BTER NXT Token Theft - Revision history

Azoundria: COMPLETE 30 minutes. Updated initial construction template. Added a much improved introduction to the case. Updated the image used. Performed a full review of all information, and moved information from the about section of the case moved into other sections. Completed the prevention section for all 3 actors. Prepared a promotion on Twitter for the case.

2024-09-27T00:12:04Z

COMPLETE 30 minutes. Updated initial construction template. Added a much improved introduction to the case. Updated the image used. Performed a full review of all information, and moved information from the about section of the case moved into other sections. Completed the prevention section for all 3 actors. Prepared a promotion on Twitter for the case.

← Older revision		Revision as of 18:12, 26 September 2024
Line 11:		Line 11:

	== The Reality ==		== The Reality ==
	~~This sections is included if a case involved deception or information that was unknown at the time. Examples include:~~		The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet.

	* When the ~~service was actually started (if different than the "official story").~~
	* Who actually ran a service and their ~~own personal history.~~
	* How the service was structured behind the scenes. (For example, ~~there was no "trading bot".)~~
	* Details of what audits reported and how vulnerabilities were missed during auditing.

	== What Happened ==		== What Happened ==
	~~The specific events of the loss and how it came about. What actually happened~~ to ~~cause~~ the ~~loss and some of~~ the ~~events leading up to it~~.		A hacker was ultimately able to gain access to the NXT funds in the hot wallet.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - BTER NXT Token Theft		\|+Key Event Timeline - BTER NXT Token Theft
Line 49:		Line 44:

	"It's totally our fault and we are trying our best to cover all the loss. However, 50m nxt is huge for us, we cannot afford it at the moment."		"It's totally our fault and we are trying our best to cover all the loss. However, 50m nxt is huge for us, we cannot afford it at the moment."



	“BTER is reporting that 50m NXT, or roughly $1.65m at press time, has been stolen from its exchange following an attack on one of its hosting servers. A developer representing the China-based digital currency exchange platform confirmed the news on the community information website NXT Forum, suggesting that the BTER team was considering urging the NXT community to roll back the NXT block chain to recover the lost funds.”		“BTER is reporting that 50m NXT, or roughly $1.65m at press time, has been stolen from its exchange following an attack on one of its hosting servers. A developer representing the China-based digital currency exchange platform confirmed the news on the community information website NXT Forum, suggesting that the BTER team was considering urging the NXT community to roll back the NXT block chain to recover the lost funds.”



Line 57:		Line 54:

	"[D]evelopers created an alternative version of the NXT client so people could choose to forge on the rollback fork if they wished. Some downloaded it and started forging."		"[D]evelopers created an alternative version of the NXT client so people could choose to forge on the rollback fork if they wished. Some downloaded it and started forging."


	"The BTER representative suggested that the exchange is exploring all options, including contacting the NXT development team in an effort to rollback the block chain, thereby restoring the ledger to its state before the theft occurred." "BTER briefly considered retrieving the stolen funds by rolling back the NXT blockchain, but the exchange eventually decided against pursuing that course of action, since they were able to obtain “lots of information” on the hacker."		"The BTER representative suggested that the exchange is exploring all options, including contacting the NXT development team in an effort to rollback the block chain, thereby restoring the ledger to its state before the theft occurred." "BTER briefly considered retrieving the stolen funds by rolling back the NXT blockchain, but the exchange eventually decided against pursuing that course of action, since they were able to obtain “lots of information” on the hacker."
Line 83:		Line 79:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~There do not appear~~ to ~~have been any~~ funds ~~recovered~~ in ~~this case~~.		The BTER platform was able to negotiate with the hacker to return most of the funds in exchange for bitcoin.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==
Line 94:		Line 88:
	The BTER platform stored funds on a managed server, which was connected to the internet. This qualifies as a hot wallet. In addition, no multi-sig was set up, so a single point of failure existed. This hack could have been avoided through setting up a multi-signature wallet which was stored offline. By multi-sig, this means that independent people hold the keys. By offline, this means that the private keys are not stored on any server or other internet-connected device.		The BTER platform stored funds on a managed server, which was connected to the internet. This qualifies as a hot wallet. In addition, no multi-sig was set up, so a single point of failure existed. This hack could have been avoided through setting up a multi-signature wallet which was stored offline. By multi-sig, this means that independent people hold the keys. By offline, this means that the private keys are not stored on any server or other internet-connected device.
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:~~Placeholder~~}}		{{Prevention:Individuals:Avoid Third Party Custodians}}

