Bitcoinica Hot Wallet Hack: Difference between revisions
(30 minutes. Integrated additional information from BitcoinTalk hack list. Added in further information and source from BitMarket.eu, who stored their funds on Bitcoinica. Formatting tweaks on the article. Added information from Bitcoin Magazine Obituary including a specific quote from Vitalik Buterin.) |
(30 minutes. Confirmed sources already integrated in wiki article. Integrating Bitcoin Wiki article into our wiki. Integrated all information from Kyle Gibson. Integrated inforamtion from BitcoinTalk updated list. Integrated information from the BitMarket.eu platform which used Bitcoinica. Integrated information from emergency BitcoinTalk forum thread. Another source expanded.) |
||
| Line 1: | Line 1: | ||
{{Case Study Under Construction}}{{Unattributed Sources}}[[File:Bitcoinica.jpg|thumb|Bitcoinica Logo/Homepage]]This shows a definite need for hot wallet insurance. Reduction in the level of funds stored in hot wallets would reduce the risk. | {{Case Study Under Construction}}{{Unattributed Sources}}[[File:Bitcoinica.jpg|thumb|Bitcoinica Logo/Homepage]]This shows a definite need for hot wallet insurance. Reduction in the level of funds stored in hot wallets would reduce the risk. | ||
This exchange or platform is based in New Zealand, or the incident targeted people primarily in New Zealand.<ref name="bitcoinmagazine-23" /><ref | This exchange or platform is based in New Zealand, or the incident targeted people primarily in New Zealand.<ref name="bitcoinmagazine-23" /><ref>[https://bitcointalk.org/index.php?topic=81045.msg894312#msg894312 Zhou Tong - "The hacker almost gained access to our Mt. Gox API keys, before I revoke them! He could get 30,000+ BTC easily if I was asleep, or busy." - BitcoinTalk] (Accessed Apr 5, 2024)</ref><ref>https://bitcointalk.org/index.php?topic=81045.msg896112#msg896112</ref><ref>https://bitcointalk.org/index.php?topic=81581.0;topicseen</ref><ref>https://nakedsecurity.sophos.com/2012/05/14/bitcoin-exchange-gets-attacked-and-loses-cash-again/</ref><ref>https://news.8btc.com/analyst-mt-gox-lost-100000-more-bitcoins-apart-from-the-2-5-billion-hack</ref> | ||
== About Bitcoinica == | == About Bitcoinica == | ||
Bitcoinica was an online platform launched on September 8, 2011, enabling leveraged speculation in its contract-for-difference (CFD) market against the Bitcoin to USD exchange rate<ref name="bitcoinwiki-24" />. | |||
The Bitcoinica exchange platform was based in New Zealand, and founded by Zhou Tong<ref name="bitcoinmagazine-23" />.<blockquote>Despite his position as the creator of a financial speculation service and his strong belief in libertarian capitalist ideals, Bitcoinica to him has never been about the profit. “Bitcoinica is not a money making machine,” he writes. “It’s just a product that sets a high standard for the Bitcoin community.”<ref name="bitcoinmagazine-23" /></blockquote> | The Bitcoinica exchange platform was based in New Zealand, and founded by Zhou Tong<ref name="bitcoinmagazine-23" />.<blockquote>Despite his position as the creator of a financial speculation service and his strong belief in libertarian capitalist ideals, Bitcoinica to him has never been about the profit. “Bitcoinica is not a money making machine,” he writes. “It’s just a product that sets a high standard for the Bitcoin community.”<ref name="bitcoinmagazine-23" /></blockquote> | ||
== The Reality == | == The Reality == | ||
The history of Bitcoinica was marred by security breaches and financial losses<ref name="bitcoinwiki-24" />. On March 1st, 2012, the site experienced a significant loss of over 43,000 bitcoins due to an internal security breach at its web hosting provider<ref name="bitcoinwiki-24" />. | |||
== What Happened == | == What Happened == | ||
| Line 20: | Line 17: | ||
!Event | !Event | ||
!Description | !Description | ||
|- | |||
|September 8th, 2011 | |||
|Bitcoinica Service Launches | |||
|The Bitcoinica service is launched<ref name="bitcoinwiki-24" />. | |||
|- | |- | ||
|May 6th, 2012 | |May 6th, 2012 | ||
|Hot Wallet Hack Announced | |Hot Wallet Hack Announced | ||
|“On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked.” | |“On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked.” The date reported by Kyle Gibson<ref name="kylegibson-86" />. | ||
|- | |||
|May 11th, 2012 7:16:37 AM MDT | |||
|BitcoinTalk Emergency Thread | |||
