Bitstamp Hot Wallet Hack: Difference between revisions

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Jump to navigation Jump to search
No edit summary
(Another 30 minutes complete. About section spread around. Reviewed sources and added in additional sources about the breach of Bitstamp.)
Line 1: Line 1:
{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/bitstamphotwallethack.php}}
{{Case Study Under Construction}}{{Unattributed Sources}}
{{Unattributed Sources}}


[[File:Bitstamp.jpg|thumb|Bitstamp]]Apparently the wallet file (named wallet.dat) was encrypted with only a simple passphrase, which was also stored online. This breach took down one of the largest and most widely used exchanges at the time, bringing down multiple services such as ATMs that sourced their liquidity from Bitstamp. Bitstamp has since set up multi-signature hot wallets through BitGo, while the majority of funds remain in cold storage. No customers of the exchange appear to have lost their funds in the incident.
[[File:Bitstamp.jpg|thumb|Bitstamp Logo/Homepage]]Apparently the wallet file (named wallet.dat) was encrypted with only a simple passphrase, which was also stored online. This breach took down one of the largest and most widely used exchanges at the time, bringing down multiple services such as ATMs that sourced their liquidity from Bitstamp. Bitstamp has since set up multi-signature hot wallets through BitGo, while the majority of funds remain in cold storage. No customers of the exchange appear to have lost their funds in the incident.


This exchange or platform is based in Luxembourg, or the incident targeted people primarily in Luxembourg.<ref name="bitcoinmagazine-6" /><ref name="kylegibson-86" /><ref name="ccn-195" /><ref name="bitstamp-196" /><ref name="cointelegraph-197" /><ref name="coinsutra-202" /><ref name="bravenewcoin-207" /><ref name="coindesk-208" /><ref name="coindesk-216" /><ref name="bitcoinexchangeguide-218" /><ref name="slowmisthacked-1160" /><ref name="bitstamp-4366" /><ref name="wikipedia-4367" /><ref name="bankinfosecurity-4369" />
<ref name="bitcoinmagazine-6" /><ref name="kylegibson-86" /><ref name="ccn-195" /><ref name="bitstamp-196" /><ref name="cointelegraph-197" /><ref name="coinsutra-202" /><ref name="bravenewcoin-207" /><ref name="coindesk-208" /><ref>http://www.reuters.com/article/2015/01/06/us-bitstamp-cybersecurity-idUSKBN0KF0UH20150106<nowiki/>Dec 11, 2023)(
 
</ref>


== About Bitstamp ==
== About Bitstamp ==
"Bitstamp is a cryptocurrency exchange based in Luxembourg. It allows trading between fiat currency, bitcoin and other cryptocurrencies. It allows USD, EUR, GBP, bitcoin, ALGO, XRP, Ether, litecoin, bitcoin cash, XLM, Link, OMG Network, USD Coin or PAX deposits and withdrawals." "Bitstamp makes trading easy, fast & reliable. With 24/7 support, staking and bank-grade security & insurance. Since 2011."
Bitstamp is the world's longest-running cryptocurrency exchange<ref name="wikipedia-4367" />.


"The company was founded as a European-focused alternative to then-dominant bitcoin exchange Mt. Gox. While the company trades in US dollars, it accepts fiat money deposits for free only via the European Union's Single Euro Payments Area, a mechanism for transferring money between European bank accounts."
"Bitstamp is a cryptocurrency exchange based in Luxembourg. It allows trading between fiat currency, bitcoin and other cryptocurrencies. It allows USD, EUR, GBP, bitcoin, ALGO, XRP, Ether, litecoin, bitcoin cash, XLM, Link, OMG Network, USD Coin or PAX deposits and withdrawals."