			{{Prevention:Individuals:Store Funds Offline}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Implement Multi-Signature}}

			{{Prevention:Platforms:Regular Audit Procedures}}

			{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Platform Security Assessments}}

			{{Prevention:Regulators:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria at 21:57, 26 September 2024

2024-09-26T21:57:42Z

← Older revision		Revision as of 15:57, 26 September 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}{{Unattributed Sources}}		{{Case Study Under Construction}}{{Unattributed Sources}}

	[[File:~~Bter~~.jpg\|thumb\|BTER Logo/Homepage]]BTER was a Chinese trading platform for blockchain assets, which was established in 2012. The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds. BTER attempted to negotiate a chain split. However, the majority of NXT nodes opposed the split and it did not proceed. BTER attempted to negotiate with the hacker. This was successful, with the hacker returning most of the funds in exchange for a smaller amount of bitcoin. This type of trade worked because the hacker has a lot of difficulty selling stolen NXT tokens, while bitcoin is much more liquid. Ultimately, the BTER platform continued to operate, and it appears they honoured the losses of affected users.		[[File:Btercom.jpg\|thumb\|BTER Logo/Homepage]]BTER was a Chinese trading platform for blockchain assets, which was established in 2012. The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds. BTER attempted to negotiate a chain split. However, the majority of NXT nodes opposed the split and it did not proceed. BTER attempted to negotiate with the hacker. This was successful, with the hacker returning most of the funds in exchange for a smaller amount of bitcoin. This type of trade worked because the hacker has a lot of difficulty selling stolen NXT tokens, while bitcoin is much more liquid. Ultimately, the BTER platform continued to operate, and it appears they honoured the losses of affected users.

	<ref name="coiniq-2326" /><ref name="coindesk-2325" /><ref name="coindesk-3043" /><ref name="bitcoinist-3044" /><ref name="reddit-3045" /><ref name="financemagnates-3046" /><ref name="thehackernews-3047" /><ref name="bitcoinwiki-2327" /><ref name="slowmisthacked-1160" /><ref>https://nxtforum.org/news-and-announcements/forgers-have-been-faced-with-a-choice/ </ref><ref>https://web.archive.org/web/20140818084659/https://www.mynxt.info/blockexplorer/details.php?action=ac&ac=1244396688755618309</ref><ref>https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/</ref>		<ref name="coiniq-2326" /><ref name="coindesk-2325" /><ref name="coindesk-3043" /><ref name="bitcoinist-3044" /><ref name="reddit-3045" /><ref name="financemagnates-3046" /><ref name="thehackernews-3047" /><ref name="bitcoinwiki-2327" /><ref name="slowmisthacked-1160" /><ref>https://nxtforum.org/news-and-announcements/forgers-have-been-faced-with-a-choice/ </ref><ref>https://web.archive.org/web/20140818084659/https://www.mynxt.info/blockexplorer/details.php?action=ac&ac=1244396688755618309</ref><ref>https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/</ref>

Azoundria: Updated initial construction template. Added a much improved introduction to the case. Performed a full review of all information from the about section of the case moved into other sections.

2024-09-26T21:57:33Z

Updated initial construction template. Added a much improved introduction to the case. Performed a full review of all information from the about section of the case moved into other sections.

Show changes

Azoundria: Added more sources and working to isolate the date of the incident.

2024-09-20T00:55:55Z

Added more sources and working to isolate the date of the incident.

