ShapeShift Three Thefts

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

ShapeShift At Trade Show

ShapeShift hired a new security "expert" and gave them full access to hot wallet funds and unrestricted access to different computers. The employee then installed UDP on a few computers and stole from the hot wallet.

Without fully securing their system, they then proceeded to reopen the platform, not just once but twice. Even though the employee had been fired, he was able to use the UDP to provide details to another hacker - who accessed and withdrew more funds.

This exchange or platform is based in United States, or the incident targeted people primarily in United States.

About ShapeShift

ShapeShift was founded on July 1st, 2014, with their swapping services launching in August 2014. The company operated out of Denver, Colorado. The company operated on core principles of decentralization and user privacy. ShapeShift CEO Erik Voorhees initially used the pseudonym Beorn Gonthier.

In March 2015, ShapeShift secured a seed-stage investment of US$525,000 from Roger Ver and Barry Silbert, followed by an additional funding round in September 2015, raising a total of US$1.6 million from investors such as Digital Currency Group, Bitfinex, Bitcoin Capital, and Mardal Investments. The company launched its iOS platform on June 2015, enabling users to exchange 25 digital currencies and value tokens. On June 11, 2015, ShapeShift ceased its services in New York in response to the state's newly introduced regulatory framework for digital currency businesses known as the BitLicense, citing concerns that complying with these regulations would jeopardize users' personal and private data.

Former Principle Address: 1624 Market Street, Suite 226 #29882, Denver, CO 80202

Expansion Of Architecture Team

"And we’ve always been playing catch-up. Trying to build at the speed of this industry, not only along the vertical of Bitcoin proper, but along the breadth of all crypto, is a challenge."

"Last Fall, we realized the “minimum viable product” server architecture established originally for ShapeShift was insufficient. We needed a professional to join the small team, and craft a scalable, and secure, server apparatus upon which our technology could grow."

"We hired such a person, and patted ourselves on the back for our proactive decision. On paper, he looked great; the reference we called confirmed his prior role and responsibility. He’d even been into Bitcoin since 2011/2012 and had built miners in his room. Awesome."

"[T]o many, ShapeShift appears to be a simple web service. It’s taken a lot of work by our engineers to keep up that appearance. Behind the scenes, the platform is complex. Over 1,400 direct asset trading pairs, integrations with half a dozen exchange API’s requiring real-time price information on all offered cryptocurrencies, low-latency service API’s to several dozen partners, the monitoring and calculation of constantly changing exchange rates and order book depth in some of the most volatile markets on Earth, and incorporation of what can only be described as alpha-level software in various states of disarray (coin daemons…bleh)."

The Reality

The newly hired employee hadn't been properly background checked. It turned out that they were dishonest and stole from ShapeShift, and additionally added backdoors onto their system.

"We learn some more things. [The thief employee] has prior police records in Florida, where he’s from." "With civil and criminal cases proceeding against him"

What Happened

In 2016, ShapeShift lost around $230,000 in three thefts over the course of four weeks in March and April, which were carried out by a company employee and a Russian hacker who was granted backdoor access to their servers.

