Bitcoinica Hot Wallet Hack

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Bitcoinica Logo/Homepage

Bitcoinica was a popular online exchange in the early days of bitcoin based in New Zealand.

This exchange or platform is based in New Zealand, or the incident targeted people primarily in New Zealand.

About Bitcoinica

Bitcoinica was an online platform launched via a forum thread on BitcoinTalk on September 8, 2011. The platform promises advanced features such as margin trading, stop orders, guaranteed liquidity, and short selling. With support for market, limit, stop, and trailing stop order types, Bitcoinica provided a forex-like experience for traders. All accounts were margin accounts by default, allowing users to trade more than their deposited amount. The platform enabled leveraged speculation in its contract-for-difference (CFD) market against the Bitcoin to USD exchange rate.

The Bitcoinica exchange platform was based in New Zealand, and founded by Zhou Tong. Bitcoinica emphasized security by promoting that they did not operate a Bitcoin wallet, instead storing funds in Mt. Gox and bank accounts instead. Operating on Heroku, a secure cloud platform, Bitcoinica ensures a professional and revolutionary trading environment without transaction fees for orders under ฿50.

Despite his position as the creator of a financial speculation service and his strong belief in libertarian capitalist ideals, Bitcoinica to him has never been about the profit. “Bitcoinica is not a money making machine,” he writes. “It’s just a product that sets a high standard for the Bitcoin community.”

The Reality

The history of Bitcoinica had already had a security breach earlier in the same year. On March 1st, 2012, the service had experienced a significant loss of over 43,000 bitcoins due to an internal security breach at their Linode web hosting provider. The Bitcoinica server had access to a hot wallet with 18,000 bitcoin as well as API keys for a Mt. Gox wallet which held over 30,000 bitcoin accessible to a single email address. The email address was apparently accessible from an insecure mail server.

What Happened

In early May, an attacker compromised the email address of an exchange operator and used their access to initiate a withdrawal of 18547.66867623 BTC.