← Older revision		Revision as of 18:55, 19 September 2024
Line 10:		Line 10:
	Ultimately the BTER platform continued to operate, and it appears they honoured the losses of affected users.		Ultimately the BTER platform continued to operate, and it appears they honoured the losses of affected users.

	This exchange or platform is based in China, or the incident targeted people primarily in China.<ref name="coiniq-2326" /><ref name="coindesk-2325" /><ref name="coindesk-3043" /><ref name="bitcoinist-3044" /><ref name="reddit-3045" /><ref name="financemagnates-3046" /><ref name="thehackernews-3047" /><ref name="bitcoinwiki-2327" /><ref name="slowmisthacked-1160" />		This exchange or platform is based in China, or the incident targeted people primarily in China.<ref name="coiniq-2326" /><ref name="coindesk-2325" /><ref name="coindesk-3043" /><ref name="bitcoinist-3044" /><ref name="reddit-3045" /><ref name="financemagnates-3046" /><ref name="thehackernews-3047" /><ref name="bitcoinwiki-2327" /><ref name="slowmisthacked-1160" /><ref>https://nxtforum.org/news-and-announcements/forgers-have-been-faced-with-a-choice/ </ref><ref>https://web.archive.org/web/20140818084659/https://www.mynxt.info/blockexplorer/details.php?action=ac&ac=1244396688755618309</ref><ref>https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/</ref>

	== About BTER ==		== About BTER ==
Line 74:		Line 74:
	!Description		!Description
	\|-		\|-
	\|August 15th, 2014		\|August 15th, 2014 2:33:00 AM MDT
	\|~~Main Event~~		\|Hack Announced On Twitter
	\|~~Expand this into a brief description of what happened~~ and the ~~impact~~. ~~If multiple lines are necessary~~, ~~add them here~~.		\|The BTER exchange announces about the theft on Twitter<ref>[https://x.com/btercom/status/500198658701135873 BTER - "Someone hacked Bter's NXT central account and stole 50m NXT. We are working with the dev for a plan. We will keep you updated." - Twitter] (Accessed Sep 19, 2024)</ref>.
	\|-		\|-
	\|		\|August 15th, 2014 7:49:00 AM MDT
	\|		\|CoinDesk Article Published
	\|		\|CoinDesk publishes an article on the incident<ref name="coindesk-2325" />.
			\|-
			\|August 15th, 2014 9:21:00 AM MDT
			\|Rollback Plan Cancelled
			\|BTER announces that they are not rolling back the chain as they have a lot of information on the hacker<ref>[https://x.com/btercom/status/500301278027608064 BTER - "We have decided not to rollback but get the stolen funds back from the hacker since we have got lots of information of him." - Twitter] (Accessed Sep 19, 2024)</ref>.
	\|}		\|}

Line 119:		Line 123:

	== References ==		== References ==
	<references><ref name="coiniq-2326">[https://coiniq.com/cryptocurrency-exchange-hacks/ 30+ Cryptocurrency Exchange Hacks - A Comprehensive List] (Aug 9, 2021)</ref>		<references>
			<ref name="coiniq-2326">[https://coiniq.com/cryptocurrency-exchange-hacks/ 30+ Cryptocurrency Exchange Hacks - A Comprehensive List] (Aug 9, 2021)</ref>
	<ref name="coindesk-2325">[https://www.coindesk.com/bter-nxt-bitcoin-exchange-hack/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Aug 9, 2021)</ref>		<ref name="coindesk-2325">[https://www.coindesk.com/bter-nxt-bitcoin-exchange-hack/ Hackers Steal $1.65 Million in NXT from BTER Exchange - CoinDesk] (Accessed Aug 9, 2021)</ref>

	<ref name="coindesk-3043">[https://www.coindesk.com/markets/2014/08/15/hackers-steal-165-million-in-nxt-from-bter-exchange/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Sep 18, 2021)</ref>		<ref name="coindesk-3043">[https://www.coindesk.com/markets/2014/08/15/hackers-steal-165-million-in-nxt-from-bter-exchange/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Sep 18, 2021)</ref>

