LocalBitcoin Forum Login Breach

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

LocalBitcoins

These criminals were far from stealthy - redirecting the forums to a suspicious login page, which allowed them to get the 2FA details from customers then empty the wallets which are used as an escrow during trades. The breach was quickly caught within 5 hours, and I was able to find a Reddit post confirming that at least one customer was reimbursed.

This is a global/international case not involving a specific country.

About LocalBitcoins

"Buy and Sell Bitcoin Everywhere Near you or around the globe. Trade bitcoins person-to-person in an easy, fast, and secure way."

"At LocalBitcoins, people from different countries can exchange their local currency into bitcoins. We allow users to create advertisements where they can choose the payment method and exchange rate for buying and selling bitcoins from and to other LocalBitcoins’ users. By replying to these advertisements, a trade chat is opened and escrow protection is automatically activated. Escrow protects both buyer and seller by keeping the bitcoins safe until the payment is done and the seller releases bitcoins to the buyer. LocalBitcoins also provides a web wallet from where you can send and receive Bitcoin transactions."

"On LocalBitcoins, you are dealing with humans. Unlike stock-like exchanges and centralized Bitcoin trading websites, LocalBitcoins allows you to trade directly with another person. This makes the process customizable, lean and fast, as there is no corporate overhead. You can get your bitcoins instantly. LocalBitcoins aims to support every suitable payment method its user community supports. For every trade, LocalBitcoins offers escrow protection to ensure the bitcoins and both traders are safe."

"The crypto market may have slowed, with Bitcoin (BTC) falling by upwards of 70% during yesteryear, but ambitious attackers have continued their attempts to breach industry upstarts. Most recently, rumors arose that LocalBitcoins, a popular peer-to-peer, non-conventional exchange, had fallen victim to a security breach."

"The popular peer-to-peer cryptocurrency exchange LocalBitcoins has seemingly been compromised, as users are reporting its forums were redirecting them to a login page that then sent their details to a hacker. An address being shared already has nearly 8 BTC – around $28,600 – in it."

"We would like to inform that today 26.01.2019 at approximately 10:00:00 UTC, LocalBitcoins has detected a security vulnerability - an unauthorised source was able to access and send transactions from a number of affected accounts. Outgoing transactions were temporarily disabled while we investigated the case."

"Moreover, users should always confirm they’re using the wallet vendor’s proprietary software and double check what they’re using does indeed come from the vendor. Phishing scams are unfortunately nothing new in the cryptocurrency space, as these attacks even took $28,600 from users of the peer-to-peer exhcnage LocalBitcoins last year."

"@LocalBitcoins has apparently been compromised. Users are claiming its forums were redirecting them to a login page that was a phishing website. An address shared on social media already has $28,000 worth of #BTC in it after tricking 5 victims. Forums are now diabled."

"From my understanding 2fa did not prevent the exploit as it occurred when a user clicked onto the forum page well the site was under attack which then redirected the user to a phishing page, which was not used to get their logins but to phish their 2fa code which was likely passed onto a script, which was executed within the 3rd party forum software that emptied the users wallet on their browser.This explains why there was no need to bypass the third factor browser authentication nor any IP logs of different IPs on the effected users account."

"As soon as they enter their credentials, the thread claims, these are sent to the hacker who then empties their accounts. An address being shared on social media already has $28,600 worth of BTC in it, after tricking 5 victims." "On the thread, various users have claimed to have lost funds, including one who says 11 BTC were taken from his address. If so, this could mean the hacker is siphoning funds to other addresses."

"[W]hen [I] first tried to logon with my 2fa code there was an error then when i tried again, my wallet was wiped clean. So these hackers move fast. They might be using an automated system to harvest and possibly enter usernames/emails and password combos and 2fa codes." "[T]hey got 1 2fa code which is good for ~15seconds to login, and then another 2fa code is required for withdrawal." "They show you an error page and ask you to login again, which gives them the second 2fa code."

"@LocalBitcoins claims the attack came due to a problem"related to a feature powered by a third party software." It has reportedly stopped the attack, and says its platform is now safe to use."

"We were able to identify the problem, which was related to a feature powered by a third party software, and stop the attack. At the moment, we are determining the correct number of users affected - so far six cases have been confirmed. For security reasons, the forum feature has been disabled until further notice."

"Outgoing transactions have already been re-enabled and we have taken a number of measures to address this issue and secure the limited number of accounts that might have been at risk."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - LocalBitcoin Forum Login Breach

Date	Event	Description
January 26th, 2019	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount at risk has been estimated at $29,000 USD. The total amount lost has been estimated at $29,000+ USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Coming soon.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.