796 Exchange Hack - Revision history

Azoundria: Another 30 minutes. Prepared and published a promotion for the article. Added additional description and information from BitcoinTalk. Added several additional sources from Twitter for additional context and timeline information on the 796 exchange platform.

2024-01-29T20:52:16Z

Another 30 minutes. Prepared and published a promotion for the article. Added additional description and information from BitcoinTalk. Added several additional sources from Twitter for additional context and timeline information on the 796 exchange platform.

Show changes

Azoundria: Another 30 minutes. Added information on potential vanity address generation. Reviewing and incorporating Twitter news sources including CoinSide.

2024-01-26T22:32:52Z

Another 30 minutes. Added information on potential vanity address generation. Reviewing and incorporating Twitter news sources including CoinSide.

← Older revision		Revision as of 16:32, 26 January 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}		{{Case Study Under Construction}}

	[[File:796exchange.jpg\|thumb\|796 Homepage/Logo]]796 was a virtual currency exchange based in China. A hacker exploited vulnerabilities in the exchange to tamper with the withdrawal address of a customer. The customer requested and confirmed a withdrawal. Both the customer and the exchange staff failed to notice the changed address, and the withdrawal was therefore approved to the hacker's wallet. 796 published a report of what happened, and the situation was made right by covering the funds for the customer. No other customers appear to have been affected.		[[File:796exchange.jpg\|thumb\|796 Homepage/Logo]]796 was a virtual currency exchange based in China. A hacker exploited vulnerabilities in the exchange to tamper with the withdrawal address of a customer. The customer requested and confirmed a withdrawal. Both the customer and the exchange staff failed to notice the changed withdrawal address, and the withdrawal was therefore approved to be sent to the hacker's wallet. 796 published a report of what happened, and the situation was made right by covering the funds for the customer. No other customers appear to have been affected.

	== About 796 Exchange ==		== About 796 Exchange ==
Line 8:		Line 8:
	Description by CEO: “in terms of our trading volume and liquidity of Bitcoin futures, we are the world’s biggest exchange,” with the service being called “the world’s most liquid futures and options exchange for Bitcoin and Litecoin.”		Description by CEO: “in terms of our trading volume and liquidity of Bitcoin futures, we are the world’s biggest exchange,” with the service being called “the world’s most liquid futures and options exchange for Bitcoin and Litecoin.”

	CEO: Nelson Yu<ref name=":1" /><ref>[https://cointelegraph.com/news/are-advanced-trading-tools-causing-the-price-drop-exchanges-experts-weigh-in Are Advanced Trading Tools Causing the Bitcoin Price Drop? Exchanges, Experts Weigh In - CoinTelegraph] (Dec 14, 2023)</ref>		CEO: Nelson Yu<ref name=":1" /><ref>[https://cointelegraph.com/news/are-advanced-trading-tools-causing-the-price-drop-exchanges-experts-weigh-in Are Advanced Trading Tools Causing the Bitcoin Price Drop? Exchanges, Experts Weigh In - CoinTelegraph] (Dec 14, 2023)</ref> (apparently the president of the American division).