|Bitcoinica administrator Zhou Tong posts an emergency thread announcing a suspicious transaction on the platform<ref name=":2">[https://bitcointalk.org/index.php?topic=81045.0 <nowiki>[Emergency ANN] Bitcoinica site is taken offline for security investigation - BitcoinTalk</nowiki>] (Accessed Apr 5, 2024)</ref>. The suspicious Bitcoin transaction not initiated by any company owners, prompting the suspension of Bitcoinica's servers for a security investigation<ref name=":2">[https://bitcointalk.org/index.php?topic=81045.0 <nowiki>[Emergency ANN] Bitcoinica site is taken offline for security investigation - BitcoinTalk</nowiki>] (Accessed Apr 5, 2024)</ref>. The transaction involved a significant loss of 18,547.66867623 BTC<ref name=":2">[https://bitcointalk.org/index.php?topic=81045.0 <nowiki>[Emergency ANN] Bitcoinica site is taken offline for security investigation - BitcoinTalk</nowiki>] (Accessed Apr 5, 2024)</ref>. While financial and trading data were deemed safe apart from the Bitcoin loss, concerns arose within the community about the vulnerability of hosted systems and the need for enhanced security measures<ref name=":2">[https://bitcointalk.org/index.php?topic=81045.0 <nowiki>[Emergency ANN] Bitcoinica site is taken offline for security investigation - BitcoinTalk</nowiki>] (Accessed Apr 5, 2024)</ref>. Comments express shock at the severity of the loss and skepticism about Bitcoinica's legitimacy, with some suggesting the incident as proof of previous warnings regarding the platform's credibility. Despite assurances from Bitcoinica's founder, doubts lingered about the site's security practices and potential scams within the Bitcoin community<ref name=":2">[https://bitcointalk.org/index.php?topic=81045.0 <nowiki>[Emergency ANN] Bitcoinica site is taken offline for security investigation - BitcoinTalk</nowiki>] (Accessed Apr 5, 2024)</ref>. | |||
|- | |||
|May 11th, 2012 | |||
|Exploit Date Bitcoin Wiki | |||
|The exploit date, according to the Bitcoin Wiki<ref name="bitcoinwiki-24" />. | |||
|- | |- | ||
|May 12th, 2012 5:19:00 AM MDT | |May 12th, 2012 5:19:00 AM MDT | ||
| Line 43: | Line 52: | ||
|December 21st, 2012 1:53:16 AM MST | |December 21st, 2012 1:53:16 AM MST | ||
|BitMarket.eu Posts About Insolvency | |BitMarket.eu Posts About Insolvency | ||
|<ref name=":0" /> | |BitMarket.eu administrator M4v3r admits in a BitcoinTalk forum thread to having stored bitcoins on the Bitcoinica platform, which are now lost. <ref name=":0">[https://bitcointalk.org/index.php?topic=5441.msg1413156#msg1413156 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk] (Accessed Apr 2, 2024)</ref> His message apologized for a failure to respond promptly due to personal issues and a search for a solution<ref name=":0">[https://bitcointalk.org/index.php?topic=5441.msg1413156#msg1413156 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk] (Accessed Apr 2, 2024)</ref>. It reveals that he cannot currently process withdrawals, attributing the problem to a misguided attempt at providing a hedge fund service for Bitmarket users<ref name=":0">[https://bitcointalk.org/index.php?topic=5441.msg1413156#msg1413156 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk] (Accessed Apr 2, 2024)</ref>. This endeavor led to a significant loss of bitcoins, worsened by a subsequent rise in BTC price<ref name=":0">[https://bitcointalk.org/index.php?topic=5441.msg1413156#msg1413156 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk] (Accessed Apr 2, 2024)</ref>. The administrator acknowledges their fault and lack of funds to cover the loss, proposing options like finding an investor or starting over with explicit fees to repay the debt<ref name=":0">[https://bitcointalk.org/index.php?topic=5441.msg1413156#msg1413156 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk] (Accessed Apr 2, 2024)</ref>. They express a commitment to making amends and provide a bitcoin address for donations to help users with locked funds<ref name=":0">[https://bitcointalk.org/index.php?topic=5441.msg1413156#msg1413156 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk] (Accessed Apr 2, 2024)</ref>. The attached comments reflect skepticism and accusations of scamming, countered by the sender's assertion of honesty despite the dire situation<ref name=":0">[https://bitcointalk.org/index.php?topic=5441.msg1413156#msg1413156 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk] (Accessed Apr 2, 2024)</ref>. | ||
