Flexcoin Hot Wallet Hack

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Flexcoin Logo/Homepage

Flexcoin was a service that allowed users to send their bitcoins to other users quickly and more conveniently than through standard bitcoin. The platform had an issue where submitting multiple withdrawal requests close together could allow the user to withdraw more funds than they had. On March 2nd, 2014, a hacker exploited this bug to steal all of the wallet funds. Only customers who had utilized the available cold storage service (available for an extra charge) were able to retrieve their funds. The company walked away and did nothing to assist the hot wallet users, however at least they were quick about it.

About Flexcoin

Flexcoin was a bitcoin storage service based in Alberta, Canada. Flexcoin presented itself as the solution to a major problem with Bitcoin by offering a centralized platform for managing bitcoins across various devices. Traditionally, bitcoins are only accessible from the device they were initially received on, limiting their usability. With Flexcoin, users can access their bitcoins from any web-connected device, enabling easy transactions and payments without technical expertise. Flexcoin described themselves as the world's first bitcoin bank, allowing users to send and receive bitcoins seamlessly.

By centralizing bitcoin storage and offering accessibility from any web-connected device, Flexcoin promised to revolutionize how bitcoins are managed and utilized. Additionally, Flexcoin rewarded users with "discount payments" on positive bitcoin balances, further positioning itself as a leader in bitcoin banking.

Flexcoin had previously emphasized the security of its bitcoin storage practices, asserting that it held zero coins in other companies or exchanges. This stance aimed to differentiate Flexcoin from other electronic wallet providers, with the company incentivizing users to keep their bitcoin balances on its platform.

One of Flexcoin's key features was its emphasis on security, implementing a ZERO link policy in emails to prevent phishing attempts. The Flexcoin homepage described Flexcoin as "a leader in bitcoin security".

Flexcoin is also a leader in bitcoin security, for example Flexcoin is the first to implement a ZERO link policy in e-mails. No e-mail sent from Flexcoin contains a link or image. If you receive one that does, it's a phishing attempt.

Flexcoin emphasized their independence from third parties.

“We hold zero coins in other companies, exchanges etc. While the MtGox closure is unfortunate, we at Flexcoin have not lost anything.”

Homepage:

The Reality

Despite branding itself as the "first bitcoin bank," Flexcoin clarified that it was not legally classified as such. Flexcoin noted on their homepage that they do not accept traditional currencies and are not regulated by government entities like FDIC.

Legal Notice: We are not a true bank that accepts USD or any national currency, only bitcoins which by their nature are not regulated, we're not FDIC insured or regulated by any government entity.

Flexcoin stored all user funds in the same hot wallet to allow for fast withdrawals. With the exception of users who had specifically opted for a premium version of the service, none of the user funds were stored offline. It is not believed that any funds were protected by a multi-signature wallet.

A bug existed on the Flexcoin platform where transfers between accounts could be conducted multiple times before balances were updated. The sending accounts would have their balance decrease well below zero, while the recipient account balance would increase. A large balance could be built up within the recipient account by repeatedly sending transfer requests to that account. The recipient could then withdraw the extra funds.

Shortly after Mt. Gox, Flexcoin announced that they had "not lost anything". This tweet announced that their hot wallet was still full.

What Happened

The Flexcoin wallets were emptied out by a hacker exploiting the account transfer bug with thousands of simultaneous requests that had a total value of 896 bitcoin.

Key Event Timeline - Flexcoin Hot Wallet Hack

Date	Event	Description
February 25th, 2014 9:52:00 AM MST	Mt. Gox Unaffected	Flexcoin assured users that it remained unaffected by the closure of Mt. Gox, asserting that it had not incurred any losses due to the latter's shutdown and emphasizing holding no coins in other companies. "We hold zero coins in other companies, exchanges etc. While the MtGox closure is unfortunate, we at Flexcoin have not lost anything."
March 2nd, 2014 5:15:12 AM MST	Hacker Withdraws 840 Bitcoin	The three largest blockchain transactions happen within the same bitcoin block, withdrawing 500 bitcoin and 90 bitcoin from Flexcoin to the first wallet, and another 250 bitcoin from Flexcoin to the second wallet.
March 2nd, 2014 5:18:16 AM MST	Hacker Withdraws 50.1 Bitcoin	The hacker withdraws a total of 50.1 bitcoin in 3 more transactions.
March 2nd, 2014 5:21:04 AM MST	Hacker Withdraws 6 Bitcoin	The hacker withdraws a further 6 bitcoin in 2 more transactions. These would be the last known withdrawals of the attacker.
March 4th, 2014 12:52:00 AM MST	Flexcoin Shutdown Tweet	Flexcoin announces on Twitter that they will be shutting their doors.
March 4th, 2014 9:07:00 AM MST	CoinDesk Article Published	CoinDesk reports on Flexcoin announcing its closure after falling victim to the cyberattack. Losses are mentioned as 896 BTC, valued at roughly $600,000. The company disclosed the theft on its homepage and conceded that it lacked the resources to recover from the significant loss, leading to the immediate cessation of its operations. Flexcoin has already provided the wallet addresses associated with the hackers, revealing that the stolen funds had been transferred out of the compromised accounts. Customers who stored bitcoins in Flexcoin's cold storage were assured that they would be able to retrieve their funds, with the company facilitating the transfer free of charge upon verification of their identities.
March 5th, 2014 1:33:00 AM MST	Reuters Article Published	Reuters reports high level details of the attack method. An update from Flexcoin revealed that the attack exploited a flaw in its code related to transfers between users, involving inundating the system with simultaneous requests to move coins between accounts. Despite the company's efforts to maintain server security, including regular testing and repelling thousands of attacks over the years, these measures proved insufficient in preventing the breach. Flexcoin emphasized its collaboration with law enforcement agencies to trace the source of the hack and announced its intention to return bitcoins stored offline, or in "cold storage," to users. Cold storage, being offline and inaccessible via the internet, offers greater security against hacking attempts. Bitcoin, a digital currency traded on a peer-to-peer network independent of central control, experienced a surge in value the previous year, with the total worth of bitcoins minted reaching approximately $7 billion. According to Bitstamp, a leading bitcoin exchange, the value of a single bitcoin was around $658 at the time of the announcement.

