ShapeShift Three Thefts - Revision history

Azoundria: 30 minutes. Preparing a draft promotion for Twitter. Reviewing significantly more media online to learn more about this case. Adding new sources to wiki.

2024-04-11T22:29:49Z

30 minutes. Preparing a draft promotion for Twitter. Reviewing significantly more media online to learn more about this case. Adding new sources to wiki.

← Older revision		Revision as of 16:29, 11 April 2024
Line 5:		Line 5:
	Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.		Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="crunchbase-2946" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref name=":5">[https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/ UPDATE for Monday, April 18th on the ShapeShift Hacking Incident - Reddit]</ref><ref name=":6">[https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday Shapeshift Rebuilds After Losing $230,000, Promised to Be Back Wednesday - CoinTelegraph]</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref><ref name=":1">[https://hackingdistributed.com/2016/04/25/shapeshift-hack-simply-incredible/ The ShapeShift Hack: Simply Incredible - Hacking Distributed] (Accessed Apr 2, 2024)</ref><ref name=":7">[https://old.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/ Cornell Professor Doubts ShapeShift Story - Reddit] (Accessed Apr 5, 2024)</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/]</ref><ref>[https://web.archive.org/web/20200607163632/https://www.coindesk.com/company/shapeshift/ ShapeShift Description - CoinDesk] (Accessed Apr 8, 2024)</ref><ref name=":8">[https://old.reddit.com/r/shapeshiftio/comments/4eolhy/update_on_last_weeks_hack_apr_13/ Update on Last Week's Hack - Apr 13 - Reddit] (Accessed Apr 8, 2024)</ref>		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="crunchbase-2946" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref name=":5">[https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/ UPDATE for Monday, April 18th on the ShapeShift Hacking Incident - Reddit]</ref><ref name=":6">[https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday Shapeshift Rebuilds After Losing $230,000, Promised to Be Back Wednesday - CoinTelegraph]</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref><ref name=":1">[https://hackingdistributed.com/2016/04/25/shapeshift-hack-simply-incredible/ The ShapeShift Hack: Simply Incredible - Hacking Distributed] (Accessed Apr 2, 2024)</ref><ref name=":7">[https://old.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/ Cornell Professor Doubts ShapeShift Story - Reddit] (Accessed Apr 5, 2024)</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/]</ref><ref>[https://web.archive.org/web/20200607163632/https://www.coindesk.com/company/shapeshift/ ShapeShift Description - CoinDesk] (Accessed Apr 8, 2024)</ref><ref name=":8">[https://old.reddit.com/r/shapeshiftio/comments/4eolhy/update_on_last_weeks_hack_apr_13/ Update on Last Week's Hack - Apr 13 - Reddit] (Accessed Apr 8, 2024)</ref><ref>https://www.linkedin.com/pulse/shapeshift-loses-230000-bitcoin-data-breach-blame-ilesh-dattani/</ref><ref>https://news.bitcoin.com/shapeshift-hack-funds-move/</ref><ref>https://www.ft.com/content/beeb2f8c-99ec-494b-aa76-a7be0bf9dae6</ref><ref>https://www.youtube.com/watch?v=LiYNafMs7f8</ref>

	== About ShapeShift ==		== About ShapeShift ==

Azoundria: 30 minutes. Further review of history with Russian hacker, and the implications of providing exchange services to his own thief.

2024-04-11T17:13:21Z

30 minutes. Further review of history with Russian hacker, and the implications of providing exchange services to his own thief.

