NiceHash Exchange Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

NiceHash is not only one of the most popular mining brokerage platforms out there; they also function as a cryptocurrency exchange. The platform was founded in part by Matjaž Škorjanc who is known to have spread malware on millions of PCs, however the breach appears to have occurred through the other founder and CEO Marko Kobal who fell victim to a spear phishing attack. Although details are limited, it would appear likely that the CEO erroneously installed malware on a company PC and this enabled an exploit of what were effectively hot wallets on the website. The company has since paid back 82% and more through a repayment program, however having an extreme amount of funds outside of a proper cold storage raises many questions.

This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.

About NiceHash

“Hackers stole $64 million from NiceHash, a company that lets users apply their extra GPUs to mining cryptocurrencies.” "Users report that funds have been moved from their own internal Nicehash Bitcoin addresses to a single Bitcoin address controlled by an unknown party." “Kobal said that about 4,700 bitcoins were stolen on December 6th and that a hacker or a group of hackers with an IP address outside of Europe accessed NiceHash computers. Through that access, the hacker(s) obtained a NiceHash engineer’s credentials and used them to access the payment system.” “A hacker or group of hackers had been in a position to infiltrate our inner programs by a compromised firm pc,” stated Marko Kobal, CEO of NiceHash, on Fb reside. “We’re nonetheless conducting a forensic evaluation on how the affected pc was really compromised.” “Now, the company’s co-founder, Marko Kobal, has stepped down as CEO.” “In the aftermath the company decided to return the stolen funds through the Repayment program. 82% of the old funds was already reimbursed by January 2020. Their headquarters are based in Ljubljana, Slovenia.”

This exchange or platform is based in Slovenia, or the incident targeted people primarily in Slovenia.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - NiceHash Exchange Hack
Date	Event	Description
December 1st, 2017 12:00:54 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?