BitcoinTalk Database Breach

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

BitcoinTalk Logo/Homepage

BitcoinTalk is the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the website's internet service provider. It was reported that 12 minutes of access was enough for the attacker to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, hashed passwords, dates of birth, secret questions, hashed secret answers, and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.

About BitcoinTalk

Bitcointalk.org stands out as the premier forum within the Bitcoin community, evolving from its inception as a platform for Bitcoin-related discussions to encompassing a wide array of topics spanning the cryptocurrency landscape. BitcoinTalk.org is a pivotal international forum catering to all facets of the Bitcoin ecosystem, where enthusiasts can engage with miners globally, explore various offers from faucets or cloud mining platforms, delve into trading strategies, and grasp the intricate economics underpinning Bitcoin.

Originally hosted on SourceForge before transitioning to bitcoin.org/smf, the forum underwent several custom modifications by Satoshi Nakamoto himself, marking its evolution into the vibrant community hub it is today. Its unofficial status was solidified in 2011 with a move to bitcointalk.org, fostering decentralization and spawning alternative forums, although Bitcoin Talk remains unparalleled in size and influence, boasting a diverse user base comprising seasoned professionals, digital enthusiasts, and adept coders.

Bitcointalk offers a rich tapestry of content. This dynamic platform boasts a robust knowledge base tailored to assist novices in navigating the complexities of Bitcoin, covering everything from its fundamentals to troubleshooting network issues. Its organized structure facilitates exploration of various sections and subsections, where users engage in lively discussions on topics such as Bitcoin valuation, emerging ICOs, alternative cryptocurrencies, cryptocurrency gambling platforms, and burgeoning enterprises. With its breadth of subjects and community-driven discourse, Bitcointalk remains a go-to destination for staying abreast of developments and insights within the cryptocurrency sphere. The FAQ section serves as a repository of information on cryptocurrency economics, technical intricacies, and general Bitcoin-related inquiries, complemented by moderator assistance for unresolved queries. Adhering to a set of stringent rules, including prohibitions on obscenity, off-topic discussions, and solicitation of funds, Bitcoin Talk ensures a conducive environment for constructive discourse.

Notably, while newcomers are initially restricted from creating new topics, they can actively participate in the "Newcomers" section, where seasoned users readily offer comprehensive insights. With sections available in multiple languages, including Indian, Italian, French, and Chinese, Bitcoin Talk fosters linguistic diversity, offering a platform for language enthusiasts to practice while engaging in discussions on mining and other cryptocurrency-related topics. Through its inclusive structure and global reach, Bitcoin Talk continues to serve as a cornerstone of the Bitcoin community, facilitating knowledge exchange and collaboration among enthusiasts worldwide.

Within this bustling online community, users like "cxboyminer" find a wealth of resources and support, particularly in their quest for Bitcoin hardware and expertise. The forum's structure facilitates various avenues of engagement, from group buys for hardware to discussions on mining techniques and marketplace transactions. Notably, the forum's decentralized nature and diverse user base foster an environment of collaboration and assistance, with seasoned members readily offering guidance to newcomers. Trust plays a pivotal role, evidenced by the forum's reputation system, which allows users to gauge the reliability of their peers. This trust extends to transactions facilitated through escrow services, ensuring secure exchanges within the community. Overall, the BitcoinTalk forum emerges as a dynamic platform, not merely for information exchange but also as a cornerstone of support and commerce within the Bitcoin community.

"In July, 2011 the forum was moved to bitcointalk.org in order to make it explicitly unofficial. The "forum" link on the bitcoin.org homepage was made to simply return the Google search results for the search terms "bitcoin forums". This was followed by Bitcoin Community members, very much in bitcoin's spirit of decentralisation, creating a number of alternative forums offering different moderatorial policies and using different software platforms. None of these alternative forums have yet reached the size of Bitcoin Talk." "On July 22, 2012, Bitcoin Talk reached its one millionth post."

The Reality

Any third party website may be breached and information stored there would be compromised in such a breach. The BitcoinTalk database was an attractive target with 499,593 users.

A small number of user accounts were hashed using the outdated MD5 method. A "minority of 9%, or 44,869 users’ accounts used MD5 hashing with a unique salt for an added layer of security".

Stored data contains all manners of user details including usernames, email addresses, passwords, IP addresses, dates of registration, and the user’s preferred language. Somewhat alarmingly, some profile details even revealed the number of bitcoins owned by the user.