“In 2015, Bitstamp lost 19,000 BTC, which were stolen by hackers from the exchange’s hot wallet. At that time, the losses were equivalent to $5 million. Surprisingly, a banal phishing attack was used by hackers — the exchange employees received personal emails and messages in Skype from seemingly friendly sources.” “Six employees of Bitstamp were targeted in a weeks-long phishing attempt leading up to the theft of roughly $5m in bitcoin in January, according to an unconfirmed incident report said to be drafted internally by the bitcoin exchange.” "Bitstamp’s wallet system was compromised, prompting it to halt deposits and later shut down its platform entirely." “What’s maybe even more surprising is that the person responsible for security, Bitstamp system administrator Luka Kodrich, clicked the link and downloaded malware onto the working computer, after which the exchange was hacked. Bitstamp hurried to notify traders about what was happening, however, the attackers had already stolen the funds.” “On this occasion, Mr.Kodric was certain that these logins were not made by him, and must therefore have been the attacker. Analysis indicates that the attacker accessed LNXSRVBTC, where the wallet.dat file was held, and the DORNATA server, where the passphrase for the bitcoin wallet was stored, before data was transferred out to both servers to IP 1**.**.***.**8, which is part of a range owned by a German hosting provider. We suspect that the the attacker copied the Bitcoin wallet file and passphrase at this stage [...] Together the wallet and passphrase would have enabled the attacker to steal bitcoins from the Bitcoin wallet.” “all BTC held with [Bitstamp] prior to the temporary suspension of services were honored in full.” “A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”
"Bitstamp makes trading easy, fast & reliable. With 24/7 support, staking and bank-grade security & insurance. Since 2011."


This exchange or platform is based in Luxembourg, or the incident targeted people primarily in Luxembourg.
"The company was founded as a European-focused alternative to then-dominant bitcoin exchange Mt. Gox. While the company trades in US dollars, it accepts fiat money deposits for free only via the European Union's Single Euro Payments Area, a mechanism for transferring money between European bank accounts."
 
The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.
 
Include:


* Known history of when and how the service was started.
Wikipedia: <ref name="wikipedia-4367" />
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.


Don't Include:
Homepage: bitstamp.net<ref name="bitstamp-4366" />
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.


== The Reality ==
== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
TBD
 
* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.


== What Happened ==
== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
Bitstamp lost 19,000 BTC from the exchange’s hot wallet.
{| class="wikitable"
{| class="wikitable"
|+Key Event Timeline - Bitstamp Hot Wallet Hack
|+Key Event Timeline - Bitstamp Hot Wallet Hack
Line 52: Line 35:
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|-
|
|January 5th, 2015 3:29:35 PM MST
|
|CoinDesk Article Published
|
|CoinDesk reports on the security breach resulting in the loss of less than 19,000 BTC (approximately $5.1 million). The compromise affected some of Bitstamp's operational wallets, leading to the suspension of deposits and ultimately a temporary shutdown of the platform. Bitstamp assured customers that funds held prior to the service suspension would not be affected, emphasizing that the majority of its Bitcoin reserves are stored in secure offline cold storage systems. The exchange is actively collaborating with law enforcement in an ongoing investigation. Bitstamp's CEO, Nejc Kodrič, stated that the breach represents only a small fraction of the total Bitcoin reserves, and efforts are underway to transfer a secure backup of the platform to a new environment, with plans to resume services in the coming days. The incident underscores the challenges and vulnerabilities faced by cryptocurrency exchanges, raising concerns about the security and mainstream viability of digital assets<ref name="coindesk-216" />.
|-
|January 6th, 2015 2:38:00 PM MST
|Bank Info Security Article
|Bank Info Security reports that European Bitcoin exchange Bitstamp experienced a data breach on January 4, leading to the theft of 19,000 Bitcoins valued at over $5 million<ref>[https://twitter.com/gen_sec/status/552579993331859457 gen_sec - "#Bitcoin Exchange Reports #Data #Breach: http://bit.ly/1DuW4Kb - @databreachtoday" - Twitter] (Dec 11, 2023)</ref>. Following the incident, BitStamp temporarily suspended its services and urged customers not to deposit funds into previously issued Bitcoin deposit addresses. The exchange assured customers that the breach, affecting some operational wallets, would not impact consumer assets, as the overwhelming majority of Bitstamp's Bitcoin reserves are stored in secure offline cold storage systems. Bitstamp is collaborating with law enforcement officials to investigate the incident, and the exchange plans to transfer a secure backup of its website to a new environment in the coming days. The breach highlights the ongoing vulnerabilities in the Bitcoin ecosystem and raises questions about the viability of Bitcoin as a mainstream alternative, particularly in terms of consumer protection<ref name="bankinfosecurity-4369" />. TBD - Any new information in here.
|-
|January 7th, 2015 9:30:00 PM MST
|Bank Info Security Article
|The Bank Info Security article author promotes it with another tweet<ref>[https://twitter.com/gen_sec/status/553045973459820544 gen_sec - "#Bitcoin Exchange Reports #Data #Breach: http://bit.ly/143bbxy - @databreachtoday" - Twitter] (Dec 11, 2023)</ref>. TBD - Check if article was updated in the meantime.
|-
|January 9th, 2015 3:50:00 PM MST
|BitStamp Back Online
|BitStamp is reportedly back online<ref>[https://twitter.com/gen_sec/status/553685173955727362 gen_sec - "#Bitstamp Back Online After #Breach: http://bit.ly/1x5tTvE - @databreachtoday" - Twitter] (Dec 11, 2023)</ref><ref>[https://www.databreachtoday.com/bitstamp-back-online-after-breach-a-7771 Bitstamp Back Online After Breach - DataBreachToday] (Dec 11, 2023)</ref>.
|-
|May 7th, 2019 7:49:57 PM MDT
|Inclusion In BitcoinExchangeGuide
|The incident is included as a "Hack / Theft" in a published list by BitcoinExchangeGuide.com<ref name="bitcoinexchangeguide-218" />.
|}
|}


