the root cause as pointed out by court documents.

    On or about December 11, 2014, Bryan Krohn, the CFO of Bitpay, received an email from someone purporting to be David Bailey of yBitcoin (a digital currency publication) requesting Mr. Krohn comment on a bitcoin industry document.

    Unbeknownst to Mr. Krohn, or anyone at Bitpay, Mr. Bailey’s computer had been illegally entered (i.e. “hacked”).

    The phony email sent by the person who hacked Mr. Bailey’s computer, directed Mr. Krohn to a website controlled by the hacker wherein Mr. Krohn provided the credentials for his Bitpay corporate email account.

    After capturing Mr. Krohn’s Bitpay credentials, the hacker used that information to hack into Mr. Krohn’s Bitpay email account to fraudulently cause a transfer of bitcoin.

    The hacker illegally hacked Mr. Krohn’s computer so he could use his or her computer to send false authorizations to Bitpay on December 11 and 12, 2014.

    It is this hacking which fraudulently caused the transfers of bitcoin and therefore the loss to Bitpay of bitcoin valued at $1,850,000 (the “Loss”).

    Bitpay cannot recapture the lost bitcoin.

  • Cloudminr.io

    An attacker defaced the cloudminr.io website with a “database for sale” message containing usernames and passwords.

    According to various reports, the site was hacked on or about July 7th, with the main page of the service being amended over the weekend to offer the sale of customer login and personal information, along with a CSV (comma separated values) taste-test of the details of 1,000 customers’ personal details by the hackers to demonstrate that they were the “real deal.”

  • Bitstamp

    If a leaked incident report is to be believed, a VBA script embedded in a Word document was delivered via social engineering tactics over Skype to several employees. This malware was detonated on a system administrator’s machine who also had access to wallet.dat files and wallet passwords. 18,866 BTC lost as deposits were stolen over the course of several days.

    Bitstamp experienced a security breach on Jan. 4th. Security of our customers’ bitcoin and information is a top priority for us, and as part of our stringent security protocol we temporarily suspended our services on January 5th. All bitcoin held with us prior to the temporary suspension of services starting on January 5 (at 9 a.m. UTC) are completely safe and will be honored in full. We are currently investigating and will reimburse all legitimate deposits to old wallet addresses affected by the breach after the suspension.

  • BitFinex

    A small hot wallet compromise, although uncertain how they were accessed.

    Dear Customer although we keep over 99.5% of users’ BTC deposits in secure multisig wallets, the small remaining amount in coins in our hot wallet are theoretically vulnerable to attack. We believe that our hot wallet keys might have been compromised and ask that all of our customer cease depositing cryptocurrency to old deposits addresses. We are in the process of creating a new hot wallet and will advise within the next few hours. Although this incident is unfortunate, its scale is small and will be fully absorbed by the company. Thanks a lot for your patience and comprehension. Bitfinex Team”

  • Allcrypt

    An attacker used a simple account takeover with multiple pivots to gain server access to a wallet.

    With administrative access to Wordpress, the attacker was able to upload PHP based tools to explore the filesystem and discover stored secrets. From there, database credentials were accessed and another PHP based database tool was used to access a database and modify a off-chain ledger. The attacker then dodged double accounting systems by discovering loopholes around the purchase/sale of bitcoins.

    This deserves a full read and is one of the better post mortems in the graveyard.

    Around 8PM on Sunday (all times EDT) our marketing director’s blog account requested a password reset. Up until the writing of this post (Wednesday morning, 10am) we do not know how the thief managed to know the marketing director’s (will refer to this as MD from here) account. Our best guess is it was an educated guess based on info found (more on that in a moment). The MD saw this email come in, and forwarded it to myself, and another team member (a technical lead/temporary assistant support staff), letting us know what happened and that he did not request the password reset. I did not see the email at the time, as I was out, and it was not a huge red flag that would require a phone call. Once I returned home later, I saw the email, and logged into the server to double-check on things. That’s when I discovered the breach.

