BitcoinTalk Database Breach - Revision history

Azoundria at 21:43, 13 September 2024

2024-09-13T21:43:57Z

Azoundria: COMPLETE 30 minutes. Full review and modification of the wiki article. Tons of sections have been filled in. Added information about earlier 2013 hack as a new case. Added detailed timeline information. Improved the immediate reactions and technical details with additional information.

2024-05-15T21:03:00Z

COMPLETE 30 minutes. Full review and modification of the wiki article. Tons of sections have been filled in. Added information about earlier 2013 hack as a new case. Added detailed timeline information. Improved the immediate reactions and technical details with additional information.

← Older revision		Revision as of 15:03, 15 May 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}{{Unattributed Sources}}		{{Case Study Under Construction}}{{Unattributed Sources}}

	[[File:Bitcointalk.jpg\|thumb\|BitcoinTalk Logo/Homepage]]BitcoinTalk is ~~one of~~ the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the website's internet service provider. In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, hashed passwords, dates of birth, secret questions, hashed secret answers, and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.		[[File:Bitcointalk.jpg\|thumb\|BitcoinTalk Logo/Homepage]]BitcoinTalk is the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the website's internet service provider. In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, hashed passwords, dates of birth, secret questions, hashed secret answers, and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.

	This is a global/international case not involving a specific country.<ref name="newsbtc-6820" /><ref name="bitcoinwiki-6920" /><ref name="youtube-6921" /><ref name="coinpoint-6922" /><ref name="reddit-6923" /><ref name="bitcointalklegendaryprofiles-6924" /><ref name="coindesk-6925" /><ref name="nforce-6926" /><ref name="bitcointalktwitter-6927" /><ref name="reddit-6928" /><ref name="leakedsourcearchive-6929" /><ref>https://web.archive.org/web/20161030093311/http://www.coindesk.com/bitcointalk-server-compromised/</ref><ref>https://web.archive.org/web/20161030093311/https://www.leakedsource.com/blog/bitcointalkbtce</ref><ref>https://web.archive.org/web/20160331235954/http://www.databreaches.net/server-compromised-due-to-social-engineering-against-isp-nforce/</ref><ref>https://bitcointalk.org/index.php?topic=4405796.0</ref><ref>https://cointelegraph.com/news/bitcointalkorg-database-with-500k-accounts-is-being-sold-on-the-dark-web (Accessed May 14, 2024)</ref>		This is a global/international case not involving a specific country.<ref name="newsbtc-6820" /><ref name="bitcoinwiki-6920" /><ref name="youtube-6921" /><ref name="coinpoint-6922" /><ref name="reddit-6923" /><ref name="bitcointalklegendaryprofiles-6924" /><ref name="coindesk-6925" /><ref name="nforce-6926" /><ref name="bitcointalktwitter-6927" /><ref name="reddit-6928" /><ref name="leakedsourcearchive-6929" /><ref>https://web.archive.org/web/20161030093311/http://www.coindesk.com/bitcointalk-server-compromised/</ref><ref>https://web.archive.org/web/20161030093311/https://www.leakedsource.com/blog/bitcointalkbtce</ref><ref>https://web.archive.org/web/20160331235954/http://www.databreaches.net/server-compromised-due-to-social-engineering-against-isp-nforce/</ref><ref>https://bitcointalk.org/index.php?topic=4405796.0</ref><ref>https://cointelegraph.com/news/bitcointalkorg-database-with-500k-accounts-is-being-sold-on-the-dark-web (Accessed May 14, 2024)</ref><ref name=":2">[https://old.reddit.com/r/Bitcoin/comments/36tqq4/bitcointalk_server_compromised_due_to_social/ BitcoinTalk "Server compromised due to social engineering against ISP NFOrce" - BitcoinTalk] (Accessed May 15, 2024)</ref><ref>https://bitcointalk.org/index.php?topic=5147697.0</ref>