Key Event Timeline - ShapeShift Three Thefts

Date	Event	Description
July 1st, 2014	ShapeShift Founded	ShapeShift is founded.
August 2014	Services Launch	The launch of the ShapeShift swapping services.
February 4th, 2015 6:00:15 AM MST	Bitcoinist Interview Published	Bitcoinist published an interview with Shapeshift.io CEO, known at the time as Beorn Gonthier, where they discussed various aspects of the cryptocurrency industry and Shapeshift's role within it. Gonthier highlighted Shapeshift's evolution from a simple exchange service to a full-fledged platform offering decentralized finance (DeFi) solutions. He emphasized the importance of decentralization and user privacy, which are core principles for Shapeshift. Gonthier also addressed the challenges facing the cryptocurrency industry, including regulatory compliance and the need for interoperability between different blockchain networks. Additionally, he discussed the potential impact of emerging technologies such as non-fungible tokens (NFTs) and decentralized autonomous organizations (DAOs) on the industry's future landscape. Gonthier expressed optimism about the continued growth and innovation in the cryptocurrency space, with Shapeshift poised to play a significant role in shaping its trajectory.
March 10th, 2015 9:00:00 AM MDT	CEO Identity Unmasked	CoinDesk reported on ShapeShift having secured $525,000 in seed funding from investors Barry Silbert and Roger Ver. CEO Erik Voorhees, previously operating under the alias Beorn Gonthier, revealed his identity as the creator of ShapeShift. The funding will be allocated towards enhancing the exchange engine, marketing efforts, and legal work in Switzerland. With a team of eight full-time staff, ShapeShift has seen a significant increase in volume, emphasizing trust by design and eliminating the need for custodianship of user funds. The company operates entirely on Bitcoin, avoiding bank accounts and fiat currency transactions, and adheres to regulatory requirements in the markets it operates in.
June 11th, 2015	BitLicense Cease New York Services	ShapeShift ceased its services in New York in response to the state's newly introduced regulatory framework for digital currency businesses known as the BitLicense. The company cited concerns that complying with these regulations would jeopardize users' personal and private data.
March 14th, 2016	Employee Theft Incident	ShapeShift reports that 315 bitcoin went missing and their employee who was in charge of security showed up at 11:30 AM.
April 7th, 2016	More Fund Stolen	Additional funds are stolen from the platform "On Thursday April 7th, around midday, we notice a bunch of Ethereum had left the hot wallet on the new infrastructure at [a new cloud service provider]. The NEW infrastructure. The infrastructure that was not even public yet. At first, we believed our code had done something weird, perhaps sweeping funds to a development server address or similar. Then we noticed a bunch of Bitcoin was also missing. And then Litecoin also."
April 9th, 2016 11:00:00 AM MDT	Ledger Labs Contacted	After the third consecutive theft, "On 2016-04-09 at 13:00 EDT, ShapeShift CEO Erik Voorhees contacted Ledger Labs Inc. (LLI) with a request for digital investigative assistance."
April 13th, 2016 6:32:12 PM MDT	Reddit Community Updated	Erik posts an update on Reddit for the community. The team is confident that their own team member was involved in the attack. At this time, they are still resolving refunds for prior pending orders of customers.
April 18th, 2016 10:25:00 AM MDT	CoinDesk Article Published	CoinDesk reports that ShapeShift experienced losses totaling $230,000 in three separate thefts over the span of a month, as revealed in an incident report obtained by CoinDesk. The report disclosed that an employee perpetrated the initial theft of $130,000 in mid-March and subsequently sold sensitive security information to an external hacker after being terminated. Further thefts amounting to $100,000 occurred in early April. ShapeShift took steps to enhance security measures following the attacks and partnered with Toronto-based consultancy Ledger Labs to develop new protocols. Despite the setbacks, ShapeShift assured users that no customer funds were lost or compromised and aimed to resume operations by April 20. Legal action has been initiated against the former employee, and efforts are underway to recover the stolen funds.
April 19th, 2016 12:15:42 AM MDT	Bitcoin.com Article From Erik Voorhees	In a harrowing account shared on Bitcoin.com, Erik Voorhees details the company's ordeal of being repeatedly hacked, shedding light on the betrayal of a trusted employee, Bob. Initially experiencing theft of Bitcoin due to Bob's actions, the company faces further breaches despite implementing new infrastructure. Through forensic investigation and communication with the hacker, Rovion, it becomes evident that Bob had sold sensitive information, including server access and source code, to the hacker. Bob's betrayal not only led to significant financial losses but also raised questions about the security practices within the company. The narrative underscores the importance of robust security measures and vigilance in the face of evolving cyber threats.
