Picostocks “Cold Wallet” Hack

PicoStocks Homepage

PicoStocks was a centralized exchange based in Marshall Islands, which operated one of the earliest forms of blockchain project fundraising, where entrepreneurs could launch offerings for investors. On November 29th, 2013, the service suffered a breach of 5,896.23098163 bitcoin from two separate wallets. Ultimately, the exchange covered all user losses and relaunched successfully. It appears that the platform continued to operate until 2019.

About PicoStocks

PicoStocks was a centralized exchange based in Marshall Islands, which was launched on either December 21st, 2012 or December 24th, 2012. The service was primarily focused around allowing companies to raise funds using the blockchain with an "Initial PicoStocks Offering (IPO)". They reportedly allowed investors to invest anonymously and used novel means for circumventing legal regulation. The service was run by the BitcoinTalk user "tytus".

Picostocks facilitates valuation and fundraising for high tech startup projects and companies and offers valuable services and benefits for both bitcoin investors and entrepreneurs.

Investors[, you] can obtain valuation of assets You own by the PicoStocks community through an Initial PicoStocks Offering (IPO). You can sell Your assets to PicoStocks if You are satisfied with the IPO evaluation results. You can obtain long term profits from the sold assets through a fixed share in future dividend payments from the asset. You can collect rewards by evaluating assets offered by other PicoStocks members. You can profit from transactions on the PicoStocks platform. You can participate in profits from dividends from assets You hold on PicoStocks. You can benefit from the anonymity of the bitcoin network.

Entrepreneurs[, y]ou can obtain initial valuation of assets of Your company at any stage of development, much cheaper and much faster than through other public stock exchange platforms. You can raise capital for the company by selling stocks of the company to PicoStocks after accepting the results of the IPO. You can monitor the valuation of the company as on any other stock exchange platform but with much less formal requirements and at a much lower cost.

The platform listed their name and address as "Picostocks Incorporated, Trust Company Complex, Ajeltake Road, Ajeltake Island, Majuro, Marshall Islands MH96960". They also featured an "IPO office" which was "operated by BioInfoBank, Sw. Marcin 80/82 lok. 355, 61-809 Poznan, Poland". Customers could contact them by email, phone, and fax, as well as through some social media channels like the BitcoinTalk forum. Traded stocks remained the legal property of PicoStocks and PicoStocks collected various fees throughout the investment process.

The Reality

Specific details of who ran the PicoStocks service were not provided to the public.

While Picostocks took care to separate their funds into separate cold and hot wallets, which were kept on separate computers, they also kept backup copies of the private keys and kept operating with those same wallets.

What Happened

PicoStocks has speculated that the private keys of the wallet may have been copied in the past and subsequently decrypted. The culprit then used this access to the keys to steal funds from both wallets.

Key Event Timeline - PicoStocks “Cold Wallet” Hack

Date	Event	Description
April 19th, 2012 3:11:53 PM	tytus Registration	The BitcoinTalk user tytus first registers on the BitcoinTalk forum.
December 24th, 2012	PicoStocks Launches	The centralized exchange service PicoStocks launches, based in the Marshall Islands.
November 29th, 2013 10:00:41 AM	Cold Wallet Breached	The breach is reported to have occurred on November 29th, 2013. The first blockchain transaction shows a timestamp of 10:00:41 AM.
November 29th, 2013 10:11:59 AM	Hot Wallet Breached	A second blockchain transaction in the following block empties what is believed to be the hot wallet.
November 29th, 2013 6:18:45 PM	BitcoinTalk Post	BitcoinTalk user tytus, suspected to be the founder of PicoStocks, posts an announcement on the BitcoinTalk forum.
November 30th, 2013 3:36:14 AM	Reddit Post	Reddit user "love_eggs_and_bacon" posts a copy of the original notice that was posted on BitcoinTalk to announce the situation.
February 15th, 2014 5:06:57 AM	Hot Wallet Funds Move	The funds originally breached from the hot storage wallet started to move on the blockchain.
February 17th, 2014 6:03:47 AM	Cold Wallet Funds Move	The funds originally breached from the cold storage wallet started to move on the blockchain.
October 3rd, 2017 9:48:28 AM	tytus Last Active	The BitcoinTalk account for tytus is last active on the BitcoinTalk forums.
February 15th, 2019	Final Medium Post	The PicoStocks account on Medium posted the final post about how the platform prevented wash trading by publishing user IDs.
March 29th, 2019 12:57 AM	Final Twitter Post	The final post of PicoStocks on Twitter.
December 13, 2019, 12:00:36 PM	Withdrawal Problems	PicoStocks users start to report withdrawal problems and a lack of support on the BitcoinTalk forum.

Technical Details

Is it reported that two separate wallets were breached. One wallet was reportedly described as "hot" while the other wallet was reportedly described as "cold". Wallets were described as being "located on different computers", which suggests that both the "hot" and "cold" wallet keys were stored and accessed from a computer. Many users have suggested that both wallets existed on networked computers. While wallet keys were believed to be encrypted, this can often be brute-forced if there is a weak password used for the encryption.