	Homepage:<ref>[https://web.archive.org/web/20131204090901/https://796.com/ 796 Xchange Homepage - Archive December 4th, 2013 2:09:01 AM MST] (Dec 12, 2023)</ref>		Homepage:<ref>[https://web.archive.org/web/20131204090901/https://796.com/ 796 Xchange Homepage - Archive December 4th, 2013 2:09:01 AM MST] (Dec 12, 2023)</ref>
Line 52:		Line 52:
	\|-		\|-
	\|January 27th, 2015 11:46:55 PM MST		\|January 27th, 2015 11:46:55 PM MST
	\|~~Discussions On~~ Reddit		\|Reddit Discussion
	\|A discussion thread on Reddit reports that the Bitcoin futures exchange 796 has been hacked, resulting in the loss of 1000 bitcoins<ref name=":6">[https://old.reddit.com/r/Bitcoin/comments/2txtjd/bitcoin_futures_exchange_hacked_796_lost_1000/ Bitcoin futures exchange hacked - 796 lost 1000 bitcoin. - Reddit] (Jan 24, 2024)</ref>. The comments section includes various speculations and criticisms, with some users suggesting that the exchange owners might be fabricating the hacking story to abscond with users' bitcoins. The term "Goxing" is referenced, likely alluding to the infamous Mt. Gox exchange incident. Users express skepticism about the exchange's credibility and advise against using derivatives, emphasizing the risks associated with centralized exchanges. One user recommends decentralized alternatives like the Bitshares exchange. The discussion also touches on the concept of proof of stake (PoS) in blockchain networks<ref name=":6">[https://old.reddit.com/r/Bitcoin/comments/2txtjd/bitcoin_futures_exchange_hacked_796_lost_1000/ Bitcoin futures exchange hacked - 796 lost 1000 bitcoin. - Reddit] (Jan 24, 2024)</ref>.		\|A discussion thread on Reddit reports that the Bitcoin futures exchange 796 has been hacked, resulting in the loss of 1000 bitcoins<ref name=":6">[https://old.reddit.com/r/Bitcoin/comments/2txtjd/bitcoin_futures_exchange_hacked_796_lost_1000/ Bitcoin futures exchange hacked - 796 lost 1000 bitcoin. - Reddit] (Jan 24, 2024)</ref>. The comments section includes various speculations and criticisms, with some users suggesting that the exchange owners might be fabricating the hacking story to abscond with users' bitcoins. The term "Goxing" is referenced, likely alluding to the infamous Mt. Gox exchange incident. Users express skepticism about the exchange's credibility and advise against using derivatives, emphasizing the risks associated with centralized exchanges. One user recommends decentralized alternatives like the Bitshares exchange. The discussion also touches on the concept of proof of stake (PoS) in blockchain networks<ref name=":6">[https://old.reddit.com/r/Bitcoin/comments/2txtjd/bitcoin_futures_exchange_hacked_796_lost_1000/ Bitcoin futures exchange hacked - 796 lost 1000 bitcoin. - Reddit] (Jan 24, 2024)</ref>. The discussion was subsequently shared on Twitter<ref>[https://twitter.com/Bitcoin_Spain/status/560372909404094464 Bitcoin_Spain - "Bitcoin futures exchange hacked - 796 lost 1000 bitcoin.:" - Twitter] (Jan 26, 2024)</ref>.
	\|-		\|-
	\|January 28th, 2015 5:16:00 AM MST		\|January 28th, 2015 5:16:00 AM MST
Line 76:		Line 76:
	\|Monster Leveraged Sell Order		\|Monster Leveraged Sell Order
	\|The platform remains operational. A Twitter user reports on a monster sell order<ref>[https://twitter.com/ToneVays/status/562631021271994369 Tone Vays - "Monster #bitcoin leveraged Sell order was just attempted on 796 (not filled) bulls should still be cautious" - Twitter] (Jan 25, 2024)</ref>.		\|The platform remains operational. A Twitter user reports on a monster sell order<ref>[https://twitter.com/ToneVays/status/562631021271994369 Tone Vays - "Monster #bitcoin leveraged Sell order was just attempted on 796 (not filled) bulls should still be cautious" - Twitter] (Jan 25, 2024)</ref>.
			\|-
			\|February 3rd, 2015 2:37:37 PM MST
			\|Russian CoinSide Article
			\|Russian cryptocurrency news outlet CoinSide reports that a significant loss of 1000 BTC. The information reportedly spread rapidly on the Chinese social network Weibo, thanks to the project's leader, Zhu Rongu. According to the exchange, an unidentified hacker took advantage of a vulnerability on the website, substituting Bitcoin wallet addresses to redirect funds. Nelson Yu, the president of the American division of "796," explained that the service had been dealing with increased hacker activity for the past three months and had recently migrated to a high-security cloud storage. However, this did not prevent the exchange from being compromised in the last 24 hours. The company's security team addressed the issue and resolved the vulnerability. Despite the incident, 796 Exchange aims to maintain transparency and keeps its wallets open for anyone interested in examining their statistics.. The news repost is reposted to Twitter<ref>[https://twitter.com/coinsideru/status/562696437742727171 CoinSide - "Обменник 796 Exchange потерял 1000 BTC" - Twitter] (Jan 26, 2024)</ref>. They include a reference to the CoinTelegraph article from January 28th.
	\|-		\|-
	\|February 9th, 2015 12:30:00 AM MST		\|February 9th, 2015 12:30:00 AM MST
Line 117:		Line 121:
	=== Vulnerability In Withdrawal Module ===		=== Vulnerability In Withdrawal Module ===
	According to sources, the vulnerability was present in a submodule of the exchange withdrawal system. It allowed the withdrawal address to be modified by an external party. Kyle Gibson quoted from an explanation<ref name="kylegibson-86" />.<blockquote>"According to the explanation, hackers had compromised areas of the exchange in the previous days, which had caused a user “to mention the current address has been tampered with, coupled with hackers deliberately [using] a similar address with the original withdrawals address to confuse users…”</blockquote>		According to sources, the vulnerability was present in a submodule of the exchange withdrawal system. It allowed the withdrawal address to be modified by an external party. Kyle Gibson quoted from an explanation<ref name="kylegibson-86" />.<blockquote>"According to the explanation, hackers had compromised areas of the exchange in the previous days, which had caused a user “to mention the current address has been tampered with, coupled with hackers deliberately [using] a similar address with the original withdrawals address to confuse users…”</blockquote>

			=== Use Of Vanity Bitcoin Address ===
			It has been suggested in multiple sources that the address in which the withdrawal was requested was similar to the customer's real wallet address<ref name="kylegibson-86" />. This suggests that the thief may have made use of a vanity wallet address. They may have generated many potential wallet addresses until they came up with a similar looking address.

	=== Confirmation During Withdrawal Time ===		=== Confirmation During Withdrawal Time ===

Azoundria: Another 30 minutes. Reviewing further, description updated. Timeline discrepancy fully resolved to correlate blockchain data and the 796 exchange's own reporting. Started to integrate several potentially insightful sources which were located through the Twitter search into the timeline.