April 19th, 2016 9:01:00 AM MDT	CoinTelegraph Article Published	CoinTelegraph reports a total of 469 BTC, 1900 LTC, and 5800 ETH taken through all 3 attacks, and estimates a value of $230,000. The incident has prompted a complete shutdown of its website for reconstruction with enhanced security measures. CEO Erik Voorhees disclosed that a rogue employee had provided information to the hacker, identified as Rovion Vavilov, facilitating the breaches. Forensic investigations led by Michael Perklin from Ledger Labs are ongoing, aiming to recover funds and ensure improved security. Despite the setbacks, ShapeShift assured customers that the platform is set to relaunch on April 20.
April 25th, 2016 6:48:00 AM MDT	Hacking Distributed Article	A Hacking Distributed article is published which is highly critical of the official story from Erik Voorhes. However, several "red flags" are highlighted in the detailed account of the incidents. According to Voorhees, a sysadmin named Bob initiated the thefts by installing a backdoor on a colleague's computer, then emptied the Bitcoin hot wallet using his own credentials. Afterward, Bob sold the backdoor access to a hacker named Rovion, who subsequently raided ShapeShift's hot wallets in multiple currencies. However, Emin Gün Sirer finds numerous inconsistencies in Voorhees's explanation, pointing out implausible scenarios such as Bob's willingness to use his real name in criminal activities and Rovion's unlikely moral stance against Bob. Sirer raises flags regarding the believability of the story, questioning the motives and actions of the involved parties. While acknowledging ShapeShift's security failures, Sirer emphasizes the importance of a thorough investigation to uncover the truth behind the hacks and prevent future incidents, expressing skepticism toward accepting the provided narrative solely based on the accounts of the involved hackers.
April 25th, 2016 9:52:21 AM MDT	Reddit And Defense	The Hacking Distribute article is shared on Reddit. In response to points raised by Emin Gün Sirer regarding the recent digital currency thefts at ShapeShift, Erik Voorhees addresses each issue individually. He clarifies that the communication between ShapeShift and the hacker, known as Rovion, occurred after Rovion reached out to ShapeShift, not the other way around, resolving one of Sirer's concerns. Voorhees acknowledges the oversight in recognizing the employee's incompetence earlier and agrees with Sirer's point on this matter. However, he disputes some of Sirer's assertions, such as the insinuation that ShapeShift's response was motivated by race. Voorhees defends the steps taken by ShapeShift in handling the situation and invites Sirer to engage directly if he wishes to discuss further. Another user, itsreallyonlysmellz, criticizes ShapeShift's approach and urges them to acknowledge the shortcomings in their story.
April 25th, 2016 5:16:29 PM MDT	Discussion Of Russian Hacker	Erik Voorhees discusses his interactions with the Russian hacker.
June 30th, 2016	ChainSec Date Listed	The date which ChainSec lists for this incident. There is no indication provided as to where this date came from. At least the year is consistent.
July 9th, 2016 5:05:00 AM MDT	CoinTelegraph Article Coins Moving	CoinTelegraph reports that Bitcoin stolen from ShapeShift have begun moving, with the thief sending portions of the loot to different addresses to obscure traceability. Despite CEO Erik Voorhees' updates on the situation, the perpetrator remains unidentified, and most of the stolen funds, valued at over $230,000, have not been recovered. The thief's tactic involves splitting transactions and sending them to multiple addresses to cover their tracks, leveraging the anonymity of Bitcoin transactions. ShapeShift, focused on rebuilding and recovering since the attack, assures customers that their funds were not affected, and the platform's infrastructure has been reconstructed.
September 4th, 2018 2:10:00 PM MDT	Membership Model Introduced	ShapeShift introduced a membership model for users, which would eventually become mandatory, marking a departure from ShapeShift's previous model of "exchange without accounts". CEO Erik Voorhees expressed reluctance about making personal information collection mandatory and emphasized the importance of financial privacy. Members will receive discounts on exchange rates, rewards for using the FOX token, and higher transaction limits. The shift towards account-based features is driven by user requests, growing interest in tokenization, and regulatory uncertainties in the cryptocurrency exchange sector. Despite these changes, ShapeShift will maintain its non-custodial exchange status, ensuring that it does not hold customer funds.