Technical Details

The attack on Flexcoin exploited a flaw in its code related to transfers between users, involving a flood of simultaneous requests to transfer coins between accounts. Despite the company's efforts to maintain server security through regular testing and repelling numerous attacks over the years, it proved insufficient in preventing this breach.

“The site was itself broken from the ground up. The hackers simply got it to do what it was programmed to do, a lot faster than normal.”

Technical Analysis On Flexcoin Homepage

FlexCoin published an analysis on their homepage of the attacker's activity.

The attacker logged into the flexcoin front end from IP address 207.12.89.117 under a newly created username and deposited to address 1DSD3B3uS2wGZjZAwa2dqQ7M9v7Ajw2iLy

The coins were then left to sit until they had reached 6 confirmations.

The attacker then successfully exploited a flaw in the code which allows transfers between flexcoin users. By sending thousands of simultaneous requests, the attacker was able to "move" coins from one user account to another until the sending account was overdrawn, before balances were updated.

This was then repeated through multiple accounts, snowballing the amount, until the attacker withdrew the coins.

Blockchain Transactions/Addresses

“Flexcoin also provided the wallet addresses of the alleged hackers. The largest wallet of which received 592.1 BTC from the breach, while the smaller of the two held at one point 304 BTC supposedly taken from the website.”

Attacker addresses:

1NDkevapt4SWYFEmquCDBSf7DLMTNVggdu

• Total received: 592.1 BTC in 3 transactions.

1QFcC5JitGwpFKqRDd9QNH3eGN56dCNgy6

• Total received: 304 BTC in 5 transactions.

Transaction example:

Total Amount Lost

Losses are mentioned by CoinDesk as 896 BTC, valued at roughly $600,000.

The total amount on the blockchain is 896.1 BTC.

“Flexcoin also provided the wallet addresses of the alleged hackers. The largest wallet of which received 592.1 BTC from the breach, while the smaller of the two held at one point 304 BTC supposedly taken from the website.”

The total amount lost has been estimated at $600,000 USD.

Immediate Reactions

Flexcoin announced its closure following the loss. The company revealed that all 896 bitcoins stored online were stolen, prompting its immediate shutdown. Flexcoin announced their closure and provided the wallet addresses associated with the hackers, revealing that the stolen funds had been transferred out of the compromised accounts.

The incident occurred shortly after the bankruptcy filing of Mt. Gox, once the leading bitcoin exchange globally, which reported the potential loss of around 850,000 bitcoins to hacking. Flexcoin clarified that it remained unaffected by Mt. Gox's closure, asserting that it had not incurred any losses from that incident. Flexcoin cited its lack of resources to recover from the significant loss as the reason for its closure, acknowledging that it could not withstand the financial impact.

Flexcoin stated its collaboration with law enforcement agencies to trace the origin of the hack and pledged to return bitcoins stored offline, known as "cold storage," to its users. Cold storage coins, held in computers disconnected from the internet, are considered more secure against hacking attempts.

Customers who stored bitcoins in Flexcoin's cold storage were assured that they would be able to retrieve their funds, with the company facilitating the transfer free of charge upon verification of their identities.

“As Flexcoin does not have the resources, assets or otherwise to come back from this loss, we are closing our doors immediately.”

Ultimate Outcome

The incident was featured in the Bitcoin Exchange Guide.

The cyberattack and subsequent theft served to underscore long-standing concerns within the bitcoin community regarding the security of wallet storage services like Flexcoin.

Total Amount Recovered

Only funds held in a special "cold storage" wallet were returned. Users who kept their funds in cold storage were required to pay a 0.5% fee. Customers who stored bitcoins in Flexcoin's cold storage were assured that they would be able to retrieve their funds, with the company facilitating the transfer free of charge upon verification of their identities.

Flexcoin conceded that it lacked the resources to recover the significant amount of funds lost, leading to the immediate cessation of its operations.

“Flexcoin held some bitcoins in “cold storage”, keeping them on devices not connected to the internet. Those bitcoins are safe, but only users who explicitly requested their bitcoins be held in cold storage (and paid a 0.5% fee) benefit.” “Users who put their coins into cold storage will be contacted by Flexcoin and asked to verify their identity. Once identified, cold storage coins will be transferred out free of charge. Cold storage coins were held offline and not within reach of the attacker. All other users will be directed to Flexcoin's "Terms of service" located at "Flexcoin.com/118.html" a document which was agreed on, upon signing up with Flexcoin.”

Ongoing Developments

Flexcoin provided the wallet addresses of the alleged hackers. It is not clear what tracing has been done on those funds.

Individual Prevention Policies

When using any third party custodial platform (such as for trading), it is important to verify that the platform has a full backing of all assets, and that assets have been secured in a proper multi-signature wallet held by several trusted and trained individuals. If this can't be validated, then users should avoid using that platform. Unfortunately, most centralized platforms today still do not provide the level of transparency and third party validation which would be necessary to ensure that assets have been kept secure and properly backed. Therefore, the most effective strategy at present remains to learn proper self custody practices and avoid using any third party custodial platforms whenever possible.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Making multiple transfers quickly is a common platform vulnerability, which should have been tested against. The Flexcoin platform could also have significantly reduced the amount which could be taken by storing most funds offline and protecting them with a multi-signature wallet.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.