    Apparently, the thief had gained access to the tech assistant’s email account. That email was hosted on a private server (not gmail, yahoo, etc). We have no idea how the password was acquired. We spent a lot of time this week downloading password lists from torrents, tor sites, etc, and could find his password in none of the lists. He assures us he did not use the password in multiple places, and that it was a secure password. Our best guess is that it was a brute force attempt. The mail server he uses used the dovecot package for IMAP mail, which, for reasons we cannot comprehend, does NOT log failed password attempts by default. Because of this, at first, we believed that the hacker somehow had the person’s password. But we do not know, and there is no way to know at this point how the password was found.

  • Cryptoine

    Application vulnerability involving a race condition for multiple currencies at Cryptoine.

    According to a statement on the Cryptoine website, the firm claims that a “hacker found some race condition bug in our trading engine. Manipulation of orders gave him false balances.”

    In a further update, Cryptoine claims that the hack only targeted hot wallets, saying that “our hot wallets was [sic] drained, coins: bitcoin, litecoin, urocoin, dogecoin, bitcoinscrypt, magi, darkcoin, dogecoindark, cannabis” but promises that all coins they still have will be returned to users “in correspondingly smaller quantities.”

  • CAVirtex

    Not much detail, other than a database breach and it seems all customers were paid back.

    Effective immediately, CAVIRTEX intends to cease carrying on an active Bitcoin business and will be winding down its operations in an orderly manner. As a result, effective immediately, no new deposits will be accepted by CAVIRTEX. Trading on CAVIRTEX will be halted effective March 20, 2015. Effective March 25th, 2015, no withdrawals will be processed. CAVIRTEX will communicate with any account holders that continue to hold balances after March 25, 2015.

    We have maintained 100% reserves. CAVIRTEX is solvent and remains in a position to accommodate all customer withdrawal requests received prior to March 25, 2015. However, On February 15, 2015 we found reason to believe that an older version of our database, including 2FA secrets and hashed passwords, may have been compromised. This database did not include identification documents.

  • ExCoin

    Not much data, other than the name of a hacker and that they stole the entire wallet, shutting down ExCoin.

    February 6th and 10th, the user ‘Ambiorx’ was able to gain access to all the Bitcoins on the Exco.in exchange. As a result we no longer have the means necessary to continue operation and are deeply saddened to announce we will be shutting down operations this month. The trading engine has been disabled and Exco.in user accounts will remain active, with the exception of Ambiorx’s account and those who may be affiliated.

  • BTER

    Cloud infrastructure account takeover without a lot of detail.

    Several hours ago one of our hosting accounts was hacked and the hacker got 50m NXT from this server. It’s totally our fault and we are trying our best to cover all the loss. However 50m nxt is huge for us, we cannot afford it at the moment.

  • 796

    Not much information available, other than the victim stating that the hacker was putting a lot of effort towards their attack.

    We have been constantly monitoring the hacking activities on our servers and 3 months back then we took the precautionary step to migrate our servers to a highly secured cloud site. Unfortunately, that didn’t stop the incident from happening last night. In the last 24 hours, our security team worked around the clock to trace back the codes and processes. At this moment, we have a pretty good idea of exactly how they did it. This was not a generalized attack. The hacker’s strategy was precisely calculated and well targeted to compromise a certain weakness on our server.

  • Justcoin

    Justcoin had significant losses due to a protocol implementation issue with the Ripple protocol. A disclosure of the issue supposedly happened months before the bug was exploited.

    Cold storage is said to have limited losses greatly.

    The consequence, allegedly, is that hackers sent deposit transactions for large amounts, e.g. 100,000, to Justcoin. They set the tfPartialPayment flag to something like .0001. The transaction would be perfectly valid, and any client unaware of this behavior in the protocol would likely not be checking for the DeliveredAmount field – since it was never documented until a week ago. The transaction Amount field says “100,000” but the DeliveredAmount is only .0001. The hacker gets credit for 100,000 but only deposits .0001. Then they make a small withdrawal, check the balance on the hotwallet address and drain as much as they can.