Technical Details

"From the recovered data, we discovered the malware, if that’s the right term. There was a program, written in Go, installed on a crucial server which communicated with coins. This program had its dates changed to appear consistent with the setup of the server, and its filename made to look innocuous. But it was the direct tool by which funds were stolen." The thief employee "had installed an RDP (remote desktop protocol – basically a screen viewer or controller) on Greg’s computer. And perhaps on others, we must assume."

"The employee, who was not identified, later sold sensitive security information to an outside hacker after being fired from the exchange. Another $100,000 in funds denominated in bitcoin, ether and litecoin were stolen on 7th and 9th April." "The report goes on highlight the steps taken by the hacker to obscure his or her tracks. It also details two conversations between the hacker and CEO Erik Voorhees, during which it was claimed that the employee had sold key security data."

Total Amount Lost

There were a total of three separate attacks carried out against the ShapeShift platform in March and April of 2016. All attacks took funds from the hot wallet. The first was carried out by an internal employee, and the second and third were carried out by an external actor.

List Of Attacks

#	Date	Actor	BTC	ETH	LTC	USD	Notes
1	March 14th	Rogue Employee	315			$106k	Initial theft by an internal employee of ShapeShift.
2	April 7th	Rovion Vavilov	97	3600	1900		First attack by external hacker Rovion, using UDP access point set up by rogue employee.
3	April 9th	Rovion Vavilov	57	2200			Final attack by external hacker Rovion, using UDP access point set up by rogue employee.
Total From All Attacks			469	5800	1900	$230k

"Thieves broke in three separate times over a time span of two weeks and cleaned out the hot wallets each time, totaling around $200K USD." "Digital currency exchange ShapeShift lost as much as $230,000 in three separate thefts over the course of a month, according to an incident report prepared by the service."

"According to the report, that employee stole $130,000 from ShapeShift in mid-March."

"After their dismissal, the ex-employee sold security information such as ShapeShift’s IP address to an outside hacker, who then stole 154 BTC, 5,800 ETH and 1,900 LTC in two further hacks."

Table of loss amounts:

Table Of Loss Amounts Reported

Source	Date	BTC	ETH	LTC	USD	Attacks	Notes
CoinDesk	April 18th, 2016	469	5800	1900	$230k	All Three	Initial theft $130k, subsequent $100k.
CoinTelegraph	April 19th, 2016	469	5800	1900	$230k	All Three	315 BTC in first attack, $124k in second and third attacks.
ChainSec	June 29th, 2019				$200k	Unspecified

The total amount lost has been estimated at $230,000 USD.

Immediate Reactions

Initial Theft Dealt With

"According to the report, the first incident took place on 14th March, the company said, resulting in the loss of 315 BTC. It was soon established that a ShapeShift employee was behind the incident." "Despite our note to all employees to come into the office urgently, our head IT guy, the one responsible for security and infrastructure, arrives at 11:30am."

"We ask [him] to join our discussion. We reveal the hack to him. We ask him if he had logged in at all that morning, to which he responded no (on several occasions). On the new[s] of the theft, he seems neither particularly shocked nor outraged, yet it was his security that failed us. Immediately, he starts pointing to red herring explanations, “It must be one of the exchanges that got hacked, that happens all the time.”"

“Well, look at the IP address, it happened somewhere off west Africa.” Umm, IP addresses on block explorers indicate only the first node that noticed a transaction, and are generally meaningless in the context of Bitcoin. (What kind of Bitcoiner doesn’t know that?)"

Subsequent Thefts After Sale

"After their dismissal, the ex-employee sold security information such as ShapeShift’s IP address to an outside hacker, who then stole 154 BTC, 5,800 ETH and 1,900 LTC in two further hacks."

"The employee, who was not identified, later sold sensitive security information to an outside hacker after being fired from the exchange. Another $100,000 in funds denominated in bitcoin, ether and litecoin were stolen on 7th and 9th April." "The report goes on highlight the steps taken by the hacker to obscure his or her tracks. It also details two conversations between the hacker and CEO Erik Voorhees, during which it was claimed that the employee had sold key security data."

"On Thursday April 7th, around midday, we notice a bunch of Ethereum had left the hot wallet on the new infrastructure at [a new cloud service provider]. The NEW infrastructure. The infrastructure that was not even public yet. At first, we believed our code had done something weird, perhaps sweeping funds to a development server address or similar. Then we noticed a bunch of Bitcoin was also missing. And then Litecoin also."

"After several hours of fruitless investigation, we decide that one of the most likely explanations is that the cloud company itself was compromised. This has happened before in Bitcoinland. We thought [they were] reputable, but who knows? Clouds are very convenient and scalable, but on some level you’re trusting that company with your infrastructure. We decided we had to keep the site down for at least 24 hours, and bust our asses to prepare, yet again, an entirely new infrastructure on an entirely new set of servers."

