HotBit Downtime and Privacy Breach

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

HotBit

The Hotbit exchange was attacked, putting $14m in hot wallet assets at risk. In this case, the situation was lucky because the risk control system kicked in to prevent the theft and funds were moved to cold storage before the attacker could steal them.

This exchange or platform is based in China, or the incident targeted people primarily in China.

About HotBit

"According to CoinMarketCap, Hotbit had listed 1559 trading pairs in total and was ranked No. 1 among all exchanges regarding the number of types of cryptocurrency projects listed. Hotbit has accumulated 1,000,000+ registered users from more than 170 countries and areas all over the world, among which 90% of registered users are non-Chinese users. Hotbit started to distribute current deposit interests for its users, which means that Hotbit was the first cryptocurrency exchange in the world to offer daily current deposit interests to its users with no token lockup or freeze required."

"Founded in January 2018 and registered in both Hong Kong and Estonia, with its core team members from China, USA and Taiwan, Hotbit is currently based in Shanghai and Taipei." "Constantly introducing and listing high quality digital currencies from all over the world, providing users with various types of transactional services in most digital currencies. We provide 24/7 online customer support to ensure quick and readily available support when needed. With a built in Artificial Intelligence market maker that meets the high standards set by Wall Street, our model analysis based on over 250 market parameters, providing 24/7 Customer Support and high liquidity."

"Security issues have always been the pain of blockchain industry, which has always been one of the major concerns of Hotbit as well." "We conduct the multinodular structure which meets the requirements set by the IT surveillance logical structure from the Financial Industry, ensuring steady operations of our systems. The front and back-end designs, combined with our multi-node and multimodular distributed deployment, scales out our capacity and thus providing better service for our customers."

"Hotbit has already accumulated more than 700,000 registered users from more than 210 countries and areas all over the world. By focusing on the world's emerging markets such as the markets of Russia, Japan, South Korea, Turkey and Southeast Asian countries, Hotbit has gathered its users from Twitter, Telegram, WeChat, VK and Facebook. Join in Hotbit community, communicate and share your thoughts and experience of cryptocurrency with our experienced users from all over the world and gain an insight into the new trend of cryptocurrency industry."

Hotbit had set up a bug bounty with firebounty/hackenproof as of November 26th, 2020.

"The official announcement of the cryptocurrency exchange Hotbit stated that Hotbit had suffered a serious network attack starting at 20:00 UTC on April 29, 2021, causing some basic services to be paralyzed and the exchange was no longer able to log in. At the same time, the attacker also tried to hack into Hotbit's wallet, which Hotbit claimed was identified and blocked by the risk control system."

Addressing users on the exchange’s Telegram group, Alex Zhou, chief security officer of Hotbit, revealed that user funds were unaffected by the attack, stating: “The attacker tried to break into the wallet server to steal funds but the action was identified and blocked successfully by Hotbit risk control system. All users’ funds are safe.” "Hotbit just suffered a serious cyber attack starting around 08:00 PM UTC, April 29,2021, which led to the paralyzation of a number of some basic services. Meanwhile, the attackers also tried to hack into Hotbit’s wallets (However, the attempt was identified and stopped by our risk control system)."

"The Hotbit team decided to immediately shut down all services for inspection and recovery. The entire recovery period is expected to be no less than 7 days. Hotbit stated that all assets are safe."

The exchange says that it is “about to exceed 2 million registered users and has a huge service system architecture of more than 200 servers online, in order to ensure security, Hotbit team will completely rebuild all servers.”

"While user funds remain safe, Hotbit warned its customers its database had been compromised during the attack, and that their phone number, email address and asset data might have been leaked." "The attacker has access to the database, so your email address, phone number, account balances, etc may be leaked. They claim that the passwords and 2FA secrets are encrypted, therefore they are safe (disclaimer: they might not). If your Hotbit password is the same as other accounts, they suggest making your passwords unique (you should be doing this already)" "[T]he Hotbit team has advised customers to disregard any communication from entities claiming to be representatives of the exchange."

"The exchange explained that the attacker deleted the user database after failing to obtain assets. It also warned that “The attacker has already gained access to the database,” so users’ “registered phone number, email address and asset data” may have been leaked." "While stating that the database is backed up, the company says, “we are still uncertain whether the attacker has polluted data or not before the attack,” justifying the need for “a comprehensive inspection.”"

"In severe cases, hackers will leave themselves a backdoor into the database several days before the main hacking event. When a company restores what they believe is a clean copy of their database from a previous day, they're actually opening the door to them once again."

"According to Hotbit, the attacker maliciously deleted the user database after failing to obtain assets. Although the database is routinely backed up , we are still uncertain whether the attacker has polluted data or not before the attack. Therefore, we also need to conduct a comprehensive inspection of the overall data."

"Hotbit is brining in outside cyber security firms for the process, which they say will take a minimum of 7 days, and possibly up to 3 weeks."

"Following the hack announcement, crypto transfers were spotted from Hotbit’s addresses. The exchange claims that the transfers resulted from them “creating new cold wallet.”" "In its Telegram channel the exchange explained it was now in the process of moving all funds from its hot wallet to a newly created cold wallet. Data from Etherscan has confirmed this, with tokens getting transferred from one of Hotbit’s known wallets to a new address, that holds around $14 million in multiple tokens."

“In the future, Hotbit team will continue to strengthen security departments. Meanwhile, by cooperating with world’s famous third-party Internet security teams, Hotbit will also conduct thorough inspection and investigation on the attack issue and thoroughly upgrade security level of the whole system.”

“All daily routine income distributions (such as investment products, current products and FIL cloud computing power ) will be paid out after the maintenance is completed .”

The last update from May 9th reports that "02:30 AM UTC More than 95% of the environment has been built, and the final performance optimization and security testing are carried out continuously to repair the inconsistency problems found in data verification. We will announce the relatively accurate external recovery steps of the platform in 12 hours"

Withdrawals appeared to start reopening for some assets around May 16th.

This exchange or platform is based in China, or the incident targeted people primarily in China.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - HotBit Downtime and Privacy Breach

Date	Event	Description
April 29th, 2021	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount at risk has been estimated at $14,000,000 USD. No funds were lost.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

No customer assets were lost in this case. This was a lucky case in which the automated systems performed as expected. Our framework does not yet include protections for customer information, however it seems that a better system would avoid exchanges needing to handle that personal information.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.