Vircurex Second Exchange Hack - Revision history

Azoundria: 30 minutes. Adding a promotion to Twitter.

2024-05-01T21:11:55Z

30 minutes. Adding a promotion to Twitter.

← Older revision		Revision as of 15:11, 1 May 2024
Line 151:		Line 151:
	"Initially, Vircurex operated normally despite the loss, though it no longer paid dividends to shareholders."		"Initially, Vircurex operated normally despite the loss, though it no longer paid dividends to shareholders."

			=== Initial Reports On The Incident ===

	Vircurex's initial report on the incident explained that the funds could be recovered from operating profits<ref name="vircurexarchive-12744" />.<blockquote>The loss of the funds will be recovered out of the monthly dividends. Dividends will be used to purchase back the missing funds in the coming months. Depending on the trading volume development this is expected to take 9 to 12 months.</blockquote>"In March 2014, due to strain caused by large withdrawals (in addition to a default by AurumXChange, a fiat processor Vircurex used), Vircurex froze large quantities of many currencies; however, it promises to pay these back eventually."		Vircurex's initial report on the incident explained that the funds could be recovered from operating profits<ref name="vircurexarchive-12744" />.<blockquote>The loss of the funds will be recovered out of the monthly dividends. Dividends will be used to purchase back the missing funds in the coming months. Depending on the trading volume development this is expected to take 9 to 12 months.</blockquote>"In March 2014, due to strain caused by large withdrawals (in addition to a default by AurumXChange, a fiat processor Vircurex used), Vircurex froze large quantities of many currencies; however, it promises to pay these back eventually."

Azoundria: 30 minutes. Review blockchain and integrate information on the litecoin theft transaction into the total lost. Update the database with the amount lost and date of incident. Added information on the lawsuit against Vircurex and the fact they were based in Germany but claimed to be based in Beijing. Added information about the case class certification request and ultimately being dismissed in Colorado.

2024-04-18T21:25:03Z

30 minutes. Review blockchain and integrate information on the litecoin theft transaction into the total lost. Update the database with the amount lost and date of incident. Added information on the lawsuit against Vircurex and the fact they were based in Germany but claimed to be based in Beijing. Added information about the case class certification request and ultimately being dismissed in Colorado.

← Older revision		Revision as of 15:25, 18 April 2024
Line 2:		Line 2:

	== About Vircurex ==		== About Vircurex ==
	Vircurex was a Beijing-based virtual currency exchange<ref name="coindesk-179">[https://web.archive.org/web/20210919020219/https://www.coindesk.com/markets/2014/03/24/exchange-vircurex-freezes-withdrawals-claims-lack-of-reserves/ Exchange Vircurex Freezes Withdrawals, Claims Lack of Reserves - CoinDesk - Archive September 18th, 2021 8:02:19 PM MDT] (Feb 29, 2020)</ref> ~~which~~ was operational since October 2011<ref name="coindesk-179" /><ref name=":5">[https://www.financemagnates.com/cryptocurrency/news/vircurex-faces-class-action-lawsuit/ Vircurex Faces Class-Action Lawsuit - Finance Magnates] (Jan 4, 2024)</ref>.		Vircurex was widely believed to be a Beijing-based virtual currency exchange<ref name="coindesk-179">[https://web.archive.org/web/20210919020219/https://www.coindesk.com/markets/2014/03/24/exchange-vircurex-freezes-withdrawals-claims-lack-of-reserves/ Exchange Vircurex Freezes Withdrawals, Claims Lack of Reserves - CoinDesk - Archive September 18th, 2021 8:02:19 PM MDT] (Feb 29, 2020)</ref><ref name=":8">[https://www.coindesk.com/markets/2018/01/12/former-customers-sue-crypto-exchange-vircurex-over-frozen-funds/ Former Customers Sue Crypto Exchange Vircurex Over Frozen Funds - CoinDesk] (Accessed Apr 18, 2024)</ref>, however they were actually based in Germany<ref name=":8" />. The exchange was operational since October 2011<ref name="coindesk-179" /><ref name=":5">[https://www.financemagnates.com/cryptocurrency/news/vircurex-faces-class-action-lawsuit/ Vircurex Faces Class-Action Lawsuit - Finance Magnates] (Jan 4, 2024)</ref>.