== Technical Details ==
== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?
 
 
"Surprisingly, a banal phishing attack was used by hackers — the exchange employees received personal emails and messages in Skype from seemingly friendly sources.”
 
“Six employees of Bitstamp were targeted in a weeks-long phishing attempt leading up to the theft of roughly $5m in bitcoin in January, according to an unconfirmed incident report said to be drafted internally by the bitcoin exchange.”
 
“What’s maybe even more surprising is that the person responsible for security, Bitstamp system administrator Luka Kodrich, clicked the link and downloaded malware onto the working computer, after which the exchange was hacked. Bitstamp hurried to notify traders about what was happening, however, the attackers had already stolen the funds.”
 
 
“On this occasion, Mr.Kodric was certain that these logins were not made by him, and must therefore have been the attacker. Analysis indicates that the attacker accessed LNXSRVBTC, where the wallet.dat file was held, and the DORNATA server, where the passphrase for the bitcoin wallet was stored, before data was transferred out to both servers to IP 1**.**.***.**8, which is part of a range owned by a German hosting provider. We suspect that the the attacker copied the Bitcoin wallet file and passphrase at this stage [...] Together the wallet and passphrase would have enabled the attacker to steal bitcoins from the Bitcoin wallet.” “all BTC held with [Bitstamp] prior to the temporary suspension of services were honored in full.”
 
“A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”


== Total Amount Lost ==
== Total Amount Lost ==
The amount lost is consistently reported as 19,000 BTC<ref name="bitcoinexchangeguide-218" /><ref name="bankinfosecurity-4369" />.
Various sources have reported this amount as "equivalent to $5 million", "$5.000k"<ref name="bitcoinexchangeguide-218" />, "more than $5 million"<ref name="bankinfosecurity-4369" />, and "about $5.1m at press time"<ref name="coindesk-216" />.
The total amount lost has been estimated at $5,100,000 USD.
The total amount lost has been estimated at $5,100,000 USD.


How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
== Immediate Reactions ==
 


== Immediate Reactions ==
Bitstamp, reported the security breach resulting in the loss of less than 19,000 BTC (approximately $5.1 million)<ref name="coindesk-216" />. The compromise affected some of Bitstamp's operational wallets, leading to the suspension of deposits and ultimately a temporary shutdown of the platform<ref name="coindesk-216" />. Bitstamp assured customers that funds held prior to the service suspension would not be affected, emphasizing that the majority of its Bitcoin reserves are stored in secure offline cold storage systems<ref name="coindesk-216" />. The exchange reported they were actively collaborating with law enforcement in an ongoing investigation<ref name="coindesk-216" />. Bitstamp's CEO, Nejc Kodrič, stated that the breach represents only a small fraction of the total Bitcoin reserves, and efforts are underway to transfer a secure backup of the platform to a new environment, with plans to resume services in the coming days<ref name="coindesk-216" />.
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?
 