Key Event Timeline - Bitcoinica Hot Wallet Hack

Date	Event	Description
September 4th, 2011	Building Service Starts	Zhou Tong starts building the Bitcoinica trading platform.
September 8th, 2011 8:27:54 AM MDT	Bitcoinica Service Launches	The Bitcoinica service is announced on the BitcoinTalk forum. This is tracked as a date of September 8th according to Bitcoin Wiki and September 9th according to founder Zhou Tong.
May 6th, 2012	Hot Wallet Hack Date Used	“On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked.” The date reported by Kyle Gibson.
May 11th, 2012 6:30:33 AM MDT	Unexpected Bitcoin Transaction	A transaction on the blockchain transfers 18,547.66867623 BTC, reportedly an unexpected transaction from the Bitcoinica hot wallet to a third party thief.
May 11th, 2012 7:16:37 AM MDT	BitcoinTalk Emergency Thread	Bitcoinica administrator Zhou Tong posts an emergency thread announcing a suspicious transaction on the platform. The suspicious Bitcoin transaction not initiated by any company owners, prompting the suspension of Bitcoinica's servers for a security investigation. The transaction involved a significant loss of 18,547.66867623 BTC. While financial and trading data were deemed safe apart from the Bitcoin loss, concerns arose within the community about the vulnerability of hosted systems and the need for enhanced security measures. Comments express shock at the severity of the loss and skepticism about Bitcoinica's legitimacy, with some suggesting the incident as proof of previous warnings regarding the platform's credibility. Despite assurances from Bitcoinica's founder, doubts lingered about the site's security practices and potential scams within the Bitcoin community.
May 11th, 2012 7:37:24 AM MDT	Mt. Gox API Keys At Risk	Zhou Tong reveals that the attacker had also been close to obtaining their Mt. Gox API keys, which could have been used to steal over 30,000 more bitcoin.
May 12th, 2012 5:19:00 AM MDT	BitcoinTalk Reported Time	The blockchain timestamp of the theft reported by BitcoinTalk, without any timezone being specified. The BitcoinTalk forums generally have posts with timestamps specified in UTC.
May 12th, 2012 4:03:41 AM MDT	Email Server Compromise Revealed	Zhou Tong reveals that an email server belonging to one of their team members was compromised. In addition, it is revealed that the database server was compromised and the private information of all customers was exposed. Customers are recommended not to reuse passwords, and there is no mention of a hashing algorithm being applied to the stored passwords.
May 12, 2012	Bitcoin.com Date Reported	"On May 12, 2012, a hacker breached the Bitcoinica Rackspace server, according to the now-defunct exchange’s founder Zhou Tong."
May 13th, 2012 7:02:13 AM MDT	Zhou Tong Leaving Bitcoin	Zhou Tong announces on a BitcoinTalk thread that he's leaving bitcoin. Despite his belief in Bitcoin's potential for financial liberty, Zhou expressed a need to pursue other passions and projects. Reflecting on their journey, Zhou Tong recounted his introduction to Bitcoin in 2010, subsequent involvement in Bitcoinica, and eventual decision to leave due to a desire for new challenges. The announcement received mixed responses from the community, with many expressing gratitude for Zhou Tong's contributions and wishing them success in his future endeavors, while others urged him to reconsider.
May 14th, 2012 6:12:46 AM MDT	Bitcoin Magazine Obituary Published	Vitalik Buterin via Bitcoin Magazine published an obituary of the Bitcoinica exchange. The Bitcoin community faced a series of setbacks, including thefts and financial stress, leading to the shutdown of Bitcoinica, a trading platform. Despite assurances of compensation for users, the future of the platform under Intersango's leadership remains uncertain. Founder Zhou Tong, though expressing faith in Bitcoin's potential for financial liberty, decided to exit the space due to a misalignment with his values, emphasizing the need to create value for society. While criticized for security flaws and inexperience, Zhou's endeavor reflects the ethos of Bitcoin as a realm of opportunity and innovation.
May 14th, 2012 9:37:47 AM MDT	Sophos NakedSecurity Article	Sophos reports on the security breach as a theft of $90,000 worth of bitcoins. This incident is noted as another attack on Bitcoinica, following a previous theft earlier in the year, highlighting ongoing security concerns within the Bitcoin community. Also mentioned in the article, a leaked FBI report expressed concerns about tracking anonymous Bitcoin users, inadvertently providing tips for users seeking greater anonymity.
August 13th, 2012 11:18:00 AM MDT	Lawsuit Files Against Platform	FinExtra reports that Bitcoinica faces a lawsuit from four former users who claim they are owed nearly $460,000 in missing funds and damages. Founded by teenager Zhou Tong, Bitcoinica suffered two hacking incidents earlier this year, resulting in the theft of thousands of Bitcoins worth tens of thousands of dollars. Despite assurances from Bitcoinica that the stolen funds were from the exchange itself, not customers, and promises to honor withdrawal requests, users allege only half of their money would be returned. With suspicions circulating that Tong might be involved in the hacks, the plaintiffs have filed a complaint in San Francisco against Bitcoinica, Intersango, and associated individuals, accusing them of conspiring to hinder and deprive the plaintiffs of their rights to the missing funds.
December 21st, 2012 1:53:16 AM MST	BitMarket.eu Posts About Insolvency	BitMarket.eu administrator M4v3r admits in a BitcoinTalk forum thread to having stored bitcoins on the Bitcoinica platform, which are now lost. His message apologized for a failure to respond promptly due to personal issues and a search for a solution. It reveals that he cannot currently process withdrawals, attributing the problem to a misguided attempt at providing a hedge fund service for Bitmarket users. This endeavor led to a significant loss of bitcoins, worsened by a subsequent rise in BTC price. The administrator acknowledges their fault and lack of funds to cover the loss, proposing options like finding an investor or starting over with explicit fees to repay the debt. They express a commitment to making amends and provide a bitcoin address for donations to help users with locked funds. The attached comments reflect skepticism and accusations of scamming, countered by the sender's assertion of honesty despite the dire situation.
December 21st, 2012	BitMarket.eu Funds Announced	"On December 21, 2012, it was discovered that BitMarket.eu lost a large portion of customer funds which were stored on Bitcoinica. These customers were reportedly unaware that their funds were stored on Bitcoinica. Return of a portion of these funds is still possible, pending the outcome of liquidation."
July 26th, 2013 5:52:51 PM MDT	Updated BitcoinTalk List	The incident is included in the updated BitcoinTalk list. The amount is increased and valued according to the January 2014 price. A disclaimer is added about the amount potentially increasing as the liquidation proceeds.
February 3rd, 2017 10:00:04 AM MST	Bitcoin.com Article	The incident is included with specific mention in a list of bitcoin thefts which you may have forgotten about, published by news site Bitcoin.com.