	~~Vircurex was based in Germany(?).~~ The exchange supported trading in different cryptocurrencies including bitcoin, namecoin, devcoin, litecoin, ixcoin, ppcoin, terracoin<ref name=":0">[https://web.archive.org/web/20130424071356/https://vircurex.com/ Vircurex Exchange Homepage Archive April 24th, 2013 1:13:56 AM MDT] (Dec 11, 2023)</ref>, and up to 12 other cryptocurrencies<ref name="coindesk-179" />. The Vircurex platform offered deposits and withdrawals in both USD and EUR<ref name="coindesk-179" /><ref name=":0">[https://web.archive.org/web/20130424071356/https://vircurex.com/ Vircurex Exchange Homepage Archive April 24th, 2013 1:13:56 AM MDT] (Dec 11, 2023)</ref>.		The exchange supported trading in different cryptocurrencies including bitcoin, namecoin, devcoin, litecoin, ixcoin, ppcoin, terracoin<ref name=":0">[https://web.archive.org/web/20130424071356/https://vircurex.com/ Vircurex Exchange Homepage Archive April 24th, 2013 1:13:56 AM MDT] (Dec 11, 2023)</ref>, and up to 12 other cryptocurrencies<ref name="coindesk-179" />. The Vircurex platform offered deposits and withdrawals in both USD and EUR<ref name="coindesk-179" /><ref name=":0">[https://web.archive.org/web/20130424071356/https://vircurex.com/ Vircurex Exchange Homepage Archive April 24th, 2013 1:13:56 AM MDT] (Dec 11, 2023)</ref>.

	Vircurex gained popularity by offering interest to users holding multiple cryptocurrencies<ref name=":5" />.		Vircurex gained popularity by offering interest to users holding multiple cryptocurrencies<ref name=":5" />.
Line 10:		Line 10:
	The homepage of the website featured pricing tables for all supported coins<ref name=":0" />. They eliminated some less popular coins as time progressed<ref name="coindesk-179" />.<blockquote>Vircurex, the exchange platform for buying, selling and trading your Bitcoins and its various alt-chains. We currently support Bitcoin, Namecoin, Devcoin, Litecoin, Ixcoin, PPCoin, Terracoin</blockquote>Homepage: vircurex.com<ref name=":0" />		The homepage of the website featured pricing tables for all supported coins<ref name=":0" />. They eliminated some less popular coins as time progressed<ref name="coindesk-179" />.<blockquote>Vircurex, the exchange platform for buying, selling and trading your Bitcoins and its various alt-chains. We currently support Bitcoin, Namecoin, Devcoin, Litecoin, Ixcoin, PPCoin, Terracoin</blockquote>Homepage: vircurex.com<ref name=":0" />
	== The Reality ==		== The Reality ==
	The [[Vircurex Exchange Hack\|Vircurex exchange had already been hacked once]].		The [[Vircurex Exchange Hack\|Vircurex exchange had already been hacked once]]. The exchange had also lied about where they were based.

	== What Happened ==		== What Happened ==
Line 31:		Line 31:
	\|First Bitcoin Transaction		\|First Bitcoin Transaction
	\|The first bitcoin blockchain transaction sends 706.01021412 BTC from the Bitcoinica hot wallets<ref name=":6">[https://www.blockchain.com/explorer/transactions/btc/cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf Theft Transaction For 706.01021412 BTC - Blockchain.com] (Accessed Apr 17, 2024)</ref>.		\|The first bitcoin blockchain transaction sends 706.01021412 BTC from the Bitcoinica hot wallets<ref name=":6">[https://www.blockchain.com/explorer/transactions/btc/cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf Theft Transaction For 706.01021412 BTC - Blockchain.com] (Accessed Apr 17, 2024)</ref>.
			\|-
			\|May 10th, 2013 7:53:49 AM MDT
			\|Litecoin Theft Transaction
			\|The only litecoin blockchain transaction sends 23,400 LTC from one of the Bitcoinica wallets to the hacker<ref name=":9">[https://blockchair.com/litecoin/transaction/30231aee25900b9cb1fba16f1a8923a0cd866d60b01e542be1a4b26f92d9d10f Theft Transaction Of 23,400 LTC - Blockchair.com] (Accessed Apr 18, 2024)</ref>.
	\|-		\|-
	\|May 10th, 2013 8:40:25 AM MDT		\|May 10th, 2013 8:40:25 AM MDT
Line 55:		Line 59:
	\|Included In BitcoinTalk List		\|Included In BitcoinTalk List
	\|A subsequent Vircurex exchange hack is featured in the BitcoinTalk "List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses" published by user dree12<ref name="bitcointalk-87" />.		\|A subsequent Vircurex exchange hack is featured in the BitcoinTalk "List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses" published by user dree12<ref name="bitcointalk-87" />.
			\|-
			\|January 12th, 2018 11:00:00 AM MST
			\|Lawsuit Against Vircurex Operators
			\|CoinDesk reports that former customers of the cryptocurrency exchange Vircurex are suing the platform four years after it froze their funds and allegedly failed to repay them<ref name=":8" />. Filed in the U.S. District Court in Colorado, the lawsuit accuses Vircurex of breach of contract, conversion of funds, fraud, and unjust enrichment<ref name=":8" />. It details how only a few account holders received their funds after the exchange froze withdrawals due to claimed lack of reserves, leaving $50 million in frozen accounts<ref name=":8" />. Despite allowing fund deposits over the past four years and still operating, Vircurex allegedly has not fully refunded its customers<ref name=":8" />. The lawsuit also accuses Vircurex of making deceptive statements and false promises to delay customer lawsuits, including falsely claiming incorporation in Belize and potential headquarters in Beijing when it's actually based in Germany<ref name=":8" />. The lawsuit names Vircurex's operators, Andreas Eckert and an unidentified individual, as defendants<ref name=":8" />. Requests for comment from the plaintiff's lawyers and Vircurex were not immediately answered<ref name=":8" />.
			\|-
			\|July 19th, 2018 1:46:00 PM MDT
			\|Requested Class Certification
			\|A request is filed with the Colorado court for class certification to turn the lawsuit into a class action claim<ref>[https://www.law360.com/articles/1064785 Virtual Coin Owners Seek Cert. Against Currency Exchange - Law360] (Accessed Apr 18, 2024)</ref>.
			\|-
			\|February 21st, 2019 4:36:00 PM MST
			\|Lawsuit Dismissed Based On Jurisdiction
			\|The lawsuit was ultimately dismissed by the judge on the basis that the Vircurex exchange had limited ties to the state of Colorado, where it was filed<ref name=":10">[https://www.law360.com/articles/1131610 Virtual Coin Owners' Suit Against Currency Exchange Tossed - Law360] (Accessed Apr 18, 2024)</ref>.
	\|}		\|}