	<ref name="bitcoinist-3044">[https://bitcoinist.com/bter-hacked-nxt-pos-at-work/ BTER Hacked, NXT PoS at work \| Bitcoinist.com] (Sep 18, 2021)</ref>		<ref name="bitcoinist-3044">[https://bitcoinist.com/bter-hacked-nxt-pos-at-work/ BTER Hacked, NXT PoS at work \| Bitcoinist.com] (Sep 18, 2021)</ref>

	<ref name="reddit-3045">[https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/ BTER.com saved from insolvency. Hacker returns funds in undisclosed deal. (USD ~1.5 M returned) : Bitcoin] (Sep 18, 2021)</ref>		<ref name="reddit-3045">[https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/ BTER.com saved from insolvency. Hacker returns funds in undisclosed deal. (USD ~1.5 M returned) : Bitcoin] (Sep 18, 2021)</ref>

	<ref name="financemagnates-3046">[https://www.financemagnates.com/cryptocurrency/news/nxt-gains-upper-hand-after-1-65m-worth-of-nxt-stolen-from-bter/ Nxt gains upper hand after $1.65m worth of Nxt stolen from BTER \| Finance Magnates] (Sep 18, 2021)</ref>		<ref name="financemagnates-3046">[https://www.financemagnates.com/cryptocurrency/news/nxt-gains-upper-hand-after-1-65m-worth-of-nxt-stolen-from-bter/ Nxt gains upper hand after $1.65m worth of Nxt stolen from BTER \| Finance Magnates] (Sep 18, 2021)</ref>

	<ref name="thehackernews-3047">[https://thehackernews.com/2015/02/bter-bitcoin-exchange-hacked.html $1.75 Million in Bitcoin Stolen from Chinese BTER Bitcoin Exchange] (Sep 18, 2021)</ref>		<ref name="thehackernews-3047">[https://thehackernews.com/2015/02/bter-bitcoin-exchange-hacked.html $1.75 Million in Bitcoin Stolen from Chinese BTER Bitcoin Exchange] (Sep 18, 2021)</ref>

	<ref name="bitcoinwiki-2327">[https://en.bitcoinwiki.org/wiki/BTER BTER Exchange: Fees, Review, Coins - BitcoinWiki] (Aug 9, 2021)</ref>		<ref name="bitcoinwiki-2327">[https://en.bitcoinwiki.org/wiki/BTER BTER Exchange: Fees, Review, Coins - BitcoinWiki] (Aug 9, 2021)</ref>
			<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
	<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref></references>		</references>

Azoundria at 23:57, 12 April 2023

2023-04-12T23:57:25Z

← Older revision		Revision as of 17:57, 12 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bternxttokentheft.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/bternxttokentheft.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Bter.jpg\|thumb\|BTER]]The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds.		[[File:Bter.jpg\|thumb\|BTER]]The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds.
Line 10:		Line 10:
	Ultimately the BTER platform continued to operate, and it appears they honoured the losses of affected users.		Ultimately the BTER platform continued to operate, and it appears they honoured the losses of affected users.

	This exchange or platform is based in China, or the incident targeted people primarily in China.		This exchange or platform is based in China, or the incident targeted people primarily in China.<ref name="coiniq-2326" /><ref name="coindesk-2325" /><ref name="coindesk-3043" /><ref name="bitcoinist-3044" /><ref name="reddit-3045" /><ref name="financemagnates-3046" /><ref name="thehackernews-3047" /><ref name="bitcoinwiki-2327" /><ref name="slowmisthacked-1160" />
	<ref name="coiniq-2326" /><ref name="coindesk-2325" /><ref name="coindesk-3043" /><ref name="bitcoinist-3044" /><ref name="reddit-3045" /><ref name="financemagnates-3046" /><ref name="thehackernews-3047" /><ref name="bitcoinwiki-2327" /><ref name="slowmisthacked-1160" />

