Flexcoin Hot Wallet Hack - Revision history

Azoundria: Prevention

2024-03-04T18:27:44Z

Prevention

← Older revision		Revision as of 12:27, 4 March 2024
Line 126:		Line 126:

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
			Making multiple transfers quickly is a common platform vulnerability, which should have been tested against. The Flexcoin platform could also have significantly reduced the amount which could be taken by storing most funds offline and protecting them with a multi-signature wallet.

	{{Prevention:Platforms:Regular Audit Procedures}}		{{Prevention:Platforms:Regular Audit Procedures}}

Azoundria: Another 30 minutes completed. Rewrote most sections of the wiki article. Added in additional blockchain information. Technical analysis improved. Added information and references from Twitter.

2024-03-04T17:54:30Z

Another 30 minutes completed. Rewrote most sections of the wiki article. Added in additional blockchain information. Technical analysis improved. Added information and references from Twitter.

Show changes

Azoundria: Another 30 minutes completed. About section spread around. Integrating information from different sources. Got to the blockchain information section. Prevention finished.

2024-03-01T23:58:07Z

Another 30 minutes completed. About section spread around. Integrating information from different sources. Got to the blockchain information section. Prevention finished.

Show changes

Azoundria at 18:35, 28 February 2024

2024-02-28T18:35:00Z

← Older revision		Revision as of 12:35, 28 February 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}{{Unattributed Sources}}		{{Case Study Under Construction}}{{Unattributed Sources}}[[File:Flexcoin.jpg\|thumb\|Flexcoin Logo/Homepage]]Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.

	Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.

	This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.<ref name="kylegibson-86" /><ref name="bitcointalklist-87" /><ref name="businessinsider-190" /><ref name="theguardian-191" /><ref name="hackingdistributed-193" /><ref name="reuters-194" /><ref name="bitcoinexchangeguide-218" />		This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.<ref name="kylegibson-86" /><ref name="bitcointalklist-87" /><ref name="businessinsider-190" /><ref name="theguardian-191" /><ref name="hackingdistributed-193" /><ref name="reuters-194" /><ref name="bitcoinexchangeguide-218" />

Azoundria: Another 30 minutes complete. About section spread around. Added information from CoinDesk article and CoinFlex homepage.

2024-02-28T18:33:37Z

Another 30 minutes complete. About section spread around. Added information from CoinDesk article and CoinFlex homepage.

Show changes

Azoundria at 23:56, 12 April 2023

2023-04-12T23:56:16Z

← Older revision		Revision as of 17:56, 12 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/flexcoinhotwallethack.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/flexcoinhotwallethack.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.		Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.

	This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.		This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.<ref name="kylegibson-86" /><ref name="bitcointalklist-87" /><ref name="coindesk-189" /><ref name="businessinsider-190" /><ref name="theguardian-191" /><ref name="hackingdistributed-193" /><ref name="reuters-194" /><ref name="bitcoinexchangeguide-218" />
	<ref name="kylegibson-86" /><ref name="bitcointalklist-87" /><ref name="coindesk-189" /><ref name="businessinsider-190" /><ref name="theguardian-191" /><ref name="hackingdistributed-193" /><ref name="reuters-194" /><ref name="bitcoinexchangeguide-218" />

	== About Flexcoin ==		== About Flexcoin ==
Line 45:		Line 44:
	!Description		!Description
	\|-		\|-
	\|March 1st, 2014 12:00:29 AM		\|March 1st, 2014 12:00:29 AM MST
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 72:		Line 71:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Coming soon.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	~~Coming soon.~~		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
Line 81:		Line 93:
	<ref name="bitcointalklist-87">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref>		<ref name="bitcointalklist-87">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref>

	<ref name="coindesk-189">[https://www.coindesk.com/bitcoin-bank-flexcoin-close-600000-bitcoin-theft Bitcoin Bank Flexcoin to Close After $600k Bitcoin Theft] (Feb 28, 2020)</ref>		<ref name="coindesk-189">[https://www.coindesk.com/bitcoin-bank-flexcoin-close-600000-bitcoin-theft Bitcoin Bank Flexcoin to Close After $600k Bitcoin Theft] (Feb 29, 2020)</ref>

