Bitfinex Security Breach - Revision history

Azoundria: COMPLETE 30 minutes. Integration of The Verge article about the new Netflix series Razzlekhan. Prepared a Twitter promotion of the case.

2024-09-25T01:09:52Z

COMPLETE 30 minutes. Integration of The Verge article about the new Netflix series Razzlekhan. Prepared a Twitter promotion of the case.

Show changes

Azoundria: Wording changes saved.

2024-09-24T21:27:18Z

Wording changes saved.

← Older revision		Revision as of 15:27, 24 September 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}{{Unattributed Sources}}		{{Case Study Under Construction}}{{Unattributed Sources}}

	[[File:Bitfinex.jpg\|thumb\|BitFinex Logo/Chart]]In August 2016, Hong Kong-based Bitfinex was the largest cryptocurrency exchange platform in the world. They had just completed an upgrade to customer wallets to implement a new multi-signature security setup which gave each customer a 2 of 3 multi-sig wallet, with a unique key stored in a database, one key held by Bitfinex supposedly offline, and a third key held with third party BitGo. While ~~this was a~~ great ~~model~~ in theory, it didn't actually require multiple signatures or any offline signing to initiate the withdrawals themselves. This became apparent when a single ~~online~~ system was able to initiate and complete a large number of withdrawals, using both the BitGo signature and the database signature. The complexity of the system and the number of wallets did act to slow down the theft somewhat, as each wallet withdrawal required a separate blockchain transaction, however by the time the Bitfinex team was able to intervene and stop the drainage, $72m worth of customer ~~funds~~ had already been drained and Bitfinex did not have ~~any~~ funds to cover this scale ~~of loss~~. Bitfinex ended up removing a portion of the balance on every customer’s account, and replaced it with new Bitfinex (BFX) Tokens. Over the next year, the exchange continued to operate, and was able to recover the sum lost~~. Bitfinex continues to operate today as one of the largest exchanges in the world, having officially paid all customers back~~, though many customers bear resentment and do not feel that they have been made whole. As part of the process, 0.023% of the bitcoin was also returned by government and law enforcement. The theft remained officially unsolved for 6 years. Finally, at the end of January 2022, the FBI announced that they had seized the funds, now worth $3.5b. The private keys had been stored in an online cloud service account. It is yet unclear what will happen to those seized funds.		[[File:Bitfinex.jpg\|thumb\|BitFinex Logo/Chart]]In August 2016, Hong Kong-based Bitfinex was the largest cryptocurrency exchange platform in the world. They had just completed an upgrade to customer wallets to implement a new multi-signature security setup which gave each customer a 2 of 3 multi-sig wallet, with a unique key stored in a database, one key held by Bitfinex supposedly offline, and a third key held with third party BitGo. While great in theory, it didn't actually require multiple signatures or any offline signing to initiate the withdrawals themselves. This became apparent when a single system was able to initiate and complete a large number of withdrawals, using both the BitGo signature authorization and the database signature. The complexity of the system and the number of wallets did act to slow down the theft somewhat, as each wallet withdrawal required a separate blockchain transaction, however by the time the Bitfinex team was able to intervene and stop the drainage, $72m worth of customer bitcoin had already been drained and Bitfinex did not have funds to cover a loss of this scale. Bitfinex ended up removing a portion of the balance on every customer’s account, and replaced it with new Bitfinex (BFX) Tokens. Over the next year, the exchange continued to operate, and was reportedly able to recover the sum lost, though many customers bear resentment and do not feel that they have been made whole. As part of the process, 0.023% of the bitcoin was also returned by government and law enforcement. The theft remained officially unsolved for 6 years. Finally, at the end of January 2022, the FBI announced that they had seized the funds, now worth $3.5b. The private keys had been stored in an online cloud service account. It is yet unclear what will happen to those seized funds which presently remain under civil asset forfeiture.