2024-01-25T21:04:31Z

Another 30 minutes. Reviewing further, description updated. Timeline discrepancy fully resolved to correlate blockchain data and the 796 exchange's own reporting. Started to integrate several potentially insightful sources which were located through the Twitter search into the timeline.

← Older revision		Revision as of 15:04, 25 January 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}		{{Case Study Under Construction}}

	[[File:796exchange.jpg\|thumb\|796 Homepage/Logo]]796 was a virtual currency exchange based in China. A hacker exploited vulnerabilities in the exchange to tamper with the withdrawal address of a customer. The customer ~~legitimately~~ requested and confirmed ~~the~~ withdrawal. Both the customer and the exchange staff failed to notice the changed address. 796 published a ~~transparent~~ report of what happened, and the situation was ~~quickly~~ made right by covering the funds for the customer. No other customers appear to have been affected.		[[File:796exchange.jpg\|thumb\|796 Homepage/Logo]]796 was a virtual currency exchange based in China. A hacker exploited vulnerabilities in the exchange to tamper with the withdrawal address of a customer. The customer requested and confirmed a withdrawal. Both the customer and the exchange staff failed to notice the changed address, and the withdrawal was therefore approved to the hacker's wallet. 796 published a report of what happened, and the situation was made right by covering the funds for the customer. No other customers appear to have been affected.