	<ref name="businessinsider-190">[https://www.businessinsider.com/flexcoin-2014-3 Flexcoin - Business Insider] (~~Feb 29~~, 2020)</ref>		<ref name="businessinsider-190">[https://www.businessinsider.com/flexcoin-2014-3 Flexcoin - Business Insider] (Mar 1, 2020)</ref>

	<ref name="theguardian-191">[https://www.theguardian.com/technology/2014/mar/04/bitcoin-bank-flexcoin-closes-after-hack-attack Bitcoin bank Flexcoin closes after hack attack \| Bitcoin \| The Guardian] (~~Feb 29~~, 2020)</ref>		<ref name="theguardian-191">[https://www.theguardian.com/technology/2014/mar/04/bitcoin-bank-flexcoin-closes-after-hack-attack Bitcoin bank Flexcoin closes after hack attack \| Bitcoin \| The Guardian] (Mar 1, 2020)</ref>

	<ref name="hackingdistributed-193">[https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ NoSQL Meets Bitcoin and Brings Down Two Exchanges: The Story of Flexcoin and Poloniex] (~~Feb 29~~, 2020)</ref>		<ref name="hackingdistributed-193">[https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ NoSQL Meets Bitcoin and Brings Down Two Exchanges: The Story of Flexcoin and Poloniex] (Mar 1, 2020)</ref>

	<ref name="reuters-194">[https://www.reuters.com/article/us-bitcoin-flexcoin/bitcoin-bank-flexcoin-shuts-down-after-theft-idUSBREA2329B20140304 Bitcoin bank Flexcoin shuts down after theft - Reuters] (~~Feb 29~~, 2020)</ref>		<ref name="reuters-194">[https://www.reuters.com/article/us-bitcoin-flexcoin/bitcoin-bank-flexcoin-shuts-down-after-theft-idUSBREA2329B20140304 Bitcoin bank Flexcoin shuts down after theft - Reuters] (Mar 1, 2020)</ref>

	<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref></references>		<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref></references>

Azoundria at 00:48, 16 February 2023

2023-02-16T00:48:39Z

← Older revision		Revision as of 18:48, 15 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/flexcoinhotwallethack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/flexcoinhotwallethack.php}}
			{{Unattributed Citations}}

	Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.		Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.

	This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.		This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.
			<ref name="kylegibson-86" /><ref name="bitcointalklist-87" /><ref name="coindesk-189" /><ref name="businessinsider-190" /><ref name="theguardian-191" /><ref name="hackingdistributed-193" /><ref name="reuters-194" /><ref name="bitcoinexchangeguide-218" />

	== About Flexcoin ==		== About Flexcoin ==
Line 23:		Line 25:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 45:		Line 46:
	\|-		\|-
	\|March 1st, 2014 12:00:29 AM		\|March 1st, 2014 12:00:29 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 58:		Line 55:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $600,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 69:		Line 66:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 80:		Line 77:

	== References ==		== References ==
	[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 24)		<references><ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>

	[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 14)		<ref name="bitcointalklist-87">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref>

	[https://www.coindesk.com/bitcoin-bank-flexcoin-close-600000-bitcoin-theft Bitcoin Bank Flexcoin to Close After $600k Bitcoin Theft] (Feb 28)		<ref name="coindesk-189">[https://www.coindesk.com/bitcoin-bank-flexcoin-close-600000-bitcoin-theft Bitcoin Bank Flexcoin to Close After $600k Bitcoin Theft] (Feb 28, 2020)</ref>

	[https://www.businessinsider.com/flexcoin-2014-3 Flexcoin - Business Insider] (Feb 29)		<ref name="businessinsider-190">[https://www.businessinsider.com/flexcoin-2014-3 Flexcoin - Business Insider] (Feb 29, 2020)</ref>

	[https://www.theguardian.com/technology/2014/mar/04/bitcoin-bank-flexcoin-closes-after-hack-attack Bitcoin bank Flexcoin closes after hack attack \| Bitcoin \| The Guardian] (Feb 29)		<ref name="theguardian-191">[https://www.theguardian.com/technology/2014/mar/04/bitcoin-bank-flexcoin-closes-after-hack-attack Bitcoin bank Flexcoin closes after hack attack \| Bitcoin \| The Guardian] (Feb 29, 2020)</ref>