← Older revision		Revision as of 11:13, 11 April 2024
Line 87:		Line 87:
	\|Reddit And Defense		\|Reddit And Defense
	\|The Hacking Distribute article is shared on Reddit<ref name=":7" />. In response to points raised by Emin Gün Sirer regarding the recent digital currency thefts at ShapeShift, Erik Voorhees addresses each issue individually<ref name=":7" />. He clarifies that the communication between ShapeShift and the hacker, known as Rovion, occurred after Rovion reached out to ShapeShift, not the other way around, resolving one of Sirer's concerns<ref name=":7" />. Voorhees acknowledges the oversight in recognizing the employee's incompetence earlier and agrees with Sirer's point on this matter<ref name=":7" />. However, he disputes some of Sirer's assertions, such as the insinuation that ShapeShift's response was motivated by race<ref name=":7" />. Voorhees defends the steps taken by ShapeShift in handling the situation and invites Sirer to engage directly if he wishes to discuss further<ref name=":7" />. Another user, itsreallyonlysmellz, criticizes ShapeShift's approach and urges them to acknowledge the shortcomings in their story<ref name=":7" />.		\|The Hacking Distribute article is shared on Reddit<ref name=":7" />. In response to points raised by Emin Gün Sirer regarding the recent digital currency thefts at ShapeShift, Erik Voorhees addresses each issue individually<ref name=":7" />. He clarifies that the communication between ShapeShift and the hacker, known as Rovion, occurred after Rovion reached out to ShapeShift, not the other way around, resolving one of Sirer's concerns<ref name=":7" />. Voorhees acknowledges the oversight in recognizing the employee's incompetence earlier and agrees with Sirer's point on this matter<ref name=":7" />. However, he disputes some of Sirer's assertions, such as the insinuation that ShapeShift's response was motivated by race<ref name=":7" />. Voorhees defends the steps taken by ShapeShift in handling the situation and invites Sirer to engage directly if he wishes to discuss further<ref name=":7" />. Another user, itsreallyonlysmellz, criticizes ShapeShift's approach and urges them to acknowledge the shortcomings in their story<ref name=":7" />.
			\|-
			\|April 25th, 2016 5:16:29 PM MDT
			\|Discussion Of Russian Hacker
			\|Erik Voorhees discusses his interactions with the Russian hacker<ref>[https://old.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/d2h7etc/ Erik Voorhees - "Maybe you don't know what "exchange" means? We traded, at market rate, ETH for BTC." - Reddit] (Apr 10, 2024)</ref>.
	\|-		\|-
	\|June 30th, 2016		\|June 30th, 2016

Azoundria at 21:32, 10 April 2024

2024-04-10T21:32:48Z

← Older revision		Revision as of 15:32, 10 April 2024
Line 5:		Line 5:
	Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.		Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="crunchbase-2946" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref name=":5">[https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/ UPDATE for Monday, April 18th on the ShapeShift Hacking Incident - Reddit]</ref><ref name=":6">[https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday Shapeshift Rebuilds After Losing $230,000, Promised to Be Back Wednesday - CoinTelegraph]</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref><ref name=":1">[https://hackingdistributed.com/2016/04/25/shapeshift-hack-simply-incredible/ The ShapeShift Hack: Simply Incredible - Hacking Distributed] (Accessed Apr 2, 2024)</ref><ref name=":7">[https://~~www~~.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/ Cornell Professor Doubts ShapeShift Story - Reddit] (Accessed Apr 5, 2024)</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/]</ref><ref>[https://web.archive.org/web/20200607163632/https://www.coindesk.com/company/shapeshift/ ShapeShift Description - CoinDesk] (Accessed Apr 8, 2024)</ref><ref name=":8">[https://old.reddit.com/r/shapeshiftio/comments/4eolhy/update_on_last_weeks_hack_apr_13/ Update on Last Week's Hack - Apr 13 - Reddit] (Accessed Apr 8, 2024)</ref>		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="crunchbase-2946" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref name=":5">[https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/ UPDATE for Monday, April 18th on the ShapeShift Hacking Incident - Reddit]</ref><ref name=":6">[https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday Shapeshift Rebuilds After Losing $230,000, Promised to Be Back Wednesday - CoinTelegraph]</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref><ref name=":1">[https://hackingdistributed.com/2016/04/25/shapeshift-hack-simply-incredible/ The ShapeShift Hack: Simply Incredible - Hacking Distributed] (Accessed Apr 2, 2024)</ref><ref name=":7">[https://old.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/ Cornell Professor Doubts ShapeShift Story - Reddit] (Accessed Apr 5, 2024)</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/]</ref><ref>[https://web.archive.org/web/20200607163632/https://www.coindesk.com/company/shapeshift/ ShapeShift Description - CoinDesk] (Accessed Apr 8, 2024)</ref><ref name=":8">[https://old.reddit.com/r/shapeshiftio/comments/4eolhy/update_on_last_weeks_hack_apr_13/ Update on Last Week's Hack - Apr 13 - Reddit] (Accessed Apr 8, 2024)</ref>

	== About ShapeShift ==		== About ShapeShift ==

Azoundria: 30 minutes. Integrated information on founding, Bitcoinist interview, and initial pseudonyms of team. Integration of two other CoinDesk articles on the company founding and path of growth. Review and expand the article further. Thinking about promotional post more.

2024-04-09T16:42:43Z

30 minutes. Integrated information on founding, Bitcoinist interview, and initial pseudonyms of team. Integration of two other CoinDesk articles on the company founding and path of growth. Review and expand the article further. Thinking about promotional post more.