Technical Details

The vulnerability reportedly happened through a compromised email address, which had a higher level of permissions than necessary. This was reportedly compromised through a vulnerable email server. The chief transaction involved in the theft is 7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8, which was announced on the BitcoinTalk forums.

BitcoinTalk Summary

Zhou Tong, former founder of Bitcoinica, discovered an entry into Bitcoinica's Rackspace server through an excessively privileged compromised email address. This caused the theft of the entire “hot wallet”, funds stored on-site, as well as the loss of the main database. No backups were kept. Bitcoinica shut down because of this incident. The claims process is still ongoing; however, Bitcoinica is now entering receivership.

Total Amount Lost

There are three different estimates of the amount lost in this case.

• The first value of 18547.66867623 comes from the blockchain transaction and amount which was reported by Zhou Tong on the BitcoinTalk forums. This is included on some lists such as dree12's list on BitcoinTalk and rounded to 18,548 by Kyle Gibson. Kyle Gibson gave an estimated value of $90,000 USD.
• BitMarket.eu had a liquidation, and in the legal paperwork, they reported losing "about" 19980 bitcoins.
• BitcoinTalk user dree12 reported a total amount affected reported to be at least 38527 bitcoin. This is very similar to an estimate on Bitcoin.com, which reported that the exchange lost over 38,000 BTC during the spring incident, which refers to an event that breached Bitcoinica's Rackspace servers on May 12th, 2012.

The total amount lost has been estimated at $91,000 USD.

Immediate Reactions

The exchange promptly suspended operations and assured users that most bitcoin deposits were unaffected and withdrawal requests would be honored. While passwords were likely not compromised due to encryption measures, the exchange urged users not to reuse passwords across different platforms. Bitcoinica stated that sensitive customer documents were encrypted and stored separately, minimizing the risk of exposure. However, usernames, email addresses, and account histories may have been compromised, prompting caution against phishing attempts.

“On May 6, 2012, bitcoin exchange Bitcoinica announced that their hot wallet had been hacked. The exchange told users that they had “discovered a suspicious bitcoin transaction that doesn’t seem to be initiated by any one of the company owners.” The hot wallet hack was initially suspected to be linked to Bitcoinica owner A. Vinnik, leading some to suspect it was an exit scam.”

Suspicious Transaction Reported

Zhou Tong reported a suspicious Bitcoin transaction not initiated by any company owners, prompting the suspension of Bitcoinica's servers for a security investigation. The transaction involved a significant loss of 18,547.66867623 BTC. While financial and trading data were deemed safe apart from the Bitcoin loss, concerns arose within the community about the vulnerability of hosted systems and the need for enhanced security measures. Comments express shock at the severity of the loss and skepticism about Bitcoinica's legitimacy, with some suggesting the incident as proof of previous warnings regarding the platform's credibility. Despite assurances from Bitcoinica's founder, doubts lingered about the site's security practices and potential scams within the Bitcoin community. It was later revealed that the same email address could have withdrawn over 30,000 bitcoin from Mt. Gox through an API key and that the root cause of the breach was an entire email server being compromised.

Media Reports About Bitcoinica

Media reports at

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

As a result, on August 1, 2012, the Wendon Group investment fund, a creditor to Bitcoinica LP, announced the appointment of a receiver under New Zealand law, marking the downfall of the platform.

