BiKi Password Tampering

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

BiKi

While details are vague, it appears that some customer accounts were breached, potentially a handful of accounts with SMS two-factor authentication. Funds were withdrawn from the accounts.

BiKi has fully compensated the customers and improved security.

This exchange or platform is based in Singapore, or the incident targeted people primarily in Singapore.

About BiKi

"Headquartered in Singapore, BiKi.com is a centralized exchange that provides a digital assets platform for trading more than 470 cryptocurrencies and 515 trading pairs. BiKi.com aims to provide the safest, most stable and most effective cryptocurrency trading platform. 100% of the transaction fees are reportedly used in buyback and burning of platform token, BIKI." "BiKi is also targeting an international audience, as it offers its platform in multiple languages, including Chinese, English, Russian, Vietnamese and Korean."

"Since its official opening in August 2018, BiKi.com is considered one of the fastest-growing cryptocurrency exchanges in the world." "BiKi.com claims to have accumulated 3.5 million registered users, 80,000 daily active users, over 3,000 community partners, and 1 million community members." "BiKi.com has received investments from Huobi co-founder Du Jun, Genesis Capital Zhu Huai Yang, FBG Capital, ChainUP and others totaling approximately 10 million USD." "The exchange offers USDT-denominated perpetual contracts that allow users to speculate on the price movements of Bitcoin, Ethereum, Bitcoin Cash, EOS, XRP and Litecoin."

"[I]t was reported that another Singapore-based crypto exchange BiKi has also encountered hijack attacks." "[C]rypto security firm SlowMist does list one incident involving BiKi, in which issues with the platform’s 2-factor authentication system caused a loss of 123,300 USDT." "Biki.com was hacked by side channel attack via SMS hijacking." "BiKi.com announced that at 0:08:23 on March 26, the BiKi.com community received a user feedback that his password has been tampered with and need to bind the new Google verification code. At around 5 in the morning, 28 users had the same problem, and the risk control system received an alarm." "At 3 pm on the same day, Biki said in the announcement that the number of accounts involved in tampering with passwords was 37, and the number of accounts involved in asset transfer was 18, and the amount of losses amounted to $123,300."

"At the time of the initial announcement, it was known that some users' accounts had been hijacked. This is not the case where the private key of the exchange is targeted, but the case where the user's customer account is targeted." "After investigation, it is because some users are not bound to Google verification code and third-party verification code service provider SMS is hijacked and caused. At present, the number of of accounts that have been tampered with passwords is 37, and the account involved in asset transfer is 18." From "the statement emphasizing "Please incorporate multi-factor authentication as well as the mobile phone verification code", it can be inferred that the mobile phone verification code, that is, the hijacking around SMS was performed." "BiKi has launched a subversive “mining, buying back, and destroying” model, where fees are used to repurchase the platform’s token, BIKI, and burn them. By destroying tokens, the company aims to increase the price of each individual token, as less tokens become available on the market."

"[T]he loss amount is 12.33 million USDT, the BiKi.com will bear the full amount of the loss." "According to the report, BiKi committed to refund the full amount to the affected users."

"At this point, the cause had been identified, and it probably took several hours to check the extent of the damage and recheck the security. The content announced after that also confirmed this, and it is stated that the account was hijacked via a third-party provider."

"In May 2019, BiKi.com announced the official appointment of its Southeast Asia CEO, Mr. Ethan Ng." "Apart from that incident, BiKi’s security record seems to be good with no other security breach reports. The exchange gives users the option to set up 2-factor authentication via Google Authenticator, or receive verification codes via SMS. Users also have to confirm certain operations through e-mails."

This exchange or platform is based in Singapore, or the incident targeted people primarily in Singapore.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - BiKi Password Tampering
Date	Event	Description
March 26th, 2019 12:00:00 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

While the exact details are vague, it would appear that the authentication factors used SMS-based verification, which is known to be vulnerable to SIM swapping.

There were no user funds lost in this case.