PayFair P2P Exchange Hacked - Revision history

Azoundria: Another 30 minutes complete. Additional sources merged in. New image for the case.

2023-11-29T18:12:14Z

Another 30 minutes complete. Additional sources merged in. New image for the case.

← Older revision		Revision as of 12:12, 29 November 2023
Line 1:		Line 1:
	{{~~Imported~~ Case Study ~~2\|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php~~}}		{{Case Study Under Construction}}
			[[File:Payfairp2p.jpg\|thumb\|Payfair P2P Exchange Homepage]]
	[[File:~~Pbs.twimg.com/profile_images/945093368647892992/QIQVnmG4~~.jpg\|thumb\|Payfair P2P Exchange]]Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.		Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.

	~~The country for this case study is not yet known~~.

	== About Payfair P2P Exchange ==		== About Payfair P2P Exchange ==
	~~“On October 2, PayFair—a~~ decentralized ~~escrow and P2P exchange—closed its website because one of its main cold wallets was emptied, leading many to speculate about a possible exit scam~~. ~~On September 29, Payfair disclosed on its Telegram channel that the private key to one of its cold wallets was compromised, which led to~~ a hack. Their team says it is still unsure of how the private key was compromised but is conducting an internal investigation into the matter. While user funds have since been transferred to backup wallets, part of the ETH that was stolen has not been recovered. Despite announcing that the platform ~~would only be down “until~~ the ~~end~~ of ~~the week,” the PayFair.io website still appears to be down and they have not updated their social media since July 29.”~~		PayFair describes itself as a "decentralized Escrow platform".<blockquote>PAYFAIR is a decentralized Escrow platform and p2p exchange which ensures the paramount security of all cryptocurrency transactions made between two parties.

	~~The country for this case study is not yet known~~.

	~~The background of the exchange platform~~, ~~service~~, ~~or individuals involved~~, ~~as it would have been seen or understood at the time of the events~~.		We provide low fees for all transactions in a safe, private and decentralized environment.</blockquote>Homepage:<ref>[https://web.archive.org/web/20180818083856/https://payfair.io/ PayFair Homepage Archive August 18th, 2018 2:38:56 AM MDT] (Nov 29, 2023)</ref><ref name=":0">[https://web.archive.org/web/20220825001014/payfair.io Payfair Homepage Archive August 24th, 2022 6:10:14 PM MDT] (Nov 29, 2023)</ref><ref>[https://payfair.io/ Payfair Homepage] (Nov 29, 2023)</ref>

	~~Include~~:		Reddit:<ref>https://beta.reddit.com/r/Payfair/ ()</ref><ref>https://www.reddit.com/r/Payfair/</ref><ref>https://twitter.com/payfairio</ref>

	* Known history of when and how the service was started.
	* What problems does the company or service claim to solve?
	* What marketing materials were used by the firm or business?
	* Audits performed, and excerpts that may have been included.
	* Business registration documents shown (~~fake or legitimate~~).
	* How were people recruited to participate?
	* Public warnings and announcements prior to the event.

	~~Don't Include~~:
	* Any wording which directly states or implies that the business is/~~was illegitimate, or that a vulnerability existed.~~
	* Anything that wasn't reasonably knowable at the time of the event.
	~~There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page~~.

	== The Reality ==		== The Reality ==
Line 36:		Line 19:

	== What Happened ==		== What Happened ==
	~~The specific events~~ of ~~the loss and how it came about~~. ~~What actually happened to cause the loss~~ and ~~some~~ of ~~the events~~ leading up to it.		“On September 29, Payfair disclosed on its Telegram channel that the private key to one of its cold wallets was compromised, which led to a hack. On October 2, PayFair—a decentralized escrow and P2P exchange—closed its website because one of its main cold wallets was emptied, leading many to speculate about a possible exit scam."
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - PayFair P2P Exchange Hacked		\|+Key Event Timeline - PayFair P2P Exchange Hacked
Line 43:		Line 26:
	!Description		!Description
	\|-		\|-
	\|~~October 1st~~, 2019 ~~12:01:29 AM MDT~~		\|September 29th, 2019
	\|~~Main Event~~		\|Wallet Breach Disclosed
	\|~~Expand this into a brief description of what happened~~ and ~~the impact. If multiple lines are necessary, add them here~~.		\|Payfair discloses on their Telegram channel that their main cold wallet had been breached and emptied.
	\|-		\|-
	\|		\|October 2nd, 2019
	\|		\|Website Reportedly Closed
	\|		\|The Payfair website is reportedly closed.
			\|-
			\|September 24th, 2021 4:16:35 AM MDT
			\|Purchase Guide Published
			\|Crypto Guides publishes a guide on "How And Where To Buy Payfair (PFR) – Step By Step Guide"<ref>[https://web.archive.org/web/20211105091149/https://cryptooguide.com/how-to-buy-payfair-pfr/ How And Where To Buy Payfair (PFR) – Step By Step Guide - Crypto Guides Archive November 5th, 2021 3:11:49 AM MDT] (Nov 29, 2023)</ref>.
			\|-
			\|August 24th, 2022 6:10:14 PM MDT
			\|Bitcoin Revolution Redirect
			\|The Payfair.io website presently redirects to the Bitcoin Revolution homepage<ref name=":0" />.
	\|}		\|}

	== Technical Details ==		== Technical Details ==
	This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?		This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

			"Their team says it is still unsure of how the private key was compromised but is conducting an internal investigation into the matter."