"Despite that, we watched the blockchains for the hacked funds. We tracked some to an exchange account. We got profile information of the depositor." “Nice job on the hack. How did you do it? -Erik”

"The rest of that night, and into the next day (Friday, the 8th), the team worked feverishly to rebuild everything on new infrastructure, once again, in a wholly clean environment on a wholly separate host." "[A]fter herculean efforts, we had everything ready by Friday night, 24 hrs later. We launched the site on yet a new provider."

"Then it was Saturday 9am, and I start emerging from slumber. My phone rings. It was Greg." “We were hacked again. Bitcoin and Ethereum taken from the [new] hot wallets.”

Ultimate Outcome

ShapeShift investigate further, going into past system logs to uncover further information about their employee and ultimately bringing in outside help from Michael Perkins, the Head of Security and Investigative Services at Ledger Labs. Together they were able to uncover the UDP access point and restore the security of the exchange.

Further Investigation

"While much of the logs were gone, we in fact recovered a great portion of them off the “empty” disk space itself using forensic techniques. This was just lucky. Perhaps the Ghost of Satoshi was looking out for us (could have used his help a week ago, of course!)"

"Over the next days, we file the formal civil complaint. The address Bob had given us was a PO box, though we had his legal name, his bank info, and his social serfdom number. We hired a private investigator. We found his apartment within a couple days. Several attempts at service failed, though the investigator heard a dog barking behind the door. One of his cars was found; he drives two unmarked retired police cruisers."

"We learn some more things. [The theif employee] has prior police records in Florida, where he’s from." "With civil and criminal cases proceeding against him, and with further discovery that [he] fled to Florida (leaving his dog to be temporarily cared for by his neighbor… who is now wondering where he is and hasn’t heard from him in weeks), we thought the case was basically closed. We’d get him somewhere, sooner or later. And, hopefully, we’d get our stolen property returned, or the fiat equivalent."

"I have investors to whom I owe a level of protocol diligence, so, we also made arrangements for a criminal case, and herein the theft constitutes a Class 3 Felony, with 4-12 years in prison. Honestly, I don’t care whether he is punished. I care whether we are made whole, and whether he realizes his error and changes his life to become a better person. No sign yet, of that."

Community Update Posted To Reddit

"To our loyal foxes,

It's been a long week, and very instructive.

Since the investigation into the ShapeShift hack last week started, we had suspicion that someone previously on the team was involved, and that this person assisted an outside hacker. We are confident now that is is indeed the case.

The story continues to unfold, and evidence continues to be revealed. We have been working with a forensic specialist from LedgerLabs, who has been terrific. A civil suit is ongoing, as are multiple criminal investigations of the perpetrators.

Our team continues to revise and rebuild infrastructure, hardening not only prior vulnerabilities, but future potential attack vectors. It has been inspiring to see anti-fragility in action as ShapeShift gets stronger.

At this point, customer refunds for prior pending orders are in the process of being resolved. Again, no customer funds were ever at risk, by design.

A more detailed post-mortem will be released at the appropriate time, after forensic work is complete. Thank you again to everyone who has contacted us for the heartfelt support. We will be back in action very soon."

Improved Security Infrastructure

"As I gather my thoughts, I decide it’s time to call in some professional resources." "Michael Perklin, Head of Security and Investigative Services at Ledger Labs, and chairman of the Steering Committee for the Board of CCSS, is first on my list. He’s in Toronto, and agrees to fly out to meet us that evening. He was on his way to the hospital; he had a toe broken in an event he’d prefer not to discuss. He changes course and heads to the airport. What a champion." "Amid a subsequent investigation conducted in partnership with Michael Perklin of Ledger Labs, a hacker contacted the exchange claiming to have purchased information, including the IP address of ShapeShift’s office and access details for the exchange’s admin interface, from that former employee."

"The exchange says it has improved its security procedures, including how it goes about transmitting secure information between employees and manages access to its servers. In the wake of the hack. ShapeShift has also moved to draft and put in place formal security policies."

"Ledger Labs has worked with ShapeShift on new infrastructure for a vastly more secure platform going forward," Perklin told CoinDesk by email. "Even with internal sabotage from an employee, the company avoided any customer funds being lost."