	<ref name="bbc-15" /><ref name="cryptopotato-161" /><ref name="fintechnews-164" /><ref name="cointelegraph-197" /><ref name="hackingdistributed-198" /><ref name="bitcoinmagazine-200" /><ref name="zdnet-201" /><ref name="coinsutra-202" /><ref name="pcmag-1165" /><ref name="cointelegraph-2236" /><ref name="cryptonews-2239" /><ref name="cryptocompare-2240" /><ref name="masterthecrypto-2241" /><ref name="youtube-6381" /><ref name="youtube-6382" /><ref name="youtube-6383" /><ref name="youtube-6384" /><ref name="techtarget-6385" /><ref name="justicedepartment-6386" /><ref name="youtube-6542" /><ref name="youtube-6543" /><ref name="bitfinex-6544" /><ref name="latimes-6545" /><ref name="bitfinex-6546" /><ref name="intotheblockmedium-6547" /><ref name="justicedepartment-6548" /><ref name="justicedepartment-6549" /><ref name="coindesk-6550" /><ref name="therecord-6551" /><ref name="techmonitor-6552" /><ref name="thejusticedepttwitter-6553" /><ref name="bitinfocharts-6554" /><ref name="nbcnews-6555" /><ref name="fridayeveryday-7532" /><ref name="coinmonksmedium-7933" /><ref>[https://www.elliptic.co/blog/elliptic-analysis-bitcoin-bitfinex-theft Elliptic Follows the $7 Billion in Bitcoin stolen from Bitfinex in 2016 - Elliptic] (Accessed Sep 20, 2024)</ref><ref>[https://pastebin.com/4J0hSCZX PasteBin Of Transactions Sorted By Amount] (Accessed Sep 20, 2024)</ref><ref name=":12">[https://www.chainalysis.com/blog/bitfinex-hack-plea-july-2023/ Bitfinex Hack Money Launderers Plead Guilty - Chainalysis] (Accessed Sep 20, 2024)</ref><ref>[https://pastebin.com/2XSASEEZ Pastebin Of Bitfinex Theft Transactions] </ref><ref>https://blog.merklescience.com/hacktrack/hack-track-bitfinex-hack-2016-recent-fund-movement-analysis</ref><ref>https://old.reddit.com/r/Bitcoin/comments/4wizdn/txid_and_bitcoin_addresses_connected_to_the/</ref>		<ref name="bbc-15" /><ref name="cryptopotato-161" /><ref name="fintechnews-164" /><ref name="cointelegraph-197" /><ref name="hackingdistributed-198" /><ref name="bitcoinmagazine-200" /><ref name="zdnet-201" /><ref name="coinsutra-202" /><ref name="pcmag-1165" /><ref name="cointelegraph-2236" /><ref name="cryptonews-2239" /><ref name="cryptocompare-2240" /><ref name="masterthecrypto-2241" /><ref name="youtube-6381" /><ref name="youtube-6382" /><ref name="youtube-6383" /><ref name="youtube-6384" /><ref name="techtarget-6385" /><ref name="justicedepartment-6386" /><ref name="youtube-6542" /><ref name="youtube-6543" /><ref name="bitfinex-6544" /><ref name="latimes-6545" /><ref name="bitfinex-6546" /><ref name="intotheblockmedium-6547" /><ref name="justicedepartment-6548" /><ref name="justicedepartment-6549" /><ref name="coindesk-6550" /><ref name="therecord-6551" /><ref name="techmonitor-6552" /><ref name="thejusticedepttwitter-6553" /><ref name="bitinfocharts-6554" /><ref name="nbcnews-6555" /><ref name="fridayeveryday-7532" /><ref name="coinmonksmedium-7933" /><ref>[https://www.elliptic.co/blog/elliptic-analysis-bitcoin-bitfinex-theft Elliptic Follows the $7 Billion in Bitcoin stolen from Bitfinex in 2016 - Elliptic] (Accessed Sep 20, 2024)</ref><ref>[https://pastebin.com/4J0hSCZX PasteBin Of Transactions Sorted By Amount] (Accessed Sep 20, 2024)</ref><ref name=":12">[https://www.chainalysis.com/blog/bitfinex-hack-plea-july-2023/ Bitfinex Hack Money Launderers Plead Guilty - Chainalysis] (Accessed Sep 20, 2024)</ref><ref>[https://pastebin.com/2XSASEEZ Pastebin Of Bitfinex Theft Transactions] </ref><ref>https://blog.merklescience.com/hacktrack/hack-track-bitfinex-hack-2016-recent-fund-movement-analysis</ref><ref>https://old.reddit.com/r/Bitcoin/comments/4wizdn/txid_and_bitcoin_addresses_connected_to_the/</ref>




