NiceHash Exchange Hack - Revision history

Azoundria at 16:32, 14 April 2023

2023-04-14T16:32:12Z

← Older revision		Revision as of 10:32, 14 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/nicehashexchangehack.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/nicehashexchangehack.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attack. Although details are limited, it would appear likely that the CEO erroneously installed malware on a company PC and this enabled an exploit of what were effectively hot wallets on the website. The company has since paid back 82% and more through a repayment program, however having an extreme amount of funds outside of a proper cold storage raises many questions.		NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attack. Although details are limited, it would appear likely that the CEO erroneously installed malware on a company PC and this enabled an exploit of what were effectively hot wallets on the website. The company has since paid back 82% and more through a repayment program, however having an extreme amount of funds outside of a proper cold storage raises many questions.

	This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.		This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.<ref name="kylegibson-86" /><ref name="theverge-144" /><ref name="theverge-145" /><ref name="wikipedia-146" /><ref name="tools4crypto-147" /><ref name="fastnethost-148" /><ref name="cryptopotato-161" /><ref name="fintechnews-164" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160" />
	<ref name="kylegibson-86" /><ref name="theverge-144" /><ref name="theverge-145" /><ref name="wikipedia-146" /><ref name="tools4crypto-147" /><ref name="fastnethost-148" /><ref name="cryptopotato-161" /><ref name="fintechnews-164" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160" />

	== About NiceHash ==		== About NiceHash ==
Line 45:		Line 44:
	!Description		!Description
	\|-		\|-
	\|December 1st, 2017 12:00:54 AM		\|December 1st, 2017 12:00:54 AM MST
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 72:		Line 71:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Coming soon.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	~~Coming soon.~~		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	<references><ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>		<references><ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>

	<ref name="theverge-144">[https://www.theverge.com/2017/12/31/16835638/nicehash-marko-kobal-bitcoin-hack-ceo-replacement-cybersecurity Crypto-mining site NiceHash has a new CEO following hack - The Verge] (Feb 23, 2020)</ref>		<ref name="theverge-144">[https://www.theverge.com/2017/12/31/16835638/nicehash-marko-kobal-bitcoin-hack-ceo-replacement-cybersecurity Crypto-mining site NiceHash has a new CEO following hack - The Verge] (Feb 24, 2020)</ref>

	<ref name="theverge-145">[https://www.theverge.com/2017/12/7/16748472/nicehash-cryptocurrency-mining-bitcoin-ethereum-hacking-security-breach Founders of hacked crypto-mining site apologize over Facebook livestream - The Verge] (Feb 23, 2020)</ref>		<ref name="theverge-145">[https://www.theverge.com/2017/12/7/16748472/nicehash-cryptocurrency-mining-bitcoin-ethereum-hacking-security-breach Founders of hacked crypto-mining site apologize over Facebook livestream - The Verge] (Feb 24, 2020)</ref>

	<ref name="wikipedia-146">[https://en.wikipedia.org/wiki/NiceHash NiceHash - Wikipedia] (Feb 23, 2020)</ref>		<ref name="wikipedia-146">[https://en.wikipedia.org/wiki/NiceHash NiceHash - Wikipedia] (Feb 24, 2020)</ref>

	<ref name="tools4crypto-147">[http://www.tools4crypto.com/mining/nicehash/ NiceHash Tools4Crypto] (Feb 23, 2020)</ref>		<ref name="tools4crypto-147">[http://www.tools4crypto.com/mining/nicehash/ NiceHash Tools4Crypto] (Feb 24, 2020)</ref>

	<ref name="fastnethost-148">[https://www.fastnethost.com/blog/bitcoins-worth-80-million-stolen-from-nicehash/ Bitcoins worth $80 million stolen from NiceHash – FastnetHost.com] (Feb 23, 2020)</ref>		<ref name="fastnethost-148">[https://www.fastnethost.com/blog/bitcoins-worth-80-million-stolen-from-nicehash/ Bitcoins worth $80 million stolen from NiceHash – FastnetHost.com] (Feb 24, 2020)</ref>

