BIKI

DESCRIPTION OF EVENTS

"Headquartered in Singapore, BiKi.com is a centralized exchange that provides a digital assets platform for trading more than 470 cryptocurrencies and 515 trading pairs. BiKi.com aims to provide the safest, most stable and most effective cryptocurrency trading platform. 100% of the transaction fees are reportedly used in buyback and burning of platform token, BIKI." "BiKi is also targeting an international audience, as it offers its platform in multiple languages, including Chinese, English, Russian, Vietnamese and Korean."

"Since its official opening in August 2018, BiKi.com is considered one of the fastest-growing cryptocurrency exchanges in the world." "BiKi.com claims to have accumulated 3.5 million registered users, 80,000 daily active users, over 3,000 community partners, and 1 million community members." "BiKi.com has received investments from Huobi co-founder Du Jun, Genesis Capital Zhu Huai Yang, FBG Capital, ChainUP and others totaling approximately 10 million USD." "The exchange offers USDT-denominated perpetual contracts that allow users to speculate on the price movements of Bitcoin, Ethereum, Bitcoin Cash, EOS, XRP and Litecoin."

"[I]t was reported that another Singapore-based crypto exchange BiKi has also encountered hijack attacks." "[C]rypto security firm SlowMist does list one incident involving BiKi, in which issues with the platform’s 2-factor authentication system caused a loss of 123,300 USDT." "Biki.com was hacked by side channel attack via SMS hijacking." "BiKi.com announced that at 0:08:23 on March 26, the BiKi.com community received a user feedback that his password has been tampered with and need to bind the new Google verification code. At around 5 in the morning, 28 users had the same problem, and the risk control system received an alarm." "At 3 pm on the same day, Biki said in the announcement that the number of accounts involved in tampering with passwords was 37, and the number of accounts involved in asset transfer was 18, and the amount of losses amounted to $123,300."

"At the time of the initial announcement, it was known that some users' accounts had been hijacked. This is not the case where the private key of the exchange is targeted, but the case where the user's customer account is targeted." "After investigation, it is because some users are not bound to Google verification code and third-party verification code service provider SMS is hijacked and caused. At present, the number of of accounts that have been tampered with passwords is 37, and the account involved in asset transfer is 18." From "the statement emphasizing "Please incorporate multi-factor authentication as well as the mobile phone verification code", it can be inferred that the mobile phone verification code, that is, the hijacking around SMS was performed." "BiKi has launched a subversive “mining, buying back, and destroying” model, where fees are used to repurchase the platform’s token, BIKI, and burn them. By destroying tokens, the company aims to increase the price of each individual token, as less tokens become available on the market."

"[T]he loss amount is 12.33 million USDT, the BiKi.com will bear the full amount of the loss." "According to the report, BiKi committed to refund the full amount to the affected users."

"At this point, the cause had been identified, and it probably took several hours to check the extent of the damage and recheck the security. The content announced after that also confirmed this, and it is stated that the account was hijacked via a third-party provider."

"In May 2019, BiKi.com announced the official appointment of its Southeast Asia CEO, Mr. Ethan Ng." "Apart from that incident, BiKi’s security record seems to be good with no other security breach reports. The exchange gives users the option to set up 2-factor authentication via Google Authenticator, or receive verification codes via SMS. Users also have to confirm certain operations through e-mails."

While details are vague, it appears that some customer accounts were breached, potentially a handful of accounts with SMS two-factor authentication. Funds were withdrawn from the accounts.

BiKi has fully compensated the customers and improved security.

HOW COULD THIS HAVE BEEN PREVENTED?

While the exact details are vague, it would appear that the authentication factors used SMS-based verification, which is known to be vulnerable to SIM swapping.

There were no user funds lost in this case.

Check Our Framework For Safe Secure Exchange Platforms

SlowMist Hacked - SlowMist Zone (Jun 26)
BiKi.com Lists Largest Decentralized Stablecoin DAI | Business Wire (Aug 7)
BiKi trade volume and market listings | CoinMarketCap (Aug 7)
How hard is it to lose money on the exchange and how to recover bitcoin digital assets? Blockchain Network (Aug 7)
DragonEx Hacked, Investigation is Undergoing | NEWS.8BTC.COM (Aug 7)
Exchange Biki.com was hacked by side channel attack via SMS hijacking : Bitcoin (Aug 7)
About Us – Help Center (Aug 7)
@DoveyWan Twitter (Aug 7)
@CoyotlCompany Twitter (Aug 7)
BiKi Review | CoinCodex (Aug 8)
@roi_landmark Twitter (Aug 8)
@FXxxx888 Twitter (Aug 8)
@warai_relation Twitter (Aug 8)
仮想通貨取引所「BiKi.com」の顧客口座乗っ取り　事例から見る対策手段【独自考察】 (Aug 8)
BiKi is one of the top cryptocurrency exchanges of 2019 - BiKi Exchange (Aug 8)
No Title (Aug 8)
The 23 exchange hacks of 2019 (Aug 8)

More case studies

DragonEx
Hacking Theft

Tesler 2 False
Investment Opportunity