	== About BTER ==		== About BTER ==
Line 75:		Line 74:
	!Description		!Description
	\|-		\|-
	\|August 15th, 2014 ~~12:00:00 AM~~		\|August 15th, 2014
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 102:		Line 101:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			The BTER platform stored funds on a managed server, which was connected to the internet. This qualifies as a hot wallet. In addition, no multi-sig was set up, so a single point of failure existed. This hack could have been avoided through setting up a multi-signature wallet which was stored offline. By multi-sig, this means that independent people hold the keys. By offline, this means that the private keys are not stored on any server or other internet-connected device.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	The BTER platform stored funds on a managed server, which was connected to the internet. This qualifies as a hot wallet. In addition, no multi-sig was set up, so a single point of failure existed. This hack could have been avoided through setting up a multi-signature wallet which was stored offline. By multi-sig, this means that independent people hold the keys. By offline, this means that the private keys are not stored on any server or other internet-connected device.		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	<references><ref name="coiniq-2326">[https://coiniq.com/cryptocurrency-exchange-hacks/ 30+ Cryptocurrency Exchange Hacks - A Comprehensive List] (Aug 8, 2021)</ref>		<references><ref name="coiniq-2326">[https://coiniq.com/cryptocurrency-exchange-hacks/ 30+ Cryptocurrency Exchange Hacks - A Comprehensive List] (Aug 9, 2021)</ref>

	<ref name="coindesk-2325">[https://www.coindesk.com/bter-nxt-bitcoin-exchange-hack/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Aug 8, 2021)</ref>		<ref name="coindesk-2325">[https://www.coindesk.com/bter-nxt-bitcoin-exchange-hack/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Aug 9, 2021)</ref>

	<ref name="coindesk-3043">[https://www.coindesk.com/markets/2014/08/15/hackers-steal-165-million-in-nxt-from-bter-exchange/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Sep 17, 2021)</ref>		<ref name="coindesk-3043">[https://www.coindesk.com/markets/2014/08/15/hackers-steal-165-million-in-nxt-from-bter-exchange/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Sep 18, 2021)</ref>

	<ref name="bitcoinist-3044">[https://bitcoinist.com/bter-hacked-nxt-pos-at-work/ BTER Hacked, NXT PoS at work \| Bitcoinist.com] (Sep 17, 2021)</ref>		<ref name="bitcoinist-3044">[https://bitcoinist.com/bter-hacked-nxt-pos-at-work/ BTER Hacked, NXT PoS at work \| Bitcoinist.com] (Sep 18, 2021)</ref>

	<ref name="reddit-3045">[https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/ BTER.com saved from insolvency. Hacker returns funds in undisclosed deal. (USD ~1.5 M returned) : Bitcoin] (Sep 17, 2021)</ref>		<ref name="reddit-3045">[https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/ BTER.com saved from insolvency. Hacker returns funds in undisclosed deal. (USD ~1.5 M returned) : Bitcoin] (Sep 18, 2021)</ref>

	<ref name="financemagnates-3046">[https://www.financemagnates.com/cryptocurrency/news/nxt-gains-upper-hand-after-1-65m-worth-of-nxt-stolen-from-bter/ Nxt gains upper hand after $1.65m worth of Nxt stolen from BTER \| Finance Magnates] (Sep 17, 2021)</ref>		<ref name="financemagnates-3046">[https://www.financemagnates.com/cryptocurrency/news/nxt-gains-upper-hand-after-1-65m-worth-of-nxt-stolen-from-bter/ Nxt gains upper hand after $1.65m worth of Nxt stolen from BTER \| Finance Magnates] (Sep 18, 2021)</ref>

	<ref name="thehackernews-3047">[https://thehackernews.com/2015/02/bter-bitcoin-exchange-hacked.html $1.75 Million in Bitcoin Stolen from Chinese BTER Bitcoin Exchange] (Sep 17, 2021)</ref>		<ref name="thehackernews-3047">[https://thehackernews.com/2015/02/bter-bitcoin-exchange-hacked.html $1.75 Million in Bitcoin Stolen from Chinese BTER Bitcoin Exchange] (Sep 18, 2021)</ref>