	Potential duplicates: <ref name="justicedepartment-6386" /><ref name="justicedepartment-6549" />		Potential duplicates: <ref name="justicedepartment-6386" /><ref name="justicedepartment-6549" />

	== About BitFinex ==		== About BitFinex ==
	"Bitfinex is a Hong Kong-based cryptocurrency exchange owned and operated by iFinex Inc., which is headquartered in Hong Kong and registered in the British Virgin Islands." "The Bitfinex exchange is a popular platform for exchanging cryptocurrencies, also hosting spot and derivatives trading as well as certain lending, borrowing and staking features. Bitfinex came into existence in 2012." "BitFinex offers three main functions - it is a pure bitcoin to fiat exchange, a margin trading exchange and a liquidity provider. The platform offers a number of features available that expand the financial positions you can take - for example, the ability to short Bitcoin via margin trading."		"Bitfinex is a Hong Kong-based cryptocurrency exchange owned and operated by iFinex Inc., which is headquartered in Hong Kong and registered in the British Virgin Islands." "The Bitfinex exchange is a popular platform for exchanging cryptocurrencies, also hosting spot and derivatives trading as well as certain lending, borrowing and staking features. Bitfinex came into existence in 2012." "BitFinex offers three main functions - it is a pure bitcoin to fiat exchange, a margin trading exchange and a liquidity provider. The platform offers a number of features available that expand the financial positions you can take - for example, the ability to short Bitcoin via margin trading."
Line 26:		Line 22:

	== What Happened ==		== What Happened ==
	~~Hackers~~ managed to deceive the BitGo algorithms ~~in an unknown way~~, forcing them to approve transactions and allowing the withdrawal of about 120,000 BTC from the hot wallet, worth the equivalent of $72 million at the exchange rate at that time.		The hackers managed to deceive the BitGo algorithms, forcing them to approve transactions and allowing the withdrawal of about 120,000 BTC from the hot wallet, worth the equivalent of $72 million at the exchange rate at that time.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Bitfinex Security Breach		\|+Key Event Timeline - Bitfinex Security Breach
Line 185:		Line 181:
	"After the execution of court-authorized search warrants of online accounts controlled by Lichtenstein and Morgan, special agents obtained access to files within an online account controlled by Lichtenstein. Those files contained the private keys required to access the digital wallet that directly received the funds stolen from Bitfinex, and allowed special agents to lawfully seize and recover more than 94,000 bitcoin that had been stolen from Bitfinex. The recovered bitcoin was valued at over $3.6 billion at the time of seizure."		"After the execution of court-authorized search warrants of online accounts controlled by Lichtenstein and Morgan, special agents obtained access to files within an online account controlled by Lichtenstein. Those files contained the private keys required to access the digital wallet that directly received the funds stolen from Bitfinex, and allowed special agents to lawfully seize and recover more than 94,000 bitcoin that had been stolen from Bitfinex. The recovered bitcoin was valued at over $3.6 billion at the time of seizure."