Line 99:		Line 115:
	\|33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64		\|33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64
	\|-		\|-
	\|LTC		\|LTC<ref name=":9" />
	\|23,400		\|23,400
	\|LV8VnCDYJzd3FYNwn6n3Kyi1i7PB2MvXPo		\|LV8VnCDYJzd3FYNwn6n3Kyi1i7PB2MvXPo
Line 122:		Line 138:
	\|-		\|-
	\|Litecoin (LTC)		\|Litecoin (LTC)
	\|		\|23400.00000000
	\|		\|$3.4433<ref>[https://coinmarketcap.com/currencies/litecoin/historical-data/ Litecoin Historic Price Data - CoinMarketCap] (Accessed Apr 18, 2024)</ref>
	\|		\|$80,573.22
	\|-		\|-
	\| colspan="3" \|Total All Coins		\| colspan="3" \|Total All Coins
	\|$~~170~~,~~411~~.42		\|$341,134.89
	\|}		\|}
	The total amount lost has been estimated at $~~170~~,000 USD.		The total amount lost has been estimated at $341,000 USD.

	== Immediate Reactions ==		== Immediate Reactions ==

			"Initially, Vircurex operated normally despite the loss, though it no longer paid dividends to shareholders."


	~~"Initially, Vircurex operated normally despite the loss, though it no longer paid dividends to shareholders."~~

	Vircurex's initial report on the incident explained that the funds could be recovered from operating profits<ref name="vircurexarchive-12744" />.<blockquote>The loss of the funds will be recovered out of the monthly dividends. Dividends will be used to purchase back the missing funds in the coming months. Depending on the trading volume development this is expected to take 9 to 12 months.</blockquote>"In March 2014, due to strain caused by large withdrawals (in addition to a default by AurumXChange, a fiat processor Vircurex used), Vircurex froze large quantities of many currencies; however, it promises to pay these back eventually."		Vircurex's initial report on the incident explained that the funds could be recovered from operating profits<ref name="vircurexarchive-12744" />.<blockquote>The loss of the funds will be recovered out of the monthly dividends. Dividends will be used to purchase back the missing funds in the coming months. Depending on the trading volume development this is expected to take 9 to 12 months.</blockquote>"In March 2014, due to strain caused by large withdrawals (in addition to a default by AurumXChange, a fiat processor Vircurex used), Vircurex froze large quantities of many currencies; however, it promises to pay these back eventually."
Line 147:		Line 163:
	Due to recent large fund withdrawals depleting their cold wallet balance, Vircurex announced on their homepage the immediate suspension of BTC, LTC, FTC, and TRC withdrawals and deposits<ref name=":1" />. Two previous incidents led to significant losses, which were covered by the exchange's income<ref name=":1" />. However, recent withdrawals exhausted their cold wallet balance, prompting the introduction of "Frozen Funds." These funds will gradually be repaid to users from the exchange's profits. Distribution logic entails allocating 50% of available funds from largest to smallest accounts and the remaining 50% from smallest to largest accounts<ref name=":1" />. This approach aims to ensure all users eventually receive their funds without penalizing new deposits or users<ref name=":1" />.		Due to recent large fund withdrawals depleting their cold wallet balance, Vircurex announced on their homepage the immediate suspension of BTC, LTC, FTC, and TRC withdrawals and deposits<ref name=":1" />. Two previous incidents led to significant losses, which were covered by the exchange's income<ref name=":1" />. However, recent withdrawals exhausted their cold wallet balance, prompting the introduction of "Frozen Funds." These funds will gradually be repaid to users from the exchange's profits. Distribution logic entails allocating 50% of available funds from largest to smallest accounts and the remaining 50% from smallest to largest accounts<ref name=":1" />. This approach aims to ensure all users eventually receive their funds without penalizing new deposits or users<ref name=":1" />.

