Coinapult Hot Wallet Hack - Revision history

Azoundria: Update to add prevention and remove templates.

2024-03-24T21:20:41Z

Update to add prevention and remove templates.

← Older revision		Revision as of 15:20, 24 March 2024
Line 14:		Line 14:

	== What Happened ==		== What Happened ==
	The ~~specific events of the loss~~ and ~~how it came about. What actually happened to cause the loss and some of the events leading up to it~~.		The Coinapult hot wallet was breached, and 150 BTC were taken.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Coinapult Hot Wallet Hack		\|+Key Event Timeline - Coinapult Hot Wallet Hack
Line 49:		Line 49:

	The total amount lost has been estimated at $43,000 USD.		The total amount lost has been estimated at $43,000 USD.

	~~How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?~~

	== Immediate Reactions ==		== Immediate Reactions ==
	~~How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?~~

	“Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service provider, and that no customer funds were affected.”		“Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service provider, and that no customer funds were affected.”

Line 60:		Line 56:

	== Ultimate Outcome ==		== Ultimate Outcome ==
	~~What was~~ the ~~end result? Was any investigation done? Were any individuals prosecuted? Was there~~ a ~~lawsuit? Was any tracing done?~~		Service at Coinapult reportedly deteriorated over the years before the platform ultimately stopped functioning. Reddit user ChrissMejia reports being a former employee of Coinapult and still having trouble getting their funds out of the exchange<ref name=":4" />. They reminisce about their positive experiences working at Coinapult in 2014 under CEO Ira Miller, praising the company, the team, and their software contributions<ref name=":4" />. However, they express disappointment with the company's subsequent changes, particularly after Ira's departure, leading them to move their coins to another platform<ref name=":4" />. They recount difficulties in accessing their account due to being locked out and facing challenges with account recovery<ref name=":4" />. Despite being a former employee, they feel ignored by Coinapult's support team, leading them to warn others to transfer their coins away from Coinapult promptly<ref name=":4" />. The update mentions the eventual return of their coins, albeit belatedly, expressing gratitude to Coinapult while highlighting the prolonged wait. Subsequent comments in the post echo similar experiences and concerns about Coinapult's decline in service quality<ref name=":4" />.

	== Total Amount Recovered ==		== Total Amount Recovered ==
	There do not appear to have been any funds recovered in this case.		There do not appear to have been any funds recovered in this case.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==
	~~What parts of this case are still remaining to be concluded?~~		It is unclear what investigation is underway.
	~~== General Prevention Policies ==~~
	~~Coming soon~~.
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:~~Placeholder~~}}		{{Prevention:Individuals:Avoid Third Party Custodians}}

			{{Prevention:Individuals:Store Funds Offline}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Implement Multi-Signature}}

			{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Platform Security Assessments}}

			{{Prevention:Regulators:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: Another 30 minutes. Integrated information from Reddit post and Bitcoin Wiki. Improved the wiki article summary and information on investment seed round. Started analysis of breach information as available in the Google Doc.

2024-03-12T21:56:11Z

Another 30 minutes. Integrated information from Reddit post and Bitcoin Wiki. Improved the wiki article summary and information on investment seed round. Started analysis of breach information as available in the Google Doc.

← Older revision		Revision as of 15:56, 12 March 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}[[File:Coinapult.jpg\|thumb\|Coinapult Logo/Homepage]]		{{Case Study Under Construction}}[[File:Coinapult.jpg\|thumb\|Coinapult Logo/Homepage]]

	~~This~~ appears to have not affected any customer deposits~~. In general~~, ~~hot wallets cannot be considered safe storage.~~		Coinapult was a Panama-based wallet service. In March 2015, the service was breached and 150 bitcoin were stolen. The breach appears to have not affected any customer deposits, although the service level reported with the platform has subsequently declined.