	== About 796 Exchange ==		== About 796 Exchange ==
Line 23:		Line 23:
	!Description		!Description
	\|-		\|-
	\|January 27th, 2015 8~~:50:54 AM MST~~		\|January 27th, 2015 8:21:00 AM MST
	~~\|Blockchain Transaction~~
	\|A blockchain transaction for 1,000 bitcoin can be found on the blockchain, which is referenced by the 8btc forum thread<ref name=":4">[https://www.blockchain.com/explorer/transactions/btc/d0488109a35eecef19a745fb50fc82eca123d071cea76e71a3e6c96fab6f3b64 Blockchain Transaction For 1,000 BTC Withdrawal - Blockchain.com] (Jan 24, 2024)</ref><ref name=":5">[https://www.blockchain.com/explorer/addresses/btc/1CvGkU5WUZR4L6uzHd5UJ6w3dXwVKe2wrU Blockchain Address - Blockchain.com] (Jan 24, 2024)</ref>. Doesn't fit with the timeline?
	\|-
	~~\|January 27th, 2015 3~~:21:00 PM MST
	\|User Requests Withdrawal		\|User Requests Withdrawal
	\|10:21 PM local time in China, a user on the 796 exchange platform requested a withdrawal<ref name=":0">[https://weibo.com/p/1001603803961751650197 关于昨晚出现被盗一事的说明 - Weibo] (Dec 11, 2023)</ref>.		\|10:21 PM local time in China, a user on the 796 exchange platform requested a withdrawal<ref name=":0">[https://weibo.com/p/1001603803961751650197 关于昨晚出现被盗一事的说明 - Weibo] (Dec 11, 2023)</ref>.
	\|-		\|-
	\|January 27th, 2015 3:26:00 PM MST		\|January 27th, 2015 8:26:00 AM MST
	\|Phone Call Confirmation		\|Phone Call Confirmation
	\|Staff of the 796 exchange platform confirmed the withdrawal through a phone call with the customer<ref name=":0" />.		\|Staff of the 796 exchange platform confirmed the withdrawal through a phone call with the customer<ref name=":0" />.
	\|-		\|-
	\|January 27th, 2015 3:38:00 PM MST		\|January 27th, 2015 8:38:00 AM MST
	\|Email Confirmation		\|Email Confirmation
	\|The withdrawal was also confirmed through an email, which was apparently done "due to a different IP location"<ref name=":0" />.		\|The withdrawal was also confirmed through an email, which was apparently done "due to a different IP location"<ref name=":0" />.
	\|-		\|-
	\|January 27th, 2015 3:50:~~00 PM~~ MST		\|January 27th, 2015 8:50:54 AM MST
	\|Withdrawal Processed		\|Withdrawal Processed Blockchain Transaction
	\|The withdrawal for 1,000 bitcoin was released to the blockchain<ref name=":0" />.		\|The withdrawal for 1,000 bitcoin was released to the blockchain<ref name=":0" />. A blockchain transaction for 1,000 bitcoin can be found on the blockchain, which is referenced by the 8btc forum thread<ref name=":4">[https://www.blockchain.com/explorer/transactions/btc/d0488109a35eecef19a745fb50fc82eca123d071cea76e71a3e6c96fab6f3b64 Blockchain Transaction For 1,000 BTC Withdrawal - Blockchain.com] (Jan 24, 2024)</ref><ref name=":5">[https://www.blockchain.com/explorer/addresses/btc/1CvGkU5WUZR4L6uzHd5UJ6w3dXwVKe2wrU Blockchain Address - Blockchain.com] (Jan 24, 2024)</ref>.
	\|-		\|-
	\|January 27th, 2015 8:50:00 PM MST		\|January 27th, 2015 1:50:00 PM MST
	\|Call From Customer About Not Receiving Withdrawal		\|Call From Customer About Not Receiving Withdrawal
	\|~~The~~ 796 exchange reportedly receives a call from the customer about having not received their requested funds<ref name=":0" />.		\|At 3:50 AM local time in China, the 796 exchange reportedly receives a call from the customer about having not received their requested funds<ref name=":0" />.
	\|-		\|-
	\|January ~~27th~~, 2015 8:50:~~54 AM~~ MST		\|January 28th, 2015 12:37:49 PM MST
	\|8btc Post About The Incident		\|8btc Post About The Incident
	\|The post was captured by the internet archive<ref>[https://web.archive.org/web/20150131022742/http://8btc.com/thread-13689-1-1.html It is said that a large household lost 1,000 coins in 796... - 8btc Archive January 30th, 2015 7:27:42 PM MST] (Jan 24, 2024)</ref><ref>[https://web.archive.org/web/20150220070113/http://8btc.com/thread-13689-1-1.html It is said that a large household lost 1,000 coins in 796... - 8btc Archive February 20th, 2015 12:01:13 AM MST] (Jan 24, 2024)</ref>. A screenshot of the post was also shared on Twitter<ref>[https://twitter.com/redtheminer/status/1749898325485080617 redtheminer - "It seems reasonable" - Twitter] (Jan 24, 2024)</ref>.		\|The post was captured by the internet archive<ref>[https://web.archive.org/web/20150131022742/http://8btc.com/thread-13689-1-1.html It is said that a large household lost 1,000 coins in 796... - 8btc Archive January 30th, 2015 7:27:42 PM MST] (Jan 24, 2024)</ref><ref>[https://web.archive.org/web/20150220070113/http://8btc.com/thread-13689-1-1.html It is said that a large household lost 1,000 coins in 796... - 8btc Archive February 20th, 2015 12:01:13 AM MST] (Jan 24, 2024)</ref>. A screenshot of the post was also shared on Twitter<ref>[https://twitter.com/redtheminer/status/1749898325485080617 redtheminer - "It seems reasonable" - Twitter] (Jan 24, 2024)</ref>. TBD - Timezone of post assumed to be PST but no way to verify that.
	\|-		\|-
	\|January 27th, 2015 9:28:35 PM MST		\|January 27th, 2015 9:28:35 PM MST
Line 72:		Line 68:
	\|Date Commonly Associated		\|Date Commonly Associated
	\|The widely reported date of the incident, which actually happened the day prior<ref name="kylegibson-86" /><ref name="bitcoinexchangeguide-218" />.		\|The widely reported date of the incident, which actually happened the day prior<ref name="kylegibson-86" /><ref name="bitcoinexchangeguide-218" />.
			\|-
			\|January 29th, 2015 10:08:00 PM MST
			\|Social Engineering Claim
			\|A Twitter user claims that the 796 exchange attack was the result of "social engineering" with a similar bitcoin address<ref>[https://twitter.com/FabShareables/status/561028167997997056 FabShareables - "Chinese #Bitcoin exchange 796 gets social-engineered through address similarity" - Twitter] (Jan 25, 2024)</ref>. There is a link to a BitxBit.in website, which has subsequently broken and does not appear to be archived.
			\|-
			\|February 3rd, 2015 8:17:00 AM MST
			\|Monster Leveraged Sell Order
			\|The platform remains operational. A Twitter user reports on a monster sell order<ref>[https://twitter.com/ToneVays/status/562631021271994369 Tone Vays - "Monster #bitcoin leveraged Sell order was just attempted on 796 (not filled) bulls should still be cautious" - Twitter] (Jan 25, 2024)</ref>.
			\|-
			\|February 9th, 2015 12:30:00 AM MST
			\|Blockchain Transaction
			\|A link is provided to a blockchain transaction with the label 796<ref>[https://twitter.com/NotesFromBTC/status/564687689241620480 NotesFromBTC - "796" - Twitter] (Jan 25, 2024)</ref>. TBD this appears to be an unrelated transaction from October 2014.
			\|-
			\|March 11th, 2015 8:14:00 AM MDT
			\|Further Promotion
			\|Third party promotion called "bitcoin billionaire"<ref>[https://twitter.com/CoinLion266/status/575661130313547777 CoinLion266 - "The new way to win big… all the cool kids are doing it!!!" - Twitter] (Jan 25, 2024)</ref>.
			\|-
			\|April 17th, 2015 8:31:00 PM MDT
			\|Exchange Offline Report
			\|There is a report on Twitter that the exchange has gone offline<ref>[https://twitter.com/easybitcoinsnet/status/589255022858371072 EasyBitcoins.net - "Huge Chinese Exchange 796 has gone OFFLINE via /r/Bitcoin" - Twitter] (Jan 25, 2024)</ref>. This comes from a Reddit thread<ref>[https://www.reddit.com/r/Bitcoin/comments/32zpy5/huge_chinese_exchange_796_has_gone_offline/ Marotta117 - Huge Chinese Exchange 796 has gone OFFLINE - Reddit] (Jan 25, 2024)</ref>. TBD
	\|-		\|-
	\|February 27th, 2019 11:31:32 AM MST		\|February 27th, 2019 11:31:32 AM MST
Line 119:		Line 135:

	The stolen system was used by hackers for problems with the 796 exchange. The 796 exchange will consult with the company’s major shareholders to see about using unallocated profits to cover this loss, which has been reissued. In such a high-risk industry, problems are inevitable, which is why the 796 major shareholders have not received dividends. Before getting the venture capital, we will do our best to ensure the safety of customer assets first. The future is very long. 796 will continue to maintain the principle of openness, fairness, and integrity. Thank you for your support. Thank you for your continued use!</blockquote>		The stolen system was used by hackers for problems with the 796 exchange. The 796 exchange will consult with the company’s major shareholders to see about using unallocated profits to cover this loss, which has been reissued. In such a high-risk industry, problems are inevitable, which is why the 796 major shareholders have not received dividends. Before getting the venture capital, we will do our best to ensure the safety of customer assets first. The future is very long. 796 will continue to maintain the principle of openness, fairness, and integrity. Thank you for your support. Thank you for your continued use!</blockquote>

			=== Reactions On Twitter ===
			<ref>https://twitter.com/aaahjoom/status/560371752132677632 (Jan 25, 2024)</ref>

	== Ultimate Outcome ==		== Ultimate Outcome ==

Azoundria: Saving 30 minutes from yesterday.

2024-01-25T20:31:42Z

Saving 30 minutes from yesterday.

← Older revision		Revision as of 14:31, 25 January 2024
Line 22:		Line 22:
	!Event		!Event
	!Description		!Description
			\|-
			\|January 27th, 2015 8:50:54 AM MST
			\|Blockchain Transaction
			\|A blockchain transaction for 1,000 bitcoin can be found on the blockchain, which is referenced by the 8btc forum thread<ref name=":4">[https://www.blockchain.com/explorer/transactions/btc/d0488109a35eecef19a745fb50fc82eca123d071cea76e71a3e6c96fab6f3b64 Blockchain Transaction For 1,000 BTC Withdrawal - Blockchain.com] (Jan 24, 2024)</ref><ref name=":5">[https://www.blockchain.com/explorer/addresses/btc/1CvGkU5WUZR4L6uzHd5UJ6w3dXwVKe2wrU Blockchain Address - Blockchain.com] (Jan 24, 2024)</ref>. Doesn't fit with the timeline?
	\|-		\|-
	\|January 27th, 2015 3:21:00 PM MST		\|January 27th, 2015 3:21:00 PM MST
Line 42:		Line 46:
	\|Call From Customer About Not Receiving Withdrawal		\|Call From Customer About Not Receiving Withdrawal
	\|The 796 exchange reportedly receives a call from the customer about having not received their requested funds<ref name=":0" />.		\|The 796 exchange reportedly receives a call from the customer about having not received their requested funds<ref name=":0" />.
			\|-
			\|January 27th, 2015 8:50:54 AM MST
			\|8btc Post About The Incident
			\|The post was captured by the internet archive<ref>[https://web.archive.org/web/20150131022742/http://8btc.com/thread-13689-1-1.html It is said that a large household lost 1,000 coins in 796... - 8btc Archive January 30th, 2015 7:27:42 PM MST] (Jan 24, 2024)</ref><ref>[https://web.archive.org/web/20150220070113/http://8btc.com/thread-13689-1-1.html It is said that a large household lost 1,000 coins in 796... - 8btc Archive February 20th, 2015 12:01:13 AM MST] (Jan 24, 2024)</ref>. A screenshot of the post was also shared on Twitter<ref>[https://twitter.com/redtheminer/status/1749898325485080617 redtheminer - "It seems reasonable" - Twitter] (Jan 24, 2024)</ref>.
			\|-
			\|January 27th, 2015 9:28:35 PM MST
			\|Bitcoin Talk Thread
			\|A thread on Bitcoin Talk discusses the theft<ref>[https://bitcointalk.org/index.php?topic=938765.0 796 lost 1,000 bitcoin - BitcoinTalk] (Jan 24, 2024)</ref>.
			\|-
			\|January 27th, 2015 11:46:55 PM MST
			\|Discussions On Reddit
			\|A discussion thread on Reddit reports that the Bitcoin futures exchange 796 has been hacked, resulting in the loss of 1000 bitcoins<ref name=":6">[https://old.reddit.com/r/Bitcoin/comments/2txtjd/bitcoin_futures_exchange_hacked_796_lost_1000/ Bitcoin futures exchange hacked - 796 lost 1000 bitcoin. - Reddit] (Jan 24, 2024)</ref>. The comments section includes various speculations and criticisms, with some users suggesting that the exchange owners might be fabricating the hacking story to abscond with users' bitcoins. The term "Goxing" is referenced, likely alluding to the infamous Mt. Gox exchange incident. Users express skepticism about the exchange's credibility and advise against using derivatives, emphasizing the risks associated with centralized exchanges. One user recommends decentralized alternatives like the Bitshares exchange. The discussion also touches on the concept of proof of stake (PoS) in blockchain networks<ref name=":6">[https://old.reddit.com/r/Bitcoin/comments/2txtjd/bitcoin_futures_exchange_hacked_796_lost_1000/ Bitcoin futures exchange hacked - 796 lost 1000 bitcoin. - Reddit] (Jan 24, 2024)</ref>.
	\|-		\|-
	\|January 28th, 2015 5:16:00 AM MST		\|January 28th, 2015 5:16:00 AM MST
Line 80:		Line 96:
	== Technical Details ==		== Technical Details ==
	The 796 exchange platform suffered from a vulnerability in a submodule of the exchange's withdrawal system. This allowed the withdrawal address to be modified.		The 796 exchange platform suffered from a vulnerability in a submodule of the exchange's withdrawal system. This allowed the withdrawal address to be modified.

