LocalBitcoin Forum Login Breach - Revision history

Azoundria at 18:58, 1 May 2023

2023-05-01T18:58:17Z

← Older revision		Revision as of 12:58, 1 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/localbitcoinsbreach.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/localbitcoinsbreach.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Localbitcoins.jpg\|thumb\|LocalBitcoins]]These criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one customer was reimbursed.		[[File:Localbitcoins.jpg\|thumb\|LocalBitcoins]]These criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one customer was reimbursed.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="ethereumworldnews-2" /><ref name="kylegibson-86" /><ref name="cointelegraph-130" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160" />
	<ref name="ethereumworldnews-2" /><ref name="kylegibson-86" /><ref name="cointelegraph-130" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160" />

	== About LocalBitcoins ==		== About LocalBitcoins ==
Line 71:		Line 70:
	!Description		!Description
	\|-		\|-
	\|January 26th, 2019 ~~3:00:00 AM~~		\|January 26th, 2019
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 79:		Line 78:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 98:		Line 100:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Coming soon.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	~~Coming soon.~~

	== References ==		== References ==
	<references><ref name="ethereumworldnews-2">[https://ethereumworldnews.com/crypto-hacker-scores-28600-after-hack-of-bitcoin-exchange/ Crypto Hacker Scores $28,600 After Hack Of Bitcoin Exchange - Ethereum World News] (~~Jan 31~~, 2020)</ref>		<references><ref name="ethereumworldnews-2">[https://ethereumworldnews.com/crypto-hacker-scores-28600-after-hack-of-bitcoin-exchange/ Crypto Hacker Scores $28,600 After Hack Of Bitcoin Exchange - Ethereum World News] (Feb 1, 2020)</ref>

	<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>		<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>

	<ref name="cointelegraph-130">[https://cointelegraph.com/news/most-significant-hacks-of-2019-new-record-of-twelve-in-one-year Most Significant Hacks of 2019 — New Record of Twelve in One Year] (Feb 22, 2020)</ref>		<ref name="cointelegraph-130">[https://cointelegraph.com/news/most-significant-hacks-of-2019-new-record-of-twelve-in-one-year Most Significant Hacks of 2019 — New Record of Twelve in One Year] (Feb 23, 2020)</ref>

	<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>		<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>

	<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref></references>		<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref></references>

Azoundria at 07:53, 17 February 2023

2023-02-17T07:53:28Z

← Older revision		Revision as of 01:53, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/localbitcoinsbreach.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/localbitcoinsbreach.php}}
			{{Unattributed Citations}}

	[[File:Localbitcoins.jpg\|thumb\|LocalBitcoins]]These criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one customer was reimbursed.		[[File:Localbitcoins.jpg\|thumb\|LocalBitcoins]]These criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one customer was reimbursed.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="ethereumworldnews-2" /><ref name="kylegibson-86" /><ref name="cointelegraph-130" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160" />

	== About LocalBitcoins ==		== About LocalBitcoins ==
Line 49:		Line 51:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 71:		Line 72:
	\|-		\|-
	\|January 26th, 2019 3:00:00 AM		\|January 26th, 2019 3:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 84:		Line 81:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount at risk has been estimated at $29,000 USD. The total amount lost has been estimated at $29,000+ USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 95:		Line 92:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 106:		Line 103:

	== References ==		== References ==
	[https://ethereumworldnews.com/crypto-hacker-scores-28600-after-hack-of-bitcoin-exchange/ Crypto Hacker Scores $28,600 After Hack Of Bitcoin Exchange - Ethereum World News] (Jan 31)		<references><ref name="ethereumworldnews-2">[https://ethereumworldnews.com/crypto-hacker-scores-28600-after-hack-of-bitcoin-exchange/ Crypto Hacker Scores $28,600 After Hack Of Bitcoin Exchange - Ethereum World News] (Jan 31, 2020)</ref>

	[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 24)		<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>

	[https://cointelegraph.com/news/most-significant-hacks-of-2019-new-record-of-twelve-in-one-year Most Significant Hacks of 2019 — New Record of Twelve in One Year] (Feb 22)		<ref name="cointelegraph-130">[https://cointelegraph.com/news/most-significant-hacks-of-2019-new-record-of-twelve-in-one-year Most Significant Hacks of 2019 — New Record of Twelve in One Year] (Feb 22, 2020)</ref>

	[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)		<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>

	[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25)		<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/localbitcoinsbreach.php}} LocalBitcoinsThese criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one c..."

2023-01-24T21:44:32Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/localbitcoinsbreach.php}} thumb|LocalBitcoinsThese criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one c..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/localbitcoinsbreach.php}}

[[File:Localbitcoins.jpg|thumb|LocalBitcoins]]These criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one customer was reimbursed.