	== About BitcoinTalk ==		== About BitcoinTalk ==
Line 28:		Line 28:
	\|-		\|-
	\|May 21st, 2015 7:14:00 PM MDT		\|May 21st, 2015 7:14:00 PM MDT
	\|~~Main Event~~		\|Twitter Post About Attack
	\|"In May 2015, ~~BitcoinTalk was~~ the ~~victim of~~ a ~~social engineering attack after an unknown hacker targeted an employee~~ of ~~NFOrce~~, ~~BitcoinTalk’s ISP~~. In a ~~revelation on Reddit at~~ the ~~time,~~ forum ~~operator and admin~~ Theymos ~~hinted~~ that password hashes, ~~private messages~~, emails and ~~other user details could be compromised~~."		\|The Bitcointalk Twitter account posts a notification about the attack<ref name=":3">[https://twitter.com/bitcointalk/status/601556710130515969 BitcoinTalk - "Server compromised due to social engineering against ISP NFOrce. There will be extended downtime for forensic analysis and reinstall." - Twitter] (Accessed May 15, 2024)</ref>.
			\|-
			\|May 21st, 2015 7:24:46 PM MDT
			\|Posting In Bitcoin Subreddit
			\|User drhelmutp posts about the BitcoinTalk breach in the Bitcoin subreddit<ref name=":2" />.
			\|-
			\|May 21st, 2015 7:57:29 PM MDT
			\|Theymos Shares Details
			\|Forum administrator Theymos shares additional details about the exploit, "The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database. However, you should act as though your password hashes, PMs, emails, etc. were compromised. The forum will probably be down for 36-60 hours for analysis and reinstall. I'll post status updates on Twitter @bitcointalk and I'll post a complete report in a post in Meta once the forum comes back online."<ref name=":4">[https://old.reddit.com/r/Bitcoin/comments/36tqq4/bitcointalk_server_compromised_due_to_social/crh0swt/ Theymos - "The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database. However, you should act as though your password hashes, PMs, emails, etc. were compromised. The forum will probably be down for 36-60 hours for analysis and reinstall. I'll post status updates on Twitter @bitcointalk and I'll post a complete report in a post in Meta once the forum comes back online." - Reddit] (Accessed May 15, 2024)</ref>
	\|-		\|-
	\|September 2nd, 2016 3:25:58 AM MDT		\|September 2nd, 2016 3:25:58 AM MDT
Line 58:		Line 66:

	=== Password Crackability ===		=== Password Crackability ===
	Bitcointalk.org utilized a superior password storage method, sha256crypt, for added security<ref name="ccn-6817" />.<blockquote>"Notably, the remaining 91% of user passwords were hashed with “sha256crypt”, a method of password storage that LeakedSource deemed as “far superior to nearly every website we’ve seen thus far.” That’s high praise, coming from a resource that reveals details of data breaches frequently, in a time where mega-breaches of hundreds of millions of users are commonplace."</blockquote>		Bitcointalk.org utilized a superior password storage method, sha256crypt, for added security<ref name="ccn-6817" />.<blockquote>"Notably, the remaining 91% of user passwords were hashed with “sha256crypt”, a method of password storage that LeakedSource deemed as “far superior to nearly every website we’ve seen thus far.” That’s high praise, coming from a resource that reveals details of data breaches frequently, in a time where mega-breaches of hundreds of millions of users are commonplace."</blockquote>Theymos provided some details on Reddit after the breach<ref>[https://old.reddit.com/r/Bitcoin/comments/36tqq4/bitcointalk_server_compromised_due_to_social/crhb73w/ Theymos - "Yes, each password has a 12-byte unique salt. The passwords are hashed with 7500 rounds of SHA-256." - Reddit] (Accessed May 15, 2024)</ref>.<blockquote>Yes, each password has a 12-byte unique salt. The passwords are hashed with 7500 rounds of SHA-256.</blockquote>

	== Total Amount Lost ==		== Total Amount Lost ==
Line 64:		Line 72:

	== Immediate Reactions ==		== Immediate Reactions ==
	"The ~~compromise was announced via the~~ official BitcoinTalk Twitter account. Operator Theymos ~~later~~ took to the bitcoin subreddit to offer a ~~more detailed explanation~~."		The official BitcoinTalk Twitter account announced the compromise via a Tweet<ref name=":3" />.<blockquote>Server compromised due to social engineering against ISP NFOrce. There will be extended downtime for forensic analysis and reinstall.</blockquote>Operator Theymos shortly thereafter took to the bitcoin subreddit to offer more details<ref name=":4" />.<blockquote>The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database. However, you should act as though your password hashes, PMs, emails, etc. were compromised. The forum will probably be down for 36-60 hours for analysis and reinstall. I'll post status updates on Twitter @bitcointalk and I'll post a complete report in a post in Meta once the forum comes back online.</blockquote>"Theymos said that BitcoinTalk could remain offline for as many as 60 hours following the incident, and cautioned users to "act as though your password hashes, PMs, emails, etc. were compromised"."

	"Theymos said that BitcoinTalk could remain offline for as many as 60 hours following the incident, and cautioned users to "act as though your password hashes, PMs, emails, etc. were compromised"."

	== Ultimate Outcome ==		== Ultimate Outcome ==

Azoundria: COMPLETE 30 minutes. Improving the summary introduction. Added a Prevention section with proposed prevention plan (may be improved later). Integrated information from a BitcoinTalk thread about the hack to help fill in the Ongoing Developments section. CCN news article with information from LeakedSource integrated. Added additional clarification to the amount lost and amount recovered sections. Completed a review of the changes to the CCN article with LeakedSource information. Added a couple sou

2024-05-14T22:30:37Z

COMPLETE 30 minutes. Improving the summary introduction. Added a Prevention section with proposed prevention plan (may be improved later). Integrated information from a BitcoinTalk thread about the hack to help fill in the Ongoing Developments section. CCN news article with information from LeakedSource integrated. Added additional clarification to the amount lost and amount recovered sections. Completed a review of the changes to the CCN article with LeakedSource information. Added a couple sou

Show changes

Azoundria: Information in the about section spread out into other sections of the article. Added information from the articles by CCN and DataBreaches.net. DataBreaches.net replaced with archived version. Updated source titles of various sources.

2024-04-02T22:40:36Z

Information in the about section spread out into other sections of the article. Added information from the articles by CCN and DataBreaches.net. DataBreaches.net replaced with archived version. Updated source titles of various sources.

Show changes

Azoundria at 23:58, 12 April 2023

2023-04-12T23:58:50Z

← Older revision		Revision as of 17:58, 12 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bitcointalkdatabasebreach.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bitcointalkdatabasebreach.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Bitcointalk.jpg\|thumb\|BitcoinTalk]]BitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.		[[File:Bitcointalk.jpg\|thumb\|BitcoinTalk]]BitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="ccn-6817" /><ref name="databreaches-6818" /><ref name="newsbtc-6820" /><ref name="bitcoinwiki-6920" /><ref name="youtube-6921" /><ref name="coinpoint-6922" /><ref name="reddit-6923" /><ref name="bitcointalklegendaryprofiles-6924" /><ref name="coindesk-6925" /><ref name="nforce-6926" /><ref name="bitcointalktwitter-6927" /><ref name="reddit-6928" /><ref name="leakedsourcearchive-6929" />
	<ref name="ccn-6817" /><ref name="databreaches-6818" /><ref name="newsbtc-6820" /><ref name="bitcoinwiki-6920" /><ref name="youtube-6921" /><ref name="coinpoint-6922" /><ref name="reddit-6923" /><ref name="bitcointalklegendaryprofiles-6924" /><ref name="coindesk-6925" /><ref name="nforce-6926" /><ref name="bitcointalktwitter-6927" /><ref name="reddit-6928" /><ref name="leakedsourcearchive-6929" />

	== About BitcoinTalk ==		== About BitcoinTalk ==
Line 65:		Line 64:
	!Description		!Description
	\|-		\|-
	\|May 21st, 2015 7:14:00 PM		\|May 21st, 2015 7:14:00 PM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 92:		Line 91:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	~~Which policies could have prevented this event from happening?~~

	== References ==		== References ==

Azoundria at 00:52, 16 February 2023

2023-02-16T00:52:17Z

← Older revision		Revision as of 18:52, 15 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bitcointalkdatabasebreach.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bitcointalkdatabasebreach.php}}
			{{Unattributed Citations}}