|- | |- | ||
|December 21st, 2012 | |December 21st, 2012 | ||
|BitMarket.eu Funds Announced | |BitMarket.eu Funds Announced | ||
|"On December 21, 2012, it was discovered that BitMarket.eu lost a large portion of customer funds which were stored on Bitcoinica. These customers were reportedly unaware that their funds were stored on Bitcoinica. Return of a portion of these funds is still possible, pending the outcome of liquidation."<ref name="bitcointalklistold-20" /> | |"On December 21, 2012, it was discovered that BitMarket.eu lost a large portion of customer funds which were stored on Bitcoinica. These customers were reportedly unaware that their funds were stored on Bitcoinica. Return of a portion of these funds is still possible, pending the outcome of liquidation."<ref name="bitcointalklistold-20" /> | ||
|- | |||
|July 26th, 2013 5:52:51 PM MDT | |||
|Updated BitcoinTalk List | |||
|The incident is included in the updated BitcoinTalk list<ref name="bitcointalklist-87" />. The amount is increased and valued according to the January 2014 price. A disclaimer is added about the amount potentially increasing as the liquidation proceeds<ref name="bitcointalklist-87" />. | |||
|- | |- | ||
|February 3rd, 2017 10:00:04 AM MST | |February 3rd, 2017 10:00:04 AM MST | ||
| Line 55: | Line 68: | ||
== Technical Details == | == Technical Details == | ||
The vulnerability reportedly happened through a compromised email address, which had a higher level of permissions than necessary<ref name="bitcointalklistold-20" />. The chief transaction involved in the theft is 7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8<ref name=":1" />. | The vulnerability reportedly happened through a compromised email address, which had a higher level of permissions than necessary<ref name="bitcointalklistold-20" />. The chief transaction involved in the theft is 7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8<ref name=":1" />, which was announced on the BitcoinTalk forums<ref name=":2" />. | ||
=== BitcoinTalk Summary === | === BitcoinTalk Summary === | ||
| Line 63: | Line 76: | ||
There are three different estimates of the amount lost in this case. | There are three different estimates of the amount lost in this case. | ||
* The first value of 18547.66867623 comes from the blockchain transaction<ref name=":1">[https://www.blockchain.com/explorer/transactions/btc/7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8 Bitcoinica Theft Transaction - Blockchain.com] (Accessed Apr 1, 2024)</ref>. This is included on some | * The first value of 18547.66867623 comes from the blockchain transaction<ref name=":1">[https://www.blockchain.com/explorer/transactions/btc/7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8 Bitcoinica Theft Transaction - Blockchain.com] (Accessed Apr 1, 2024)</ref> and amount which was reported by Zhou Tong on the BitcoinTalk forums<ref name=":2" />. This is included on some lists such as dree12's list on BitcoinTalk<ref name="bitcointalklistold-20" /> and rounded to 18,548 by Kyle Gibson<ref name="kylegibson-86" />. Kyle Gibson gave an estimated value of $90,000 USD<ref name="kylegibson-86" />. | ||
* BitMarket.eu had a liquidation, and in the legal paperwork, they reported "about" 19980 bitcoins<ref name="bitcointalklistold-20" />. | * BitMarket.eu had a liquidation, and in the legal paperwork, they reported "about" 19980 bitcoins<ref name="bitcointalklistold-20" />. | ||
* BitcoinTalk user dree12 reported a total amount affected reported to be at least 38527 bitcoin<ref name="bitcointalklistold-20" />. This is very similar to an estimate on Bitcoin.com, which reported that the exchange lost over 38,000 BTC during the spring incident, which refers to an event that breached Bitcoinica's Rackspace servers on May 12th, 2012<ref name="newsdotbitcoin-7" />. | * BitcoinTalk user dree12 reported a total amount affected reported to be at least 38527 bitcoin<ref name="bitcointalklistold-20" />. This is very similar to an estimate on Bitcoin.com, which reported that the exchange lost over 38,000 BTC during the spring incident, which refers to an event that breached Bitcoinica's Rackspace servers on May 12th, 2012<ref name="newsdotbitcoin-7" />. | ||
The total amount lost has been estimated at $91,000 USD. | The total amount lost has been estimated at $91,000 USD. | ||
| Line 75: | Line 87: | ||