Show changes

Azoundria: 30 minutes. Found the CoinDesk company description page. Added new information from Reddit update Apr 13th. Reviewed and made modifications to the descriptions on the wiki. Added in a complete prevention section.

2024-04-08T21:14:20Z

30 minutes. Found the CoinDesk company description page. Added new information from Reddit update Apr 13th. Reviewed and made modifications to the descriptions on the wiki. Added in a complete prevention section.

Show changes

Azoundria: 30 minutes. Review of the wiki article. Wikipedia information fully integrated. CoinDesk article integrated into timeline. Integrated more information from Hacking Ditributed article and Reddit response from Erik Voorhees. Added in article from Bitcoin.com from Erik Voorhees.

2024-04-05T21:27:03Z

30 minutes. Review of the wiki article. Wikipedia information fully integrated. CoinDesk article integrated into timeline. Integrated more information from Hacking Ditributed article and Reddit response from Erik Voorhees. Added in article from Bitcoin.com from Erik Voorhees.

← Older revision		Revision as of 15:27, 5 April 2024
Line 5:		Line 5:
	Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.		Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="crunchbase-2946~~" /><ref name="wikipedia-2944~~" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref name=":5">[https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/ UPDATE for Monday, April 18th on the ShapeShift Hacking Incident - Reddit]</ref><ref name=":6">[https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday Shapeshift Rebuilds After Losing $230,000, Promised to Be Back Wednesday - CoinTelegraph]</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref><ref name=":1">[https://hackingdistributed.com/2016/04/25/shapeshift-hack-simply-incredible/ The ShapeShift Hack: Simply Incredible - Hacking Distributed] (Accessed Apr 2, 2024)</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/ ~~https://old.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/~~]</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/]</ref>		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="crunchbase-2946" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref name=":5">[https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/ UPDATE for Monday, April 18th on the ShapeShift Hacking Incident - Reddit]</ref><ref name=":6">[https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday Shapeshift Rebuilds After Losing $230,000, Promised to Be Back Wednesday - CoinTelegraph]</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref><ref name=":1">[https://hackingdistributed.com/2016/04/25/shapeshift-hack-simply-incredible/ The ShapeShift Hack: Simply Incredible - Hacking Distributed] (Accessed Apr 2, 2024)</ref><ref name=":7">[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/ Cornell Professor Doubts ShapeShift Story - Reddit] (Accessed Apr 5, 2024)</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/]</ref>

	== About ShapeShift ==		== About ShapeShift ==
	ShapeShift was founded on July 1st, 2014<ref name="wikipedia-2944" />, and operated out of Denver, Colorado<ref name="crunchbase-2946" />.		ShapeShift was founded on July 1st, 2014<ref name="wikipedia-2944" />, and operated out of Denver, Colorado<ref name="crunchbase-2946" />.

			In March 2015, ShapeShift secured a seed-stage investment of US$525,000 from Roger Ver and Barry Silbert, followed by an additional funding round in September 2015, raising a total of US$1.6 million from investors such as Digital Currency Group, Bitfinex, Bitcoin Capital, and Mardal Investments<ref name="wikipedia-2944" />. The company launched its platform initially on iOS in June 2015, enabling users to exchange 25 digital currencies and value tokens<ref name="wikipedia-2944" />. However, on June 11, 2015, ShapeShift ceased its services in New York in response to the state's newly introduced regulatory framework for digital currency businesses known as the BitLicense<ref name="wikipedia-2944" />. The company cited concerns that complying with these regulations would jeopardize users' personal and private data<ref name="wikipedia-2944" />.


