PayFair P2P Exchange Hacked

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Payfair P2P Exchange Homepage

Ethereum is tricky to set up as a proper multi-signature wallet, since the functionality is not built-in and must instead be done through a smart contract. Smart contracts often have exploitable vulnerabilities. But more importantly, it does not make sense to trust an unknown entity in an unidentified country with your funds, regardless of whether the exchange claims to be “P2P” or not. The same issues with centralized exchanges apply to any escrow service as well.

About Payfair P2P Exchange

PayFair describes itself as a "decentralized Escrow platform".

PAYFAIR is a decentralized Escrow platform and p2p exchange which ensures the paramount security of all cryptocurrency transactions made between two parties. We provide low fees for all transactions in a safe, private and decentralized environment.

Homepage:

Reddit:

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

“On September 29, Payfair disclosed on its Telegram channel that the private key to one of its cold wallets was compromised, which led to a hack. On October 2, PayFair—a decentralized escrow and P2P exchange—closed its website because one of its main cold wallets was emptied, leading many to speculate about a possible exit scam."

Key Event Timeline - PayFair P2P Exchange Hacked

Date	Event	Description
September 29th, 2019	Wallet Breach Disclosed	Payfair discloses on their Telegram channel that their main cold wallet had been breached and emptied.
October 2nd, 2019	Website Reportedly Closed	The Payfair website is reportedly closed.
September 24th, 2021 4:16:35 AM MDT	Purchase Guide Published	Crypto Guides publishes a guide on "How And Where To Buy Payfair (PFR) – Step By Step Guide".
August 24th, 2022 6:10:14 PM MDT	Bitcoin Revolution Redirect	The Payfair.io website presently redirects to the Bitcoin Revolution homepage.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

"Their team says it is still unsure of how the private key was compromised but is conducting an internal investigation into the matter."

Total Amount Lost

The total amount lost is unknown.

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

“On September 29, Payfair disclosed on its Telegram channel that the private key to one of its cold wallets was compromised, which led to a hack. On October 2, PayFair—a decentralized escrow and P2P exchange—closed its website because one of its main cold wallets was emptied, leading many to speculate about a possible exit scam."

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

"Their team says it is still unsure of how the private key was compromised but is conducting an internal investigation into the matter. While user funds have since been transferred to backup wallets, part of the ETH that was stolen has not been recovered. Despite announcing that the platform would only be down “until the end of the week,” the PayFair.io website still appears to be down and they have not updated their social media since July 29.”

Redirect To Bitcoin Revolution

The Payfair website appears to redirect to the "bitcoin revolution" homepage, a likely ponzi scheme.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Let this be a reminder that claiming to be "decentralized" doesn't always mean that there is no custody of any funds. The proper storage of funds offline in a multi-signature wallet with keys held by multiple reputable people has never been breached.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.