 
"Bitstamp’s wallet system was compromised, prompting it to halt deposits and later shut down its platform entirely."
 
Following the incident, BitStamp temporarily suspended its services and urged customers not to deposit funds into previously issued Bitcoin deposit addresses. The exchange assured customers that the breach, affecting some operational wallets, would not impact consumer assets, as the overwhelming majority of Bitstamp's Bitcoin reserves are stored in secure offline cold storage systems<ref name="bankinfosecurity-4369" />.


== Ultimate Outcome ==
== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
The incident was included in SlowMist<ref name="slowmisthacked-1160" />.
 
“A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”


== Total Amount Recovered ==
== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?


== Ongoing Developments ==
== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
TBD
== General Prevention Policies ==
== General Prevention Policies ==
Coming soon.
Coming soon.
Line 96: Line 115:


== References ==
== References ==
<references><ref name="bitcoinmagazine-6">[https://bitcoinmagazine.com/articles/infographic-overview-compromised-bitcoin-exchange-events Infographic: An Overview of Compromised Bitcoin Exchange Events] (Jan 30, 2020)</ref>
<references>
 
<ref name="bitcoinmagazine-6">[https://bitcoinmagazine.com/articles/infographic-overview-compromised-bitcoin-exchange-events Infographic: An Overview of Compromised Bitcoin Exchange Events] (Jan 30, 2020)</ref>
<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>
<ref name="kylegibson-86">[https://medium.com/@kylegibson/100-crypto-thefts-a-timeline-of-hacks-glitches-exit-scams-and-other-lost-cryptocurrency-873c87fd5522 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents] (Jan 25, 2020)</ref>
<ref name="ccn-195">[https://www.ccn.com/31-million-tether-hack-linked-to-27000-btc-in-previous-exchange-thefts/ $31 Million Tether Hack Linked to 27,000 BTC in Previous Bitcoin Theft] (Mar 2, 2020)</ref>
<ref name="ccn-195">[https://www.ccn.com/31-million-tether-hack-linked-to-27000-btc-in-previous-exchange-thefts/ $31 Million Tether Hack Linked to 27,000 BTC in Previous Bitcoin Theft] (Mar 2, 2020)</ref>
<ref name="bitstamp-196">[https://www.bitstamp.net/article/relaunch-faq/ Bitstamp - Relaunch FAQ] (Mar 2, 2020)</ref>
<ref name="bitstamp-196">[https://www.bitstamp.net/article/relaunch-faq/ Bitstamp - Relaunch FAQ] (Mar 2, 2020)</ref>
<ref name="cointelegraph-197">[https://cointelegraph.com/news/crypto-exchange-hacks-in-review-proactive-steps-and-expert-advice Crypto Exchange Hacks in Review: Proactive Steps and Expert Advice] (Mar 2, 2020)</ref>
<ref name="cointelegraph-197">[https://cointelegraph.com/news/crypto-exchange-hacks-in-review-proactive-steps-and-expert-advice Crypto Exchange Hacks in Review: Proactive Steps and Expert Advice] (Mar 2, 2020)</ref>
<ref name="coinsutra-202">[https://coinsutra.com/biggest-bitcoin-hacks/ Top 6 Biggest Bitcoin Hacks Ever] (Mar 2, 2020)</ref>
<ref name="coinsutra-202">[https://coinsutra.com/biggest-bitcoin-hacks/ Top 6 Biggest Bitcoin Hacks Ever] (Mar 2, 2020)</ref>
<ref name="bravenewcoin-207">[https://bravenewcoin.com/insights/bitstamp-hack-result-of-phishing-attack-says-leaked-internal-report Brave New Coin] (Mar 2, 2020)</ref>
<ref name="bravenewcoin-207">[https://bravenewcoin.com/insights/bitstamp-hack-result-of-phishing-attack-says-leaked-internal-report Brave New Coin] (Mar 2, 2020)</ref>
 