	[[File:Bitcointalk.jpg\|thumb\|BitcoinTalk]]BitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.		[[File:Bitcointalk.jpg\|thumb\|BitcoinTalk]]BitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="ccn-6817" /><ref name="databreaches-6818" /><ref name="newsbtc-6820" /><ref name="bitcoinwiki-6920" /><ref name="youtube-6921" /><ref name="coinpoint-6922" /><ref name="reddit-6923" /><ref name="bitcointalklegendaryprofiles-6924" /><ref name="coindesk-6925" /><ref name="nforce-6926" /><ref name="bitcointalktwitter-6927" /><ref name="reddit-6928" /><ref name="leakedsourcearchive-6929" />

	== About BitcoinTalk ==		== About BitcoinTalk ==
Line 43:		Line 45:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 65:		Line 66:
	\|-		\|-
	\|May 21st, 2015 7:14:00 PM		\|May 21st, 2015 7:14:00 PM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 78:		Line 75:

	== Total Amount Lost ==		== Total Amount Lost ==
	~~The total amount~~ lost ~~is unknown~~.		No funds were lost.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 89:		Line 86:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 97:		Line 94:

	== Prevention Policies ==		== Prevention Policies ==
			Which policies could have prevented this event from happening?

	== References ==		== References ==
	[https://www.ccn.com/bitcoin-exchange-btc-e-bitcointalk-forum-breaches-details-revealed/ https://www.ccn.com/bitcoin-exchange-btc-e-bitcointalk-forum-breaches-details-revealed/] (Mar 4)		<references><ref name="ccn-6817">[https://www.ccn.com/bitcoin-exchange-btc-e-bitcointalk-forum-breaches-details-revealed/ https://www.ccn.com/bitcoin-exchange-btc-e-bitcointalk-forum-breaches-details-revealed/] (Mar 4, 2022)</ref>

	[https://www.databreaches.net/bitcoin-exchange-btc-e-and-bitcointalk-forum-breaches/ https://www.databreaches.net/bitcoin-exchange-btc-e-and-bitcointalk-forum-breaches/] (Mar 4)		<ref name="databreaches-6818">[https://www.databreaches.net/bitcoin-exchange-btc-e-and-bitcointalk-forum-breaches/ https://www.databreaches.net/bitcoin-exchange-btc-e-and-bitcointalk-forum-breaches/] (Mar 4, 2022)</ref>

	[https://www.newsbtc.com/news/leakedsource-publishes-update-btc-e-bitcointalk-hacking-incidents/ Update on BTC-E and BitcoinTalk Hacking Incidents] (Mar 4)		<ref name="newsbtc-6820">[https://www.newsbtc.com/news/leakedsource-publishes-update-btc-e-bitcointalk-hacking-incidents/ Update on BTC-E and BitcoinTalk Hacking Incidents] (Mar 4, 2022)</ref>

	[https://en.bitcoinwiki.org/wiki/Bitcoin_Talk Bitcoin Talk. All about cryptocurrency - BitcoinWiki] (Mar 7)		<ref name="bitcoinwiki-6920">[https://en.bitcoinwiki.org/wiki/Bitcoin_Talk Bitcoin Talk. All about cryptocurrency - BitcoinWiki] (Mar 7, 2022)</ref>

	[https://www.youtube.com/watch?v=ETh4KgKTyHs Introduction to BitcoinTalk.org \| Bitcoin Weekly Show - YouTube] (Mar 7)		<ref name="youtube-6921">[https://www.youtube.com/watch?v=ETh4KgKTyHs Introduction to BitcoinTalk.org \| Bitcoin Weekly Show - YouTube] (Mar 7, 2022)</ref>

	[https://www.coinpoint.net/partners/bitcointalk/ Bitcointalk - CoinPoint - The Premium Digital Marketing Agency] (Mar 7)		<ref name="coinpoint-6922">[https://www.coinpoint.net/partners/bitcointalk/ Bitcointalk - CoinPoint - The Premium Digital Marketing Agency] (Mar 7, 2022)</ref>