    Ripple commented on the issue here and puts blame squarely on Justcoin’s implementation.

    Justcoin did not implement partial payments correctly. The exchange falsely credited a non-KYC’d user for a deposit, and then allowed the user to illegitimately withdraw the funds from its hot wallet. For every transaction, an exchange needs to ensure the total of user balances plus the new deposit matches the balance of its Ripple cold and hot wallets. If these balances don’t match, the exchange should stop processing the transaction. Ripple Labs has engaged Justcoin in ongoing discourse about its lack of risk and compliance controls. As demonstrated by this incident, a non-KYC’d user can steal with little fear of being identified and owning the consequences.

  • BitTrader

    Not much data available, other than that a hacker supposedly stole a wallet and then extorted the operator for further funds.

    While preparing for the final audit results, a task we were working on for weeks now, our bitcoin wallet has been hacked and emptied, just after exchanging our fiat holdings within the exchanges to bitcoin and transferring our entire holdings to our wallet, in order to proof our solvency.

    It is a known fact that I personally opposed any proof of solvency, but agreed to conduct it for the sake of a few dozen small and medium investors.

    The hacker contacted me shortly after he took advantage of our holdings and demanded a ransom in order to transfer the coins back. I have agreed to a 25% ransom of the entire sum, but haven’t heard back from him for several days now.

  • CryptoThrift

    Very traditional application vulnerability (SQL injection) that was brought in by a third party library. This modified their “escrow” product.

    Whilst we have not yet completed our investigation, we have identified the attack vector as a vulnerability in a third party plugin. This was used to inject SQL queries into our database and manipulate the amounts on transactions being released from escrow. What we have not made public until now is that we have seen sustained and almost-daily attack attempts on the site for many months. We have been in contact with the Australian Federal Police regarding this, and will be sharing with them all data that we have on this attack as well as all previous attempts.

  • MintPal

    Little information provided.

    A few hours ago we were unfortunately the subject of a successful attack against the exchange. Our investigations have shown that whilst our security was breached, VeriCoin was the target. We would like to stress that VeriCoin and the VeriCoin network has not been in any way compromised. We have worked to secure the exchange and the withdraw process from any further attack.

  • DogeVault

    Little information provided, though the attackers seemed to have accessed the DogeVault servers and accessed a wallet directly.

    We regret to announce that on the 11th of May, attackers compromised the Doge Vault online wallet service resulting in wallet funds being stolen. After salvaging our wallet we have ascertained that around 280 million Dogecoins were taken in the attack, out of a total balance of 400 million kept in our hot wallet. 120 million Dogecoins have been since recovered and transferred to an address under our control. It is believed the attacker gained access to the node on which Doge Vault’s virtual machines were stored, providing them with full access to our systems. It is likely our database was also exposed containing user account information; passwords were stored using a strong one-way hashing algorithm. All private keys for addresses are presumed compromised, please do not transfer any funds to Doge Vault addresses.

  • coinex.pw

    Not enough information, other than a infrastructure intrusion that breached the wallet.

    Long story short: yes, our wallet server got hacked and all funds were withdrawn.

  • Poloniex

    Poloniex is a Bitcoin exchange that has been operating since 2014. In March of 2014, an Application Vulnerability was exploited and caused a loss of 97 BTC (a 12.3% loss on the exchange). The reported cause of the hack was that they did not properly check for a negative account balance while processing multiple, simultaneous withdrawals.

    The hacker found a vulnerability in the code that takes withdrawals. The hacker discovered that if you place several withdrawals all in practically the same instant, they will get processed at more or less the same time. This will result in a negative balance, but valid insertions into the database, which then get picked up by the withdrawal daemon.

    What Will Be Done to Prevent Further Exploits?

    Withdrawals and order creation have been switched to a queued method, where the first step is to add the task to a global execution queue that is processed sequentially. Each step of critical database operations is verified before proceeding, and such operations are in the process of being converted to transactions. I have hired additional developers to help with tightening up security at Poloniex, as well as created a bug bounty.