Zhou Tong Leaving Bitcoin

Founder Zhou Tong decided to leave bitcoin entirely. In a forum post from May 13, 2012, user Zhou Tong announced their departure from Bitcoin-related projects following the Bitcoinica incident, where they will discontinue involvement until further notice. Despite their belief in Bitcoin's potential for financial liberty, they expressed a need to pursue other passions and projects.

“I always believe in Bitcoin, or simply anything that brings people financial liberty. I have heavily invested in Bitcoin (I purchased one 1,000 BTC gold coin from Casascius and will keep it for as long as I can).”

The announcement received mixed responses from the community, with many expressing gratitude for Zhou Tong's contributions and wishing them success in their future endeavors, while others urged them to reconsider. Vitalik Buterin had strong praise for Zhou Tong and criticized his critics.

Zhou Tong has often been reviled as a scammer, and this crisis has, predictably, only amplified such cries. But his actions over the past eight months do not paint the picture of a man who consciously set out to defraud the public with a Ponzi scheme or an arcane system of liquidation rules; rather, they paint the picture of a teenager, still uncorrupted by the rigidities of the status quo, ready to discover the world and find a place where he can make a difference. Of course, Bitcoinica’s history is marked by security blunders and telling signs of Zhou’s inexperience. However, failure is an inevitable part of learning and innovation, and if the Bitcoin community begins to treat failure as an unforgivable sin and every blunder as proof of moral turpitude, then it will cease to be a community that values learning and innovation at all. Instead, it will become yet another manifestation of the inflexible and bureaucratic status quo.

Lawsuit Against Platform

Finextra reports that four former users of Bitcoinica have filed a lawsuit alleging that they are owed nearly half a million dollars in missing funds, as well as damages. Bitcoinica, once a successful exchange created by teenager Zhou Tong, suffered two major hacking incidents earlier this year, resulting in the theft of thousands of Bitcoins. Despite assurances from Bitcoinica that the stolen funds were from the exchange itself and not customers, the site has remained offline, leaving users uncertain about the fate of their investments. Additionally, Bitcoinica had initially promised to honor all withdrawal requests but later informed users that only half of their funds would be returned, prompting speculation about the exchange's integrity. Amidst rumors implicating Tong in the hacks, the plaintiffs filed a complaint in San Francisco alleging that Bitcoinica, its successor Intersango, and associated individuals conspired to deprive them of their rights regarding the missing funds.

BitMarket.eu Collapse Resulting

In December, BitMarket.eu's administrator M4v3r admitted in a BitcoinTalk forum thread to having stored bitcoins on the Bitcoinica platform, which are now lost. His message apologized for a failure to respond promptly due to personal issues and a search for a solution. It reveals that he cannot currently process withdrawals, attributing the problem to a misguided attempt at providing a hedge fund service for Bitmarket users. This endeavor led to a significant loss of bitcoins, worsened by a subsequent rise in BTC price. The administrator acknowledges their fault and lack of funds to cover the loss, proposing options like finding an investor or starting over with explicit fees to repay the debt. They express a commitment to making amends and provide a bitcoin address for donations to help users with locked funds. The attached comments reflect skepticism and accusations of scamming, countered by the sender's assertion of honesty despite the dire situation.

Inclusion In Incident Lists

This incident was included in many sources, including:

• both versions of a list compiled by BitcoinTalk user dree12.
• a list of incidents put together by Kyle Gibson.
• a Bitcoin Magazine infographic (along with another Bitcoinica theft).
• Bitcoin.news lists this as one of the most controversial in the industry.
• Bitcoin Exchange Guide.
• Slowmist.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

There are a few potential ongoing developments.

Identity Of The Hacker

According to BitcoinTalk, the hacker is unknown.

Wendon Group Legal Action

Venture capital group Wendon Group threatened legal action against Bitcoinica Consultancy.

New Zealand Bankruptcy

A receivership in New Zealand was ongoing.

General Prevention Policies

This is a case where simply knowing who's holding the funds and storing them properly offline with multiple signatures would have avoided the issues.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.