			=== Lawsuit In Colorado State ===
			With an anonymous exchange operator, once the hacks occurred, neither hack was revealed until far later. The exchange had also lied about where they were based<ref name=":8" />.

			A lawsuit was filed against the operators of the Vircurex exchange in the state of Colorado<ref name=":8" />, however this was dismissed as the exchange operators have limited ties to Colorado<ref name=":10" />.
	=== Inclusion In Lists ===		=== Inclusion In Lists ===
	The breach was ultimately included in a list published by user dree12 on Bitcoin Talk<ref name="bitcointalk-87" />.		The breach was ultimately included in a list published by user dree12 on Bitcoin Talk<ref name="bitcointalk-87" />.
Line 161:		Line 181:

	== Ongoing Developments ==		== Ongoing Developments ==
	~~What parts~~ of ~~this case are still remaining to be concluded?~~		There may be future legal action taken against the operators of the Vircurex exchange<ref name=":8" />, given that the initial suite in the state of Colorado was dismissed<ref name=":10" />.

	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:Avoid Third Party Custodians}}		{{Prevention:Individuals:Avoid Third Party Custodians}}

Azoundria: 30 minutes. Updated and rewrote about section for improved readability. Integrated significant extra information from the bitcoin and terracoin blockchain transactions and historic market pricing.

2024-04-17T17:10:51Z

30 minutes. Updated and rewrote about section for improved readability. Integrated significant extra information from the bitcoin and terracoin blockchain transactions and historic market pricing.

← Older revision		Revision as of 11:10, 17 April 2024
Line 4:		Line 4:
	Vircurex was a Beijing-based virtual currency exchange<ref name="coindesk-179">[https://web.archive.org/web/20210919020219/https://www.coindesk.com/markets/2014/03/24/exchange-vircurex-freezes-withdrawals-claims-lack-of-reserves/ Exchange Vircurex Freezes Withdrawals, Claims Lack of Reserves - CoinDesk - Archive September 18th, 2021 8:02:19 PM MDT] (Feb 29, 2020)</ref> which was operational since October 2011<ref name="coindesk-179" /><ref name=":5">[https://www.financemagnates.com/cryptocurrency/news/vircurex-faces-class-action-lawsuit/ Vircurex Faces Class-Action Lawsuit - Finance Magnates] (Jan 4, 2024)</ref>.		Vircurex was a Beijing-based virtual currency exchange<ref name="coindesk-179">[https://web.archive.org/web/20210919020219/https://www.coindesk.com/markets/2014/03/24/exchange-vircurex-freezes-withdrawals-claims-lack-of-reserves/ Exchange Vircurex Freezes Withdrawals, Claims Lack of Reserves - CoinDesk - Archive September 18th, 2021 8:02:19 PM MDT] (Feb 29, 2020)</ref> which was operational since October 2011<ref name="coindesk-179" /><ref name=":5">[https://www.financemagnates.com/cryptocurrency/news/vircurex-faces-class-action-lawsuit/ Vircurex Faces Class-Action Lawsuit - Finance Magnates] (Jan 4, 2024)</ref>.

	Vircurex was based in Germany(?). The exchange supported trading in different cryptocurrencies including bitcoin, namecoin, devcoin, litecoin, ixcoin, ppcoin, ~~and~~ terracoin<ref name=":0">[https://web.archive.org/web/20130424071356/https://vircurex.com/ Vircurex Exchange Homepage Archive April 24th, 2013 1:13:56 AM MDT] (Dec 11, 2023)</ref>. The Vircurex platform ~~enabled trading between BTC,~~ USD or EUR~~, plus up to 18 other cryptocurrencies, however they've eliminated some less popular coins over time~~<ref name="coindesk-179" />.		Vircurex was based in Germany(?). The exchange supported trading in different cryptocurrencies including bitcoin, namecoin, devcoin, litecoin, ixcoin, ppcoin, terracoin<ref name=":0">[https://web.archive.org/web/20130424071356/https://vircurex.com/ Vircurex Exchange Homepage Archive April 24th, 2013 1:13:56 AM MDT] (Dec 11, 2023)</ref>, and up to 12 other cryptocurrencies<ref name="coindesk-179" />. The Vircurex platform offered deposits and withdrawals in both USD and EUR<ref name="coindesk-179" /><ref name=":0">[https://web.archive.org/web/20130424071356/https://vircurex.com/ Vircurex Exchange Homepage Archive April 24th, 2013 1:13:56 AM MDT] (Dec 11, 2023)</ref>.

	Vircurex gained popularity by offering interest to users holding multiple cryptocurrencies<ref name=":5" />.		Vircurex gained popularity by offering interest to users holding multiple cryptocurrencies<ref name=":5" />.