“On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked. The exchange told users that they had “discovered a suspicious bitcoin transaction that doesn’t seem to be initiated by any one of the company owners.” The hot wallet hack was initially suspected to be linked to Bitcoinica owner A. Vinnik, leading some to suspect it was an exit scam.” | “On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked. The exchange told users that they had “discovered a suspicious bitcoin transaction that doesn’t seem to be initiated by any one of the company owners.” The hot wallet hack was initially suspected to be linked to Bitcoinica owner A. Vinnik, leading some to suspect it was an exit scam.” | ||
=== Suspicious Transaction Reported === | |||
Zhou Tong reported a suspicious Bitcoin transaction not initiated by any company owners, prompting the suspension of Bitcoinica's servers for a security investigation<ref name=":2" />. The transaction involved a significant loss of 18,547.66867623 BTC<ref name=":2" />. While financial and trading data were deemed safe apart from the Bitcoin loss, concerns arose within the community about the vulnerability of hosted systems and the need for enhanced security measures<ref name=":2" />. Comments express shock at the severity of the loss and skepticism about Bitcoinica's legitimacy, with some suggesting the incident as proof of previous warnings regarding the platform's credibility<ref name=":2" />. Despite assurances from Bitcoinica's founder, doubts lingered about the site's security practices and potential scams within the Bitcoin community<ref name=":2" />. | |||
== Ultimate Outcome == | == Ultimate Outcome == | ||
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done? | What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done? | ||
As a result, on August 1, 2012, the Wendon Group investment fund, a creditor to Bitcoinica LP, announced the appointment of a receiver under New Zealand law, marking the downfall of the platform<ref name="bitcoinwiki-24" />. | |||
=== Zhou Tong Leaving Bitcoin === | === Zhou Tong Leaving Bitcoin === | ||
| Line 86: | Line 100: | ||
=== Lawsuit Against Platform === | === Lawsuit Against Platform === | ||
Finextra reports that four former users of Bitcoinica have filed a lawsuit alleging that they are owed nearly half a million dollars in missing funds, as well as damages<ref name="finextra-13" />. Bitcoinica, once a successful exchange created by teenager Zhou Tong, suffered two major hacking incidents earlier this year, resulting in the theft of thousands of Bitcoins. Despite assurances from Bitcoinica that the stolen funds were from the exchange itself and not customers, the site has remained offline, leaving users uncertain about the fate of their investments. Additionally, Bitcoinica had initially promised to honor all withdrawal requests but later informed users that only half of their funds would be returned, prompting speculation about the exchange's integrity. Amidst rumors implicating Tong in the hacks, the plaintiffs filed a complaint in San Francisco alleging that Bitcoinica, its successor Intersango, and associated individuals conspired to deprive them of their rights regarding the missing funds<ref name="finextra-13" />. | Finextra reports that four former users of Bitcoinica have filed a lawsuit alleging that they are owed nearly half a million dollars in missing funds, as well as damages<ref name="finextra-13" />. Bitcoinica, once a successful exchange created by teenager Zhou Tong, suffered two major hacking incidents earlier this year, resulting in the theft of thousands of Bitcoins. Despite assurances from Bitcoinica that the stolen funds were from the exchange itself and not customers, the site has remained offline, leaving users uncertain about the fate of their investments. Additionally, Bitcoinica had initially promised to honor all withdrawal requests but later informed users that only half of their funds would be returned, prompting speculation about the exchange's integrity. Amidst rumors implicating Tong in the hacks, the plaintiffs filed a complaint in San Francisco alleging that Bitcoinica, its successor Intersango, and associated individuals conspired to deprive them of their rights regarding the missing funds<ref name="finextra-13" />. | ||
=== BitMarket.eu Collapse Resulting === | |||
