BitcoinTalk Database Breach

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

BitcoinTalk

BitcoinTalk is one of the largest and oldest forums on the internet related to bitcoin. In May 2015, the server was compromised through a social engineering attack on the sites ISP (internet service provider). In the apparent 12 minutes that the attackers had access, they managed to pull the entire database of all 499,593 users. The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform. Luckily, passwords were securely hashed and the vast majority could not be efficiently brute forced.

This is a global/international case not involving a specific country.

About BitcoinTalk

BitcoinTalk is "one of the largest and, most importantly, international forums where you can find absolutely all the information about Bitcoins." "Bitcointalk.org is the largest and probably the most famous forum related to the Bitcoin world." "Here you can safely communicate with miners from different parts of the world, read about the most favorable offers from cranes or cloud mining sites, learn the principles of doubling and choose the most reliable services, communicate in "non-stop"mode."

"BitcoinTalk is a message board where people interested in the technical details and the development of Bitcoin software can talk to each other. The forum also has places for people who are interested in bitcoin mining, in trading with bitcoin, and in the economics of Bitcoin."

"Before the creation of the current BitcoinTalk Forum, Satoshi used a SourceForge forum, which is lost. When Sirius provided hosting, the forum was moved to bitcoin.org/smf. Satoshi made several custom modifications to the forum software and theme."

"In July, 2011 the forum was moved to bitcointalk.org in order to make it explicitly unofficial. The "forum" link on the bitcoin.org homepage was made to simply return the Google search results for the search terms "bitcoin forums". This was followed by Bitcoin Community members, very much in bitcoin's spirit of decentralisation, creating a number of alternative forums offering different moderatorial policies and using different software platforms. None of these alternative forums have yet reached the size of Bitcoin Talk." "On July 22, 2012, Bitcoin Talk reached its one millionth post."

"In May 2015, BitcoinTalk was the victim of a social engineering attack after an unknown hacker targeted an employee of NFOrce, BitcoinTalk’s ISP. In a revelation on Reddit at the time, forum operator and admin Theymos hinted that password hashes, private messages, emails and other user details could be compromised."

"Bitcointalk.org had 499,593 users hacked in May of 2015, and they do know about the breach. Bitcointalk.org data contains usernames, emails, passwords, birthdays, secret questions, hashed secret answers and some other internal data." "The stolen BitcoinTalk data includes usernames, email addresses, passwords, birthdates, secret questions, hashed secret answers and other pieces of data belonging to the platform."

"The attack is said to have targeted the site's ISP, a company called NFOrce that is based in the Netherlands." "Server compromised due to social engineering against ISP NFOrce. There will be extended downtime for forensic analysis and reinstall."

"The forum's ISP NFOrce managed to get tricked into giving an attacker access to the server. I think that the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn't able to get a complete dump of the database."

"The compromise was announced via the official BitcoinTalk Twitter account. Operator Theymos later took to the bitcoin subreddit to offer a more detailed explanation."

"Theymos said that BitcoinTalk could remain offline for as many as 60 hours following the incident, and cautioned users to "act as though your password hashes, PMs, emails, etc. were compromised"."

"However, the account information gained by the hackers may not have come of much use to them due to additional protection features incorporated into these platforms." "Only 44,869 (9%) of users on Bitcointalk.org used MD5 hashing with a unique salt for passwords. Of those, LeakedSource.com was able to crack 30,389 or 68%. The remaining 91% of user passwords were hashed with “sha256crypt” and LeakedSource estimates it would take them about a year to crack an estimated 60-70% of them. This method of password storage is far superior to nearly every website they say they’ve seen thus far."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - BitcoinTalk Database Breach
Date	Event	Description
May 21st, 2015 7:14:00 PM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?