			Transactions: <ref name=":4" /><ref name=":5" />

	=== Vulnerability In Withdrawal Module ===		=== Vulnerability In Withdrawal Module ===
Line 85:		Line 103:

	=== Confirmation During Withdrawal Time ===		=== Confirmation During Withdrawal Time ===
	The company published a detailed report on the incident to Weibo<ref name=":0" />. On January 27, 2015, at 22:21 local time, a user requested a withdrawal, which was confirmed by the staff through a phone call at 22:26, and later via email at 22:38, due to a different IP location. After confirmation, the customer service manager initiated the withdrawal at 22:50. ~~When the~~ customer reported the withdrawal did not arrive around 3:50 am		The company published a detailed report on the incident to Weibo<ref name=":0" />. On January 27, 2015, at 22:21 local time, a user requested a withdrawal, which was confirmed by the staff through a phone call at 22:26, and later via email at 22:38, due to a different IP location. After confirmation, the customer service manager initiated the withdrawal at 22:50. The customer reported the withdrawal did not arrive around 3:50 am.

	=== Laundering Of Funds ===		=== Laundering Of Funds ===
	Limited details are available. ~~TBD?~~		Limited details are available on what the attacker did with the funds.

	== Total Amount Lost ==		== Total Amount Lost ==
Line 96:		Line 114:

	== Immediate Reactions ==		== Immediate Reactions ==
	The 796 platform published a summary of the incident online on the Weibo platform<ref name=":0" />. The original post ~~was~~ in Chinese titled "Notes on the theft last night". A translation is below:<blockquote>At 22:21 last night, ~~users~~ applied for ~~1000BTC~~ cash on the 796 exchange. Our staff called at 22:26 to confirm that it was ~~my own operation~~, because the registered IP ~~has~~ different ~~areas and emails were distributed~~ at 22:38 ~~Confirm~~. After confirmation, the customer service manager issued the ~~present~~ at 22:50. ~~After receiving the~~ user's phone call at about 3:50 in the morning ~~and~~ saying that the cash was not received, I immediately called the relevant person in charge of the company to study the problem. After detailed analysis of various logs and audit records, we found that there was a sub-module updated by the system a few days ago. Hackers attacked the ~~loopholes~~ used, causing users to tamper with their current ~~addresses，In~~ addition, the hacker's deliberate use of an address similar to the original present address to confuse the user and our division's manual review. At present, this problem has been repaired, and encryption and monitoring functions have been added. Although ~~the encrypted currency exchange is~~ often exposed to such risks, the 796 exchange has also been involved in this risk prevention after nearly two years of operation. ~~Synchronized and strengthened, and~~ will continue to strengthen the monitoring of user account funds security in the ~~later period~~.		The 796 platform published a summary of the incident online on the Weibo platform<ref name=":0" />. The original post in Chinese was titled "Notes on the theft last night". A potential translation is below.<blockquote>At 22:21 last night, a user applied for a 1000 BTC cash withdrawal on the 796 exchange. Our staff called at 22:26 to confirm that it was a request from the customer, because the registered IP was from a different area. Email confirmation was requested at 22:38. After confirmation, the customer service manager issued the withdrawal at 22:50. The user made a phone call at about 3:50 in the morning saying that the cash was not received, and I immediately called the relevant person in charge of the company to study the problem. After detailed analysis of various logs and audit records, we found that there was a sub-module updated by the system a few days ago. Hackers attacked the code used, causing users to tamper with their current withdrawals addresses. In addition, the hacker's deliberate use of a withdrawal address similar to the original present address was designed to confuse the user and our division's manual review.

			At present, this problem has been repaired, and encryption and monitoring functions have been added. Although cryptocurrency exchanges are often exposed to such risks, the 796 exchange has also been involved in this risk prevention after nearly two years of operation. We will continue to strengthen the monitoring of user account funds security in the future.

