Bitcoins Reserve Social Engineering

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Bitcoins Reserve Logo/Homepage

The Bitcoins Reserve email address of Sam Lee was leaked by the US Marshall Service as part of their auction of bitcoin seized from Silk Road. Sam Lee then received and fell for a targeted spear phishing attack, where he entered his password in a fake Google Drive website. The attackers used his email account to request the CTO Jim Chen to transfer them 100 bitcoins and he happily obliged. The money was reimbursed by the platform, so no customers faced losses. It appears that Bitcoins Reserve website has remained online until June 2019.

This exchange or platform is based in Australia, or the incident targeted people primarily in Australia.

About Bitcoins Reserve

"Bitcoins Reserve has serviced hundreds of customers since starting operations in June 2013, first to market in Cryptocurrency Arbitrage and large volume Procurement, we work to offer our investors a diversified approach to generate returns in both Fiat and Cryptocurrency." "Offering the worlds first cryptocurrency arbitrage fund, Bitcoins Reserve has since June 2013 consistently generated double digit monthly returns for investors. Since the fund started 9 months ago, our automated trading engine has generated a return of over 205.8%." "Our team constantly seeks and executes opportunities and manage their associated risks. With a strong understanding on what is becoming the greatest financial revolution in the 21st century, we have helped both skeptics and believers realise incredible returns in the Cryptocurrency space."

"Based out of Level 11, 470 Collins Street, Melbourne, Australia, Bitcoins Reserve runs a number of initiatives educational initiatives such as Bitcoins 101 and the Arbitrage Acadamy. We take pride to provide the general public with the information necessary for them to make an informed decision when investing into cryptocurrency, one such investment vehicle is our Arbitrage fund, which performs automated simultaneous trades across multiple exchanges with price differentials, to correct market inefficiencies and bring liquidity, all in the while netting profitable trades."

"In addition, we work with a number of retail exchanges and OTC traders to provide procurement services, providing emergency liquidity when a larger than expected buy or sell order is beyond their capacity to service." "Looking to stake a portion of your assets in Cryptocurrencies? Having fostered close relationships with major global and regional exchanges, we’re able to offer wiring services as well facilitate localised on demand Over The Counter buying and selling." "Bitcoins Reserve can help secure your cryptocurrency assets through our cold storage solution."

About Silk Road Seizure

In 2014, the US government had recently auctioned off bitcoin seized from Silk Road, marking a significant event in the currency's history. This action has been seen as a step towards legitimizing bitcoin, as the government's willingness to auction it implies a certain acceptance and acknowledgment of its value.

"The US government's recent auction of bitcoin seized from Silk Road was a landmark in bitcoin's story – as many have pointed out, it gives some small sense of legitimacy to the currency in the sense that the government wouldn't auction off seized cocaine, for example. The US government is willing to deal in bitcoin to some extent, a small but important signal."

"But it was also accompanied by its fair share of farce. Before the auction the government accidentally emailed the potential participants but forgot to bcc them, so everyone who received the email could see who else had been emailed, meaning their names were eventually leaked."

"The message was not intended for any particular group of people, but for anyone who had emailed a question to the general mailbox to ask about the auction. Only recipient email addresses were disclosed."

"The upshot of the US government leak is that the people whose emails were leaked were targeted by scammers, one of whom succeeded in dramatic style."

The Reality

The Silk Road auction was marred by a serious blunder: the government accidentally exposed the email addresses of potential participants by not using the BCC field, leading to a leak of their identities. This mistake resulted in those affected being targeted by scammers. This mistake is not uncommon, as it's happened before in 2012 with Amir Taaki.

What Happened

"Sam Lee of of bitcoin fund Bitcoins Reserve received an email claiming to be from a media company. The attached document was supposedly a list of interview questions but actually linked to a website prompting Lee to enter his password. When he did, the attacker took over his email and sent a message to the CTO, requesting a transfer of 100 bitcoin."

Key Event Timeline - Bitcoins Reserve Social Engineering

Date	Event	Description
June 18th, 2014 12:15:00 PM MDT	Leak Reported On CoinDesk	CoinDesk reports on the leak of email addresses bidding on the Silk Road bitcoin.
June 21st, 2014	Linda Jackson Email	Sam Lee receives an email which appears to be from Linda Jackson from BitFilm Production. The email sender falsely claimed that BitFilm was preparing a series of interviews about the Silk Road auction for their client.
June 25th, 2014 6:45:02 AM MDT	Phishing Attack Succeeds	Sending an email from Sam Lee's account, the attacker successfully convinces the CTO Jim Chen to send 100 bitcoin to an external bitcoin wallet address that they own.
July 20th, 2014 4:20:00 AM MDT	CoinDesk Article Screwups	CoinDesk publishes an article on the 9 biggest screw-ups of bitcoin's history. The issue comes in as #4 on the list.

Technical Details

"Lee received an email on 21st June from a certain 'Linda Jackson' claiming to represent BitFilm Production, a genuine company based in Germany. Jackson falsely claimed that the firm was assembling a series of interviews about the impending auction for a client."

"Jackson then sent Lee a second email containing a link that directed to a file containing the questions for the interviews. This appeared to be a Google Drive document, but was actually a website controlled by the attacker."

"The faked page then requested Lee's email password to gain access to the document, and consequently, when the password was entered, the attacker gained access to Lee's email accounts."

"The scammers finally sent an email, purporting to be from Lee, to various employees requesting funds be sent to an external bitcoin wallet address, and the CTO unsuspectingly complied."

"The funds were sent by the firm's chief technology officer, Jim Chen, after he received what seemed like an email request to do so from Lee. In fact, the funds ended up being sent outside the company to the attacker's wallet. The transaction can be seen here, according to Lee."

Bitcoin Send Transaction:

Total Amount Lost

There were 100 bitcoin sent as a result of the successful attack.

The total amount lost has been estimated at $63,000 USD.

Immediate Reactions

"Individuals on the recipients list of the leaked US Marshals Service email to Silk Road auction enquirers are being targeted in a phishing attack, and at least one individual has fallen for the scam."

Ultimate Outcome

Lynzey Donahue, a US Marshals spokeswoman, later contact CoinDesk to clarify that the emailer had intended to send all recipients the information via blind carbon copy.

"The message was not intended for any particular group of people, but for anyone who had emailed a question to the general mailbox to ask about the auction. Only recipient email addresses were disclosed." "The USMS apologizes for this mistake which was in no way intentional".

"As this attack vector was only successful due to an oversight in operations, the founders of Bitcoins Reserve will compensate the company by injecting an additional 100 Bitcoins to ensure we're still effectively performing arbitrage for our investors."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

"As this attack vector was only successful due to an oversight in operations, the founders of Bitcoins Reserve will compensate the company by injecting an additional 100 Bitcoins to ensure we're still effectively performing arbitrage for our investors."

Ongoing Developments

There is no indication of further developments.

Individual Prevention Policies

This case does not appear to have resulted in a loss to any individual.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Better training for platform operators would avoid falling for schemes like this. Storing funds in a multi-sig wallet where they must be approved by multiple team members increases the scrutiny on transactions.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.