	[https://www.reddit.com/r/CryptoCurrency/comments/8j3tkq/collection_of_legendary_bitcoin_talk_posts_from/ Reddit - Dive into anything] (Mar 7)		<ref name="reddit-6923">[https://www.reddit.com/r/CryptoCurrency/comments/8j3tkq/collection_of_legendary_bitcoin_talk_posts_from/ Reddit - Dive into anything] (Mar 7, 2022)</ref>

	[https://bitcointalk.org/index.php?topic=3247239.0 Legendary profiles of bitcointalk.] (Mar 7)		<ref name="bitcointalklegendaryprofiles-6924">[https://bitcointalk.org/index.php?topic=3247239.0 Legendary profiles of bitcointalk.] (Mar 7, 2022)</ref>

	[https://www.coindesk.com/business/2015/05/22/bitcointalk-server-compromised-during-social-engineering-attack/ BitcoinTalk Server Compromised During Social Engineering Attack] (Mar 8)		<ref name="coindesk-6925">[https://www.coindesk.com/business/2015/05/22/bitcointalk-server-compromised-during-social-engineering-attack/ BitcoinTalk Server Compromised During Social Engineering Attack] (Mar 8, 2022)</ref>

	[https://www.nforce.com/ https://www.nforce.com/] (Mar 8)		<ref name="nforce-6926">[https://www.nforce.com/ https://www.nforce.com/] (Mar 8, 2022)</ref>

	[https://twitter.com/bitcointalk/status/601556710130515969 @bitcointalk Twitter] (Mar 8)		<ref name="bitcointalktwitter-6927">[https://twitter.com/bitcointalk/status/601556710130515969 @bitcointalk Twitter] (Mar 8, 2022)</ref>

	[https://www.reddit.com/r/Bitcoin/comments/36tqq4/bitcointalk_server_compromised_due_to_social/crh0swt/ Reddit - Dive into anything] (Mar 8)		<ref name="reddit-6928">[https://www.reddit.com/r/Bitcoin/comments/36tqq4/bitcointalk_server_compromised_due_to_social/crh0swt/ Reddit - Dive into anything] (Mar 8, 2022)</ref>

	[https://web.archive.org/web/20161208010408/https://www.leakedsource.com/blog/bitcointalkbtce LeakedSource disclosure of Bitcointalk.org and Btc-e.com Hack] (Mar 8)		<ref name="leakedsourcearchive-6929">[https://web.archive.org/web/20161208010408/https://www.leakedsource.com/blog/bitcointalkbtce LeakedSource disclosure of Bitcointalk.org and Btc-e.com Hack] (Mar 8, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bitcointalkdatabasebreach.php}} BitcoinTalkBitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 us..."

2023-01-24T20:45:27Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bitcointalkdatabasebreach.php}} thumb|BitcoinTalkBitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 us..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bitcointalkdatabasebreach.php}}

[[File:Bitcointalk.jpg|thumb|BitcoinTalk]]BitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.

This is a global/international case not involving a specific country.

== About BitcoinTalk ==
BitcoinTalk is "one of the largest and, most importantly, international forums where you can find absolutely all the information about Bitcoins." "Bitcointalk.org is the largest and probably the most famous forum related to the Bitcoin world." "Here you can safely communicate with miners from different parts of the world, read about the most favorable offers from cranes or cloud mining sites, learn the principles of doubling and choose the most reliable services, communicate in "non-stop"mode."

"BitcoinTalk is a message board where people interested in the technical details and the development of Bitcoin software can talk to each other. The forum also has places for people who are interested in bitcoin mining, in trading with bitcoin, and in the economics of Bitcoin."

"Before the creation of the current BitcoinTalk Forum, Satoshi used a SourceForge forum, which is lost. When Sirius provided hosting, the forum was moved to bitcoin.org/smf. Satoshi made several custom modifications to the forum software and theme."

"In July, 2011 the forum was moved to bitcointalk.org in order to make it explicitly unofficial. The "forum" link on the bitcoin.org homepage was made to simply return the Google search results for the search terms "bitcoin forums". This was followed by Bitcoin Community members, very much in bitcoin's spirit of decentralisation, creating a number of alternative forums offering different moderatorial policies and using different software platforms. None of these alternative forums have yet reached the size of Bitcoin Talk." "On July 22, 2012, Bitcoin Talk reached its one millionth post."