What Happened

Through socially engineering BitcoinTalk's internet service provider, an attacker was able to gain access to the database of BitcoinTalk user information in May 2015..

Key Event Timeline - BitcoinTalk Database Breach

Date	Event	Description
May 21st, 2015 7:14:00 PM MDT	Twitter Post About Attack	The Bitcointalk Twitter account posts a notification about the attack.
May 21st, 2015 7:24:46 PM MDT	Posting In Bitcoin Subreddit	User drhelmutp posts about the BitcoinTalk breach in the Bitcoin subreddit.
May 21st, 2015 7:57:29 PM MDT	Theymos Shares Details	Forum administrator Theymos shares additional details about the exploit, "The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database. However, you should act as though your password hashes, PMs, emails, etc. were compromised. The forum will probably be down for 36-60 hours for analysis and reinstall. I'll post status updates on Twitter @bitcointalk and I'll post a complete report in a post in Meta once the forum comes back online."
May 22nd, 2015 12:21:00 AM MDT	CoinDesk Article Published	CoinDesk published an article about the exploit. CoinDesk reports that BitcoinTalk suffered a server compromise due to a social engineering attack targeting its ISP, NFOrce. The breach was swiftly detected, but users were urged to assume their data was compromised. BitcoinTalk could be offline for up to 60 hours. Updates will be provided via Twitter, and a detailed report will follow when the forum is restored.
September 1st, 2016	LeakedSource Article	LeakedSource publishes information about the breaches of BTC-e and BitcoinTalk. This provides an overview of both breaches.
September 2nd, 2016 3:25:58 AM MDT	CCN Article Mention	The breach is mentioned in a CCN article with details of cyberattacks resulting in breaches of user data from two prominent bitcoin websites, BTC-e exchange, and Bitcointalk.org forum, have been revealed by data breach monitoring resource LeakedSource. BitcoinTalk.org saw stolen information from 499,593 users, with a small percentage using MD5 hashing and the majority utilizing the "sha256crypt" method, praised as superior in password storage security. LeakedSource noted the difficulty in cracking these passwords, highlighting the effectiveness of BitcoinTalk's security measures.
September 2nd, 2016 7:02:05 AM MDT	DataBreaches.net Article Posted	DataBreaches.net reports that two Bitcoin-related websites, Btc-E.com and Bitcointalk.org, were hacked in October 2014 and May 2015, respectively. Btc-E.com had 568,355 users' data compromised, including usernames, emails, passwords, IP addresses, registration dates, and internal data. Their password hashing method remains uncrackable, enhancing security against potential Bitcoin theft. Bitcointalk.org, with 499,593 users affected, saw varying password hashing methods, with 9% using MD5 hashing and the majority utilizing "sha256crypt," deemed superior in security by LeakedSource.com. Cracking sha256crypt passwords would take a year, highlighting the robustness of Bitcointalk.org's security measures.
September 4th, 2016 12:30:36 AM MDT	NewsBTC Article Published	NewsBTC publishes an article which provides updated information on the BitcoinTalk hacking incidents, including the number of affected users, types of compromised data, analysis of password protection mechanisms, and recommendations for enhancing account security. More details are shared about the size of the LeakedSource database and password hashing mechnisms which were used by BitcoinTalk.
December 20th, 2020 6:29:25 PM MST	BitcoinTalk Hack Discussion	A discussion thread on the BitcoinTalk forum discusses information about past hacks and inquires about when they occurred. The poster, in particular, reports that he was approached by multiple accounts that haven't been online since 2016-2017.
March 4th, 2021 9:50:54 AM MST	CCN Article Updated	An update was made to the CCN article about the breach. The update added a comma and removed some whitespace.

Technical Details

The attacker was able to social engineer the server's internet service provider, a company named NFOrce, based in the Netherlands. They convinced the provider to give them access to the server, based on impersonating Theymos.

About NForce Internet Services

Operating since 2003 from the Netherlands, NFOrce boasts ISO27001 certified datacenters with high-capacity bandwidth and dedicated support. They offer personalized service, technical support, and continuous improvement to meet diverse client needs and ensure optimal performance. NFOrce network solutions are designed to enhance server efficiency, data reliability, and minimize service disruptions.