	"On January 31, 2022, law enforcement gained access to Wallet 1CGA4s by decrypting a file saved to LICHTENSTEIN’s cloud storage account, which had been obtained pursuant to a search warrant. The file contained a list of 2,000 virtual currency addresses, along with corresponding private keys. Blockchain analysis confirmed that almost all 10 of those addresses were directly linked to the hack. Between January 31, 2022, and February 1, 2022, law enforcement obtained approval to execute a lawful seizure supported by probable cause under exigent circumstances and used the private keys from LICHTENSTEIN’s file to seize Wallet 1CGA4’s remaining balance of approximately 94,636 BTC, [now] worth $3.629 billion."		"On January 31, 2022, law enforcement gained access to Wallet 1CGA4s by decrypting a file saved to LICHTENSTEIN’s cloud storage account, which had been obtained pursuant to a search warrant. The file contained a list of 2,000 virtual currency addresses, along with corresponding private keys. Blockchain analysis confirmed that almost all of those addresses were directly linked to the hack. Between January 31, 2022, and February 1, 2022, law enforcement obtained approval to execute a lawful seizure supported by probable cause under exigent circumstances and used the private keys from LICHTENSTEIN’s file to seize Wallet 1CGA4’s remaining balance of approximately 94,636 BTC, [now] worth $3.629 billion."

	On "February 1, 2022 these addresses [which were seized by law enforcement made] various transactions. A total of 94,643 BTC (approximately $3.6 billion) [was] transferred to a new address." "The U.S. government becomes the 5th largest holder of Bitcoin in a single address." "The LEO token reached a new all-time high after the U.S. government seized the stolen funds, but before it was public information."		On "February 1, 2022 these addresses [which were seized by law enforcement made] various transactions. A total of 94,643 BTC (approximately $3.6 billion) [was] transferred to a new address." "The U.S. government becomes the 5th largest holder of Bitcoin in a single address." "The LEO token reached a new all-time high after the U.S. government seized the stolen funds, but before it was public information."

Azoundria: COMPLETE 30 minutes. Added information about the online cloud storage account. Filling in more information about the actual Bitfinex withdrawal transactions and timeline of the theft. Integrated additional information about the money laundering activities which occurred after the initial theft. More information and minor tweaks throughout the rest of the case.

2024-09-20T21:48:38Z

COMPLETE 30 minutes. Added information about the online cloud storage account. Filling in more information about the actual Bitfinex withdrawal transactions and timeline of the theft. Integrated additional information about the money laundering activities which occurred after the initial theft. More information and minor tweaks throughout the rest of the case.

Show changes

Azoundria: COMPLETE 30 minutes. Verified that there was no loss of data due to spam backup restoration. Edited the introduction to update the text description of the incident, removing irrelevant data and shortening things further. Improved the reality section. Review of article. Cleaning up default template parts and adding in further information. Moved the inclusion in reference lists to the end of the wiki article. Information integrated from Department of Justice and Washington Post articles on the arr

2024-09-18T22:10:10Z

COMPLETE 30 minutes. Verified that there was no loss of data due to spam backup restoration. Edited the introduction to update the text description of the incident, removing irrelevant data and shortening things further. Improved the reality section. Review of article. Cleaning up default template parts and adding in further information. Moved the inclusion in reference lists to the end of the wiki article. Information integrated from Department of Justice and Washington Post articles on the arr

Show changes

Azoundria: COMPLETE 30 minutes. New logo. Reference lists populated into ultimate outcome. Moving government interference information around. Integrated information from BBC article.

2024-02-22T22:12:00Z

COMPLETE 30 minutes. New logo. Reference lists populated into ultimate outcome. Moving government interference information around. Integrated information from BBC article.

← Older revision		Revision as of 16:12, 22 February 2024
Line 7:		Line 7:
	The theft remained officially unsolved for 6 years. Finally, at the end of January 2022, the FBI announced that they had seized the funds, now worth $3.5b. It is yet unclear what will happen to those seized funds.		The theft remained officially unsolved for 6 years. Finally, at the end of January 2022, the FBI announced that they had seized the funds, now worth $3.5b. It is yet unclear what will happen to those seized funds.