	~~The exchange offered deposits and withdrawals in both USD and EUR<ref name=":0" />.~~ The homepage of the website featured pricing tables for all supported coins<ref name=":0" />.<blockquote>Vircurex, the exchange platform for buying, selling and trading your Bitcoins and its various alt-chains. We currently support Bitcoin, Namecoin, Devcoin, Litecoin, Ixcoin, PPCoin, Terracoin</blockquote>Homepage: vircurex.com<ref name=":0" />		The homepage of the website featured pricing tables for all supported coins<ref name=":0" />. They eliminated some less popular coins as time progressed<ref name="coindesk-179" />.<blockquote>Vircurex, the exchange platform for buying, selling and trading your Bitcoins and its various alt-chains. We currently support Bitcoin, Namecoin, Devcoin, Litecoin, Ixcoin, PPCoin, Terracoin</blockquote>Homepage: vircurex.com<ref name=":0" />
	== The Reality ==		== The Reality ==
	The [[Vircurex Exchange Hack\|Vircurex exchange had already been hacked once]].		The [[Vircurex Exchange Hack\|Vircurex exchange had already been hacked once]].
Line 19:		Line 19:
	!Event		!Event
	!Description		!Description
			\|-
			\|May 10th, 2013 2:52:27 AM MDT
			\|First Terracoin Transaction
			\|The first transaction takes exactly 95,000 Terracoin (TRC) from the Bitcoinica hot wallets<ref name=":3">[https://chainz.cryptoid.info/trc/tx.dws?90239779a08243883f54bdb2503f4f40be2541487c2ef2383ef4d8277660e88b Theft Transaction For 95,000 TRC - Cryptoid] (Accessed Apr 17, 2024)</ref>.
			\|-
			\|May 10th, 2013 3:55:41 AM MDT
			\|Second Terracoin Transaction
			\|The second transaction takes another 130,263 Terracoin (TRC) from the Bitcoinica hot wallets<ref name=":4">[https://chainz.cryptoid.info/trc/tx.dws?33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64.htm Theft Transaction For 130,263 TRC - Cryptoid] (Accessed Apr 17, 2024)</ref>.
			\|-
			\|May 10th, 2013 7:31:19 AM MDT
			\|First Bitcoin Transaction
			\|The first bitcoin blockchain transaction sends 706.01021412 BTC from the Bitcoinica hot wallets<ref name=":6">[https://www.blockchain.com/explorer/transactions/btc/cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf Theft Transaction For 706.01021412 BTC - Blockchain.com] (Accessed Apr 17, 2024)</ref>.
			\|-
			\|May 10th, 2013 8:40:25 AM MDT
			\|Second Bitcoin Transaction
			\|A second bitcoin blockchain transaction sends a further 748.01217755 BTC from the Bitcoinica hot wallets<ref name=":7">[https://www.blockchain.com/explorer/transactions/btc/85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9 Theft Transaction For 748.01217755 BTC - Blockchain.com] (Accessed Apr 17, 2024)</ref>.
	\|-		\|-
	\|May 10th, 2013		\|May 10th, 2013
Line 57:		Line 73:
	A breakdown of the losses was provided in a report published by Vircurex<ref name="vircurexarchive-12744" />.		A breakdown of the losses was provided in a report published by Vircurex<ref name="vircurexarchive-12744" />.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Table ~~Breakdown~~ Of ~~Losses~~		\|+Table Of Loss Transactions
	!Currency		!Currency
	!Amount		!Amount
Line 63:		Line 79:
	!Transaction		!Transaction
	\|-		\|-
	\|BTC		\|BTC<ref name=":6" />
	\|706		\|706.01021412
	\|17gPdCyzEMRXdNTBpHrUhsM4FaiWMHhx2Q		\|17gPdCyzEMRXdNTBpHrUhsM4FaiWMHhx2Q
	\|cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf		\|cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf
	\|-		\|-
	\|BTC		\|BTC<ref name=":7" />
	\|748		\|748.01217755
	\|1PWQJu9AskoXEBYMod1KqPE6TTG4VYNz1P		\|1PWQJu9AskoXEBYMod1KqPE6TTG4VYNz1P
	\|85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9		\|85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9
	\|-		\|-
	\|TRC		\|TRC<ref name=":3" />
			\|95,000
			\|1MeY3VVudFUV91gxVZsaY92TguRWy7eQbE
			\|90239779a08243883f54bdb2503f4f40be2541487c2ef2383ef4d8277660e88b
			\|-
			\|TRC<ref name=":4" />
	\|130,263		\|130,263
	\|1Mu1wbyfkcrRarPveiihy5iuceLGC91Z4T		\|1Mu1wbyfkcrRarPveiihy5iuceLGC91Z4T
	\|33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64		\|33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64
	\|-
	~~\|TRC~~
	~~\|95,000~~
	~~\|1MeY3VVudFUV91gxVZsaY92TguRWy7eQbE~~
	~~\|90239779a08243883f54bdb2503f4f40be2541487c2ef2383ef4d8277660e88b~~
	\|-		\|-
	\|LTC		\|LTC
Line 87:		Line 103:
	\|LV8VnCDYJzd3FYNwn6n3Kyi1i7PB2MvXPo		\|LV8VnCDYJzd3FYNwn6n3Kyi1i7PB2MvXPo
	\|30231aee25900b9cb1fba16f1a8923a0cd866d60b01e542be1a4b26f92d9d10f		\|30231aee25900b9cb1fba16f1a8923a0cd866d60b01e542be1a4b26f92d9d10f
			\|}
			{\| class="wikitable"
			\|+Table Of Total Losses
			!Currency
			!Amount Lost
			!Market Price
			!Total Value
			\|-
			\|Bitcoin (BTC)
			\|1454.02239167
			\|$117.20<ref>[https://coinmarketcap.com/currencies/bitcoin/historical-data/ Bitcoin Historic Price Data - CoinMarketCap] (Accessed Apr 17, 2024)</ref>
			\|$170,411.42
			\|-
			\|Terracoin (TRC)
			\|225263.00000000
			\|$0.400200<ref>[https://www.coingecko.com/en/coins/terracoin Terracoin - CoinGecko] (Accessed Apr 17, 2024)</ref>
			\|$90,150.25
			\|-
			\|Litecoin (LTC)
			\|
			\|
			\|
			\|-
			\| colspan="3" \|Total All Coins
			\|$170,411.42
	\|}		\|}
	The total amount lost has been estimated at $170,000 USD.		The total amount lost has been estimated at $170,000 USD.