	<ref name="bitcoinwiki-2327">[https://en.bitcoinwiki.org/wiki/BTER BTER Exchange: Fees, Review, Coins - BitcoinWiki] (Aug 8, 2021)</ref>		<ref name="bitcoinwiki-2327">[https://en.bitcoinwiki.org/wiki/BTER BTER Exchange: Fees, Review, Coins - BitcoinWiki] (Aug 9, 2021)</ref>

	<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref></references>		<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref></references>

Azoundria at 00:49, 16 February 2023

2023-02-16T00:49:50Z

← Older revision		Revision as of 18:49, 15 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bternxttokentheft.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bternxttokentheft.php}}
			{{Unattributed Citations}}

	[[File:Bter.jpg\|thumb\|BTER]]The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds.		[[File:Bter.jpg\|thumb\|BTER]]The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds.
Line 10:		Line 11:

	This exchange or platform is based in China, or the incident targeted people primarily in China.		This exchange or platform is based in China, or the incident targeted people primarily in China.
			<ref name="coiniq-2326" /><ref name="coindesk-2325" /><ref name="coindesk-3043" /><ref name="bitcoinist-3044" /><ref name="reddit-3045" /><ref name="financemagnates-3046" /><ref name="thehackernews-3047" /><ref name="bitcoinwiki-2327" /><ref name="slowmisthacked-1160" />

	== About BTER ==		== About BTER ==
Line 53:		Line 55:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 75:		Line 76:
	\|-		\|-
	\|August 15th, 2014 12:00:00 AM		\|August 15th, 2014 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 88:		Line 85:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $1,650,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 99:		Line 96:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 110:		Line 107:

	== References ==		== References ==
	[https://coiniq.com/cryptocurrency-exchange-hacks/ 30+ Cryptocurrency Exchange Hacks - A Comprehensive List] (Aug 8)		<references><ref name="coiniq-2326">[https://coiniq.com/cryptocurrency-exchange-hacks/ 30+ Cryptocurrency Exchange Hacks - A Comprehensive List] (Aug 8, 2021)</ref>

	[https://www.coindesk.com/bter-nxt-bitcoin-exchange-hack/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Aug 8)		<ref name="coindesk-2325">[https://www.coindesk.com/bter-nxt-bitcoin-exchange-hack/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Aug 8, 2021)</ref>

	[https://www.coindesk.com/markets/2014/08/15/hackers-steal-165-million-in-nxt-from-bter-exchange/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Sep 17)		<ref name="coindesk-3043">[https://www.coindesk.com/markets/2014/08/15/hackers-steal-165-million-in-nxt-from-bter-exchange/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Sep 17, 2021)</ref>

	[https://bitcoinist.com/bter-hacked-nxt-pos-at-work/ BTER Hacked, NXT PoS at work \| Bitcoinist.com] (Sep 17)		<ref name="bitcoinist-3044">[https://bitcoinist.com/bter-hacked-nxt-pos-at-work/ BTER Hacked, NXT PoS at work \| Bitcoinist.com] (Sep 17, 2021)</ref>

	[https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/ BTER.com saved from insolvency. Hacker returns funds in undisclosed deal. (USD ~1.5 M returned) : Bitcoin] (Sep 17)		<ref name="reddit-3045">[https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/ BTER.com saved from insolvency. Hacker returns funds in undisclosed deal. (USD ~1.5 M returned) : Bitcoin] (Sep 17, 2021)</ref>

	[https://www.financemagnates.com/cryptocurrency/news/nxt-gains-upper-hand-after-1-65m-worth-of-nxt-stolen-from-bter/ Nxt gains upper hand after $1.65m worth of Nxt stolen from BTER \| Finance Magnates] (Sep 17)		<ref name="financemagnates-3046">[https://www.financemagnates.com/cryptocurrency/news/nxt-gains-upper-hand-after-1-65m-worth-of-nxt-stolen-from-bter/ Nxt gains upper hand after $1.65m worth of Nxt stolen from BTER \| Finance Magnates] (Sep 17, 2021)</ref>