	This exchange or platform is based in Hong Kong, or the incident targeted people primarily in Hong Kong.~~<ref name="bitcoinmagazine-6" />~~<ref name="bbc-15~~" /><ref name="kylegibson-86~~" /><ref name="cryptopotato-161" /><ref name="fintechnews-164" /><ref name="cointelegraph-197" /><ref name="hackingdistributed-198" /><ref name="bitcoinmagazine-200" /><ref name="zdnet-201" /><ref name="coinsutra-202~~" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160~~" /><ref name="pcmag-1165" /><ref name="cointelegraph-2236" /><ref name="cryptonews-2239" /><ref name="cryptocompare-2240" /><ref name="masterthecrypto-2241" /><ref name="youtube-6381" /><ref name="youtube-6382" /><ref name="youtube-6383" /><ref name="youtube-6384" /><ref name="techtarget-6385" /><ref name="justicedepartment-6386" /><ref name="youtube-6542" /><ref name="youtube-6543" /><ref name="bitfinex-6544" /><ref name="latimes-6545" /><ref name="bitfinex-6546" /><ref name="intotheblockmedium-6547" /><ref name="justicedepartment-6548" /><ref name="justicedepartment-6549" /><ref name="coindesk-6550" /><ref name="therecord-6551" /><ref name="techmonitor-6552" /><ref name="thejusticedepttwitter-6553" /><ref name="bitinfocharts-6554" /><ref name="nbcnews-6555" /><ref name="fridayeveryday-7532" /><ref name="coinmonksmedium-7933" />		This exchange or platform is based in Hong Kong, or the incident targeted people primarily in Hong Kong.<ref name="bbc-15" /><ref name="cryptopotato-161" /><ref name="fintechnews-164" /><ref name="cointelegraph-197" /><ref name="hackingdistributed-198" /><ref name="bitcoinmagazine-200" /><ref name="zdnet-201" /><ref name="coinsutra-202" /><ref name="pcmag-1165" /><ref name="cointelegraph-2236" /><ref name="cryptonews-2239" /><ref name="cryptocompare-2240" /><ref name="masterthecrypto-2241" /><ref name="youtube-6381" /><ref name="youtube-6382" /><ref name="youtube-6383" /><ref name="youtube-6384" /><ref name="techtarget-6385" /><ref name="justicedepartment-6386" /><ref name="youtube-6542" /><ref name="youtube-6543" /><ref name="bitfinex-6544" /><ref name="latimes-6545" /><ref name="bitfinex-6546" /><ref name="intotheblockmedium-6547" /><ref name="justicedepartment-6548" /><ref name="justicedepartment-6549" /><ref name="coindesk-6550" /><ref name="therecord-6551" /><ref name="techmonitor-6552" /><ref name="thejusticedepttwitter-6553" /><ref name="bitinfocharts-6554" /><ref name="nbcnews-6555" /><ref name="fridayeveryday-7532" /><ref name="coinmonksmedium-7933" />


Line 20:		Line 20:
	Unfortunately the Bitfinex platform was using a vulnerable BitGo implementation.		Unfortunately the Bitfinex platform was using a vulnerable BitGo implementation.

	“There were a lot of reasons for why we went with this implementation with BitGo; one, a big one, was transparency,” said Tackett. “Everyone has their own wallet that they can watch on the blockchain. They can see their bitcoin at any time, and we settle it once per day.”		“There were a lot of reasons for why we went with this implementation with BitGo; one, a big one, was transparency,” said Tackett. “Everyone has their own wallet that they can watch on the blockchain. They can see their bitcoin at any time, and we settle it once per day.”

			=== Initial Government Regulation ===
			Initial government regulation was focused on ensuring that all assets were stored in separate account for each customer.