Azoundria: 30 minutes. Article review. Added in initial prevention strategies section. Review and information on the Vircurex recovery plan. Implemented all sources so far to remove template. More review of the homepage information over time.

2024-04-09T18:43:53Z

30 minutes. Article review. Added in initial prevention strategies section. Review and information on the Vircurex recovery plan. Implemented all sources so far to remove template. More review of the homepage information over time.

← Older revision		Revision as of 12:43, 9 April 2024
Line 1:		Line 1:
	{{Case Study Under Construction}}~~{{Unattributed Sources}}~~		{{Case Study Under Construction}}[[File:Vircurex.jpg\|thumb\|Vircurex Homepage/Logo]]Vircurex experienced a second hack in 2013, which ultimately contributed to the collapse of the exchange later in 2014. It appears that attempts were made to repay the debt with ongoing profits, however this proposal suffered from implementation weaknesses and lacked any indication of how the platform was going to prevent future hacks.

	[[File:Vircurex.jpg\|thumb\|Vircurex Homepage/Logo]]Vircurex experienced a second hack in 2013, which ultimately contributed to the collapse of the exchange later in 2014. It appears that attempts were made to repay the debt with ongoing profits, however this proposal ~~appears to be very poorly implemented~~ and lacked any indication of how the platform was going to prevent future hacks.

	~~The country for this case study is not yet known.<ref>https://blockchain.info/address/16cDeEFn6sraUEJrDCt2Yg3r7j2oazSYEd</ref><ref>https://vircurex.com/welcome/ann_reserved.html</ref>~~

	== About Vircurex ==		== About Vircurex ==
Line 31:		Line 27:
	\|Report Released		\|Report Released
	\|Vircurex releases a report covering the events of May, including the breach which happened<ref name="vircurexarchive-12744" />.		\|Vircurex releases a report covering the events of May, including the breach which happened<ref name="vircurexarchive-12744" />.
			\|-
			\|March 23rd, 2014 1:55:52 PM MDT
			\|Homepage Distribution Announcement
			\|The Vircurex homepage warns users that due to recent large fund withdrawals depleting their cold wallet balance, the exchange has announced the immediate suspension of BTC, LTC, FTC, and TRC withdrawals and deposits<ref name=":1">[https://web.archive.org/web/20140323195552/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 23rd, 2014 1:55:52 PM MDT] (Accessed Apr 9, 2024)</ref>. On March 24, 2014, they plan to freeze current account balances and redistribute available coins, deleting open sell orders for the affected cryptocurrencies<ref name=":1">[https://web.archive.org/web/20140323195552/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 23rd, 2014 1:55:52 PM MDT] (Accessed Apr 9, 2024)</ref>. Two previous incidents led to significant losses, which were covered by the exchange's income<ref name=":1">[https://web.archive.org/web/20140323195552/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 23rd, 2014 1:55:52 PM MDT] (Accessed Apr 9, 2024)</ref>. However, recent withdrawals exhausted their cold wallet balance, prompting the introduction of "Frozen Funds." These funds will gradually be repaid to users from the exchange's profits<ref name=":1">[https://web.archive.org/web/20140323195552/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 23rd, 2014 1:55:52 PM MDT] (Accessed Apr 9, 2024)</ref>. Distribution logic entails allocating 50% of available funds from largest to smallest accounts and the remaining 50% from smallest to largest accounts<ref name=":1">[https://web.archive.org/web/20140323195552/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 23rd, 2014 1:55:52 PM MDT] (Accessed Apr 9, 2024)</ref>. This approach aims to ensure all users eventually receive their funds without penalizing new deposits or users<ref name=":1">[https://web.archive.org/web/20140323195552/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 23rd, 2014 1:55:52 PM MDT] (Accessed Apr 9, 2024)</ref>.
			\|-
			\|March 25th, 2014 2:36:39 PM MDT
			\|Update To Homepage
			\|An update is provided on the homepage with the number of accounts remaining<ref name=":2">[https://web.archive.org/web/20140325203639/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 25th, 2014 2:36:39 PM MDT] (Accessed Apr 9, 2024)</ref>. There are 355 bitcoin accounts, 1,563 litecoin accounts, 77 TRC accounts, and 42 FTC accounts which are still outstanding to be reimbursed<ref name=":2">[https://web.archive.org/web/20140325203639/https://vircurex.com/welcome/ann_reserved.html Vircurex Homepage Archive March 25th, 2014 2:36:39 PM MDT] (Accessed Apr 9, 2024)</ref>. TBD keep exploring homepage<ref>https://web.archive.org/web/20140715000000*/https://vircurex.com/welcome/ann_reserved.html</ref>.
	\|-		\|-
	\|April 18th, 2014 7:56:22 PM MDT		\|April 18th, 2014 7:56:22 PM MDT
Line 38:		Line 42:

	== Technical Details ==		== Technical Details ==
	Based on an analysis report provided by Vircurex, the attack was a simple impersonation where the perpetrator claimed to be the exchange operator and requested a reset of the account credentials. In addition to resetting the servers, the root password was provided outside of the normal email address to be used and the attacker was able to circumvent an IP-based restriction on the account's control panel<ref name="vircurexarchive-12744" />.<blockquote>The attacker has acquired login credentials to our VPS control account with our hosting service provider and has then asked for the root password reset of all servers which – unfortunately – the service provider has then done and posted the credentials in their helpdesk ticket, rather than the standard process of sending it to our email address (which has 2FA protection), also the security setup of allowing only our IP range to login to the management console was not working. It was an additional security feature the provider offered but was obviously circumvented by the attacker. As a result out of this incident we have moved all our services to a new provider who offers 2 factor authentication for all logins as well as other verification processes that we hope will make similar attempts impossible in the future.</blockquote>Relevant blockchain transactions<ref name="bitcointalk-87" />:		Based on an analysis report provided by Vircurex, the attack was a simple impersonation where the perpetrator claimed to be the exchange operator and requested a reset of the account credentials<ref name="vircurexarchive-12744" />. In addition to resetting the servers, the root password was provided outside of the normal email address to be used and the attacker was able to circumvent an IP-based restriction on the account's control panel<ref name="vircurexarchive-12744" />.<blockquote>The attacker has acquired login credentials to our VPS control account with our hosting service provider and has then asked for the root password reset of all servers which – unfortunately – the service provider has then done and posted the credentials in their helpdesk ticket, rather than the standard process of sending it to our email address (which has 2FA protection), also the security setup of allowing only our IP range to login to the management console was not working. It was an additional security feature the provider offered but was obviously circumvented by the attacker. As a result out of this incident we have moved all our services to a new provider who offers 2 factor authentication for all logins as well as other verification processes that we hope will make similar attempts impossible in the future.</blockquote>Relevant blockchain transactions<ref name="bitcointalk-87" />:

	* cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf		* cbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf
	* 85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9		* 85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9
			Relevant bitcoin addresses:<ref>[https://blockchain.info/address/16cDeEFn6sraUEJrDCt2Yg3r7j2oazSYEd Bitcoin Address 16cDeEFn6sraUEJrDCt2Yg3r7j2oazSYEd - Blockchain.info]</ref>

	== Total Amount Lost ==		== Total Amount Lost ==
Line 86:		Line 91:

	== Immediate Reactions ==		== Immediate Reactions ==



Line 96:		Line 102:
	=== Addition of IP Whitelisting ===		=== Addition of IP Whitelisting ===
	After 3 user accounts reported being hacked, Vircurex added IP address whitelisting to their service, so users who logged in from a new IP address would have to confirm their IP address via email<ref name="vircurexarchive-12744" />.		After 3 user accounts reported being hacked, Vircurex added IP address whitelisting to their service, so users who logged in from a new IP address would have to confirm their IP address via email<ref name="vircurexarchive-12744" />.

			=== Frozen Fund Scheme Implementation ===
			Due to recent large fund withdrawals depleting their cold wallet balance, Vircurex announced on their homepage the immediate suspension of BTC, LTC, FTC, and TRC withdrawals and deposits<ref name=":1" />. Two previous incidents led to significant losses, which were covered by the exchange's income<ref name=":1" />. However, recent withdrawals exhausted their cold wallet balance, prompting the introduction of "Frozen Funds." These funds will gradually be repaid to users from the exchange's profits. Distribution logic entails allocating 50% of available funds from largest to smallest accounts and the remaining 50% from smallest to largest accounts<ref name=":1" />. This approach aims to ensure all users eventually receive their funds without penalizing new deposits or users<ref name=":1" />.