	<ref name="cryptopotato-161">[https://cryptopotato.com/lessons-learned-from-the-biggest-crypto-hacks-in-history/ Lessons Learned from the Biggest Crypto Hacks in History] (Feb 25, 2020)</ref>		<ref name="cryptopotato-161">[https://cryptopotato.com/lessons-learned-from-the-biggest-crypto-hacks-in-history/ Lessons Learned from the Biggest Crypto Hacks in History] (Feb 26, 2020)</ref>

	<ref name="fintechnews-164">[https://fintechnews.sg/23594/blockchain/cryptocurrency-hack-binance/ A Look Back on Some of the Most Devastating Crypto Hacks \| Fintech Singapore] (Feb 26, 2020)</ref>		<ref name="fintechnews-164">[https://fintechnews.sg/23594/blockchain/cryptocurrency-hack-binance/ A Look Back on Some of the Most Devastating Crypto Hacks \| Fintech Singapore] (Feb 27, 2020)</ref>

	<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>		<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>

	<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref></references>		<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref></references>

Azoundria at 05:10, 17 February 2023

2023-02-17T05:10:42Z

← Older revision		Revision as of 23:10, 16 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/nicehashexchangehack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/nicehashexchangehack.php}}
			{{Unattributed Citations}}

	NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attack. Although details are limited, it would appear likely that the CEO erroneously installed malware on a company PC and this enabled an exploit of what were effectively hot wallets on the website. The company has since paid back 82% and more through a repayment program, however having an extreme amount of funds outside of a proper cold storage raises many questions.		NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attack. Although details are limited, it would appear likely that the CEO erroneously installed malware on a company PC and this enabled an exploit of what were effectively hot wallets on the website. The company has since paid back 82% and more through a repayment program, however having an extreme amount of funds outside of a proper cold storage raises many questions.

	This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.		This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.
			<ref name="kylegibson-86" /><ref name="theverge-144" /><ref name="theverge-145" /><ref name="wikipedia-146" /><ref name="tools4crypto-147" /><ref name="fastnethost-148" /><ref name="cryptopotato-161" /><ref name="fintechnews-164" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160" />

	== About NiceHash ==		== About NiceHash ==
Line 23:		Line 25:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 45:		Line 46:
	\|-		\|-
	\|December 1st, 2017 12:00:54 AM		\|December 1st, 2017 12:00:54 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 58:		Line 55:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $64,000,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 69:		Line 66:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 80:		Line 77:

	== References ==		== References ==
	[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 24)		<references><ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>

	[https://www.theverge.com/2017/12/31/16835638/nicehash-marko-kobal-bitcoin-hack-ceo-replacement-cybersecurity Crypto-mining site NiceHash has a new CEO following hack - The Verge] (Feb 23)		<ref name="theverge-144">[https://www.theverge.com/2017/12/31/16835638/nicehash-marko-kobal-bitcoin-hack-ceo-replacement-cybersecurity Crypto-mining site NiceHash has a new CEO following hack - The Verge] (Feb 23, 2020)</ref>

	[https://www.theverge.com/2017/12/7/16748472/nicehash-cryptocurrency-mining-bitcoin-ethereum-hacking-security-breach Founders of hacked crypto-mining site apologize over Facebook livestream - The Verge] (Feb 23)		<ref name="theverge-145">[https://www.theverge.com/2017/12/7/16748472/nicehash-cryptocurrency-mining-bitcoin-ethereum-hacking-security-breach Founders of hacked crypto-mining site apologize over Facebook livestream - The Verge] (Feb 23, 2020)</ref>

	[https://en.wikipedia.org/wiki/NiceHash NiceHash - Wikipedia] (Feb 23)		<ref name="wikipedia-146">[https://en.wikipedia.org/wiki/NiceHash NiceHash - Wikipedia] (Feb 23, 2020)</ref>

	[http://www.tools4crypto.com/mining/nicehash/ NiceHash Tools4Crypto] (Feb 23)		<ref name="tools4crypto-147">[http://www.tools4crypto.com/mining/nicehash/ NiceHash Tools4Crypto] (Feb 23, 2020)</ref>