			“the US government did interfere with, fine, and modify the operations of Bitfinex. But as far as [one researcher could] tell, the government's touch was incredibly gentle. First, they fined Bitfinex only $75K, a slap on the wrist, three months' salary for a valley dev, for not having spent the three months of a developer's time on some needed key management structure. Second, they made sure that Bitfinex kept its funds not in a master omnibus account, but in multisig accounts for each individual registered with bitfinex. Essentially, the regulators wanted to see that the coins were delivered to individuals, as opposed to held in one giant pool. This little accounting twist was all that was required to satisfy the regulators, who generally seem clueless and out of the picture as far as security measures go. All the relevant decisions about protecting the private keys, then, rest with Bitfinex.”

	== What Happened ==		== What Happened ==
Line 33:		Line 38:
	\|Reddit Discussion		\|Reddit Discussion
	\|A discussion takes place on Reddit about the breach<ref name=":9">[https://old.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfinex_down_due_to_bitcoin_security_breach/ FearTheCoin - Bitfinex down due to bitcoin security breach - Reddit] (Jan 26, 2024)</ref>. The post reveals that Bitfinex has experienced a security breach leading to a halt in all trading and digital token deposits/withdrawals. Some users' bitcoins have been stolen, and an investigation is underway. The platform aims to determine affected users, settle open positions, and normalize account balances before resuming operations. The breach is reported to law enforcement, and updates will be posted on their status page. Discussions among users reflect skepticism, suspicion of an inside job, concerns about losses, and debates on the fairness of a proposed 36.067% haircut on all accounts. Bitfinex's announcement of losses being generalized across all accounts using BFX tokens as placeholders is met with criticism and questions about legality. The situation is fluid, and users express frustration, uncertainty, and speculation about the platform's future<ref name=":9">[https://old.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfinex_down_due_to_bitcoin_security_breach/ FearTheCoin - Bitfinex down due to bitcoin security breach - Reddit] (Jan 26, 2024)</ref>.		\|A discussion takes place on Reddit about the breach<ref name=":9">[https://old.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfinex_down_due_to_bitcoin_security_breach/ FearTheCoin - Bitfinex down due to bitcoin security breach - Reddit] (Jan 26, 2024)</ref>. The post reveals that Bitfinex has experienced a security breach leading to a halt in all trading and digital token deposits/withdrawals. Some users' bitcoins have been stolen, and an investigation is underway. The platform aims to determine affected users, settle open positions, and normalize account balances before resuming operations. The breach is reported to law enforcement, and updates will be posted on their status page. Discussions among users reflect skepticism, suspicion of an inside job, concerns about losses, and debates on the fairness of a proposed 36.067% haircut on all accounts. Bitfinex's announcement of losses being generalized across all accounts using BFX tokens as placeholders is met with criticism and questions about legality. The situation is fluid, and users express frustration, uncertainty, and speculation about the platform's future<ref name=":9">[https://old.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfinex_down_due_to_bitcoin_security_breach/ FearTheCoin - Bitfinex down due to bitcoin security breach - Reddit] (Jan 26, 2024)</ref>.
			\|-
			\|August 8th, 2016 7:06:07 AM MDT
			\|BBC Article Published
			\|BBC news reports that users would collectively lose 36% of their assets due to the cyber-attack<ref name="bbc-15" />. This loss-sharing approach, termed as "socialising" losses, means that all users of the platform will bear a portion of the impact<ref name="bbc-15" />. Emin Gun Sirer, a Bitcoin expert at Cornell University, highlighted the significant implications of this move, emphasizing that users effectively become part of an insurance plan for others when holding assets on exchanges<ref name="bbc-15" />. The event is compared with previous attacks on exchanges like Mt Gox in 2014, where numerous users experienced losses<ref name="bbc-15" />. Dr. Sirer anticipates challenges ahead and suggests a shift towards models with better understood insurance mechanisms<ref name="bbc-15" />. Prof. Alan Woodward from the University of Surrey likened the situation to a bank spreading losses across all customers, emphasizing the vulnerability of users who hold bitcoins in exchanges and online wallets<ref name="bbc-15" />.
	\|-		\|-
	\|April 14th, 2021 11:06:00 AM MDT		\|April 14th, 2021 11:06:00 AM MDT
Line 107:		Line 116:

	== Immediate Reactions ==		== Immediate Reactions ==
	~~How did~~ the ~~various parties involved (firm~~, ~~platform~~, ~~management~~, and/or ~~affected individual(s)) deal with~~ the ~~events? Were services shut down? Were announcements made? Were groups formed?~~		Bitfinex made statements through Zane Tackett, Director of Community & Product Development. The price of bitcoin dropped by roughly 20% before recovering. The incident was widely publicized and discussed in social media.