	[https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ NoSQL Meets Bitcoin and Brings Down Two Exchanges: The Story of Flexcoin and Poloniex] (Feb 29)		<ref name="hackingdistributed-193">[https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ NoSQL Meets Bitcoin and Brings Down Two Exchanges: The Story of Flexcoin and Poloniex] (Feb 29, 2020)</ref>

	[https://www.reuters.com/article/us-bitcoin-flexcoin/bitcoin-bank-flexcoin-shuts-down-after-theft-idUSBREA2329B20140304 Bitcoin bank Flexcoin shuts down after theft - Reuters] (Feb 29)		<ref name="reuters-194">[https://www.reuters.com/article/us-bitcoin-flexcoin/bitcoin-bank-flexcoin-shuts-down-after-theft-idUSBREA2329B20140304 Bitcoin bank Flexcoin shuts down after theft - Reuters] (Feb 29, 2020)</ref>

	[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)		<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/flexcoinhotwallethack.php}} Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assis..."

2023-01-22T18:25:16Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/flexcoinhotwallethack.php}} Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assis..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/flexcoinhotwallethack.php}}

Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. While hackers of course got into the hot wallets, all customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.

This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.

== About Flexcoin ==
“Alberta-based bitcoin storage specialist” “Flexcoin aimed to differentiate itself from other electronic wallet providers by incentivizing users for keeping their bitcoin balances on the site.” 6 days after bragging that “We hold zero coins in other companies, exchanges etc. While the MtGox closure is unfortunate, we at Flexcoin have not lost anything.” "Flexcoin has announced that it will shut down following an attack and subsequent robbery that saw cybercriminals abscond with 896 BTC (roughly $600,000 at press time) stored in the company’s hot wallets." “The attacker successfully exploited a flaw in the code which allows transfers between flexcoin users. By sending thousands of simultaneous requests, the attacker was able to "move" coins from one user account to another until the sending account was overdrawn, before balances were updated.” “The site was itself broken from the ground up. The hackers simply got it to do what it was programmed to do, a lot faster than normal.” “As Flexcoin does not have the resources, assets or otherwise to come back from this loss, we are closing our doors immediately.” “Flexcoin also provided the wallet addresses of the alleged hackers. The largest wallet of which received 592.1 BTC from the breach, while the smaller of the two held at one point 304 BTC supposedly taken from the website.” “As Flexcoin does not have the resources, assets, or otherwise to come back from this loss, we are closing our doors immediately.” “Flexcoin held some bitcoins in “cold storage”, keeping them on devices not connected to the internet. Those bitcoins are safe, but only users who explicitly requested their bitcoins be held in cold storage (and paid a 0.5% fee) benefit.” “Users who put their coins into cold storage will be contacted by Flexcoin and asked to verify their identity. Once identified, cold storage coins will be transferred out free of charge. Cold storage coins were held offline and not within reach of the attacker. All other users will be directed to Flexcoin's "Terms of service" located at "Flexcoin.com/118.html" a document which was agreed on, upon signing up with Flexcoin.”

This exchange or platform is based in Canada, or the incident targeted people primarily in Canada.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Flexcoin Hot Wallet Hack
!Date
!Event
!Description
|-
|March 1st, 2014 12:00:29 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Coming soon.

== References ==
[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 24)

[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 14)

[https://www.coindesk.com/bitcoin-bank-flexcoin-close-600000-bitcoin-theft Bitcoin Bank Flexcoin to Close After $600k Bitcoin Theft] (Feb 28)

[https://www.businessinsider.com/flexcoin-2014-3 Flexcoin - Business Insider] (Feb 29)

[https://www.theguardian.com/technology/2014/mar/04/bitcoin-bank-flexcoin-closes-after-hack-attack Bitcoin bank Flexcoin closes after hack attack | Bitcoin | The Guardian] (Feb 29)

[https://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ NoSQL Meets Bitcoin and Brings Down Two Exchanges: The Story of Flexcoin and Poloniex] (Feb 29)

[https://www.reuters.com/article/us-bitcoin-flexcoin/bitcoin-bank-flexcoin-shuts-down-after-theft-idUSBREA2329B20140304 Bitcoin bank Flexcoin shuts down after theft - Reuters] (Feb 29)

[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)