In December, BitMarket.eu's administrator M4v3r admitted in a BitcoinTalk forum thread to having stored bitcoins on the Bitcoinica platform, which are now lost<ref name=":0" />. His message apologized for a failure to respond promptly due to personal issues and a search for a solution<ref name=":0" />. It reveals that he cannot currently process withdrawals, attributing the problem to a misguided attempt at providing a hedge fund service for Bitmarket users<ref name=":0" />. This endeavor led to a significant loss of bitcoins, worsened by a subsequent rise in BTC price<ref name=":0" />. The administrator acknowledges their fault and lack of funds to cover the loss, proposing options like finding an investor or starting over with explicit fees to repay the debt<ref name=":0" />. They express a commitment to making amends and provide a bitcoin address for donations to help users with locked funds<ref name=":0" />. The attached comments reflect skepticism and accusations of scamming, countered by the sender's assertion of honesty despite the dire situation<ref name=":0" />. | |||
=== Inclusion In Incident Lists === | === Inclusion In Incident Lists === | ||
This incident was included in many sources, including: | This incident was included in many sources, including: | ||
* a list compiled by BitcoinTalk user dree12<ref name="bitcointalklistold-20" />. | * both versions of a list compiled by BitcoinTalk user dree12<ref name="bitcointalklistold-20" /><ref name="bitcointalklist-87" />. | ||
* a list of incidents put together by Kyle Gibson<ref name="kylegibson-86" />. | |||
* a Bitcoin Magazine infographic<ref name="bitcoinmagazine-6" /> (along with another Bitcoinica theft). | * a Bitcoin Magazine infographic<ref name="bitcoinmagazine-6" /> (along with another Bitcoinica theft). | ||
* Bitcoin.news lists this as one of the most controversial in the industry<ref name="newsdotbitcoin-7" />. | * Bitcoin.news lists this as one of the most controversial in the industry<ref name="newsdotbitcoin-7" />. | ||
| Line 136: | Line 154: | ||
<ref name="bitcoinmagazine-23">[https://bitcoinmagazine.com/articles/bitcoinica_an_obituary-1336979566 Bitcoinica: An Obituary - Bitcoin Magazine] (Accessed Feb 4, 2020)</ref> | <ref name="bitcoinmagazine-23">[https://bitcoinmagazine.com/articles/bitcoinica_an_obituary-1336979566 Bitcoinica: An Obituary - Bitcoin Magazine] (Accessed Feb 4, 2020)</ref> | ||
<ref name="bitcoinwiki-24">[https://en.bitcoin.it/wiki/Bitcoinica Bitcoinica - Bitcoin Wiki] (Feb 4, 2020)</ref> | <ref name="bitcoinwiki-24">[https://en.bitcoin.it/wiki/Bitcoinica Bitcoinica - Bitcoin Wiki] (Feb 4, 2020)</ref> | ||
<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref> | <ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents - Kyle Gibson] (Jan 25, 2020)</ref> | ||
<ref name="bitcointalklist-87">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref> | <ref name="bitcointalklist-87">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses - BitcoinTalk] (Feb 15, 2020)</ref> | ||
<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref> | <ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref> | ||
<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref> | <ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref> | ||
</references> | </references> | ||
Revision as of 16:14, 5 April 2024
Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
This shows a definite need for hot wallet insurance. Reduction in the level of funds stored in hot wallets would reduce the risk.
This exchange or platform is based in New Zealand, or the incident targeted people primarily in New Zealand.[1][2][3][4][5][6]
About Bitcoinica
Bitcoinica was an online platform launched on September 8, 2011, enabling leveraged speculation in its contract-for-difference (CFD) market against the Bitcoin to USD exchange rate[7].
The Bitcoinica exchange platform was based in New Zealand, and founded by Zhou Tong[1].
Despite his position as the creator of a financial speculation service and his strong belief in libertarian capitalist ideals, Bitcoinica to him has never been about the profit. “Bitcoinica is not a money making machine,” he writes. “It’s just a product that sets a high standard for the Bitcoin community.”[1]
The Reality
The history of Bitcoinica was marred by security breaches and financial losses[7]. On March 1st, 2012, the site experienced a significant loss of over 43,000 bitcoins due to an internal security breach at its web hosting provider[7].