	~~This exchange or~~ platform ~~is based in Panama, or the incident targeted people primarily in Panama.~~

	~~https://www.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/~~

	~~https://bitcoinwiki~~.~~org/wiki/coinapult~~

	== About Coinapult ==		== About Coinapult ==
	Coinapult was a Panama-based wallet service with a goal of simplifying Bitcoin usage for individuals and businesses alike<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Through their website, they offered a range of services to enhance accessibility and usability in the cryptocurrency space, including sending Bitcoin by email and SMS<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. These features enable users to send Bitcoin to anyone, even those unfamiliar with the cryptocurrency, through email or simple text messages<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Additionally, Coinapult provided payment processing services for businesses, ensuring no fees, guaranteed pricing, and daily bank settlements<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Merchants could use Coinapult to accept Bitcoin payments quickly and easily, expanding their payment options without incurring additional fees<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.		Coinapult was a Panama-based wallet service with a goal of simplifying Bitcoin usage for individuals and businesses alike<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref><ref name=":3">[https://bitcoinwiki.org/wiki/coinapult Coinapult - Bitcoin Wiki] (Accessed Mar 12, 2024)</ref>. Through their website, they offered a range of services to enhance accessibility and usability in the cryptocurrency space, including sending Bitcoin by email and SMS<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref><ref name=":3">[https://bitcoinwiki.org/wiki/coinapult Coinapult - Bitcoin Wiki] (Accessed Mar 12, 2024)</ref>. These features enable users to send Bitcoin to anyone, even those unfamiliar with the cryptocurrency, through email or simple text messages<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Additionally, Coinapult provided payment processing services for businesses, ensuring no fees, guaranteed pricing, and daily bank settlements<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Merchants could use Coinapult to accept Bitcoin payments quickly and easily, expanding their payment options without incurring additional fees<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.

	Locks, a feature offered by Coinapult, enables users to easily receive, save, and spend Bitcoin while mitigating price volatility<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Users could receive, lock, unlock, and spend Bitcoin seamlessly, allowing for instant transactions worldwide. Locks provided a simple and fast way for both new and experienced users to engage with Bitcoin without needing to speculate on its price<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. It promised a convenient tool for introducing newcomers to Bitcoin and facilitating regular Bitcoin payments for more experienced users<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.<ref name=":1">[https://www.youtube.com/watch?v=AxriIkGaY60 Coinapult Locks - YouTube] (Accessed Feb 28, 2024)</ref>		Locks, a feature offered by Coinapult, enables users to easily receive, save, and spend Bitcoin while mitigating price volatility<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref><ref name=":3">[https://bitcoinwiki.org/wiki/coinapult Coinapult - Bitcoin Wiki] (Accessed Mar 12, 2024)</ref>. Users could receive, lock, unlock, and spend Bitcoin seamlessly, allowing for instant transactions worldwide. Locks provided a simple and fast way for both new and experienced users to engage with Bitcoin without needing to speculate on its price<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. It promised a convenient tool for introducing newcomers to Bitcoin and facilitating regular Bitcoin payments for more experienced users<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.<ref name=":1">[https://www.youtube.com/watch?v=AxriIkGaY60 Coinapult Locks - YouTube] (Accessed Feb 28, 2024)</ref>

	Coinapult offered a hassle-free service for businesses that were looking to integrate Bitcoin payments<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Businesses were promised the ability to provide more payment options and enhance their payment processing capabilities with no fees and user-friendly features<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Coinapult also provided developer resources for integrating Bitcoin services into applications, including ready-to-use API clients and shopping cart plugins<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.		Coinapult offered a hassle-free service for businesses that were looking to integrate Bitcoin payments<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Businesses were promised the ability to provide more payment options and enhance their payment processing capabilities with no fees and user-friendly features<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Coinapult also provided developer resources for integrating Bitcoin services into applications, including ready-to-use API clients and shopping cart plugins<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.

	== The Reality ==		== The Reality ==
	~~This sections is included if a case involved deception or information that~~ was ~~unknown at the time. Examples include:~~		The Coinapult platform was vulnerable.