	[https://thehackernews.com/2015/02/bter-bitcoin-exchange-hacked.html $1.75 Million in Bitcoin Stolen from Chinese BTER Bitcoin Exchange] (Sep 17)		<ref name="thehackernews-3047">[https://thehackernews.com/2015/02/bter-bitcoin-exchange-hacked.html $1.75 Million in Bitcoin Stolen from Chinese BTER Bitcoin Exchange] (Sep 17, 2021)</ref>

	[https://en.bitcoinwiki.org/wiki/BTER BTER Exchange: Fees, Review, Coins - BitcoinWiki] (Aug 8)		<ref name="bitcoinwiki-2327">[https://en.bitcoinwiki.org/wiki/BTER BTER Exchange: Fees, Review, Coins - BitcoinWiki] (Aug 8, 2021)</ref>

	[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25)		<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bternxttokentheft.php}} BTERThe BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds. The first thing which BTER attempted was to negotiate a chain split. However, the majority of NXT nodes opposed the split and it did not pr..."

2023-01-22T18:38:34Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bternxttokentheft.php}} thumb|BTERThe BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds. The first thing which BTER attempted was to negotiate a chain split. However, the majority of NXT nodes opposed the split and it did not pr..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bternxttokentheft.php}}

[[File:Bter.jpg|thumb|BTER]]The BTER trading platform held 5% of the NXT tokens in existence online on their managed server environment, without using a multi-sig wallet. A hacker managed to break into the platform and steal the funds.

The first thing which BTER attempted was to negotiate a chain split. However, the majority of NXT nodes opposed the split and it did not proceed.

The next thing which BTER attempted was to negotiate with the hacker. This was successful, with the hacker returning most funds, in exchange for a smaller amount of bitcoin. This type of trade works well because the hacker has a lot of difficulty selling stolen NXT tokens, while bitcoin is much more liquid.

Ultimately the BTER platform continued to operate, and it appears they honoured the losses of affected users.

This exchange or platform is based in China, or the incident targeted people primarily in China.

== About BTER ==
"Bter is a Chinese Blockchain Assets Trading Platform established in 2012 by Jinan Manwei Information Technology co., Ltd." "BTER is another of the hybrid fiat to crypto and crypto to crypto exchanges." "The objective of the exchange is to provide safe, efficient and honest services of cryptocurrency trading. BTER is another of the hybrid fiat to crypto and crypto to crypto exchanges. Although they had a rocky start to 2015 with a severe security breach, they have gradually reopened markets and have dealt with the situation in a professional manner."

"Bter is one of the few exchanges working also with fiat money, in this case it is us dollars and Chinese yuan. Trading on the exchange is carried out in 100 cryptocurrencies. This platform is protected by SSL certificate, Web application Firewall, manual confirmation of withdrawal, as well as two-stage authentication with one-time passwords Google. Most of the funds in the system are stored in cold wallets."

“BTER is reporting that 50m NXT, or roughly $1.65m at press time, has been stolen from its exchange following an attack on one of its hosting servers. A developer representing the China-based digital currency exchange platform confirmed the news on the community information website NXT Forum, suggesting that the BTER team was considering urging the NXT community to roll back the NXT block chain to recover the lost funds.”

"Someone hacked Bter's NXT central account and stole 50m NXT. We are working with the dev for a plan. We will keep you updated."

"This is by far the largest hack that has ever happened in NXT’s history. Although it was entirely down to BTER’s lack of security, NXT as an economic system has started bleeding. Indeed, the hack concerns over 5% of the total money supply."