"In May 2015, BitcoinTalk was the victim of a social engineering attack after an unknown hacker targeted an employee of NFOrce, BitcoinTalk’s ISP. In a revelation on Reddit at the time, forum operator and admin Theymos hinted that password hashes, private messages, emails and other user details could be compromised."

"Bitcointalk.org had 499,593 users hacked in May of 2015, and they do know about the breach. Bitcointalk.org data contains usernames, emails, passwords, birthdays, secret questions, hashed secret answers and some other internal data." "The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform."

"The attack is said to have targeted the site's ISP, a company called NFOrce that is based in the Netherlands." "Server compromised due to social engineering against ISP NFOrce. There will be extended downtime for forensic analysis and reinstall."

"The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database."

"The compromise was announced via the official BitcoinTalk Twitter account. Operator Theymos later took to the bitcoin subreddit to offer a more detailed explanation."

"Theymos said that BitcoinTalk could remain offline for as many as 60 hours following the incident, and cautioned users to "act as though your password hashes, PMs, emails, etc. were compromised"."

"However, the account information gained by the hackers may not have come of much use to them due to additional protection features incorporated into these platforms." "Only 44,869 (9%) of users on Bitcointalk.org used MD5 hashing with a unique salt for passwords. Of those, LeakedSource.com was able to crack 30,389 or 68%. The remaining 91% of user passwords were hashed with “sha256crypt” and LeakedSource estimates it would take them about a year to crack an estimated 60-70% of them. This method of password storage is far superior to nearly every website they say they’ve seen thus far."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - BitcoinTalk Database Breach
!Date
!Event
!Description
|-
|May 21st, 2015 7:14:00 PM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==

== References ==
[https://www.ccn.com/bitcoin-exchange-btc-e-bitcointalk-forum-breaches-details-revealed/ https://www.ccn.com/bitcoin-exchange-btc-e-bitcointalk-forum-breaches-details-revealed/] (Mar 4)

[https://www.databreaches.net/bitcoin-exchange-btc-e-and-bitcointalk-forum-breaches/ https://www.databreaches.net/bitcoin-exchange-btc-e-and-bitcointalk-forum-breaches/] (Mar 4)

[https://www.newsbtc.com/news/leakedsource-publishes-update-btc-e-bitcointalk-hacking-incidents/ Update on BTC-E and BitcoinTalk Hacking Incidents] (Mar 4)

[https://en.bitcoinwiki.org/wiki/Bitcoin_Talk Bitcoin Talk. All about cryptocurrency - BitcoinWiki] (Mar 7)

[https://www.youtube.com/watch?v=ETh4KgKTyHs Introduction to BitcoinTalk.org | Bitcoin Weekly Show - YouTube] (Mar 7)

[https://www.coinpoint.net/partners/bitcointalk/ Bitcointalk - CoinPoint - The Premium Digital Marketing Agency] (Mar 7)

[https://www.reddit.com/r/CryptoCurrency/comments/8j3tkq/collection_of_legendary_bitcoin_talk_posts_from/ Reddit - Dive into anything] (Mar 7)

[https://bitcointalk.org/index.php?topic=3247239.0 Legendary profiles of bitcointalk.] (Mar 7)

[https://www.coindesk.com/business/2015/05/22/bitcointalk-server-compromised-during-social-engineering-attack/ BitcoinTalk Server Compromised During Social Engineering Attack] (Mar 8)

[https://www.nforce.com/ https://www.nforce.com/] (Mar 8)

[https://twitter.com/bitcointalk/status/601556710130515969 @bitcointalk Twitter] (Mar 8)

[https://www.reddit.com/r/Bitcoin/comments/36tqq4/bitcointalk_server_compromised_due_to_social/crh0swt/ Reddit - Dive into anything] (Mar 8)

[https://web.archive.org/web/20161208010408/https://www.leakedsource.com/blog/bitcointalkbtce LeakedSource disclosure of Bitcointalk.org and Btc-e.com Hack] (Mar 8)