			=== Reactions Within BitFinex ===
			Bitfinex announced that users would collectively lose 36% of their assets due to a cyber-attack resulting in a loss of up to $65 million. This loss-sharing approach, termed as "socialising" losses, means that all users of the platform will bear a portion of the impact. Emin Gun Sirer, a Bitcoin expert at Cornell University, highlighted the significant implications of this move, emphasizing that users effectively become part of an insurance plan for others when holding assets on exchanges.

			In response to the attack, Bitfinex informed customers that they would encounter a loss percentage of 36.067% upon logging into the platform and would receive "BFX tokens" equivalent to their individual losses, which could be redeemed for repayment or shares in the parent company, iFinex Inc. The exchange disclosed that hackers had stolen 119,756 bitcoins, marking a substantial setback. This incident mirrors previous attacks on exchanges like Mt Gox in 2014, where numerous users experienced losses.

	"Zane Tackett, Director of Community & Product Development for Bitfinex, told Reuters on Wednesday that 119,756 bitcoins had been stolen from users’ accounts and that the exchange hadn’t yet decided how to address customer losses..."		"Zane Tackett, Director of Community & Product Development for Bitfinex, told Reuters on Wednesday that 119,756 bitcoins had been stolen from users’ accounts and that the exchange hadn’t yet decided how to address customer losses..."

	“Due to the magnitude of the attack and the fact that Bitfinex did not publish the details of their internal investigation, the hack created a strange confusion in the crypto community at the time.” “If one had to take a blind guess, one would suspect that the hacker obtained the private keys held by Bitfinex, coupled with API access to BitGo to instruct BitGo to sign the withdrawals. Additional trickery would probably be required to circumvent BitGo's daily withdrawal limits.”		“Due to the magnitude of the attack and the fact that Bitfinex did not publish the details of their internal investigation, the hack created a strange confusion in the crypto community at the time.” “If one had to take a blind guess, one would suspect that the hacker obtained the private keys held by Bitfinex, coupled with API access to BitGo to instruct BitGo to sign the withdrawals. Additional trickery would probably be required to circumvent BitGo's daily withdrawal limits.”

			=== Bitcoin Price Drop ===
			The news of Bitfinex's significant bitcoin loss led to a more than 20% drop in the cryptocurrency's price initially, although it showed some recovery fairly quickly<ref name="bbc-15" />.

	=== Community Reactions ===		=== Community Reactions ===
Line 117:		Line 134:

	== Ultimate Outcome ==		== Ultimate Outcome ==
	~~What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?~~

	=== ~~US Government Interference~~ ===		=== Inclusion on Reference Lists ===
	~~“the US government did interfere with, fine, and modify the operations of~~ Bitfinex~~. But as far as [one researcher could] tell, the government's touch~~ was ~~incredibly gentle. First, they fined Bitfinex only $75K, a slap~~ on ~~the wrist~~, ~~three months' salary for a valley dev~~, for not having spent the three months of a developer's time on some needed key management structure. Second, they made sure that Bitfinex kept its funds not in a master omnibus account, but in multisig accounts for each individual registered with bitfinex. Essentially, the ~~regulators wanted to see that the coins were delivered to individuals~~, as opposed to held in one giant pool. This little accounting twist was all that was required to satisfy the regulators, who generally seem clueless and out of the picture as far as security measures go. All the relevant decisions about protecting the private keys, then, rest with Bitfinex.”		The Bitfinex case was widely cited on various lists, including Bitcoin Magazine<ref name="bitcoinmagazine-6" />, Kyle Gibson<ref name="kylegibson-86" />, the Bitcoin Exchange Guide<ref name="bitcoinexchangeguide-218" />, Slowmist<ref name="slowmisthacked-1160" />.