Line 54:		Line 56:
	\|Ledger Labs Contacted		\|Ledger Labs Contacted
	\|After the third consecutive theft, "On 2016-04-09 at 13:00 EDT, ShapeShift CEO Erik Voorhees contacted Ledger Labs Inc. (LLI) with a request for digital investigative assistance."<ref name=":0" />		\|After the third consecutive theft, "On 2016-04-09 at 13:00 EDT, ShapeShift CEO Erik Voorhees contacted Ledger Labs Inc. (LLI) with a request for digital investigative assistance."<ref name=":0" />
			\|-
			\|April 18th, 2016 10:25:00 AM MDT
			\|CoinDesk Article Published
			\|CoinDesk reports that ShapeShift experienced losses totaling $230,000 in three separate thefts over the span of a month, as revealed in an incident report obtained by CoinDesk<ref name="coindesk-3038" />. The report disclosed that an employee perpetrated the initial theft of $130,000 in mid-March and subsequently sold sensitive security information to an external hacker after being terminated<ref name="coindesk-3038" />. Further thefts amounting to $100,000 occurred in early April. ShapeShift took steps to enhance security measures following the attacks and partnered with Toronto-based consultancy Ledger Labs to develop new protocols<ref name="coindesk-3038" />. Despite the setbacks, ShapeShift assured users that no customer funds were lost or compromised and aimed to resume operations by April 20<ref name="coindesk-3038" />. Legal action has been initiated against the former employee, and efforts are underway to recover the stolen funds<ref name="coindesk-3038" />.
			\|-
			\|April 19th, 2016 12:15:42 AM MDT
			\|Bitcoin.com Article From Erik Voorhees
			\|In a harrowing account shared on Bitcoin.com, Erik Voorhees details the company's ordeal of being repeatedly hacked, shedding light on the betrayal of a trusted employee, Bob<ref name="newsdotbitcoin-3039" />. Initially experiencing theft of Bitcoin due to Bob's actions, the company faces further breaches despite implementing new infrastructure<ref name="newsdotbitcoin-3039" />. Through forensic investigation and communication with the hacker, Rovion, it becomes evident that Bob had sold sensitive information, including server access and source code, to the hacker<ref name="newsdotbitcoin-3039" />. Bob's betrayal not only led to significant financial losses but also raised questions about the security practices within the company<ref name="newsdotbitcoin-3039" />. The narrative underscores the importance of robust security measures and vigilance in the face of evolving cyber threats<ref name="newsdotbitcoin-3039" />.
	\|-		\|-
	\|April 19th, 2016 9:01:00 AM MDT		\|April 19th, 2016 9:01:00 AM MDT
Line 61:		Line 71:
	\|April 25th, 2016 6:48:00 AM MDT		\|April 25th, 2016 6:48:00 AM MDT
	\|Hacking Distributed Article		\|Hacking Distributed Article
	\|A Hacking Distributed article is published which is highly critical of the official story from Erik Voorhes<ref name=":1" />. ~~Several~~ "red flags" are highlighted in the story.		\|A Hacking Distributed article is published which is highly critical of the official story from Erik Voorhes<ref name=":1" />. However, several "red flags" are highlighted in the detailed account of the incidents. According to Voorhees, a sysadmin named Bob initiated the thefts by installing a backdoor on a colleague's computer, then emptied the Bitcoin hot wallet using his own credentials. Afterward, Bob sold the backdoor access to a hacker named Rovion, who subsequently raided ShapeShift's hot wallets in multiple currencies<ref name=":1" />. However, Emin Gün Sirer finds numerous inconsistencies in Voorhees's explanation, pointing out implausible scenarios such as Bob's willingness to use his real name in criminal activities and Rovion's unlikely moral stance against Bob<ref name=":1" />. Sirer raises flags regarding the believability of the story, questioning the motives and actions of the involved parties<ref name=":1" />. While acknowledging ShapeShift's security failures, Sirer emphasizes the importance of a thorough investigation to uncover the truth behind the hacks and prevent future incidents, expressing skepticism toward accepting the provided narrative solely based on the accounts of the involved hackers<ref name=":1" />.
			\|-
			\|April 25th, 2016 9:52:21 AM MDT
			\|Reddit And Defense
			\|The Hacking Distribute article is shared on Reddit<ref name=":7" />. In response to points raised by Emin Gün Sirer regarding the recent digital currency thefts at ShapeShift, Erik Voorhees addresses each issue individually<ref name=":7" />. He clarifies that the communication between ShapeShift and the hacker, known as Rovion, occurred after Rovion reached out to ShapeShift, not the other way around, resolving one of Sirer's concerns<ref name=":7" />. Voorhees acknowledges the oversight in recognizing the employee's incompetence earlier and agrees with Sirer's point on this matter<ref name=":7" />. However, he disputes some of Sirer's assertions, such as the insinuation that ShapeShift's response was motivated by race<ref name=":7" />. Voorhees defends the steps taken by ShapeShift in handling the situation and invites Sirer to engage directly if he wishes to discuss further<ref name=":7" />. Another user, itsreallyonlysmellz, criticizes ShapeShift's approach and urges them to acknowledge the shortcomings in their story<ref name=":7" />.
	\|-		\|-
	\|June 30th, 2016		\|June 30th, 2016
Line 132:		Line 146:
	\|		\|
	\|}		\|}