  • FlexCoin

    “Front End” flaw implies an application vulnerability involving transactions between users of their application. It sounds like a race condition given the use of thousands of requests that were necessary to deplete the wallet before the off-chain ledger could update.

    During the investigation into stolen funds we have determined that the extent of the theft was enabled by a flaw within the front-end. The attacker logged into the flexcoin front end from IP address 207.12.89.117 under a newly created username and deposited to address 1DSD3B3uS2wGZjZAwa2dqQ7M9v7Ajw2iLy. The coins were then left to sit until they had reached 6 confirmations. The attacker then successfully exploited a flaw in the code which allows transfers between flexcoin users. By sending thousands of simultaneous requests, the attacker was able to “move” coins from one user account to another until the sending account was overdrawn, before balances were updated.

  • Silk Road 2.0

    If you trust the operators, they blame the famous “[transaction malleability][1]” vulnerability. [1]: https://en.bitcoin.it/wiki/Transaction_Malleability

    Our initial investigations indicate that a vendor exploited a recently discovered vulnerability in the Bitcoin protocol known as “transaction malleability” to repeatedly withdraw coins from our system until it was completely empty.

  • Bid Extreme

    Very little information available.

    As a result of a hacker attack it was robbed portfolio BTC and LTC. This fact was reported to law enforcement authorities.

    They were stolen currency BTC and LTC belonging to all users. If they recover they will be returned to users in accordance with the state of the balance on the day 17.11.2013r.

  • inputs.io

    This was a clear application vulnerability with a potentially fraudulent cover up and incident response. On July 28, 2013, hackers discovered an application condition that allowed them to credit accounts from a wallet supporting multiple organizations (Bitfunder and WeExchange). While the SEC found fraud, this seems to be more related to handling of the breach and operating an unregistered exchange.

    During the summer of 2013, one or more individuals (the “Hackers”) exploited a weakness in the BitFunder programming code to cause BitFunder to credit the Hackers with profits they did not, in fact, earn (the “Exploit”). As a result, the Hackers were able to wrongfully withdraw from WeExchange approximately 6,000 bitcoins, with the majority of those coins being wrongfully withdrawn between July 28, 2013, and July 31, 2013. In today’s value, the wrongfully withdrawn bitcoin were worth more than $60 million. As a result of the Exploit, BitFunder and WeExchange lacked the bitcoins necessary to cover what MONTROLL owed to users.

  • inputs.io

    Cloud infrastructure account takeover. Some kind of 2FA bypass exploit as well. Source code, wallets, and user data exfiltrated by attacker.

    Two hacks totalling about 4100 BTC have left Inputs.io unable to pay all user balances. The attacker compromised the hosting account through compromising email accounts (some very old, and without phone numbers attached, so it was easy to reset). The attacker was able to bypass 2FA due to a flaw on the server host side. Database access was also obtained, however passwords are securely stored and are hashed on the client. Bitcoin backend code were transferred to 10;15Hd@mastersearching.com:mercedes49@69.85.88.31 (most likely another compromised server).

  • Vircurex

    Cloud infrastructure compromise. After an initial credential breach, the attacker escalated access through social engineering. The victim blames the hosting provider for violating their own procedure for password resets.

    The attacker has acquired login credentials to our VPS control account with our hosting service provider and has then asked for the root password reset of all servers which – unfortunately – the service provider has then done and posted the credentials in their helpdesk ticket, rather than the standard process of sending it to our email address (which has 2FA protection), also the security setup of allowing only our IP range to login to the management console was not working. It was an additional security feature the provider offered but was obviously circumvented by the attacker. As a result out of this incident we have moved all our services to a new provider who offers 2 factor authentication for all logins as well as other verification processes that we hope will make similar attempts impossible in the future

  • Bitcoin Central

    This was an account takeover on the victim’s cloud provider, allowing access to a server hosting a hot wallet. This was part of a larger breach.