	The stolen system was used by hackers for problems with the 796 exchange. The 796 exchange will ~~accrue~~ the company’s major shareholders ~~for~~ unallocated profits to cover this loss, which has been reissued. In such a high-risk industry, problems are inevitable, which is why the 796 major shareholders have not received dividends. Before getting the venture capital, we will do our best to ensure the safety of customer assets first. The future is very long. 796 will continue to maintain the principle of openness and ~~fairness. Integrity will only serve~~. Thank you for your support. Thank you for ~~coming all the way！~~</blockquote>		The stolen system was used by hackers for problems with the 796 exchange. The 796 exchange will consult with the company’s major shareholders to see about using unallocated profits to cover this loss, which has been reissued. In such a high-risk industry, problems are inevitable, which is why the 796 major shareholders have not received dividends. Before getting the venture capital, we will do our best to ensure the safety of customer assets first. The future is very long. 796 will continue to maintain the principle of openness, fairness, and integrity. Thank you for your support. Thank you for your continued use!</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==
	~~The~~ incident was ~~included in multiple references including the BitcoinExchangeGuide<ref name="bitcoinexchangeguide-218" /> and a list of incidents~~ published ~~by Kyle Gibson<ref name="kylegibson-86" />~~.		There were some ongoing improvements to the security of the 796 exchange, and the incident was widely published.

			=== 796 Exchange Security Improvements ===
	Nelson Yu provided a further statement to CoinTelegraph<ref name=":1" />:<blockquote>"We have been constantly monitoring the hacking activities on our servers and 3 months back then we took the precautionary step to migrate our servers to a highly secured cloud site. Unfortunately, that didn’t stop the incident from happening last night. In the last 24 hours, our security team worked around the clock to trace back the codes and processes. At this moment, we have a pretty good idea of exactly how they did it. This was not a generalized attack. The hacker’s strategy was precisely calculated and well targeted to compromise a certain weakness on our server.		Nelson Yu provided a further statement to CoinTelegraph<ref name=":1" />:<blockquote>"We have been constantly monitoring the hacking activities on our servers and 3 months back then we took the precautionary step to migrate our servers to a highly secured cloud site. Unfortunately, that didn’t stop the incident from happening last night. In the last 24 hours, our security team worked around the clock to trace back the codes and processes. At this moment, we have a pretty good idea of exactly how they did it. This was not a generalized attack. The hacker’s strategy was precisely calculated and well targeted to compromise a certain weakness on our server.

Line 110:		Line 131:

	Due to this nature, major shareholders have carried out their obligation to our customers in covering this loss of fund. The remedy came from the major shareholders’ unpaid dividend."</blockquote>		Due to this nature, major shareholders have carried out their obligation to our customers in covering this loss of fund. The remedy came from the major shareholders’ unpaid dividend."</blockquote>

			=== Wide Publication Of Incident ===
			The incident was included as an exchange hack in multiple references including the BitcoinExchangeGuide<ref name="bitcoinexchangeguide-218" /> and a list of incidents published by Kyle Gibson<ref name="kylegibson-86" />. The incident has also been included in the book Blockchain: A Hype or a Hoax?<ref>[https://books.google.ca/books?id=Ig-mEAAAQBAJ&pg=PA107&lpg=PA107&dq=796+exchange+1000+btc+withdrawal+laundering&source=bl&ots=6lF280jVvS&sig=ACfU3U0g6xoXHgkMkL05EmXNKeIkm4bH_g&hl=en&sa=X&ved=2ahUKEwjf3JGX8_aDAxXAODQIHT3KAKsQ6AF6BAhDEAM#v=onepage&q=796%20exchange%201000%20btc%20withdrawal%20laundering&f=false Blockchain: A Hype or a Hoax? - Google Books] (Jan 24, 2024)</ref>.

			In most cases, the incident has only been given a brief mention.

	== Total Amount Recovered ==		== Total Amount Recovered ==

Azoundria: Another 30 minutes complete. Added prevention. Added lots more information on the exchange. Added further quotes and references from CoinTelegraph.

2023-12-14T21:02:32Z

Another 30 minutes complete. Added prevention. Added lots more information on the exchange. Added further quotes and references from CoinTelegraph.

Show changes

Azoundria: Another 30 minutes complete. Added a logo image for this exchange incident and a couple more sources.

2023-12-12T21:28:28Z

Another 30 minutes complete. Added a logo image for this exchange incident and a couple more sources.

← Older revision		Revision as of 15:28, 12 December 2023
Line 64:		Line 64:
	\|ChainSec Article Inclusion		\|ChainSec Article Inclusion
	\|ChainSec includes the 796 exchange hack in their timeline<ref name=":2">[https://chainsec.io/exchange-hacks/ Exchange Hacks - ChainSec] (Dec 12, 2023)</ref>. Unlike other sources, they specify the correct date of January 27th.		\|ChainSec includes the 796 exchange hack in their timeline<ref name=":2">[https://chainsec.io/exchange-hacks/ Exchange Hacks - ChainSec] (Dec 12, 2023)</ref>. Unlike other sources, they specify the correct date of January 27th.
			\|-
			\|January 20th, 2023 1:22:18 AM MST
			\|SelfKey Inclusion
			\|SelfKey includes the 796 exchange hack in their "Comprehensive List of Cryptocurrency Exchange Hacks"<ref name=":3">[https://selfkey.org/list-of-cryptocurrency-exchange-hacks/ A Comprehensive List of Cryptocurrency Exchange Hacks - SelfKey] (Dec 12, 2023)</ref>. "It was not a good start to the year for cryptocurrency exchanges in 2015. Chinese exchange 796 had its server compromised, and hackers tampered with withdrawal addresses to trick users. It worked, and major shareholders footed the bill so users didn’t have to lose funds themselves."
	\|}		\|}