Line 153:		Line 168:
	!Attacks		!Attacks
	!Notes		!Notes
			\|-
			\|CoinDesk<ref name="coindesk-3038" />
			\|April 18th, 2016
			\|469
			\|5800
			\|1900
			\|$230k
			\|All Three
			\|Initial theft $130k, subsequent $100k.
	\|-		\|-
	\|CoinTelegraph<ref name=":6" />		\|CoinTelegraph<ref name=":6" />
Line 225:		Line 249:

	"Ledger Labs has worked with ShapeShift on new infrastructure for a vastly more secure platform going forward," Perklin told CoinDesk by email. "Even with internal sabotage from an employee, the company avoided any customer funds being lost."		"Ledger Labs has worked with ShapeShift on new infrastructure for a vastly more secure platform going forward," Perklin told CoinDesk by email. "Even with internal sabotage from an employee, the company avoided any customer funds being lost."

			=== Criticism From Cornell Professor ===
			A Cornell professor named Emin Gün Sirer announced numerous inconsistencies in Voorhees's explanation, pointing out implausible scenarios such as the hacker's willingness to use his real name in criminal activities and Rovion's unlikely moral stance against the hacker<ref name=":1" />. Sirer raises flags regarding the believability of the story, questioning the motives and actions of the involved parties<ref name=":1" />. While acknowledging ShapeShift's security failures, Sirer emphasizes the importance of a thorough investigation to uncover the truth behind the hacks and prevent future incidents, expressing skepticism toward accepting the provided narrative solely based on the accounts of the involved hackers<ref name=":1" />.

			In response to points raised by Emin Gün Sirer regarding the recent digital currency thefts at ShapeShift, Erik Voorhees addresses each issue individually in a response on Reddit<ref name=":7" />. He clarified that the communication between ShapeShift and the hacker, known as Rovion, occurred after Rovion reached out to ShapeShift, not the other way around, resolving one of Sirer's concerns<ref name=":7" />. Voorhees acknowledges the oversight in recognizing the employee's incompetence earlier and agrees with Sirer's point on this matter<ref name=":7" />. However, he disputes some of Sirer's assertions, such as the insinuation that ShapeShift's response was motivated by race<ref name=":7" />. Voorhees defends the steps taken by ShapeShift in handling the situation and invites Sirer to engage directly if he wishes to discuss further<ref name=":7" />. Another user, itsreallyonlysmellz, criticizes ShapeShift's approach and urges them to acknowledge the shortcomings in their story<ref name=":7" />.

	=== Exchange Brought Back Online ===		=== Exchange Brought Back Online ===

Azoundria: 30 minutes. Organizing information and sources. Improving and making tables for the loss amounts of each attack. Detailed review of CoinTelegraph article and Reddit thread.

2024-04-04T19:57:40Z

30 minutes. Organizing information and sources. Improving and making tables for the loss amounts of each attack. Detailed review of CoinTelegraph article and Reddit thread.

Show changes

Azoundria: 30 minutes. Reviewing and improving the wiki article. Integrated ChainSec source. Added more information on ShapeShift founding from CrunchBase. Reviewed and integrated some information on the SEC charges against ShapeShift.

2024-04-03T20:59:53Z

30 minutes. Reviewing and improving the wiki article. Integrated ChainSec source. Added more information on ShapeShift founding from CrunchBase. Reviewed and integrated some information on the SEC charges against ShapeShift.

Show changes

Azoundria: 30 minutes. Reviewed the official hacking story and criticisms from Hacking Distributed in further detail. Reviewing and integrate information from Hacking Distributed article and resulting Reddit discussions.

2024-04-02T18:22:59Z

30 minutes. Reviewed the official hacking story and criticisms from Hacking Distributed in further detail. Reviewing and integrate information from Hacking Distributed article and resulting Reddit discussions.

← Older revision		Revision as of 12:22, 2 April 2024
Line 5:		Line 5:
	Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.		Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.

