Bitstamp Hot Wallet Hack

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Bitstamp Logo/Homepage

Apparently the wallet file (named wallet.dat) was encrypted with only a simple passphrase, which was also stored online. This breach took down one of the largest and most widely used exchanges at the time, bringing down multiple services such as ATMs that sourced their liquidity from Bitstamp. Bitstamp has since set up multi-signature hot wallets through BitGo, while the majority of funds remain in cold storage. No customers of the exchange appear to have lost their funds in the incident.

About Bitstamp

Bitstamp is a Slovenian bitcoin exchange which was originally founded in 2011. Bitstamp was also reportedly based in Luxembourg. Bitstamp is the world's longest-running cryptocurrency exchange.

"Bitstamp is a cryptocurrency exchange based in Luxembourg. It allows trading between fiat currency, bitcoin and other cryptocurrencies. It allows USD, EUR, GBP, bitcoin, ALGO, XRP, Ether, litecoin, bitcoin cash, XLM, Link, OMG Network, USD Coin or PAX deposits and withdrawals."

"Bitstamp makes trading easy, fast & reliable. With 24/7 support, staking and bank-grade security & insurance. Since 2011."

"The company was founded as a European-focused alternative to then-dominant bitcoin exchange Mt. Gox. While the company trades in US dollars, it accepts fiat money deposits for free only via the European Union's Single Euro Payments Area, a mechanism for transferring money between European bank accounts."

Wikipedia:

Homepage: bitstamp.net

The Reality

TBD

What Happened

Bitstamp lost less than 19,000 BTC from the exchange’s hot wallet.

Key Event Timeline - Bitstamp Hot Wallet Hack

Date	Event	Description
January 1st, 2015 12:00:36 AM MST	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
January 5th, 2015 3:29:35 PM MST	CoinDesk Article Published	CoinDesk reports on the security breach resulting in the loss of less than 19,000 BTC (approximately $5.1 million). The compromise affected some of Bitstamp's operational wallets, leading to the suspension of deposits and ultimately a temporary shutdown of the platform. Bitstamp assured customers that funds held prior to the service suspension would not be affected, emphasizing that the majority of its Bitcoin reserves are stored in secure offline cold storage systems. The exchange is actively collaborating with law enforcement in an ongoing investigation. Bitstamp's CEO, Nejc Kodrič, stated that the breach represents only a small fraction of the total Bitcoin reserves, and efforts are underway to transfer a secure backup of the platform to a new environment, with plans to resume services in the coming days. The incident underscores the challenges and vulnerabilities faced by cryptocurrency exchanges, raising concerns about the security and mainstream viability of digital assets.
January 6th, 2015 2:38:00 PM MST	Bank Info Security Article	Bank Info Security reports that European Bitcoin exchange Bitstamp experienced a data breach on January 4, leading to the theft of 19,000 Bitcoins valued at over $5 million. Following the incident, BitStamp temporarily suspended its services and urged customers not to deposit funds into previously issued Bitcoin deposit addresses. The exchange assured customers that the breach, affecting some operational wallets, would not impact consumer assets, as the overwhelming majority of Bitstamp's Bitcoin reserves are stored in secure offline cold storage systems. Bitstamp is collaborating with law enforcement officials to investigate the incident, and the exchange plans to transfer a secure backup of its website to a new environment in the coming days. The breach highlights the ongoing vulnerabilities in the Bitcoin ecosystem and raises questions about the viability of Bitcoin as a mainstream alternative, particularly in terms of consumer protection. TBD - Any new information in here.
January 7th, 2015 9:30:00 PM MST	Bank Info Security Article	The Bank Info Security article author promotes it with another tweet. TBD - Check if article was updated in the meantime.
January 9th, 2015 3:50:00 PM MST	BitStamp Back Online	BitStamp is reportedly back online.
October 19th, 2017 2:11:44 AM MDT	CoinSutra Biggest Bitcoin Hacks	CoinSutra publishes an article titled "Top 6 Biggest Bitcoin Hacks Ever", which discusses significant historical Bitcoin hacks to emphasize the importance of securing private keys. Among the mentioned hacks, Bitstamp, a Slovenian Bitcoin exchange founded in 2011, suffered a hack on January 4, 2015. During this incident, an anonymous hacker compromised Bitstamp's operational hot wallet, resulting in the loss of 19,000 bitcoins, equivalent to $5 million at the time. Bitstamp suspended operations temporarily but resumed with enhanced security measures, such as implementing BitGo multisig wallets. Despite the setback, Bitstamp managed to regain user trust and continues to operate successfully. The article serves as a cautionary tale, urging readers to prioritize securing their private keys and advocating for the use of hardware wallets to safeguard cryptocurrencies.
November 21st, 2017 12:45:47 PM MST	CCN Article Linking To Tether Hack	A CCN article has managed to trace the funds to be linked to a $31m hack of the Tether stablecoin. "This same wallet" which "had received .01 BTC shortly before the hack" "was first used to steal more than 18,500 BTC — worth $5 million then but more than $150 million today — from Bitstamp in January 2015."
February 27th, 2019 11:31:32 AM MST	Inclusion In Kyle Gibson Timeline	Kyle Gibson includes the incident in his "100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents". Curiously, this incident is listed as a "Theft - Exit Scam" and it notes that "prompting [Bitstamp] to halt deposits and later shut down its platform entirely". The Bitstamp platform was still operating at the time of publication.
May 7th, 2019 7:49:57 PM MDT	Inclusion In BitcoinExchangeGuide	The incident is included as a "Hack / Theft" in a published list by BitcoinExchangeGuide.com.
May 24th, 2019 12:56:03 PM MDT	Bitcoin Magazine Inclusion	The incident is included in an infographic put together by Bitcoin Magazine. The Bitstamp hack occupies a central position on their chart of bitcoin price versus amount lost. Limited information is provided, with the hack data only listed as "January 2015", however it mentions that "[a]s a result of the theft, Bitstamp began to keep 98 percent of its bitcoin in cold storage".