	=== Inclusion In Lists ===		=== Inclusion In Lists ===
Line 101:		Line 110:

	== Total Amount Recovered ==		== Total Amount Recovered ==
			Vircurex planned to implement a recovery process which would provide users with "frozen fund" account balances and repay those users over time from the exchange profits. They would distribute 50% of profits to the accounts with the largest balance of lost funds, and 50% of profits to the accounts with the smallest balance of lost funds. While such an idea may have been better for affected users than an outright platform collapse, this scheme was inadequate because:

			* The primary issue of preventing future exchange breaches was not mentioned anywhere. Thus, users had no assurances against not losing additional funds or that they would ultimately be repaid.
			* The scheme was implemented too late, with the full balances of users being frozen instead of a partial freeze which could be beneficial to allow users access to some of their funds.
			* There was no reimbursement provided for users who were not at either end of the list. This prevented those users from participating in trading and generating any platform profit.
			* Once users were fully reimbursed, they had no incentive to remain using the platform or engaged in the recovery of others. As such, the largest traders and a large number of small traders could leave the platform quickly. By contrast, a scheme which distributed less to more users could keep more users engaged for longer.

	There do not appear to have been any funds recovered in this case.		There do not appear to have been any funds recovered in this case.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:Individuals:~~Placeholder~~}}		{{Prevention:Individuals:Avoid Third Party Custodians}}

			{{Prevention:Individuals:Store Funds Offline}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Regular Audit Procedures}}

			{{Prevention:Platforms:Implement Multi-Signature}}

			{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Platform Security Assessments}}

			{{Prevention:Regulators:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: 30 minutes. Integrated about section information and updated template. Integrated inforamtion about Vircurex from other hacking article. Integrating information from BitcoinTalk article. Added in information from the Vircurex report, including the additional terracoin and litecoin which were stolen. Fully integrated may 2013 report and further review.

2024-04-02T19:45:22Z

30 minutes. Integrated about section information and updated template. Integrated inforamtion about Vircurex from other hacking article. Integrating information from BitcoinTalk article. Added in information from the Vircurex report, including the additional terracoin and litecoin which were stolen. Fully integrated may 2013 report and further review.

Show changes

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/vircurexsecondexchangehack.php}} {{Unattributed Sources}} Vircurex Homepage/LogoVircurex experienced a second hack in 2013, which ultimately contributed to the collapse of the exchange later in 2014. It appears that attempts were made to repay the debt with ongoing profits, however this proposal appears to be very poorly implemented and lacked any indication of how the..."

2023-12-12T19:26:03Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/vircurexsecondexchangehack.php}} {{Unattributed Sources}} thumb|Vircurex Homepage/LogoVircurex experienced a second hack in 2013, which ultimately contributed to the collapse of the exchange later in 2014. It appears that attempts were made to repay the debt with ongoing profits, however this proposal appears to be very poorly implemented and lacked any indication of how the..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/vircurexsecondexchangehack.php}}
{{Unattributed Sources}}

[[File:Vircurex.jpg|thumb|Vircurex Homepage/Logo]]Vircurex experienced a second hack in 2013, which ultimately contributed to the collapse of the exchange later in 2014. It appears that attempts were made to repay the debt with ongoing profits, however this proposal appears to be very poorly implemented and lacked any indication of how the platform was going to prevent future hacks.

The country for this case study is not yet known.<ref name="bitcointalk-87" /><ref name="vircurexarchive-12744" />

== About Vircurex ==
"The hot wallet and “warm” wallet of Bitcoin to alternative cryptocurrency exchange service Vircurex was emptied in May 2013, resulting in a significant loss of three currencies: Bitcoin, Terracoin, and Litecoin.[57] Initially, Vircurex operated normally despite the loss, though it no longer paid dividends to shareholders. In March 2014, due to strain caused by large withdrawals (in addition to a default by AurumXChange, a fiat processor Vircurex used), Vircurex froze large quantities of many currencies; however, it promises to pay these back eventually.[59]"

The country for this case study is not yet known.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Vircurex Second Exchange Hack
!Date
!Event
!Description
|-
|May 10th, 2013
|Breach Date
|Reported date of breach.
|-
|April 18th, 2014 7:56:22 PM MDT
|Included In BitcoinTalk List
|A subsequent Vircurex exchange hack is featured in the BitcoinTalk "List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses" published by user dree12[1].
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
1454 BTC x $117.20 = $170408.8

The total amount lost has been estimated at $170,000 USD.

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="bitcointalk-87">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref>

<ref name="vircurexarchive-12744">[https://web.archive.org/web/20140323195916/https://vircurex.com/Reports/2013-05.pdf Wayback Machine] (Dec 12, 2023)</ref></references>