Theft And Mayhem In The Bitcoin World (2024)

The schadenfreude of Bitcoin enthusiasts over Ethereum’s recent troubles ended abruptly last week. A major Bitcoin exchange, Bitfinex, was hacked and nearly 120,000 BTC (around $60m) was stolen. The price of Bitcoin promptly crashed, and Bitfinex was forced to suspend trading. Suddenly, Ethereum was not the only basket case cryptocurrency around.

It appears that Bitfinex’s security was seriously compromised. Customer coins were held in individual wallets secured with a 2 of 3 multisig arrangement: keys were held by Bitfinex itself and Bitgo, a professional custodian and signatory, with a third (backup) key held in secure offline storage. Customers could not withdraw funds from the wallets until any borrowings had been cleared. It was, if you like, a form of escrow. And it should have been secure.

But it wasn’t. Somehow, the hacker managed to gain access to hundreds of customer wallets. Not only did the hacker gain access to the wallets, he/she also overrode Bitgo’s withdrawal limits. It was a well-planned and comprehensive security breach by someone who knew exactly what they were doing. Funds were moved to thousands of addresses over a short period of time. Bitfinex, it seems, was powerless to stop it.

This is one of the largest Bitcoin heists ever, dwarfed only by Mt. Gox in 2014. It is comparable in size to Ethereum’s DAO theft only a couple of weeks ago. And it is going to result in a lot of people losing a lot of money. All of Bitfinex’s customers, in fact. The company has announced a haircut of 36.067% across the board:

After much thought, analysis, and consultation, we have arrived at the conclusion that losses must be generalized across all accounts and assets. This is the closest approximation to what would happen in a liquidation context. Upon logging into the platform, customers will see that they have experienced a generalized loss percentage of 36.067%. In a later announcement we will explain in full detail the methodology used to compute these losses.

Although the loss is estimated as the amount the customers would receive if the company were liquidated, this is a bail-in. Bitfinex has no plans to cease trading:

We intend to come online within 24-48 hours with limited platform functionality. Additional announcements will be made as we progressively enable more platform features and return to full operations.

See Also

Bitcoin Fell Off a Cliff and No One Knows How Far It Is to the BottomFive reasons 2018 could be the best year yet for cryptocurrenciesThe 9 Best Cryptocurrencies to Watch for the Rest of 2020Trade Spotlight | What should you do with TVS Motor, Exide Industries, RBL Bank on RBI policy day?

It’s not at all clear what the legal basis for this bail-in is. There will no doubt be court cases to establish it. Though Bitfinex seems to be hoping for some gullible investors to make good the losses:

We are actively discussing various strategic options with numerous potential investors as part of our strategy to fully compensate our customers. Such discussions, however, are in early stages and will likely take time to play out.

A very long time, I should think.

So how did this happen – and who was responsible? Unsurprisingly, Bitfinex blamed everyone except itself. Color me unconvinced. I may be wrong, but I think this theft was most likely planned and executed by someone within Bitfinex, using the CFTC’s recent investigation into Bitfinex’s margin trading activities as cover.

In June, Bitfinex was issued with a cease-and-desist order by the CFTC for breaking the Commodities Act by executing illegal off-exchange margin trading deals and failing to register as a futures commission merchant. In its judgment, the CFTC notes that during the investigation, Bitfinex twice changed its procedures for storing customer money:

From April 2013 to August 2015, when a customer purchased bitcoins on Bitfinex, the purchased bitcoins were held for the benefit of the buyer in Bitfinex' s omnibus settlement wallet. The individual customer interests in the omnibus settlement wallet were accounted for in real time on Bitfinex's database. However, the omnibus settlement wallet was owned and controlled by Bitfinex and Bitfinex held all "private keys" associated with its omnibus settlement wallet.....

In August 2015, Bitfinex changed its model so that bitcoins purchased using the Exchange Trading feature were held in multi-signature wallets established by a third party firm that were individually enumerated for each trader. Bitcoins purchased using the Exchange Trading feature were settled to the Blockchain on an intra-day basis. However, Bitfinex retained control over the private keys to these wallets as well.

In January 2016 and for the remainder of the Relevant Period, during the course of the Division of Enforcement's investigation, Bitfinex changed its model again so that bitcoins purchased using both the Exchange Trading and Margin Trading features were held in individually enumerated, multi-signature wallets. However, Bitfinex continued to retain control over the private keys to those wallets.

It has been alleged that the CFTC forced Bitfinex to change its storage arrangements, introducing a weakness into the system which the hacker could exploit. Keeping customer money in individual multi-signature wallets in the custody of a neutral third party is apparently not as safe as keeping it offline in a very large bucket with a single set of keys.

I find this hard to believe. The CFTC’s judgment does not impose any requirement on Bitfinex to change their storage procedures, although the CFTC notes that Bitfinex said it changed some business practices in response to the investigation. And the last change to the procedures was six months prior to the CFTC’s cease-and-desist order. It seems highly unlikely that this change was driven by the regulator.

But even if it were, it is hard to see why the new arrangement should be any less safe than the old. A multisig arrangement where two signatures from independent parties are required to release funds SHOULD be completely secure. So why wasn’t it?

The problem, as Emin Gün Sirer explains, was that activating Bitgo’s key was initiated by Bitfinex:

BFX stored its coins in an account per user. Each account was protected by 3 keys, and 2 out of 3 keys were sufficient to move the funds. 1 key for user, 1 key for BFX, and 1 key for BitGo.

BFX had a special API key that allowed it to instruct BitGo to provide a signature programmatically. So a compromise at BFX meant that the attacker had (1) the BFX keys, one for each BFX user, and (2) the BFX->BitGo API key, which allowed BFX (and the hacker) to instruct BitGo to sign the transaction. That enabled the attacker to turn a compromise at one location (BFX) into many withdrawals.

So the wallets were “multisig” in name only. In reality, as the CFTC noted, Bitfinex controlled access to them.

There is a huge amount of soul-searching going on now about the security of multisig wallets. But I think the angst is misplaced. Multisig did not fail. It wasn’t really being used.

And this also supports my view that the hacking was an inside job. Why would anyone set up a security system with such an obvious flaw? I suppose they could just be terminally naive (yes, I know, Hanlon’s razor). But the FT’s Izabella Kaminska says that Bitfinex had previously been hacked, losing 1500 BTC ($330,000) in May 2015. You would think they would do something about their security after that. And even more so after being fined by the CTFC at the beginning of June 2016 for failing to segregate customer money properly. However, if they were operating a scam, then setting up the flawed security system enabled them to drain the funds.

But who are “they”? We do not know. It is difficult to find out who is really in charge at Bitfinex: the website gives no information. Bitfinex’s co-founders are Raphael Nicolle, whosays he has moved on to pastures new, leaving Bitfinex “in the capable hands of a good team of investors and experts”, and Giancarlo Devasini, currently listed as Risk Manager. LinkedIn lists J.L. Van Der Velde as CEO. None of them has said anything since the hacking.

The one director we do hear from is Zane Tuckett, who has been doing a wonderful job of maintaining communication with the Bitcoin community. But it appears to be a completely solo effort. So where are the other directors?Someone listed as "Bitcoin CEO" is allegedly on the run, but we do not know who that is.

We may never know. The funds may simply vanish, the perpetrators disappear and the customers lick their wounds. But here is one last thought. A trawl of Bitcoin discussion forums over the last three years revealed that Bitfinex has a long history of hacks, errors, insider trading and suspected scams. Why on earth is anyone still using it?

The date of Bitfinex's previous hacking has been corrected.