Youbit Exchange Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Details appear to have been slow to come out on this hack, which took place right after a government security inspection by South Korea. It appears to be some kind of malware which was installed on the operation. Youbit had been previously hacked in April, and would again suffer issues as CoinBin in the future. The exchange filed for insurance, but this was denied, causing them to file for bankruptcy, before eventually being purchased by another exchange CoinBin. This highlights the importance of using air-gapped multi-sig cold storage, where any transactions are signed in an isolated environment and a breach requires all parties to sign off. Had this been employed for the vast majority of funds, and a self-insurance model been employed for the narrow percentage of hot wallets, the bankruptcy would have been avoided.

This exchange or platform is based in South Korea, or the incident targeted people primarily in South Korea.

About YouBit

“Youbit, which lets people buy and sell bitcoins and other virtual currencies, has filed for bankruptcy after losing 17% of its assets in the cyber-attack.” "The cyber attack is the second for Youbit, previously known Yapizon. The exchange was previously targeted in April in an attack which South Korean officials believe was conducted with the support of neighboring North Korea. Recent reports indicate that intelligence services in South Korea suspect that North Korea is behind additional attacks against domestic cryptocurrency exchanges, including market-leader Bithumb." “Yapian obtained a DB Cyber Comprehensive Liability Insurance policy just 20 days before it declared bankruptcy” “DB Insurance, one of South Korea’s biggest property-and-casualty insurers, has denied the claim of 3 billion won (~USD$2.65 million) by Yapian, the operator of Youbit” “In a statement, Youbit said that customers would get back about 75% of the value of the crypto-currency they have lodged with the exchange.” “But, to claim the rest of the funds, the company stated that investors will have to wait until the final settlement of bankruptcy proceedings.” “Unfortunately, for Youbit investors, it may take several months to years to receive the remaining 25 percent of their personal funds, as the settlement of bankruptcy proceedings will have to be finalized before the company can credit its customers.” “The hack has been attributed to North Korean hackers” “While the investigation could take “weeks” to review the malware code, “the people said there were telltale signs and historical evidence that North Korea was behind the Youbit attack,” the news outlet detailed.” “According to Yonhap, the rights and duties related to the personal information of Youbit members and all assets were transferred to Coinbin on March 21.”

This exchange or platform is based in South Korea, or the incident targeted people primarily in South Korea.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Youbit Exchange Hack
Date	Event	Description
December 1st, 2017 12:00:55 AM	First Event	This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?