    Someone managed to reset the password from our hosting provider web interface, this enabled the attacker to lock us out of the interface and request a reboot of the machine in ‘rescue’ mode. Using this, the attacker copied our hot wallet and sent away what was present.

    This very hosting provider (OVH) had been compromised a couple of days ago, in the exact same way, leading to loss of funds on mining.bitcoin.cz.

  • InstaWallet

    Given that a database was accessed, this was probably a breach of infrastructure.

    The Instawallet service is suspended indefinitely until we are able to develop an alternative architecture. Our database was fraudulently accessed, due to the very nature of Instawallet it is impossible to reopen the service as-is.

  • Mercado Bitcoin

    This is a tough translation but it seems like a clear application vulnerability involving some kind of coupon code system.

    (Translated)

    The Bitcoin market suffered an attack, which unfortunately was successful in its implementation redeem code. Due to a coding error, it was possible for an attacker to generate new credit codes, without the value was properly charged to your final balance. Getting thus generate a false amount of bitcoins within the system and rescue him in time during the night.

  • BitInstant

    Attacker pivoted several times after initially gaining access to the victim’s domain registrar via social engineering. This then allowed a DNS hijack, allowing them to route password resets to the attacker. Attacker then took over cloud infrastructure hosting wallets.

    The attacker contacted our domain registrar at Site5 posing as me and using a very similar email address as mine, they did so by proxying through a network owned by a haulage company in the UK whom I suspect are innocent victims the same as ourselves. Armed with knowledge of my place of birth and mother’s maiden name alone (both facts easy to locate on the public record) they convinced Site5 staff to add their email address to the account and make it the primary login (this prevented us from deleting it from the account). We immediately realized what was going on, and logged in to change the information back. After changing this info and locking the attacker out, overnight he was able to revert my changes and point our website somewhere else. Site5 is denying any damages, but we suspect this was partly their fault.

    After gaining access, they redirected DNS by pointing the nameservers to hetzner.de in germany, they used hetzner’s nameservers to redirect traffic to a hosting provider in ukraine. By doing this, he locked out both my login and Gareths’s login and they used this to hijack our emails and reset the login for one exchange (VirWox), enabling them to gain access and steal $12,480 USD worth of BTC. No other exchanges were affected due to either Mult Factor Authentication, OTP, Yubikey’s and auto lockdowns.

    The hacker was also able to pull a few hours of internal company emails. However due to mandatory PGP encrytion between members of our company and tools like Cryptocat, sensitive information was not breached.

  • MT Gox

    The big one. Lots of speculation and not a lot of hard data. Everything from negligence, insider threat, and fraud has been speculated.

    On Monday night, a number of leading Bitcoin companies jointly announced that Mt. Gox, the largest exchange for most of Bitcoin’s existence, was planning to file for bankruptcy after months of technological problems and what appeared to have been a major theft. A document circulating widely in the Bitcoin world said the company had lost 744,000 Bitcoins in a theft that had gone unnoticed for years. That would be about 6 percent of the 12.4 million Bitcoins in circulation.

    Mark Karpeles, the former CEO of Mt. Gox, told the Daily Beast last month, “I suspect that some of the missing bit coins were taken by a company insider but when I tried to talk to the police about it, they seemed disinterested.

  • BitFloor

    Attackers likely gained access through a cloud infrastructure provider and accessed a server with unencrypted hot wallet.

    Last night, a few of our servers were compromised. As a result, the attacker gained accesses to an unencrypted backup of the wallet keys (the actual keys live in an encrypted area). Using these keys they were able to transfer the coins. This attack took the vast majority of the coins BitFloor was holding on hand. As a result, I have paused all exchange operations. Even tho only a small majority of the coins are ever in use at any time, I felt it inappropriate to continue operating not having the capability to cover all account balances for BTC at the time.

  • Bitcoinica

    Infrastructure breach with access to a large hot wallet.

