50BTC Mining Pool Exit Scam

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

50BTC Logo/Banner/Homepage

50 BTC was a large mining pool. Near the end of their existence, there was a reported event where balances were switched around, and many users reported that they were unable to withdraw their stored funds. It's unclear how much was lost. There is no record of any recovery. The site eventually went offline.

The country for this case study is not yet known.

About 50BTC

"We’ve created the 50BTC.com pool first because of increasing difficulty of generating new blocks and second because we want to reward your investment in hardware. We don’t like the situation when the most powerful graphic card, presented on the market, can’t give you 50 BTC. Periodic payments from pool allow participants to earn bitcoins and reduce risks of investment;"

"Every time 50 BTC are earned, these bitcoins are distributed between participants according to their contribution. Let’s describe the process of earning bitcoins."

"The server sends to the participant the “block” — it is a cryptographic task which has to be solved by participant’s CPU and graphics card. Every time some solution for this task is generated (no matter if it is correct or not — it just should “look" like solution), it is sent to the server and the server counts how many possible solutions ("shares") you’ve sent. Occasionally, the solution will match hard requirements of the Bitcoin algorithms and this case will be granted with 50 BTC."

"So, when some user of the pool sends “good” solution for the block, the pool will start sending bitcoins to participants. Specifically, it will divide earned 50 BTC between all users of the pool who sent some possible solutions for that block according to the number of shares. The more time your computer was mining, the more bitcoins you will get."

The Reality

50BTC was explicitly trusted to perform the distribution of mining rewards to participants.

What Happened

50BTC mining operators stopped distributing rewards or responding to enquiries.

Key Event Timeline - 50BTC Mining Pool Exit Scam

Date	Event	Description
May 3rd, 2012 2:20:32 PM MDT	50BTC Homepage Online	The 50BTC homepage is captured as online.
November 30th, 2013 12:04:23 PM MST	BitcoinTalk Thread	BitcoinTalk user noncecents reports that they logged into their 50BTC account and found a balance of 160 bitcoin, when they were expecting a potential balance of just a few bitcoin which they may have mined previously.
January 31st, 2014 12:50:58 AM MST	Website Fixed	noncecents reports that the 50BTC website has been fixed, and their balance updated to a value of 0.
June 17th, 2014 1:02:19 AM MDT	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
December 19th, 2014 12:33:13 AM MST	50BTC Homepage Online	The 50BTC website is still captured as online. The website has been upgraded.
March 14th, 2015 6:46:14 PM MDT	50BTC Homepage Online	The 50BTC website is captured as still online and looks very similar.
March 9th, 2016 10:56:01 AM MST	50BTC Homepage Offline	The 50BTC website is captured as being offline and displaying a "Welcome to nginx!" message which congratulates the user for installing a fresh web server.
January 9th, 2018 9:01:43 PM MST	BitcoinTalk Lawsuit Discussion	A BitcoinTalk discussion revolves around a user claiming that 50btc.com stole 64 BTC (worth approximately $1 million at the time). The user recounts their experience from 2013-2014, where 50btc.com promised to return the bitcoins but failed to do so after citing system issues. Despite providing requested information, communication ceased, and the user suspects theft. Others in the forum express similar experiences and suggest legal action, though it's noted that finding the administrators and recovering the funds internationally poses significant challenges. The user expresses intent to pursue legal recourse after years of inaction.

Total Amount Lost

The total amount lost is unknown.

Immediate Reactions

"If someone has the time, do you think you could start a new thread that just quotes all the new 50BTC.com miners asking "Where the hell's my money?". You could also use that as the name of the thread."

Ultimate Outcome

"The pool operator has been given plenty of opportunity to respond on this thread after he private messaged me. I'm going to assume he has forsaken all his users and close this thread. I suggest users open their own thread if they wish to discuss 50BTC's unresponsiveness further. The same goes for the opening poster/pool operator."

Total Amount Recovered

There do not appear to have been any funds recovered in this case. There is limited information available in regards to who operated the original mining pool website. Given this difficulty and the amount of time which has passed, the potential prospects for recovery of funds appear to be quite slim.

Ongoing Developments

There has been discussion of pursuing legal action against the platform operators as late as 2018.

Individual Prevention Policies

When using any third party custodial platform (such as for trading), it is important to verify that the platform has a full backing of all assets, and that assets have been secured in a proper multi-signature wallet held by several trusted and trained individuals. If this can't be validated, then users should avoid using that platform. Unfortunately, most centralized platforms today still do not provide the level of transparency and third party validation which would be necessary to ensure that assets have been kept secure and properly backed. Therefore, the most effective strategy at present remains to learn proper self custody practices and avoid using any third party custodial platforms whenever possible.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The 50BTC platform lacked sufficient controls to prevent a large amount of user bitcoin from being withdrawn once user balances were modified. No alarm was triggered even after the user balances exceeded the available bitcoin by a vast amount. Having the majority of funds protected through a cold storage wallet with multiple signatures required would have effectively prevented funds from being withdrawn, assuming that the increase in withdrawals raised enough suspicion to see what was happening prior to releasing the funds.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

The 50BTC platform lacked sufficient controls to prevent a large amount of user bitcoin from being withdrawn once user balances were modified. No alarm was triggered even after the user balances exceeded the available bitcoin by a vast amount. Having the majority of funds protected through a cold storage wallet with multiple signatures required would have effectively prevented funds from being withdrawn, assuming that the increase in withdrawals raised enough suspicion to see what was happening prior to releasing the funds.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.