	[https://www.fastnethost.com/blog/bitcoins-worth-80-million-stolen-from-nicehash/ Bitcoins worth $80 million stolen from NiceHash – FastnetHost.com] (Feb 23)		<ref name="fastnethost-148">[https://www.fastnethost.com/blog/bitcoins-worth-80-million-stolen-from-nicehash/ Bitcoins worth $80 million stolen from NiceHash – FastnetHost.com] (Feb 23, 2020)</ref>

	[https://cryptopotato.com/lessons-learned-from-the-biggest-crypto-hacks-in-history/ Lessons Learned from the Biggest Crypto Hacks in History] (Feb 25)		<ref name="cryptopotato-161">[https://cryptopotato.com/lessons-learned-from-the-biggest-crypto-hacks-in-history/ Lessons Learned from the Biggest Crypto Hacks in History] (Feb 25, 2020)</ref>

	[https://fintechnews.sg/23594/blockchain/cryptocurrency-hack-binance/ A Look Back on Some of the Most Devastating Crypto Hacks \| Fintech Singapore] (Feb 26)		<ref name="fintechnews-164">[https://fintechnews.sg/23594/blockchain/cryptocurrency-hack-binance/ A Look Back on Some of the Most Devastating Crypto Hacks \| Fintech Singapore] (Feb 26, 2020)</ref>

	[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)		<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>

	[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25)		<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nicehashexchangehack.php}} NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attac..."

2023-01-24T21:03:27Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nicehashexchangehack.php}} NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attac..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/nicehashexchangehack.php}}

NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attack. Although details are limited, it would appear likely that the CEO erroneously installed malware on a company PC and this enabled an exploit of what were effectively hot wallets on the website. The company has since paid back 82% and more through a repayment program, however having an extreme amount of funds outside of a proper cold storage raises many questions.

This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.

== About NiceHash ==
“Hackers stole $64 million from NiceHash, a company that lets users apply their extra GPUs to mining cryptocurrencies.” "Users report that funds have been moved from their own internal Nicehash Bitcoin addresses to a single Bitcoin address controlled by an unknown party." “Kobal said that about 4,700 bitcoins were stolen on December 6th and that a hacker or a group of hackers with an IP address outside of Europe accessed NiceHash computers. Through that access, the hacker(s) obtained a NiceHash engineer’s credentials and used them to access the payment system.” “A hacker or group of hackers had been in a position to infiltrate our inner programs by a compromised firm pc,” stated Marko Kobal, CEO of NiceHash, on Fb reside. “We’re nonetheless conducting a forensic evaluation on how the affected pc was really compromised.” “Now, the company’s co-founder, Marko Kobal, has stepped down as CEO.” “In the aftermath the company decided to return the stolen funds through the Repayment program. 82% of the old funds was already reimbursed by January 2020. Their headquarters are based in Ljubljana, Slovenia.”

This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - NiceHash Exchange Hack
!Date
!Event
!Description
|-
|December 1st, 2017 12:00:54 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Coming soon.

== References ==
[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 24)

[https://www.theverge.com/2017/12/31/16835638/nicehash-marko-kobal-bitcoin-hack-ceo-replacement-cybersecurity Crypto-mining site NiceHash has a new CEO following hack - The Verge] (Feb 23)

[https://www.theverge.com/2017/12/7/16748472/nicehash-cryptocurrency-mining-bitcoin-ethereum-hacking-security-breach Founders of hacked crypto-mining site apologize over Facebook livestream - The Verge] (Feb 23)

[https://en.wikipedia.org/wiki/NiceHash NiceHash - Wikipedia] (Feb 23)

[http://www.tools4crypto.com/mining/nicehash/ NiceHash Tools4Crypto] (Feb 23)

[https://www.fastnethost.com/blog/bitcoins-worth-80-million-stolen-from-nicehash/ Bitcoins worth $80 million stolen from NiceHash – FastnetHost.com] (Feb 23)

[https://cryptopotato.com/lessons-learned-from-the-biggest-crypto-hacks-in-history/ Lessons Learned from the Biggest Crypto Hacks in History] (Feb 25)

[https://fintechnews.sg/23594/blockchain/cryptocurrency-hack-binance/ A Look Back on Some of the Most Devastating Crypto Hacks | Fintech Singapore] (Feb 26)

[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)

[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 25)