This is a global/international case not involving a specific country.

== About LocalBitcoins ==
"Buy and Sell Bitcoin Everywhere Near you or around the globe. Trade bitcoins person-to-person in an easy, fast, and secure way."

"At LocalBitcoins, people from different countries can exchange their local currency into bitcoins. We allow users to create advertisements where they can choose the payment method and exchange rate for buying and selling bitcoins from and to other LocalBitcoins’ users. By replying to these advertisements, a trade chat is opened and escrow protection is automatically activated. Escrow protects both buyer and seller by keeping the bitcoins safe until the payment is done and the seller releases bitcoins to the buyer. LocalBitcoins also provides a web wallet from where you can send and receive Bitcoin transactions."

"On LocalBitcoins, you are dealing with humans. Unlike stock-like exchanges and centralized Bitcoin trading websites, LocalBitcoins allows you to trade directly with another person. This makes the process customizable, lean and fast, as there is no corporate overhead. You can get your bitcoins instantly. LocalBitcoins aims to support every suitable payment method its user community supports. For every trade, LocalBitcoins offers escrow protection to ensure the bitcoins and both traders are safe."

"The crypto market may have slowed, with Bitcoin (BTC) falling by upwards of 70% during yesteryear, but ambitious attackers have continued their attempts to breach industry upstarts. Most recently, rumors arose that LocalBitcoins, a popular peer-to-peer, non-conventional exchange, had fallen victim to a security breach."

"The popular peer-to-peer cryptocurrency exchange LocalBitcoins has seemingly been compromised, as users are reporting its forums were redirecting them to a login page that then sent their details to a hacker. An address being shared already has nearly 8 BTC – around $28,600 – in it."

"We would like to inform that today 26.01.2019 at approximately 10:00:00 UTC, LocalBitcoins has detected a security vulnerability - an unauthorised source was able to access and send transactions from a number of affected accounts. Outgoing transactions were temporarily disabled while we investigated the case."

"Moreover, users should always confirm they’re using the wallet vendor’s proprietary software and double check what they’re using does indeed come from the vendor. Phishing scams are unfortunately nothing new in the cryptocurrency space, as these attacks even took $28,600 from users of the peer-to-peer exhcnage LocalBitcoins last year."

"@LocalBitcoins has apparently been compromised. Users are claiming its forums were redirecting them to a login page that was a phishing website. An address shared on social media already has $28,000 worth of #BTC in it after tricking 5 victims. Forums are now diabled."

"From my understanding 2fa did not prevent the exploit as it occurred when a user clicked onto the forum page well the site was under attack which then redirected the user to a phishing page, which was not used to get their logins but to phish their 2fa code which was likely passed onto a script, which was executed within the 3rd party forum software that emptied the users wallet on their browser.This explains why there was no need to bypass the third factor browser authentication nor any IP logs of different IPs on the effected users account."

"As soon as they enter their credentials, the thread claims, these are sent to the hacker who then empties their accounts. An address being shared on social media already has $28,600 worth of BTC in it, after tricking 5 victims." "On the thread, various users have claimed to have lost funds, including one who says 11 BTC were taken from his address. If so, this could mean the hacker is siphoning funds to other addresses."

"[W]hen [I] first tried to logon with my 2fa code there was an error then when i tried again, my wallet was wiped clean. So these hackers move fast. They might be using an automated system to harvest and possibly enter usernames/emails and password combos and 2fa codes." "[T]hey got 1 2fa code which is good for ~15seconds to login, and then another 2fa code is required for withdrawal." "They show you an error page and ask you to login again, which gives them the second 2fa code."

"@LocalBitcoins claims the attack came due to a problem"related to a feature powered by a third party software." It has reportedly stopped the attack, and says its platform is now safe to use."

"We were able to identify the problem, which was related to a feature powered by a third party software, and stop the attack. At the moment, we are determining the correct number of users affected - so far six cases have been confirmed. For security reasons, the forum feature has been disabled until further notice."

"Outgoing transactions have already been re-enabled and we have taken a number of measures to address this issue and secure the limited number of accounts that might have been at risk."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - LocalBitcoin Forum Login Breach
!Date
!Event
!Description
|-
|January 26th, 2019 3:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Coming soon.

== References ==
[https://ethereumworldnews.com/crypto-hacker-scores-28600-after-hack-of-bitcoin-exchange/ Crypto Hacker Scores $28,600 After Hack Of Bitcoin Exchange - Ethereum World News] (Jan 31)

[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 24)

[https://cointelegraph.com/news/most-significant-hacks-of-2019-new-record-of-twelve-in-one-year Most Significant Hacks of 2019 — New Record of Twelve in One Year] (Feb 22)

[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)

[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25)