NFOrce Internet Services prioritizes customer satisfaction by tailoring their top-quality IT solutions to individual needs. Their consultative approach ensures understanding of current and future business needs, while their extensive line of servers, VPS, and software solutions guarantee superb computing performance on a superior network. NFOrce's enterprise-level infrastructure, 24/7 support, and skilled team ensure uninterrupted service, whether for a small website or a network with millions of users. With a focus on simplicity and quality, customers can configure their own high-end servers tailored to their specific needs. Their services include colocation, cloud, VPS solutions, internet access, IP transit, and web hosting. All servers come with Linux OS, IPv4 address, remote reboots, management tools, and extensive bandwidth.

Social Engineering

Limited information is available about the actual method of the social engineering which was used.

"The attack is said to have targeted the site's ISP, a company called NFOrce that is based in the Netherlands." "Server compromised due to social engineering against ISP NFOrce. There will be extended downtime for forensic analysis and reinstall."

"The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database."

Data Included In Breach

"Bitcointalk.org had 499,593 users hacked in May of 2015, and they do know about the breach. Bitcointalk.org data contains usernames, emails, passwords, birthdays, secret questions, hashed secret answers and some other internal data." "The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform."

Password Crackability

Bitcointalk.org utilized a superior password storage method, sha256crypt, for added security.

"Notably, the remaining 91% of user passwords were hashed with “sha256crypt”, a method of password storage that LeakedSource deemed as “far superior to nearly every website we’ve seen thus far.” That’s high praise, coming from a resource that reveals details of data breaches frequently, in a time where mega-breaches of hundreds of millions of users are commonplace."

Theymos provided some details on Reddit after the breach.

Yes, each password has a 12-byte unique salt. The passwords are hashed with 7500 rounds of SHA-256.

Total Amount Lost

There are not believed to be any funds lost as a direct result of this incident.

Immediate Reactions

The official BitcoinTalk Twitter account announced the compromise via a Tweet.

Server compromised due to social engineering against ISP NFOrce. There will be extended downtime for forensic analysis and reinstall.

Operator Theymos shortly thereafter took to the bitcoin subreddit to offer more details.

The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database. However, you should act as though your password hashes, PMs, emails, etc. were compromised. The forum will probably be down for 36-60 hours for analysis and reinstall. I'll post status updates on Twitter @bitcointalk and I'll post a complete report in a post in Meta once the forum comes back online.

"Theymos said that BitcoinTalk could remain offline for as many as 60 hours following the incident, and cautioned users to "act as though your password hashes, PMs, emails, etc. were compromised"."

Ultimate Outcome

"However, the account information gained by the hackers may not have come of much use to them due to additional protection features incorporated into these platforms." "Only 44,869 (9%) of users on Bitcointalk.org used MD5 hashing with a unique salt for passwords. Of those, LeakedSource.com was able to crack 30,389 or 68%. The remaining 91% of user passwords were hashed with “sha256crypt” and LeakedSource estimates it would take them about a year to crack an estimated 60-70% of them. This method of password storage is far superior to nearly every website they say they’ve seen thus far."

In 2021, LeakedSource revealed additional information about the breach. LeakedSource disclosed information about data breaches suffered by BTC-e in 2014 and Bitcointalk.org in 2015, highlighting the robust security measures used by both platforms. Despite the breaches, BTC-e's discreet password hashing method rendered over half a million user passwords uncrackable, while Bitcointalk.org utilized a superior password storage method, sha256crypt, for added security.

Total Amount Recovered

There are not believed to be any funds lost as a direct result of this incident.

Ongoing Developments

The subject of the hack comes up multiple times, as the private details of users continue to be used. For example, a 2020 discussion thread on the BitcoinTalk forum discusses information about past hacks and when they occurred. The poster, in particular, reports that he was approached by multiple accounts that haven't been online since 2016-2017.

Information sources continue to be updated about the hack. For example, as late as 2021, CCN made minor modifications to their article with information on the breach.

Individual Prevention Policies

Users are recommended to take strong measures to protect their privacy across all platforms which they use.

Set up separate email addresses for each service, and avoid providing your phone number whenever possible. Any received emails or phone calls must be viewed with scrutiny, especially if unsolicited. Interact with companies only through their official websites and confirm anything with the company directly via multiple official sources, especially if it promises a significant incentive to take an action or threatens access to your funds if an action is not taken. It would be recommended to also establish a network of multiple trusted individuals who use the same services and have a strong level of security knowledge.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

It may have been possible that a security review would have identified the risks before the breach occurred.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

It may have been possible that a security review would have identified the risks before the breach occurred.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.