<ref name="coindesk-208">[https://www.coindesk.com/unconfirmed-report-5-million-bitstamp-bitcoin-exchange Details of $5 Million Bitstamp Hack Revealed - CoinDesk] (Mar 2, 2020)</ref>
<ref name="coindesk-208">[https://www.coindesk.com/unconfirmed-report-5-million-bitstamp-bitcoin-exchange Details of $5 Million Bitstamp Hack Revealed] (Mar 2, 2020)</ref>
<ref name="coindesk-216">[https://www.coindesk.com/bitstamp-claims-roughly-19000-btc-lost-hot-wallet-hack\ Bitstamp Claims $5 Million Lost in Hot Wallet Hack - CoinDesk] (Mar 4, 2020)</ref>
 
<ref name="bitcoinexchangeguide-218">[https://web.archive.org/web/20200413134528/https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com Archive April 13th, 2020 7:45:28 AM MDT] (Mar 5, 2020)</ref>
<ref name="coindesk-216">[https://www.coindesk.com/bitstamp-claims-roughly-19000-btc-lost-hot-wallet-hack\ Bitstamp Claims $5 Million Lost in Hot Wallet Hack] (Mar 4, 2020)</ref>
 
<ref name="bitcoinexchangeguide-218">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 5, 2020)</ref>
 
<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
<ref name="slowmisthacked-1160">[https://hacked.slowmist.io/en/?c=Exchange SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
 
<ref name="bitstamp-4366">[https://www.bitstamp.net/ Bitstamp Homepage] (Dec 12, 2021)</ref>
<ref name="bitstamp-4366">[https://www.bitstamp.net/ https://www.bitstamp.net/] (Dec 12, 2021)</ref>
 
<ref name="wikipedia-4367">[https://en.wikipedia.org/wiki/Bitstamp Bitstamp - Wikipedia] (Dec 12, 2021)</ref>
<ref name="wikipedia-4367">[https://en.wikipedia.org/wiki/Bitstamp Bitstamp - Wikipedia] (Dec 12, 2021)</ref>
 
<ref name="bankinfosecurity-4369">[https://www.bankinfosecurity.com/bitcoin-exchange-reports-data-breach-a-7760 Bitcoin Exchange Reports Data Breach - BankInfoSecurity] (Dec 12, 2021)</ref>
<ref name="bankinfosecurity-4369">[https://www.bankinfosecurity.com/bitcoin-exchange-reports-data-breach-a-7760 Bitcoin Exchange Reports Data Breach - BankInfoSecurity] (Dec 12, 2021)</ref></references>
</references>

Revision as of 13:59, 11 December 2023

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Bitstamp Logo/Homepage

Apparently the wallet file (named wallet.dat) was encrypted with only a simple passphrase, which was also stored online. This breach took down one of the largest and most widely used exchanges at the time, bringing down multiple services such as ATMs that sourced their liquidity from Bitstamp. Bitstamp has since set up multi-signature hot wallets through BitGo, while the majority of funds remain in cold storage. No customers of the exchange appear to have lost their funds in the incident.

[1][2][3][4][5][6][7][8][9]

About Bitstamp

Bitstamp is the world's longest-running cryptocurrency exchange[10].

"Bitstamp is a cryptocurrency exchange based in Luxembourg. It allows trading between fiat currency, bitcoin and other cryptocurrencies. It allows USD, EUR, GBP, bitcoin, ALGO, XRP, Ether, litecoin, bitcoin cash, XLM, Link, OMG Network, USD Coin or PAX deposits and withdrawals."

"Bitstamp makes trading easy, fast & reliable. With 24/7 support, staking and bank-grade security & insurance. Since 2011."

"The company was founded as a European-focused alternative to then-dominant bitcoin exchange Mt. Gox. While the company trades in US dollars, it accepts fiat money deposits for free only via the European Union's Single Euro Payments Area, a mechanism for transferring money between European bank accounts."