Technical Details

"Surprisingly, a banal phishing attack was used by hackers — the exchange employees received personal emails and messages in Skype from seemingly friendly sources.”

“Six employees of Bitstamp were targeted in a weeks-long phishing attempt leading up to the theft of roughly $5m in bitcoin in January, according to an unconfirmed incident report said to be drafted internally by the bitcoin exchange.”

“What’s maybe even more surprising is that the person responsible for security, Bitstamp system administrator Luka Kodrich, clicked the link and downloaded malware onto the working computer, after which the exchange was hacked. Bitstamp hurried to notify traders about what was happening, however, the attackers had already stolen the funds.”

“On this occasion, Mr.Kodric was certain that these logins were not made by him, and must therefore have been the attacker. Analysis indicates that the attacker accessed LNXSRVBTC, where the wallet.dat file was held, and the DORNATA server, where the passphrase for the bitcoin wallet was stored, before data was transferred out to both servers to IP 1**.**.***.**8, which is part of a range owned by a German hosting provider. We suspect that the the attacker copied the Bitcoin wallet file and passphrase at this stage [...] Together the wallet and passphrase would have enabled the attacker to steal bitcoins from the Bitcoin wallet.” “all BTC held with [Bitstamp] prior to the temporary suspension of services were honored in full.”

“A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”

Total Amount Lost

Despite the initial announcement from Bitstamp being clear that the amount was "less than 19,000 BTC", the amount lost is consistently reported as 19,000 BTC across almost all major sources.

Various sources have reported this amount as "equivalent to $5 million", "$5.000k", "5,000,000.00", "$5 million", "more than $5 million", and "about $5.1m at press time".

The total amount lost has been estimated at $5,100,000 USD.

Immediate Reactions

Bitstamp, reported the security breach resulting in the loss of less than 19,000 BTC (approximately $5.1 million). The compromise affected some of Bitstamp's operational wallets, leading to the suspension of deposits and ultimately a temporary shutdown of the platform. Bitstamp assured customers that funds held prior to the service suspension would not be affected, emphasizing that the majority of its Bitcoin reserves are stored in secure offline cold storage systems. The exchange reported they were actively collaborating with law enforcement in an ongoing investigation. Bitstamp's CEO, Nejc Kodrič, stated that the breach represents only a small fraction of the total Bitcoin reserves, and efforts are underway to transfer a secure backup of the platform to a new environment, with plans to resume services in the coming days.

"Bitstamp’s wallet system was compromised, prompting it to halt deposits and later shut down its platform entirely."

Following the incident, BitStamp temporarily suspended its services and urged customers not to deposit funds into previously issued Bitcoin deposit addresses. The exchange assured customers that the breach, affecting some operational wallets, would not impact consumer assets, as the overwhelming majority of Bitstamp's Bitcoin reserves are stored in secure offline cold storage systems.

Ultimate Outcome

According to Bitcoin Magazine, as a result of this theft, Bitstamp's security policies changed to store 98% of bitcoin in cold storage.

The incident was included in SlowMist.

Include more from

Same Wallets Used In Hack Of Tether Stablecoin

“A wallet associated with [the] $31 million Tether hack has been linked to previous bitcoin exchange thefts numbering in the tens of thousands of bitcoins.”

In 2017, a $31 million Tether hack was linked to the previous Bitstamp theft involving tens of thousands of bitcoins. The Tether development team disclosed the hack of its hot wallet, and an analyst discovered a connection between the wallet used in the Tether hack and those involved in the 2015 Bitstamp bitcoin exchange theft of over 18,500 BTC, valued at $5 million then and over $150 million today. The hacker, who seems to have stolen at least $250 million in current value, brazenly linked wallets from multiple hacks, even connecting them to LocalBitcoins transactions from 2015. The analyst suggests that the hacker either disregards the power of blockchain analytics tools or is ignorant of their capabilities.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

TBD

General Prevention Policies

Coming soon.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.