What Happened
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
| Date | Event | Description |
|---|---|---|
| September 8th, 2011 | Bitcoinica Service Launches | The Bitcoinica service is launched[7]. |
| May 6th, 2012 | Hot Wallet Hack Announced | “On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked.” The date reported by Kyle Gibson[8]. |
| May 11th, 2012 7:16:37 AM MDT | BitcoinTalk Emergency Thread | Bitcoinica administrator Zhou Tong posts an emergency thread announcing a suspicious transaction on the platform[9]. The suspicious Bitcoin transaction not initiated by any company owners, prompting the suspension of Bitcoinica's servers for a security investigation[9]. The transaction involved a significant loss of 18,547.66867623 BTC[9]. While financial and trading data were deemed safe apart from the Bitcoin loss, concerns arose within the community about the vulnerability of hosted systems and the need for enhanced security measures[9]. Comments express shock at the severity of the loss and skepticism about Bitcoinica's legitimacy, with some suggesting the incident as proof of previous warnings regarding the platform's credibility. Despite assurances from Bitcoinica's founder, doubts lingered about the site's security practices and potential scams within the Bitcoin community[9]. |
| May 11th, 2012 | Exploit Date Bitcoin Wiki | The exploit date, according to the Bitcoin Wiki[7]. |
| May 12th, 2012 5:19:00 AM MDT | BitcoinTalk Reported Time | The blockchain timestamp of the theft reported by BitcoinTalk, without any timezone being specified[10]. The BitcoinTalk forums generally have posts with timestamps specified in UTC. |
| May 12, 2012 | Bitcoin.com Date Reported | "On May 12, 2012, a hacker breached the Bitcoinica Rackspace server, according to the now-defunct exchange’s founder Zhou Tong."[11] |
| May 14th, 2012 6:12:46 AM MDT | Bitcoin Magazine Obituary Published | Vitalik Buterin via Bitcoin Magazine published an obituary of the Bitcoinica exchange[1]. The Bitcoin community faced a series of setbacks, including thefts and financial stress, leading to the shutdown of Bitcoinica, a trading platform[1]. Despite assurances of compensation for users, the future of the platform under Intersango's leadership remains uncertain[1]. Founder Zhou Tong, though expressing faith in Bitcoin's potential for financial liberty, decided to exit the space due to a misalignment with his values, emphasizing the need to create value for society[1]. While criticized for security flaws and inexperience, Zhou's endeavor reflects the ethos of Bitcoin as a realm of opportunity and innovation[1]. |
| August 13th, 2012 11:18:00 AM MDT | Lawsuit Files Against Platform | FinExtra reports that Bitcoinica faces a lawsuit from four former users who claim they are owed nearly $460,000 in missing funds and damages[12]. Founded by teenager Zhou Tong, Bitcoinica suffered two hacking incidents earlier this year, resulting in the theft of thousands of Bitcoins worth tens of thousands of dollars. Despite assurances from Bitcoinica that the stolen funds were from the exchange itself, not customers, and promises to honor withdrawal requests, users allege only half of their money would be returned. With suspicions circulating that Tong might be involved in the hacks, the plaintiffs have filed a complaint in San Francisco against Bitcoinica, Intersango, and associated individuals, accusing them of conspiring to hinder and deprive the plaintiffs of their rights to the missing funds[12]. |
| December 21st, 2012 1:53:16 AM MST | BitMarket.eu Posts About Insolvency | BitMarket.eu administrator M4v3r admits in a BitcoinTalk forum thread to having stored bitcoins on the Bitcoinica platform, which are now lost. [13] His message apologized for a failure to respond promptly due to personal issues and a search for a solution[13]. It reveals that he cannot currently process withdrawals, attributing the problem to a misguided attempt at providing a hedge fund service for Bitmarket users[13]. This endeavor led to a significant loss of bitcoins, worsened by a subsequent rise in BTC price[13]. The administrator acknowledges their fault and lack of funds to cover the loss, proposing options like finding an investor or starting over with explicit fees to repay the debt[13]. They express a commitment to making amends and provide a bitcoin address for donations to help users with locked funds[13]. The attached comments reflect skepticism and accusations of scamming, countered by the sender's assertion of honesty despite the dire situation[13]. |
| December 21st, 2012 | BitMarket.eu Funds Announced | "On December 21, 2012, it was discovered that BitMarket.eu lost a large portion of customer funds which were stored on Bitcoinica. These customers were reportedly unaware that their funds were stored on Bitcoinica. Return of a portion of these funds is still possible, pending the outcome of liquidation."[10] |
| July 26th, 2013 5:52:51 PM MDT | Updated BitcoinTalk List | The incident is included in the updated BitcoinTalk list[14]. The amount is increased and valued according to the January 2014 price. A disclaimer is added about the amount potentially increasing as the liquidation proceeds[14]. |
| February 3rd, 2017 10:00:04 AM MST | Bitcoin.com Article | The incident is included with specific mention in a list of bitcoin thefts which you may have forgotten about, published by news site Bitcoin.com[11]. |
Technical Details
The vulnerability reportedly happened through a compromised email address, which had a higher level of permissions than necessary[10]. The chief transaction involved in the theft is 7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8[15], which was announced on the BitcoinTalk forums[9].