Wikipedia: [10]

Homepage: bitstamp.net[11]

The Reality

TBD

What Happened

Bitstamp lost 19,000 BTC from the exchange’s hot wallet.

Key Event Timeline - Bitstamp Hot Wallet Hack
Date Event Description
January 1st, 2015 12:00:36 AM MST Main Event Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
January 5th, 2015 3:29:35 PM MST CoinDesk Article Published CoinDesk reports on the security breach resulting in the loss of less than 19,000 BTC (approximately $5.1 million). The compromise affected some of Bitstamp's operational wallets, leading to the suspension of deposits and ultimately a temporary shutdown of the platform. Bitstamp assured customers that funds held prior to the service suspension would not be affected, emphasizing that the majority of its Bitcoin reserves are stored in secure offline cold storage systems. The exchange is actively collaborating with law enforcement in an ongoing investigation. Bitstamp's CEO, Nejc Kodrič, stated that the breach represents only a small fraction of the total Bitcoin reserves, and efforts are underway to transfer a secure backup of the platform to a new environment, with plans to resume services in the coming days. The incident underscores the challenges and vulnerabilities faced by cryptocurrency exchanges, raising concerns about the security and mainstream viability of digital assets[12].
January 6th, 2015 2:38:00 PM MST Bank Info Security Article Bank Info Security reports that European Bitcoin exchange Bitstamp experienced a data breach on January 4, leading to the theft of 19,000 Bitcoins valued at over $5 million[13]. Following the incident, BitStamp temporarily suspended its services and urged customers not to deposit funds into previously issued Bitcoin deposit addresses. The exchange assured customers that the breach, affecting some operational wallets, would not impact consumer assets, as the overwhelming majority of Bitstamp's Bitcoin reserves are stored in secure offline cold storage systems. Bitstamp is collaborating with law enforcement officials to investigate the incident, and the exchange plans to transfer a secure backup of its website to a new environment in the coming days. The breach highlights the ongoing vulnerabilities in the Bitcoin ecosystem and raises questions about the viability of Bitcoin as a mainstream alternative, particularly in terms of consumer protection[14]. TBD - Any new information in here.
January 7th, 2015 9:30:00 PM MST Bank Info Security Article The Bank Info Security article author promotes it with another tweet[15]. TBD - Check if article was updated in the meantime.
January 9th, 2015 3:50:00 PM MST BitStamp Back Online BitStamp is reportedly back online[16][17].
May 7th, 2019 7:49:57 PM MDT Inclusion In BitcoinExchangeGuide The incident is included as a "Hack / Theft" in a published list by BitcoinExchangeGuide.com[18].

Technical Details

"Surprisingly, a banal phishing attack was used by hackers — the exchange employees received personal emails and messages in Skype from seemingly friendly sources.”

“Six employees of Bitstamp were targeted in a weeks-long phishing attempt leading up to the theft of roughly $5m in bitcoin in January, according to an unconfirmed incident report said to be drafted internally by the bitcoin exchange.”

“What’s maybe even more surprising is that the person responsible for security, Bitstamp system administrator Luka Kodrich, clicked the link and downloaded malware onto the working computer, after which the exchange was hacked. Bitstamp hurried to notify traders about what was happening, however, the attackers had already stolen the funds.”


“On this occasion, Mr.Kodric was certain that these logins were not made by him, and must therefore have been the attacker. Analysis indicates that the attacker accessed LNXSRVBTC, where the wallet.dat file was held, and the DORNATA server, where the passphrase for the bitcoin wallet was stored, before data was transferred out to both servers to IP 1**.**.***.**8, which is part of a range owned by a German hosting provider. We suspect that the the attacker copied the Bitcoin wallet file and passphrase at this stage [...] Together the wallet and passphrase would have enabled the attacker to steal bitcoins from the Bitcoin wallet.” “all BTC held with [Bitstamp] prior to the temporary suspension of services were honored in full.”

“A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”

Total Amount Lost

The amount lost is consistently reported as 19,000 BTC[18][14].