	* When the service was actually started (if different than the "official story").
	* Who actually ran a service and their own personal history.
	* How the service was structured behind the scenes. (For example, there was no "trading bot".)
	* Details of what audits reported and how vulnerabilities were missed during auditing.

	== What Happened ==		== What Happened ==
Line 35:		Line 24:
	\|Locks Video Promotion		\|Locks Video Promotion
	\|A video is put on YouTube to announce the Coinapult locks program<ref name=":1" />.		\|A video is put on YouTube to announce the Coinapult locks program<ref name=":1" />.
			\|-
			\|September 30th, 2014
			\|Seed Investment Round
			\|A seed investment round is conducted, with investors including "Bitcoin Opportunity Corp, Roger Ver, FirstMark Capital, Erik Voorhees, and Ira Miller"<ref name=":3" />.
	\|-		\|-
	\|March 17th, 2015 11:55:00 AM MDT		\|March 17th, 2015 11:55:00 AM MDT
Line 43:		Line 36:
	\|Coinapult Website Notice Captured		\|Coinapult Website Notice Captured
	\|The first time that the Coinapult homepage is captured with a notice placed for users. Coinapult notifies users they are currently investigating a security breach of the hot wallet and advises customers to refrain from sending Bitcoin to existing Coinapult addresses immediately, including Lock Addresses<ref name=":2" />. Updates on the situation will be provided as they become available<ref name=":2" />. The company has contained the situation, ensuring the safety of all funds except for the 150 BTC withdrawn during the breach. Investigations are ongoing to determine the method of attack, and until the attack vector is identified and patched, Coinapult will not re-enable its services<ref name=":2" />. If the process extends beyond a few days, the company promises to issue manual refunds to affected customers<ref name=":2" />.		\|The first time that the Coinapult homepage is captured with a notice placed for users. Coinapult notifies users they are currently investigating a security breach of the hot wallet and advises customers to refrain from sending Bitcoin to existing Coinapult addresses immediately, including Lock Addresses<ref name=":2" />. Updates on the situation will be provided as they become available<ref name=":2" />. The company has contained the situation, ensuring the safety of all funds except for the 150 BTC withdrawn during the breach. Investigations are ongoing to determine the method of attack, and until the attack vector is identified and patched, Coinapult will not re-enable its services<ref name=":2" />. If the process extends beyond a few days, the company promises to issue manual refunds to affected customers<ref name=":2" />.
			\|-
			\|November 13th, 2017 5:58:22 PM MST
			\|Challenges Getting Out Funds
			\|Reddit user ChrissMejia reports being a former employee of Coinapult and still having trouble getting their funds out of the exchange<ref name=":4">[https://old.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/ ChrissMejia - Why I don't trust Coinapult? (From ex employee) - Reddit] (Accessed Mar 12, 2024)</ref>. They reminisce about their positive experiences working at Coinapult in 2014 under CEO Ira Miller, praising the company, the team, and their software contributions<ref name=":4">[https://old.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/ ChrissMejia - Why I don't trust Coinapult? (From ex employee) - Reddit] (Accessed Mar 12, 2024)</ref>. However, they express disappointment with the company's subsequent changes, particularly after Ira's departure, leading them to move their coins to another platform<ref name=":4">[https://old.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/ ChrissMejia - Why I don't trust Coinapult? (From ex employee) - Reddit] (Accessed Mar 12, 2024)</ref>. They recount difficulties in accessing their account due to being locked out and facing challenges with account recovery<ref name=":4">[https://old.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/ ChrissMejia - Why I don't trust Coinapult? (From ex employee) - Reddit] (Accessed Mar 12, 2024)</ref>. Despite being a former employee, they feel ignored by Coinapult's support team, leading them to warn others to transfer their coins away from Coinapult promptly<ref name=":4">[https://old.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/ ChrissMejia - Why I don't trust Coinapult? (From ex employee) - Reddit] (Accessed Mar 12, 2024)</ref>. The update mentions the eventual return of their coins, albeit belatedly, expressing gratitude to Coinapult while highlighting the prolonged wait. Subsequent comments in the post echo similar experiences and concerns about Coinapult's decline in service quality<ref name=":4">[https://old.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/ ChrissMejia - Why I don't trust Coinapult? (From ex employee) - Reddit] (Accessed Mar 12, 2024)</ref>.
	\|}		\|}