"[D]evelopers created an alternative version of the NXT client so people could choose to forge on the rollback fork if they wished. Some downloaded it and started forging. But the big NXT holders, some of whom had had a lot of NXT on BTER, decided not to forge on that fork, believing that protecting the NXT blockchain was more important than trying to recover funds in a way that would kill NXT value in the mid and long term. The Proof of Stake system worked like a census democracy: those who had the most to lose had more power to decide and the NXT blockchain was protected – at the cost of 51 million NXT."

"It's totally our fault and we are trying our best to cover all the loss. However, 50m nxt is huge for us, we cannot afford it at the moment."

"The BTER representative suggested that the exchange is exploring all options, including contacting the NXT development team in an effort to rollback the block chain, thereby restoring the ledger to its state before the theft occurred." "BTER briefly considered retrieving the stolen funds by rolling back the NXT blockchain, but the exchange eventually decided against pursuing that course of action, since they were able to obtain “lots of information” on the hacker."

"We have decided not to rollback but get the stolen funds back from the hacker since we have got lots of information of him."

"According to CoinDesk, the exchange was eventually able to negotiate a partial return of the stolen funds." "The hacker sent a ransom message through the Blockchain, demanding bitcoins in exchange for the stolen nxt. BTER negotiated and sent 10 BTC in exchange for five million nxt. The hacker then became impatient- and hostile."

“So, what taking so long? Send me the next batch already. I’m going to leave soon. It’s already 2 hours of negotiation, it took me 1 hour to clean your whole exchanger. BTC 500+ I’m not going to sit here, and wait 2 more hours for you to decide to send the lousy 10 BTC.”

"BTER sent another 100 BTC for the remaining Nxt but received nothing in return as the hacker went silent. 3 options were on the table: offer more BTC to the hacker, a 310 BTC bounty for hunting him down, or implement a fork/rollback." "Several hours ago, there were reports of more nxt being returned to BTER."

"The convoluted series of events, including the hacker’s willingness to negotiate after the decision not to fork, have led some to speculate that it was an inside job."

This exchange or platform is based in China, or the incident targeted people primarily in China.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - BTER NXT Token Theft
!Date
!Event
!Description
|-
|August 15th, 2014 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
The BTER platform stored funds on a managed server, which was connected to the internet. This qualifies as a hot wallet. In addition, no multi-sig was set up, so a single point of failure existed. This hack could have been avoided through setting up a multi-signature wallet which was stored offline. By multi-sig, this means that independent people hold the keys. By offline, this means that the private keys are not stored on any server or other internet-connected device.

== References ==
[https://coiniq.com/cryptocurrency-exchange-hacks/ 30+ Cryptocurrency Exchange Hacks - A Comprehensive List] (Aug 8)

[https://www.coindesk.com/bter-nxt-bitcoin-exchange-hack/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Aug 8)

[https://www.coindesk.com/markets/2014/08/15/hackers-steal-165-million-in-nxt-from-bter-exchange/ Hackers Steal $1.65 Million in NXT from BTER Exchange] (Sep 17)

[https://bitcoinist.com/bter-hacked-nxt-pos-at-work/ BTER Hacked, NXT PoS at work | Bitcoinist.com] (Sep 17)

[https://www.reddit.com/r/Bitcoin/comments/2ds5ty/btercom_saved_from_insolvency_hacker_returns/ BTER.com saved from insolvency. Hacker returns funds in undisclosed deal. (USD ~1.5 M returned) : Bitcoin] (Sep 17)

[https://www.financemagnates.com/cryptocurrency/news/nxt-gains-upper-hand-after-1-65m-worth-of-nxt-stolen-from-bter/ Nxt gains upper hand after $1.65m worth of Nxt stolen from BTER | Finance Magnates] (Sep 17)

[https://thehackernews.com/2015/02/bter-bitcoin-exchange-hacked.html $1.75 Million in Bitcoin Stolen from Chinese BTER Bitcoin Exchange] (Sep 17)

[https://en.bitcoinwiki.org/wiki/BTER BTER Exchange: Fees, Review, Coins - BitcoinWiki] (Aug 8)

[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25)