Criticism From Cornell Professor

A Cornell professor named Emin Gün Sirer announced numerous inconsistencies in Voorhees's explanation, pointing out implausible scenarios such as the hacker's willingness to use his real name in criminal activities and Rovion's unlikely moral stance against the hacker. Sirer raises flags regarding the believability of the story, questioning the motives and actions of the involved parties. While acknowledging ShapeShift's security failures, Sirer emphasizes the importance of a thorough investigation to uncover the truth behind the hacks and prevent future incidents, expressing skepticism toward accepting the provided narrative solely based on the accounts of the involved hackers.

In response to points raised by Emin Gün Sirer regarding the recent digital currency thefts at ShapeShift, Erik Voorhees addresses each issue individually in a response on Reddit. He clarified that the communication between ShapeShift and the hacker, known as Rovion, occurred after Rovion reached out to ShapeShift, not the other way around, resolving one of Sirer's concerns. Voorhees acknowledges the oversight in recognizing the employee's incompetence earlier and agrees with Sirer's point on this matter. However, he disputes some of Sirer's assertions, such as the insinuation that ShapeShift's response was motivated by race. Voorhees defends the steps taken by ShapeShift in handling the situation and invites Sirer to engage directly if he wishes to discuss further. Another user, itsreallyonlysmellz, criticizes ShapeShift's approach and urges them to acknowledge the shortcomings in their story.

Exchange Brought Back Online

"To our customers, I would like to personally apologize for our downtime. While we can ensure your funds are not at risk, I know many rely on our service, and it has been unavailable. Redundancy, even in the face of disaster, will be one of our primary development goals going forward."

Blockchain Movement Of Funds

The stolen funds remained stationary and unspent for multiple months following the theft.

"On June 30th, the stolen funds were moved to two separate addresses, one in a $205,666 chunk and the other in a $654 chunk. Each one of these addresses shows only two transactions: the receipt of the funds, and the subsequent transmission of those funds to two separate addresses. This continues on seemingly endlessly, as each new transaction is separated into two and sent to two new, empty addresses so as to cover the thief’s tracks."

Inclusion In Lists

The incident was included in a list compiled by ChainSec.

US-Based Crypto Exchange Dissolved

ShapeShift dissolved it's US-based cryptocurrency exchange in 2021.

Deletion Of Postmortem Document

The postmortem has since been deleted. The deletion happened at some point between April 25th, 2021 and December 5th, 2022.

Settlement With Security Exchange Commission

In March, 2014, ShapeShift completed a settlement with the United States Security and Exchange Commission. In this settlement, ShapeShift would be required to pay a penalty of $275,000 USD for previous operations in the United States. The cease and desist applies only to the existing entity.

Total Amount Recovered

"1500 ETH recovered, and exchanges are hunting for more. The thief is probably upset by this… it sucks to be stolen from, after all."

"The exchange says it believes it can recover a “significant” amount of the lost funds." "Because ShapeShift is a non-custodial exchange, no customer funds were lost during the hacks."

Ongoing Developments

The exchange continues to pursue the employee who stole for them. As for the Russian hacker, they technically appear to have assisted him in laundering the stolen funds by knowingly swapping his stolen ethereum for bitcoin at market rate.

"Legal action in the form of a civil lawsuit has also been taken against the former employee, though ShapeShift declined to comment on where the suit has been filed, citing privacy reasons."

Operation Of DAO

ShapeShift changed into a DAO in 2021.

Individual Prevention Policies

This case does not appear to have resulted in a loss to any individual. ShapeShift does not store any customer funds beyond the point of transfer. All individual funds were returned. The risk level can be minimized by decreasing the size of transactions and carefully reviewing to ensure that you are using a reputable platform from the correction location prior to any swap.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

It would have helped to perform a background check on the employee - who had a known criminal record.

Hot wallet keys were generated on a single PC, outside of dedicated hardware. All transactions (large and small) within ShapeShift appear to have been performed from the same hot wallet. ShapeShift could have benefited from gaining the opinions of security experts on their setup early in the process, rather than relying on a single team member.

While it is true that ShapeShift was dealing with a large volume of transactions, these would most likely have followed a 80-20 pareto distribution. By manually processing the largest transactions, the needed size of the hot wallet can be drastically reduced. For these large transactions, using a multi-sig, where the signatures of multiple employees are required, would prevent those assets from being stolen by one insider.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.