	== Technical Details ==		== Technical Details ==
	~~This section includes specific detailed technical~~ analysis of ~~any security breaches which happened~~. ~~What specific software vulnerabilities contributed~~ to the ~~problem and how were they exploited?~~		On March 17, 2015, an unauthorized withdrawal of 150 BTC occurred from Coinapult's hot wallet, with no subsequent spending recorded. The incident involved individuals from Coinapult's team with various levels of access to servers, including CEO Ira, IT Admin Zach, CTO GP, Developer Cindy, COO Justin, and Customer Service Robinson<ref name=":5">[https://web.archive.org/web/20170905192246/https://docs.google.com/document/d/1_xxKLUVvEcen6XI7DsUzLtv2_C8oQ8JzAwlsNOMnapg/pub March 17 2015 Incidence Report - Google Doc Archive September 5th, 2017 1:22:46 PM MDT] (Accessed Mar 12, 2024)</ref>. Investigations revealed suspicious activities on the finance server, including modifications to log files and unusual network behavior on Zach's laptop, potentially indicating a man-in-the-middle attack. Furthermore, an outage at the data center and plans to transition IT services may have been related to the incident's timing. Clues from the finance, API, and SaaS servers, alongside an objective timeline, provided insights into the attack's execution. Robinson's account corroborated the timeline, indicating early detection of anomalies. Next steps involved forensic analysis of hardware and data recovery efforts. Additionally, updates clarified unrelated issues, such as Zach's IP address discrepancy. Plans included requesting access logs and surveillance footage from the data center to gather more information about the outage<ref name=":5">[https://web.archive.org/web/20170905192246/https://docs.google.com/document/d/1_xxKLUVvEcen6XI7DsUzLtv2_C8oQ8JzAwlsNOMnapg/pub March 17 2015 Incidence Report - Google Doc Archive September 5th, 2017 1:22:46 PM MDT] (Accessed Mar 12, 2024)</ref>.

	== Total Amount Lost ==		== Total Amount Lost ==
Line 59:		Line 56:

	“Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service provider, and that no customer funds were affected.”		“Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service provider, and that no customer funds were affected.”

			Coinapult updated their homepage to provide high level information about the breach and reassure users that their funds were safe<ref name=":2" />.<blockquote>To summarize, Coinapult has the situation contained and all funds (minus the 150 BTC withdrawn last night) are safe. Investigations are ongoing to determine the method of attack. Until we are able to determine and patch the attack vector, we will not re-enable our services. If this takes more than a few days, we will refund customers manually.</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==

Azoundria: Another 30 minutes complete. Created a logo graphic. Populating in detailed about information on the service. Some on the notice which was placed on the website.

2024-02-28T22:25:36Z

Another 30 minutes complete. Created a logo graphic. Populating in detailed about information on the service. Some on the notice which was placed on the website.

← Older revision		Revision as of 16:25, 28 February 2024
Line 1:		Line 1:
	{{~~Imported~~ Case Study ~~2\|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php~~}}[[File:Coinapult.jpg\|thumb\|Coinapult Logo/Homepage]]		{{Case Study Under Construction}}[[File:Coinapult.jpg\|thumb\|Coinapult Logo/Homepage]]

	This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage.		This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage.
Line 10:		Line 10:

	== About Coinapult ==		== About Coinapult ==
	~~“Coinapult COO~~ and ~~CFO Justin Blincoe stressed that~~ the ~~hot wallet was used only for funds owned~~ by the ~~bitcoin wallet~~ and ~~service provider~~, and ~~that no customer funds were affected~~.”		Coinapult was a Panama-based wallet service with a goal of simplifying Bitcoin usage for individuals and businesses alike<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Through their website, they offered a range of services to enhance accessibility and usability in the cryptocurrency space, including sending Bitcoin by email and SMS<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. These features enable users to send Bitcoin to anyone, even those unfamiliar with the cryptocurrency, through email or simple text messages<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Additionally, Coinapult provided payment processing services for businesses, ensuring no fees, guaranteed pricing, and daily bank settlements<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Merchants could use Coinapult to accept Bitcoin payments quickly and easily, expanding their payment options without incurring additional fees<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.

	~~This exchange or platform is based in Panama~~, ~~or the incident targeted people primarily in Panama~~.		Locks, a feature offered by Coinapult, enables users to easily receive, save, and spend Bitcoin while mitigating price volatility<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Users could receive, lock, unlock, and spend Bitcoin seamlessly, allowing for instant transactions worldwide. Locks provided a simple and fast way for both new and experienced users to engage with Bitcoin without needing to speculate on its price<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. It promised a convenient tool for introducing newcomers to Bitcoin and facilitating regular Bitcoin payments for more experienced users<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.<ref name=":1">[https://www.youtube.com/watch?v=AxriIkGaY60 Coinapult Locks - YouTube] (Accessed Feb 28, 2024)</ref>

	~~The background of the exchange platform,~~ service, ~~or individuals involved~~, ~~as it would have been seen or understood at~~ the ~~time of the events~~.		Coinapult offered a hassle-free service for businesses that were looking to integrate Bitcoin payments<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Businesses were promised the ability to provide more payment options and enhance their payment processing capabilities with no fees and user-friendly features<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>. Coinapult also provided developer resources for integrating Bitcoin services into applications, including ready-to-use API clients and shopping cart plugins<ref name=":0">[https://web.archive.org/web/20150227230113/https://coinapult.com/ Coinapult Homepage Archive February 27th, 2015 4:01:13 PM MST] (Accessed Feb 28, 2024)</ref>.

	~~Include~~:

	* Known history of when and how the service was started.
	* What problems does the company or service claim to solve?
	* What marketing materials were used by the firm or business?
	* Audits performed, ~~and excerpts that may have been included.~~
	* Business registration documents shown (~~fake or legitimate~~).
	* How were people recruited to ~~participate?~~
	* Public warnings and ~~announcements prior to the event.~~

	~~Don't Include~~:
	* Any wording which directly states or implies that the business is/~~was illegitimate, or that a vulnerability existed~~.
	* Anything that wasn't reasonably knowable at the time of the event.
	~~There could be more than one section here~~. ~~If the same platform is involved with multiple incidents~~, ~~then it can be linked to a main article page~~.

	== The Reality ==		== The Reality ==
Line 47:		Line 32:
	!Description		!Description
	\|-		\|-
	\|~~March 1st~~, ~~2015 12~~:00:~~42 AM MST~~		\|July 18th, 2014 5:29:41 PM MDT
	\|~~Main Event~~		\|Locks Video Promotion
	\|~~Expand this into a brief description of what happened and~~ the ~~impact. If multiple lines are necessary, add them here~~.		\|A video is put on YouTube to announce the Coinapult locks program<ref name=":1" />.
	\|-		\|-
	\|		\|March 17th, 2015 11:55:00 AM MDT
	\|		\|Coinapult Under Maintenance
	\|		\|The Coinapult website is placed under maintenance, according to their homepage<ref name=":2">[https://web.archive.org/web/20150319090158/https://coinapult.com/ Coinapult Homepage Archive March 19th, 2015 3:01:58 AM MDT] (Accessed Feb 28, 2024)</ref>.
			\|-
			\|March 19th, 2015 3:01:58 AM MDT
			\|Coinapult Website Notice Captured
			\|The first time that the Coinapult homepage is captured with a notice placed for users. Coinapult notifies users they are currently investigating a security breach of the hot wallet and advises customers to refrain from sending Bitcoin to existing Coinapult addresses immediately, including Lock Addresses<ref name=":2" />. Updates on the situation will be provided as they become available<ref name=":2" />. The company has contained the situation, ensuring the safety of all funds except for the 150 BTC withdrawn during the breach. Investigations are ongoing to determine the method of attack, and until the attack vector is identified and patched, Coinapult will not re-enable its services<ref name=":2" />. If the process extends beyond a few days, the company promises to issue manual refunds to affected customers<ref name=":2" />.
	\|}		\|}