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost is unknown.		The total amount lost is unknown.

	~~How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?~~

	== Immediate Reactions ==		== Immediate Reactions ==
	How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?		How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

			“On September 29, Payfair disclosed on its Telegram channel that the private key to one of its cold wallets was compromised, which led to a hack. On October 2, PayFair—a decentralized escrow and P2P exchange—closed its website because one of its main cold wallets was emptied, leading many to speculate about a possible exit scam."

	== Ultimate Outcome ==		== Ultimate Outcome ==
	What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?		What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

			"Their team says it is still unsure of how the private key was compromised but is conducting an internal investigation into the matter. While user funds have since been transferred to backup wallets, part of the ETH that was stolen has not been recovered. Despite announcing that the platform would only be down “until the end of the week,” the PayFair.io website still appears to be down and they have not updated their social media since July 29.”

			<ref>https://www.reddit.com/r/Payfair/comments/tccbsg/payfair_update_12032022/</ref><ref>https://www.reddit.com/r/Payfair/comments/ea2fas/payfair_update_13122019/</ref>

			=== Redirect To Bitcoin Revolution ===
			The Payfair website appears to redirect to the "bitcoin revolution" homepage, a likely ponzi scheme.

	== Total Amount Recovered ==		== Total Amount Recovered ==

Azoundria at 23:57, 2 May 2023

2023-05-02T23:57:29Z

← Older revision		Revision as of 17:57, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php}}

	[[File:Pbs.twimg.com/profile_images/945093368647892992/QIQVnmG4.jpg\|thumb\|Payfair P2P Exchange]]Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.		[[File:Pbs.twimg.com/profile_images/945093368647892992/QIQVnmG4.jpg\|thumb\|Payfair P2P Exchange]]Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.

	The country for this case study is not yet known.		The country for this case study is not yet known.


	== About Payfair P2P Exchange ==		== About Payfair P2P Exchange ==
Line 44:		Line 43:
	!Description		!Description
	\|-		\|-
	\|October 1st, 2019 12:01:29 AM		\|October 1st, 2019 12:01:29 AM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 52:		Line 51:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 71:		Line 73:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Let this be a reminder that claiming to be "decentralized" doesn't always mean that there is no custody of any funds. The proper storage of funds offline in a multi-signature wallet with keys held by multiple reputable people has never been breached.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	Let this be a reminder that claiming to be "decentralized" doesn't always mean that there is no custody of any funds. The proper storage of funds offline in a multi-signature wallet with keys held by multiple reputable people has never been breached.

	== References ==		== References ==
	<references></references>		<references></references>

Azoundria at 06:01, 21 February 2023

2023-02-21T06:01:46Z

← Older revision		Revision as of 00:01, 21 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php}}

	Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.		[[File:Pbs.twimg.com/profile_images/945093368647892992/QIQVnmG4.jpg\|thumb\|Payfair P2P Exchange]]Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.

	The country for this case study is not yet known.		The country for this case study is not yet known.


	== About Payfair P2P Exchange ==		== About Payfair P2P Exchange ==
Line 23:		Line 24:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 45:		Line 45:
	\|-		\|-
	\|October 1st, 2019 12:01:29 AM		\|October 1st, 2019 12:01:29 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 69:		Line 65:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 80:		Line 76:

	== References ==		== References ==
			<references></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php}} Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims..."

2023-01-25T03:19:55Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php}} Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/payfairp2pexchangehacked.php}}

Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.

The country for this case study is not yet known.

== About Payfair P2P Exchange ==
“On October 2, PayFair—a decentralized escrow and P2P exchange—closed its website because one of its main cold wallets was emptied, leading many to speculate about a possible exit scam. On September 29, Payfair disclosed on its Telegram channel that the private key to one of its cold wallets was compromised, which led to a hack. Their team says it is still unsure of how the private key was compromised but is conducting an internal investigation into the matter. While user funds have since been transferred to backup wallets, part of the ETH that was stolen has not been recovered. Despite announcing that the platform would only be down “until the end of the week,” the PayFair.io website still appears to be down and they have not updated their social media since July 29.”

The country for this case study is not yet known.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - PayFair P2P Exchange Hacked
!Date
!Event
!Description
|-
|October 1st, 2019 12:01:29 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Let this be a reminder that claiming to be "decentralized" doesn't always mean that there is no custody of any funds. The proper storage of funds offline in a multi-signature wallet with keys held by multiple reputable people has never been breached.

== References ==