Line 74:		Line 78:

	== Total Amount Lost ==		== Total Amount Lost ==
	The amount of loss was 1,000 bitcoin<ref name=":0" />. This was estimated to be worth $230,000 USD by both Kyle Gibson<ref name="kylegibson-86" /> and BitcoinExchangeGuide<ref name="bitcoinexchangeguide-218" />. ChainSec estimated the loss at $270,000<ref name=":2" />.		The amount of loss was 1,000 bitcoin<ref name=":0" /><ref name=":3" />. This was estimated to be worth $230,000 USD by both Kyle Gibson<ref name="kylegibson-86" /> and BitcoinExchangeGuide<ref name="bitcoinexchangeguide-218" />. ChainSec estimated the loss at $270,000<ref name=":2" />.

	The total amount lost has been estimated at $230,000 USD.		The total amount lost has been estimated at $230,000 USD.

Azoundria at 21:22, 12 December 2023

2023-12-12T21:22:57Z

← Older revision		Revision as of 15:22, 12 December 2023
Line 1:		Line 1:
	{{Case Study Under Construction}}		{{Case Study Under Construction}}

	This is an unusual case, where the hacker exploited vulnerabilities in the exchange to tamper with the withdrawal address of a customer. The customer legitimately requested the withdrawal and failed to notice the changed address. “796” appears to have handled this well, and the situation was quickly made right. No other customers appear to have been affected. It is suggested that all large withdrawals must be tested before completion.		[[File:796exchange.jpg\|thumb\|796 Homepage/Logo]]This is an unusual case, where the hacker exploited vulnerabilities in the exchange to tamper with the withdrawal address of a customer. The customer legitimately requested the withdrawal and failed to notice the changed address. “796” appears to have handled this well, and the situation was quickly made right. No other customers appear to have been affected. It is suggested that all large withdrawals must be tested before completion.

	== About 796 Exchange ==		== About 796 Exchange ==

Azoundria at 21:21, 12 December 2023

2023-12-12T21:21:49Z

← Older revision		Revision as of 15:21, 12 December 2023
Line 5:		Line 5:
	== About 796 Exchange ==		== About 796 Exchange ==
	The 796 exchange platform was based in China.		The 796 exchange platform was based in China.

			Homepage:<ref>[https://web.archive.org/web/20131204090901/https://796.com/ 796 Xchange Homepage - Archive December 4th, 2013 2:09:01 AM MST] (Dec 12, 2023)</ref>

	== The Reality ==		== The Reality ==
Line 58:		Line 60:
	\|Inclusion In BitcoinExchangeGuide		\|Inclusion In BitcoinExchangeGuide
	\|The incident is included as a "Hack / Theft" in a published list by BitcoinExchangeGuide.com<ref name="bitcoinexchangeguide-218" />.		\|The incident is included as a "Hack / Theft" in a published list by BitcoinExchangeGuide.com<ref name="bitcoinexchangeguide-218" />.
			\|-
			\|June 29th, 2019 9:39:37 AM MDT
			\|ChainSec Article Inclusion
			\|ChainSec includes the 796 exchange hack in their timeline<ref name=":2">[https://chainsec.io/exchange-hacks/ Exchange Hacks - ChainSec] (Dec 12, 2023)</ref>. Unlike other sources, they specify the correct date of January 27th.
	\|}		\|}

Line 68:		Line 74:

	== Total Amount Lost ==		== Total Amount Lost ==
	The amount of loss was 1,000 bitcoin<ref name=":0" />. This was estimated to be worth $230,000 USD by both Kyle Gibson<ref name="kylegibson-86" /> and BitcoinExchangeGuide<ref name="bitcoinexchangeguide-218" />.		The amount of loss was 1,000 bitcoin<ref name=":0" />. This was estimated to be worth $230,000 USD by both Kyle Gibson<ref name="kylegibson-86" /> and BitcoinExchangeGuide<ref name="bitcoinexchangeguide-218" />. ChainSec estimated the loss at $270,000<ref name=":2" />.

	The total amount lost has been estimated at $230,000 USD.		The total amount lost has been estimated at $230,000 USD.

Azoundria: Another 30 minutes complete. Integrated all sources and some additional key sources. Added technical analysis. All sections summarized with initial draft content.

2023-12-11T18:56:18Z

Another 30 minutes complete. Integrated all sources and some additional key sources. Added technical analysis. All sections summarized with initial draft content.

Show changes

Azoundria at 18:09, 11 December 2023

2023-12-11T18:09:34Z

← Older revision		Revision as of 12:09, 11 December 2023
Line 52:		Line 52:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==