Various sources have reported this amount as "equivalent to $5 million", "$5.000k"[18], "more than $5 million"[14], and "about $5.1m at press time"[12].

The total amount lost has been estimated at $5,100,000 USD.

Immediate Reactions

Bitstamp, reported the security breach resulting in the loss of less than 19,000 BTC (approximately $5.1 million)[12]. The compromise affected some of Bitstamp's operational wallets, leading to the suspension of deposits and ultimately a temporary shutdown of the platform[12]. Bitstamp assured customers that funds held prior to the service suspension would not be affected, emphasizing that the majority of its Bitcoin reserves are stored in secure offline cold storage systems[12]. The exchange reported they were actively collaborating with law enforcement in an ongoing investigation[12]. Bitstamp's CEO, Nejc Kodrič, stated that the breach represents only a small fraction of the total Bitcoin reserves, and efforts are underway to transfer a secure backup of the platform to a new environment, with plans to resume services in the coming days[12].


"Bitstamp’s wallet system was compromised, prompting it to halt deposits and later shut down its platform entirely."

Following the incident, BitStamp temporarily suspended its services and urged customers not to deposit funds into previously issued Bitcoin deposit addresses. The exchange assured customers that the breach, affecting some operational wallets, would not impact consumer assets, as the overwhelming majority of Bitstamp's Bitcoin reserves are stored in secure offline cold storage systems[14].

Ultimate Outcome

The incident was included in SlowMist[19].

“A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

TBD

General Prevention Policies

Coming soon.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.

References

  1. ↑ Infographic: An Overview of Compromised Bitcoin Exchange Events (Jan 30, 2020)
  2. ↑ 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents (Jan 25, 2020)
  3. ↑ $31 Million Tether Hack Linked to 27,000 BTC in Previous Bitcoin Theft (Mar 2, 2020)
  4. ↑ Bitstamp - Relaunch FAQ (Mar 2, 2020)
  5. ↑ Crypto Exchange Hacks in Review: Proactive Steps and Expert Advice (Mar 2, 2020)
  6. ↑ Top 6 Biggest Bitcoin Hacks Ever (Mar 2, 2020)
  7. ↑ Brave New Coin (Mar 2, 2020)
  8. ↑ Details of $5 Million Bitstamp Hack Revealed - CoinDesk (Mar 2, 2020)
  9. ↑ http://www.reuters.com/article/2015/01/06/us-bitstamp-cybersecurity-idUSKBN0KF0UH20150106Dec 11, 2023)(
  10. ↑ 10.0 10.1 Bitstamp - Wikipedia (Dec 12, 2021)
  11. ↑ Bitstamp Homepage (Dec 12, 2021)
  12. ↑ 12.0 12.1 12.2 12.3 12.4 12.5 12.6 Bitstamp Claims $5 Million Lost in Hot Wallet Hack - CoinDesk (Mar 4, 2020)
  13. ↑ gen_sec - "#Bitcoin Exchange Reports #Data #Breach: http://bit.ly/1DuW4Kb - @databreachtoday" - Twitter (Dec 11, 2023)
  14. ↑ 14.0 14.1 14.2 14.3 Bitcoin Exchange Reports Data Breach - BankInfoSecurity (Dec 12, 2021)
  15. ↑ gen_sec - "#Bitcoin Exchange Reports #Data #Breach: http://bit.ly/143bbxy - @databreachtoday" - Twitter (Dec 11, 2023)
  16. ↑ gen_sec - "#Bitstamp Back Online After #Breach: http://bit.ly/1x5tTvE - @databreachtoday" - Twitter (Dec 11, 2023)
  17. ↑ Bitstamp Back Online After Breach - DataBreachToday (Dec 11, 2023)
  18. ↑ 18.0 18.1 18.2 Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com Archive April 13th, 2020 7:45:28 AM MDT (Mar 5, 2020)
  19. ↑ SlowMist Hacked - SlowMist Zone (Jun 26, 2021)
Retrieved from "https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Bitstamp_Hot_Wallet_Hack&oldid=5306"