Line 60:		Line 49:

	== Total Amount Lost ==		== Total Amount Lost ==
			According to the homepage notice, the total loss is 150 bitcoin<ref name=":2" />.

	The total amount lost has been estimated at $43,000 USD.		The total amount lost has been estimated at $43,000 USD.

Line 66:		Line 57:
	== Immediate Reactions ==		== Immediate Reactions ==
	How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?		How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

			“Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service provider, and that no customer funds were affected.”

	== Ultimate Outcome ==		== Ultimate Outcome ==

Azoundria at 21:10, 28 February 2024

2024-02-28T21:10:31Z

← Older revision		Revision as of 15:10, 28 February 2024
Line 1:		Line 1:
	{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php}}[[File:Coinapult.jpg\|thumb\|Coinapult Logo/Homepage]]

	This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage.		This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage.

Azoundria at 21:09, 28 February 2024

2024-02-28T21:09:41Z

← Older revision		Revision as of 15:09, 28 February 2024
Line 4:		Line 4:

	This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.		This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.

			https://www.reddit.com/r/Bitcoin/comments/7crwcb/why_i_dont_trust_coinapult_from_ex_employee/

			https://bitcoinwiki.org/wiki/coinapult

	== About Coinapult ==		== About Coinapult ==

Azoundria at 23:57, 2 May 2023

2023-05-02T23:57:17Z

← Older revision		Revision as of 17:57, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php}}

	This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage.		This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage.

	This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.		This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.


	== About Coinapult ==		== About Coinapult ==
Line 44:		Line 43:
	!Description		!Description
	\|-		\|-
	\|March 1st, 2015 12:00:42 AM		\|March 1st, 2015 12:00:42 AM MST
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 52:		Line 51:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 71:		Line 73:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Coming soon.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	~~Coming soon.~~

	== References ==		== References ==
	<references></references>		<references></references>

Azoundria at 00:52, 16 February 2023

2023-02-16T00:52:01Z

← Older revision		Revision as of 18:52, 15 February 2023
Line 4:		Line 4:

	This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.		This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.


	== About Coinapult ==		== About Coinapult ==
Line 23:		Line 24:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 45:		Line 45:
	\|-		\|-
	\|March 1st, 2015 12:00:42 AM		\|March 1st, 2015 12:00:42 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 58:		Line 54:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $43,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 69:		Line 65:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 80:		Line 76:

	== References ==		== References ==
			<references></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php}} This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage. This exchange or platform is based in Panama, or the incident targeted people primarily in Panama. == About Coinapult == “Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service..."

2023-01-24T20:44:57Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php}} This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage. This exchange or platform is based in Panama, or the incident targeted people primarily in Panama. == About Coinapult == “Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/coinapulthotwallethack.php}}

This appears to have not affected any customer deposits. In general, hot wallets cannot be considered safe storage.

This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.

== About Coinapult ==
“Coinapult COO and CFO Justin Blincoe stressed that the hot wallet was used only for funds owned by the bitcoin wallet and service provider, and that no customer funds were affected.”

This exchange or platform is based in Panama, or the incident targeted people primarily in Panama.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Coinapult Hot Wallet Hack
!Date
!Event
!Description
|-
|March 1st, 2015 12:00:42 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Coming soon.

== References ==