	=== Multi-Signature BitGo Wallets Set Up ===		=== Multi-Signature BitGo Wallets Set Up ===

Azoundria: Another 30 minutes. Integrated tweet on DOJ seizure leaving one address. Finished about section spread around. Template updated. All sources have been given a proper title. Incorporated information about the Reddit discussion. Potential duplicate statement of facts source flagged.

2024-01-26T19:47:50Z

Another 30 minutes. Integrated tweet on DOJ seizure leaving one address. Finished about section spread around. Template updated. All sources have been given a proper title. Incorporated information about the Reddit discussion. Potential duplicate statement of facts source flagged.

Show changes

Azoundria: Added deposit transactions to the wiki page for later integration.

2024-01-25T21:09:06Z

Added deposit transactions to the wiki page for later integration.

← Older revision		Revision as of 15:09, 25 January 2024
Line 126:		Line 126:
	Blockchain Addresses: <ref>https://oxt.me/address/1HaQbNXKuad7FEj4Yuosho3ZxKGtroYehc (Jan 25, 2024)</ref><ref>https://oxt.me/address/16UPkXBDP8jPiDd9iFjKwQ6BPouZh5MUTQ (Jan 25, 2024)</ref><ref>https://oxt.me/address/19VEBJAbYHShSmAjmZh2RDX6s79cWZtL3Z (Jan 25, 2024)</ref><ref>https://oxt.me/address/1g1RjLuos5kdgrBLxdfugTCy4zEsyErvk (Jan 25, 2024)</ref>		Blockchain Addresses: <ref>https://oxt.me/address/1HaQbNXKuad7FEj4Yuosho3ZxKGtroYehc (Jan 25, 2024)</ref><ref>https://oxt.me/address/16UPkXBDP8jPiDd9iFjKwQ6BPouZh5MUTQ (Jan 25, 2024)</ref><ref>https://oxt.me/address/19VEBJAbYHShSmAjmZh2RDX6s79cWZtL3Z (Jan 25, 2024)</ref><ref>https://oxt.me/address/1g1RjLuos5kdgrBLxdfugTCy4zEsyErvk (Jan 25, 2024)</ref>

	Poloniex Deposits: <ref name=":8" />		Poloniex Deposits: <ref name=":8" /><ref>https://oxt.me/transaction/e31e72548717fb67c0380fb48547f2bd731419e6086f6768e800b3043f525d17 (Jan 25, 2024)</ref><ref>https://oxt.me/transaction/5b550175e1bd323a1c7b3577fc0bbae6caf4da749f1294d50fd8f5216e3a39db (Jan 25, 2024)</ref><ref>https://oxt.me/transaction/6cc74341dd491e195ac7c234938279af4172079b12438d5439f43e3b6be2a610 (Jan 25, 2024)</ref> TBD Add Poloniex deposits to the timeline.

	== Total Amount Lost ==		== Total Amount Lost ==

Azoundria: Another 30 minutes and included the statement about the coin control effectiveness. Included tons of other tweets and data from ErgoBTC, and added blockchain transactions to timeline and technical analysis.

2024-01-25T18:25:35Z

Another 30 minutes and included the statement about the coin control effectiveness. Included tons of other tweets and data from ErgoBTC, and added blockchain transactions to timeline and technical analysis.

Show changes

Azoundria: Another 30 minutes complete. Analysis and spreading out the About section further to construct the initial article. Put in place information from further review of the ErgoBTC Twitter posts.

2024-01-24T17:34:28Z

Another 30 minutes complete. Analysis and spreading out the About section further to construct the initial article. Put in place information from further review of the ErgoBTC Twitter posts.

Show changes

Azoundria at 16:28, 14 April 2023

2023-04-14T16:28:08Z

Show changes