BitcoinTalk Summary
Zhou Tong, former founder of Bitcoinica, discovered an entry into Bitcoinica's Rackspace server through an excessively privileged compromised email address. This caused the theft of the entire “hot wallet”, funds stored on-site, as well as the loss of the main database. No backups were kept. Bitcoinica shut down because of this incident. The claims process is still ongoing; however, Bitcoinica is now entering receivership.
Total Amount Lost
There are three different estimates of the amount lost in this case.
- The first value of 18547.66867623 comes from the blockchain transaction[15] and amount which was reported by Zhou Tong on the BitcoinTalk forums[9]. This is included on some lists such as dree12's list on BitcoinTalk[10] and rounded to 18,548 by Kyle Gibson[8]. Kyle Gibson gave an estimated value of $90,000 USD[8].
- BitMarket.eu had a liquidation, and in the legal paperwork, they reported "about" 19980 bitcoins[10].
- BitcoinTalk user dree12 reported a total amount affected reported to be at least 38527 bitcoin[10]. This is very similar to an estimate on Bitcoin.com, which reported that the exchange lost over 38,000 BTC during the spring incident, which refers to an event that breached Bitcoinica's Rackspace servers on May 12th, 2012[11].
The total amount lost has been estimated at $91,000 USD.
Immediate Reactions
“On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked. The exchange told users that they had “discovered a suspicious bitcoin transaction that doesn’t seem to be initiated by any one of the company owners.” The hot wallet hack was initially suspected to be linked to Bitcoinica owner A. Vinnik, leading some to suspect it was an exit scam.”
Suspicious Transaction Reported
Zhou Tong reported a suspicious Bitcoin transaction not initiated by any company owners, prompting the suspension of Bitcoinica's servers for a security investigation[9]. The transaction involved a significant loss of 18,547.66867623 BTC[9]. While financial and trading data were deemed safe apart from the Bitcoin loss, concerns arose within the community about the vulnerability of hosted systems and the need for enhanced security measures[9]. Comments express shock at the severity of the loss and skepticism about Bitcoinica's legitimacy, with some suggesting the incident as proof of previous warnings regarding the platform's credibility[9]. Despite assurances from Bitcoinica's founder, doubts lingered about the site's security practices and potential scams within the Bitcoin community[9].
Ultimate Outcome
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
As a result, on August 1, 2012, the Wendon Group investment fund, a creditor to Bitcoinica LP, announced the appointment of a receiver under New Zealand law, marking the downfall of the platform[7].
Zhou Tong Leaving Bitcoin
Founder Zhou Tong decided to leave bitcoin entirely[1].
“I always believe in Bitcoin, or simply anything that brings people financial liberty. I have heavily invested in Bitcoin (I purchased one 1,000 BTC gold coin from Casascius and will keep it for as long as I can).”
Vitalik Buterin had strong praise for Zhou Tong and criticized his critics[1].
Zhou Tong has often been reviled as a scammer, and this crisis has, predictably, only amplified such cries. But his actions over the past eight months do not paint the picture of a man who consciously set out to defraud the public with a Ponzi scheme or an arcane system of liquidation rules; rather, they paint the picture of a teenager, still uncorrupted by the rigidities of the status quo, ready to discover the world and find a place where he can make a difference. Of course, Bitcoinica’s history is marked by security blunders and telling signs of Zhou’s inexperience. However, failure is an inevitable part of learning and innovation, and if the Bitcoin community begins to treat failure as an unforgivable sin and every blunder as proof of moral turpitude, then it will cease to be a community that values learning and innovation at all. Instead, it will become yet another manifestation of the inflexible and bureaucratic status quo.
Lawsuit Against Platform
Finextra reports that four former users of Bitcoinica have filed a lawsuit alleging that they are owed nearly half a million dollars in missing funds, as well as damages[12]. Bitcoinica, once a successful exchange created by teenager Zhou Tong, suffered two major hacking incidents earlier this year, resulting in the theft of thousands of Bitcoins. Despite assurances from Bitcoinica that the stolen funds were from the exchange itself and not customers, the site has remained offline, leaving users uncertain about the fate of their investments. Additionally, Bitcoinica had initially promised to honor all withdrawal requests but later informed users that only half of their funds would be returned, prompting speculation about the exchange's integrity. Amidst rumors implicating Tong in the hacks, the plaintiffs filed a complaint in San Francisco alleging that Bitcoinica, its successor Intersango, and associated individuals conspired to deprive them of their rights regarding the missing funds[12].