Hot Wallet Address: 19t7RxwXdfiwQMyQ3JVB16e9HgV7omijSs

Cold Wallet Addresses: Multiple, as moved in bitcoin transaction 28c9d7b0b31c9262958b88c42b1703098d44574e0830173c0b5cfe2a79490881

Total Amount Lost

The loss amount was reported as 5,896.23098163 BTC (many sources rounded this to 5,895 BTC), with an estimated value of either $6,000,000 USD or $3,009,397 USD.

Funds were removed from both the hot wallet and cold wallet of PicoStocks. According to blockchain data, the hot wallet had 685.57933572 BTC and the cold wallet had 5210.65104591 BTC. This maintains a total of 5896.23038163 BTC. Using the bitcoin market price for November 29th, 2013 of $1,037.76 USD from BuyBitcoinWorldWide, this gives a total value of $5,407,405.23 USD.

Immediate Reactions

It does not appear that there were any changes to the PicoStocks website to announce the hack situation at the time. PicoStocks posted an announcement about what happened on the BitcoinTalk forum, which was subsequently reposted to Reddit. The initial announcement mentioned both the hot and cold wallets were emptied, and a suspicion that the wallets may have been copied by people who previously had access to the system.

PicoStocks is down for a while and will remain like this for sure over the weekend. Funds from our hot wallet and cold wallet account have been stolen.

There is no sign of an intrusion into the systems. Both wallets were located on different computers. We suspect that these have been copied by people who had access to the system in the past and decrypted.

This is of course a serious loss for the company, but we expect no losses for the users. the funds collected on user account will be returned. We will have to create a new hot wallet and we will change all PicoStocks addresses for all users, but the rest will remain as it was. We will open the system when we have positively reviewed the security and collected the funds for the users :-( Maybe in 1 week from now :-(

Multiple users heavily criticized PicoStocks for operating their cold wallet on a networked computer, but there is no indication that this was the way the wallet had operated. Many users on Reddit concluded that the PicoStocks platform was either incompetent or attempting a scam. Some BitcoinTalk users were similarly critical.

This reeks of a scam. And if not, if you are so incompetent that you actually got your cold wallet drained then you deserve to be sued by your customers for all you've got.

Scam or stupid, pick one to describe the company. They either took the funds themselves, or didn't actually have a cold wallet set up.

You're exactly the scumbag thief I said you were, back in Spring.

Ultimate Outcome

PicoStocks promised a timeline of 1 week to relaunch their platform. The platform promised to completely cover all losses, which was reportedly followed through with.

The attacker appears to have kept the breached funds in the same wallet location for the subsequent 3 months before finally starting to move those funds starting February 15th, 2014.

Total Amount Recovered

PicoStocks promised users that they would return all "the funds collected on user account" and this was reportedly followed through with.

Ongoing Developments

PicoStocks continued to operate for close to a decade and remained active on social media until March 2019, although users started to report withdrawal problems and a lack of support near the end of 2019. Posts by the founder tytus on BitcoinTalk regarding the platform appear to have been deleted.

[I'm] trying to withdraw some ETH from picostocks.com, but since last week [I'm] unable to withdraw my balance[. I] check[ed] their [T]witter[ and] [F]ac[e]book[. I see] many people complaining [about] the[ir] withdrawal req[u]est[s] but no one is responsible and there is no proper way to contact som[e]one for support[.] So just be car[e]ful before using this exchange, because [I'm] still not sure [if] this site is [a] scam or not.

The PicoStocks homepage was still online as of September 28th, 2021, and the website appeared functional to log in as of January 3rd, 2022. However, no subsequent captures of the site have been made and it appears to be offline as of February 8th, 2023.

Individual Prevention Policies

When using any third party custodial platform (such as for trading), it is important to verify that the platform has a full backing of all assets, and that assets have been secured in a proper multi-signature wallet held by several trusted and trained individuals. If this can't be validated, then users should avoid using that platform. Unfortunately, most centralized platforms today still do not provide the level of transparency and third party validation which would be necessary to ensure that assets have been kept secure and properly backed. Therefore, the most effective strategy at present remains to learn proper self custody practices and avoid using any third party custodial platforms whenever possible.

Any time that you are promised any profit or benefit in exchange for an initial payment, smart contract approval, or deposit, pay special care as to whether the entity making that offer is trustworthy, actually who they say they are, and has the means to fulfill what they're promising. There are no magic algorithms providing guaranteed returns from trading or mining. Trading on average will lose money. Mining is expensive and complex. No one is going to immediately send back more than you sent them. NFT projects will rarely announce a surprise mint in only a single location. Are you fully prepared for the event your money is kept and nothing is delivered in return?

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

This situation could have been most effectively prevented by the use of a multi-signature wallet, rather than a single private key. In such a setup, the cold storage wallet would have required approvals from multiple team members to initiate a withdrawal. This, combined with a reasonable level of training for key holders, would have effectively prevented an attacker from obtaining enough private keys to perform a transfer.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.