    It is with much regret that we write to inform our users of a recent security breach at Bitcoinica. At approximately 1:00pm GMT, our live production servers were compromised by an attacker and they used this access to deplete our online wallet of 18547 BTC.

  • Slush's Pool

    A breach at Linode was the root cause here and there’s plenty of information to understand the breach. Credentials for a customer support team member were used and eight Linode customers were compromised for having affliations to bitcoin.

    After accessing the customer support interface, the attacker was able to access the individual account interface for their victims and change root passwords on customer’s machines. To apply this root password change, servers were rebooted.

    A VP at Linode responded.

    Somebody hacked my backup machine with pool data hosted on Linode and steal 3094 BTC (“hot” coins ready for payouts). Cold backup was not affected in any way by this hack.

    It looks that also user database has been compromised. Although passwords are stored in SHA1 with salt, I strongly recommend to change your password on the pool immediately.

    Robery of Bitcoins has no impact to pool users, I’m covering the loss from my own income (although it means that many months of my work is wasted Roll Eyes ).

  • Bitcoin7

    Attackers made it onto Bitcoin7 infrastructure, due to wallets and database data being accessed. Given that “other websites” were owned, it’s possible a larger unknown shared hosting provider with other customers was compromised.

    On Oct 5th 2011 Bitcoin7.com became the victim of a number of pre-planned hacker attacks. While our investigation is still going, evidence reveals that the attacks originated from Russia and Eastern Europe.

    The attack itself took action not only against the bitcoin7.com server but also against other websites and servers which were part of the same network. Eventually the hackers managed to breach into the network which subsequently lead to a major breach into the bitcoin7.com website.

    As a result of the hacking, unknown individuals managed to gain full access to the site’s main bitcoin depository/wallet and 2 of the 3 backup wallets.

    In addition the hackers gained access to our user database.

  • MyBitcoin

    This sounds like an application vulnerability that allowed forged deposits that could eventually be withdrawn from a hot wallet. This sort of attack is more common with “off blockchain” ledgers.

    After careful analysis of the intrusion we have concluded that the software that waited for Bitcoin confirmations was far too lenient. An unknown attacker was able to forge Bitcoin deposits via the Shopping Cart Interface (SCI) and withdraw confirmed/older Bitcoins. This led to a slow trickle of theft that went unnoticed for a few days. Luckily, we do keep a percentage of the holdings in cold storage so the attackers didn’t completely clean us out. Just to clarify, we weren’t “fully” hacked aka “rooted”. You can still trust our PGP, SSL, and Tor public keys.

  • Bitomat.pl

    The cause is very uncertain. The operator suspects a third party destroying a host on AWS, but it looks like operator error is highly possible due to the “breach” occurring during a major upgrade.

    (Translated)

    On 26 July 2011, at about 23:00 am, I have found the overloaded the Bitcoin server and I had to increase the RAM. As a result of this operation, the entire virtual machine was removed, and with it all the information, including the wallet and all of its backups. I have found that the data did not go into Nirvana because the Virtual Machine settings have >been changed, even though I have changed even nothing. Our Hoster, Amazon Web Services Company, indicates that the deleted machine was adjusted so that they are once you shut down irrevocably “destroyed” (including all data on the hard disks).

    I am still determine who changed the settings on the VM and whether it is possible to recover the deleted data. Unfortunately, the collaboration with Amazon Web Services (AWS) to be very difficult. Once I realized that the virtual machine is lost, I immediately ordered AWS premium support, talked to the manager and asked for protection of my data. So far without success.

    To this day I could not find out the exact reasons for the misery. I suspect the actions of third parties, which wanted to cover up their illegal activities, or even wanted to crash the whole service, responsible for them. Should my suspicions in that direction harden, I’ll go with the case to the police and prosecutor’s office. For this I need but the cooperation between AWS and which is (as mentioned above) currently very difficult. Efforts of data recovery are of course still in progress.

Update This

Submit a pull request at the GitHub link below if a similar breach has occurred.