BitMarket.eu Collapse Resulting
In December, BitMarket.eu's administrator M4v3r admitted in a BitcoinTalk forum thread to having stored bitcoins on the Bitcoinica platform, which are now lost[13]. His message apologized for a failure to respond promptly due to personal issues and a search for a solution[13]. It reveals that he cannot currently process withdrawals, attributing the problem to a misguided attempt at providing a hedge fund service for Bitmarket users[13]. This endeavor led to a significant loss of bitcoins, worsened by a subsequent rise in BTC price[13]. The administrator acknowledges their fault and lack of funds to cover the loss, proposing options like finding an investor or starting over with explicit fees to repay the debt[13]. They express a commitment to making amends and provide a bitcoin address for donations to help users with locked funds[13]. The attached comments reflect skepticism and accusations of scamming, countered by the sender's assertion of honesty despite the dire situation[13].
Inclusion In Incident Lists
This incident was included in many sources, including:
- both versions of a list compiled by BitcoinTalk user dree12[10][14].
- a list of incidents put together by Kyle Gibson[8].
- a Bitcoin Magazine infographic[16] (along with another Bitcoinica theft).
- Bitcoin.news lists this as one of the most controversial in the industry[11].
- Bitcoin Exchange Guide[17].
- Slowmist[18].
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
Ongoing Developments
There are a few potential ongoing developments.
Identity Of The Hacker
According to BitcoinTalk, the hacker is unknown[10].
Wendon Group Legal Action
Venture capital group Wendon Group threatened legal action against Bitcoinica Consultancy[10].
New Zealand Bankruptcy
A receivership in New Zealand was ongoing[10].
General Prevention Policies
This is a case where simply knowing who's holding the funds and storing them properly offline with multiple signatures would have avoided the issues.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 Bitcoinica: An Obituary - Bitcoin Magazine (Accessed Feb 4, 2020)
- ↑ Zhou Tong - "The hacker almost gained access to our Mt. Gox API keys, before I revoke them! He could get 30,000+ BTC easily if I was asleep, or busy." - BitcoinTalk (Accessed Apr 5, 2024)
- ↑ https://bitcointalk.org/index.php?topic=81045.msg896112#msg896112
- ↑ https://bitcointalk.org/index.php?topic=81581.0;topicseen
- ↑ https://nakedsecurity.sophos.com/2012/05/14/bitcoin-exchange-gets-attacked-and-loses-cash-again/
- ↑ https://news.8btc.com/analyst-mt-gox-lost-100000-more-bitcoins-apart-from-the-2-5-billion-hack
- ↑ 7.0 7.1 7.2 7.3 7.4 7.5 Bitcoinica - Bitcoin Wiki (Feb 4, 2020)
- ↑ 8.0 8.1 8.2 8.3 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents - Kyle Gibson (Jan 25, 2020)
- ↑ 9.00 9.01 9.02 9.03 9.04 9.05 9.06 9.07 9.08 9.09 9.10 9.11 [Emergency ANN] Bitcoinica site is taken offline for security investigation - BitcoinTalk (Accessed Apr 5, 2024)
- ↑ 10.00 10.01 10.02 10.03 10.04 10.05 10.06 10.07 10.08 10.09 10.10 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old] - BitcoinTalk (Jan 28, 2020)
- ↑ 11.0 11.1 11.2 11.3 The Bitcoin Exchange Thefts You May Have Forgotten - Bitcoin.com (Jan 29, 2020)
- ↑ 12.0 12.1 12.2 12.3 Users sue Bitcoin exchange over $460k in missing funds - FinExtra (Feb 3, 2020)
- ↑ 13.00 13.01 13.02 13.03 13.04 13.05 13.06 13.07 13.08 13.09 13.10 13.11 13.12 13.13 M4V3r - "Earlier this year, I had this "genius" idea which led me to making a fatal mistake. I thought I could provide a hedge fund service for Bitmarket users. There were other sites providing this service so I guesses that it could be successful. I had experience in trading before, all I needed is a platform. And there was one - Bitcoinica." - BitcoinTalk (Accessed Apr 2, 2024)
- ↑ 14.0 14.1 14.2 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses - BitcoinTalk (Feb 15, 2020)
- ↑ 15.0 15.1 Bitcoinica Theft Transaction - Blockchain.com (Accessed Apr 1, 2024)
- ↑ Infographic: An Overview of Compromised Bitcoin Exchange Events (Jan 30, 2020)
- ↑ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com (Mar 5, 2020)
- ↑ SlowMist Hacked - SlowMist Zone (Jun 26, 2021)