	This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="cryptosec-442" /><ref name="coindesk-2945" /><ref name="crunchbase-2946" /><ref name="wikipedia-2944" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref>https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/</ref><ref>https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref>		This exchange or platform is based in United States, or the incident targeted people primarily in United States.<ref name="cryptosec-442" /><ref name="coindesk-2945" /><ref name="crunchbase-2946" /><ref name="wikipedia-2944" /><ref name="coindesk-3038" /><ref name="newsdotbitcoin-3039" /><ref name="blockchaindotcom-3040" /><ref>https://www.reddit.com/r/shapeshiftio/comments/4fcpui/update_for_monday_april_18th_on_the_shapeshift/</ref><ref>https://cointelegraph.com/news/shapeshift-rebuilds-after-losing-230000-promised-to-be-back-wednesday</ref><ref name=":0">[https://web.archive.org/web/20160429180007/https://zh.scribd.com/doc/309591980/ShapeShift-Postmortem ShapeShift Postmortem - Scribd Archive April 29th, 2016 12:00:07 PM MDT] (Accessed Apr 1, 2024)</ref><ref name=":1">[https://hackingdistributed.com/2016/04/25/shapeshift-hack-simply-incredible/ The ShapeShift Hack: Simply Incredible - Hacking Distributed] (Accessed Apr 2, 2024)</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/cornell_professor_doubts_shapeshift_story/]</ref><ref>[https://www.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/ https://old.reddit.com/r/Bitcoin/comments/4gdxe9/comment/d2gy4iz/]</ref>

	== About ShapeShift ==		== About ShapeShift ==
Line 29:		Line 29:

	== What Happened ==		== What Happened ==
	"In 2016, ShapeShift lost around $230,000 in three thefts over the course of four weeks in March and April, which it claimed were carried out by [this] company ~~employee~~."		"In 2016, ShapeShift lost around $230,000 in three thefts over the course of four weeks in March and April, which it claimed were carried out by [this] company eApril 25th, 2016 6:48:00 AM MDTApril 25th, 2016 6:48:00 AM MDTApril 25th, 2016 6:48:00 AM MDTApril 25th, 2016 6:48:00 AM MDTApril 25th, 2016 6:48:00 AM MDTApril 25th, 2016 6:48:00 AM MDTmployee."
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - ShapeShift Three Thefts		\|+Key Event Timeline - ShapeShift Three Thefts
Line 47:		Line 47:
	\|Ledger Labs Contacted		\|Ledger Labs Contacted
	\|"On 2016-04-09 at 13:00 EDT, ShapeShift CEO Erik Voorhees contacted Ledger Labs Inc. (LLI) with a request for digital investigative assistance."<ref name=":0" />		\|"On 2016-04-09 at 13:00 EDT, ShapeShift CEO Erik Voorhees contacted Ledger Labs Inc. (LLI) with a request for digital investigative assistance."<ref name=":0" />
			\|-
			\|April 25th, 2016 6:48:00 AM MDT
			\|Hacking Distributed Article
			\|A Hacking Distributed article is published which is highly critical of the official story from Erik Voorhes<ref name=":1" />.
	\|-		\|-
	\|July 9th, 2016 5:05:00 AM MDT		\|July 9th, 2016 5:05:00 AM MDT
Line 118:		Line 122:
	=== Blockchain Movement Of Funds ===		=== Blockchain Movement Of Funds ===
	The stolen funds remained stationary and unspent for multiple months following the theft<ref name="cointelegraph-3042" />.<blockquote>"On June 30th, the stolen funds were moved to two separate addresses, one in a $205,666 chunk and the other in a $654 chunk. Each one of these addresses shows only two transactions: the receipt of the funds, and the subsequent transmission of those funds to two separate addresses. This continues on seemingly endlessly, as each new transaction is separated into two and sent to two new, empty addresses so as to cover the thief’s tracks."</blockquote>		The stolen funds remained stationary and unspent for multiple months following the theft<ref name="cointelegraph-3042" />.<blockquote>"On June 30th, the stolen funds were moved to two separate addresses, one in a $205,666 chunk and the other in a $654 chunk. Each one of these addresses shows only two transactions: the receipt of the funds, and the subsequent transmission of those funds to two separate addresses. This continues on seemingly endlessly, as each new transaction is separated into two and sent to two new, empty addresses so as to cover the thief’s tracks."</blockquote>

			=== Inclusion In Lists ===
			The incident was included in a list compiled by ChainSec<ref name="cryptosec-442" />.

	=== Deletion Of Postmortem Document ===		=== Deletion Of Postmortem Document ===

Azoundria: 30 minutes. Relocated information from the about section to various other sections. Improved description. Integrated more information about blockchain movement of funds from CoinTelegraph. Started analysis of the postmortem document.

2024-04-01T19:29:46Z

30 minutes. Relocated information from the about section to various other sections. Improved description. Integrated more information about blockchain movement of funds from CoinTelegraph. Started analysis of the postmortem document.

Show changes