Bitcurex Targeted by Hacking

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Bitcurex Logo/Homepage

The Bitcurex platform featured a magical money duplication “feature”. The hacker used their “magic money” to purchase all the bitcoin on the platform. It appears they managed to make off with 1,323 bitcoin before the issue was discovered (very quickly). The exchange continued operation after this hack without revealing what had happened.

About Bitcurex

This exchange or platform is based in Poland.

Archive Homepage:

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The Bitcurex platform was hacked and 1,323 bitcoin were stolen.

Key Event Timeline - Bitcurex Targeted by Hacking

Date	Event	Description
February 25th, 2014 8:52:00 AM MDT	Report About Mt. Gox	Bitcurex publishes an official statement about the situation with Mt. Gox on their Facebook page.
March 14th, 2014 3:37:00 AM MDT	Initial Facebook Announcement	The Bitcurex platform posts a notification on Facebook in Polish that they have temporarily suspended the website for verification purposes and that they will provide further appropriate information after the verification is complete.
March 14th, 2014 4:06:00 AM MDT	Announcement Posted In English	Bitcurex posts an announcement in English that they "decided to temporarily shut down our service" due "to an error and ongoing maintenance works".
March 14th, 2014 7:45:00 AM MDT	Security Procedure Announcement	The Bitcurex posts that "funds are safe". The website has reportedly been disabled as part of security procedures.
March 14th, 2014 8:16:20 AM MDT	Platform Shutdown Reported	NewsBTC reports that the Bitcurex platform had shut down.
March 14th, 2014 8:23:00 AM MDT	English Safety Procedures	Bitcurex posts an update in English that "funds are secure" and the "current shutdown results from safety procedures".
March 14th, 2014 10:27:00 AM MDT	Further Polish Explanation	Bitcurex posts an update on Facebook that they have successfully stopped a hacking attack on Bitcurex, preventing significant theft of BTC funds. Most funds in our Hot Wallet, as well as all Cold Wallet and FIAT funds, are safe. Our team has resolved the issue and is working on resuming service. We'll update you on the full restoration date soon. Thank you for your support. .
March 14th, 2014 11:08:00 AM MDT	Further English Explanation	The update is posted in English as well.
March 14th, 2014 11:31:05 AM MDT	Follow Up Statement	NewsBTC reports that Bitcurex has issued a follow up statement. In a follow-up statement, the company says they “successfully blocked a hacking attack,” adding that “Thanks to automatic safety procedures, hackers manages to defraud only a portion of the funds stored in operational Hot Wallet Bitcurex.”
March 15th, 2014 7:06:00 AM MDT	Progress Update Polish	Bitcurex posts an update that the IT work is almost complete and testing of the modified system is scheduled for that evening. Users should expect an exact date for the relaunch once the audit is completed.
March 15th, 2014 7:46:00 AM MDT	Progress Update English	An English version of the same update was posted.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $844,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Facebook Announcements Throughout the Process

An initial announcement was first posted in Polish.

Dear Users,

Due to the irregularities, we have temporarily suspended the website for verification purposes. After its completion, we will provide you with appropriate information.

Kind regards,

Bitcurex Team

Within an hour an announcement was also posted in English.

Dear Users,

Due to an error and ongoing maintenance works, we decided to temporarily shut down our service. Further information coming soon.

Regards,

Bitcurex Team

A few hours later, an update was posted in Polish.

Dear Users,

Work is underway to restore the operation of the website. At the same time, we would like to inform you that your funds are safe - the website has been disabled as part of security procedures. We will provide you with further, more detailed information in the near future.

Kind regards,

Bitcurex Team

Followed by an English variant of the update.

Dear Users,

We are working on resuming our service. We would like to inform you that your funds are secure - current shutdown results from safety procedures. We will soon provide you with further, more detailed information.

Regards,

Bitcurex Team

Details of the attack were posted in Polish.

Dear Users,

We managed to thwart a hacker attack on the Bitcurex website, preventing the mass theft of our users' BTC funds. Thanks to automatic security procedures, the hackers managed to embezzle only part of the funds stored on the operational Bitcurex Hot Wallet. Most of the funds present in the Hot Wallet, as well as all of the funds in the Cold Wallet and FIAT cash, remained intact.

Our team located and removed the source of the problem. Work is underway to resume the website, and an external audit is being conducted in parallel: we will soon provide you with the exact date of relaunch of all Bitcurex functionalities. We will provide you with more information in subsequent communications.

We apologize for any inconvenience and, above all, we would like to thank the entire BTC community for their support: we are coming out of this trial stronger.

Kind regards,

Bitcurex Team

As with the others, the update was translated to English.

Dear Users,

We successfully blocked a hacking attack on Bitcurex, preventing mass theft of BTC funds of our users. Thanks to automatic safety procedures, hackers managed to defraud only a portion of the funds stored in operational Hot Wallet Bitcurex. The majority of funds from Hot Wallet, as well the entirety of funds from Cold Wallet and FIAT monetary funds remained intact.

Our team located and removed the source of the problem. We are working on resuming normal service, at the same time an external audit is being conducted: we will soon provide the exact date of resuming all Bitcurex functionalities. More information will be provided in further statements.

We are sorry for the inconvenience, and most of all we thank the whole BTC community for the support we received: we were put to a test that will make us stronger.

Best regards,

Bitcurex Team

A further update was provided the next day in Polish and English.

Dear Users,

IT works are almost completed. Internal tests of the modified system are planned today in the evening, after which a final external audit will be carried out. After its positive completion, we will publish a message in which we will provide you with the exact launch date of the website and all necessary details.

Thank you once again for your patience and trust - it means a lot to our entire team.

Kind regards,

Bitcurex Team

Update posted on the website.

Dear Users,

First of all, we would like to thank all of you for your patience and understanding that you have shown during the last couple of dozen hours. We thank all our Users from Poland and abroad who contacted us and stressed their faith in resolving this situation in an positive way, despite the black scenarios that everybody must have thought about.

We are proud to inform you that we are resuming our service with all its functionalities on March 18 (Tuesday) at the latest. We will inform you about the exact hour of resuming the service soon. The service will be brought back to its state from before the attack using the backup copies.

The thief did not manage to break our security measures protecting your accounts nor gain full access to operational Hot Wallet Bitcurex. Thanks to our safety procedures, after the initial non- authorised transactions, the thief was prevented from making any further operations. Then the service was shut down to carry out repair works and implement the necessary improvements to our system.

Our internal procedures prevented any further losses, which were limited to between 10 and 20 percent of our operational Hot Wallet Bitcurex. Because of realistic chances of filing criminal charges against those who are responsible, in order to allow an effective official investigation, we prefer not to disclose details that could facilitate destroying evidence.

All the incurred losses were covered from the funds gathered by Digital Future – the owner of Bitcurex. Our fees will not be raised, nor will we introduce any other restrictions.

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Coming soon.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.