Bitcoin Forum

Digital currency exchange service ShapeShift is offline after a security incident earlier this week.

A statement posted to Reddit by ShapeShift CEO Eric Voorhees offered more details as to why the site was taken offline, indicating an unknown quantity of funds had been taken from the service’s connected wallets. Customers with pending orders would receive their money within 24 hours, the company said.

See his post on reddit : https://www.reddit.com/r/shapeshiftio/comments/4dx6k4/shapeshift_update_april_7_security_breach/
and full article : http://www.coindesk.com/shapeshift/



More exchanges will open in the future and more will get hacked , so if you don't want to lose your coins and cry , you better store them well instead of keeping them in exchanges .

Also they did not give a timeline for when the service which is currently off will be restorted ? Also there is no grantee if the lost money of the people will be returned or not.

So its time we move to Mobile wallets which are more safer then Desktop wallets i guess.

Im never use shapeshift.io but i think this is verybad news :(
hope he save the bitcoin at safety place

Most likely the Bitcoin wallet will be touched including ETH

No any bitcoin or crypto related service are out of watch of hackers and hacker may have figure out that shapeshift store most of their money in their hot wallet which can be hacked by finding some loop hole in script.
They are saying "no customer money at risk. ". hope this is true and nobody will loss their coin.

I thought that people learned from their mistakes with Mt. Gox, but apparently that was not the case.

I wouldn't classify it as 'very bad', rather just negative.

1) Mobile wallets are not safer than desktop wallets.
2) ShapeShift is not a wallet.

never used them, and anyway i never lost anything on any exchange, always fast withdrawn everything i have the same day after i make profit

but after they broke the security of cryptsy i'm not surprised by anything

Apparently people never learn that earning trust of customers is really hard - and you can lose it in blink of an eye. After successful hacking I feel like Shapeshift trust is shaken.
I wonder if they survive as I expect most of their customers to give up on them.

shapeshift is not a deposit, play around for the day, withdrawal system.

shapeshift is where you type in an amount of what altcoin you want, and the address you want the altcoin delivered.. and it tells you an address and amount to pay. and you pay it. then receive the coins at the destination.

its more OTC(over the counter) rather than daytrade(deposit).

so shapeshift could actually spin it into a positive that customers are always left whole.
(bar the inconvenience of the few that happened to have placed an order just seconds before the site closed, who should get their requests filled soon)

but generally if there were lets say 10 customers every minute.. (14400 a day,5mill a year).. only 10 people would be inconvenienced by not getting their funds as fast as usual.

maybe some spin like
X mill customers a year only 0.000X% delayed

but still its been years now and i would have expected these services to have stopped using hotwallets on the front end server by now. there are more secure and practical ways to run a service without even having a hot-wallet on the same server

I used shapeshift few times in trading few litecoins their service is always smooth and very fast didnt expect this to happen , after reading this im losing my trust in using their site.

That's why it's not a good idea to store your coins in these website  ::)

Shapeshift does not hold any customer coins.This is no exchange or web wallet service like blockchain, coinbase, circle and so on.
The coins get swapped immediately and that's it.Therefore this is no drama imo.Sure it's never good press when you get hacked however as long as no customers funds are involved or lost I don't see as a big problem.
But it should make us aware never to store any serious amount of coins in third party services!

Thanks for the information provided. Im wondering why they are offline and cant be accessed. I'm thinking they are on maintenance or system upgrade until i read it here. But Now, shapeshift back to online. Thanks.

So sad to hear that. They provide such great facility, and I've always (and only) used them to convert my bitcoins to altcoins and vice versa. They seem to be just fine right now and hopefully everything is fixed now.

Meh. I used them once out of convenience but the fees were so ridiculously high for transferring between certain coins. If you use the android app Coinomi, shapeshift is built in to make it a very simple process.

It's unfortunate that yet another security breach has been announced on yet another exchange. At least the CEO was upfront and honest about it. It, at the very least, shows he has some integrity.

"By design, ShapeShift doesn't hold customer balances, so even in the case of a security breach, there is no customer money at risk. However, a portion of our own hot wallet inventory funds were taken, but nothing that will interfere with operations once our new environment is online. This is also by design.

We've built customer protection into our platform – hacks may be inevitable, but customer losses should not be. Not a cent of customer funds was lost, nor could they have been."

gj.

I dont think shapeshift ever had the option to store your bitcoins or altcoins there, it was a on the spot exchange, where you send btc or altcoins and recieve the required after and sometimes without confirmation.

Well, we approaching to block halving and price will rise , this will attract more hackers to come and do their best,
against best exchanges..I wonder where they gonna hit next?

That is a first (I think?). I do have to say that they did well when it comes to that aspect.

Apparently it did not and thus no customer funds were lost.

Saying that it is not an exchange and that it is one in the same sentence does not make much sense, does it?

Amazing way to manipulate bitcoin by hacking a exchange. Or maybe it is just how it seems. Need to get used to sites getting hacked now.

Very nice job by ShapeShift, as I always say, they are the best ones. I never use any other currency exchange than ShapeShift. Exchange is done within 15 minutes as always, just like now! ;)

big up shapeshift!

good to hear was not that bad  ;)

imho shapeshift is still one of the best and most useful services existing in the bitcoin realm

I used them in the past and was very fast. The thing is they don't have alot of information to be stolen from users because it was an accountless service. I never signed up for anything on their website but still used their service to exchange my alternative coins for bitcoin on many of occasions.

that's was shocking me,i know shapeshift since long time,and this is bad news for those people who still use it,and yes you right,more exchange will open and more will hacked or maybe scamming us,now its hard believe fully to exchange.

Its really happen to shapeshift?this is will be bad news for people who loves use shapeshift,and i never think that hacker start to hack so many sites related bitcoin,its make me little bit worry. but i'm sure,people with good plan on security aspect have try to prevent this all.

reaaly its sad

Never used, but expected it to be safer.

The first thing about the security systems ==> They are not secure...

Currently, the site is back up and actively trading only Bitcoin and Ether. The Shapeshift.io Twitter account stated that other coins will be trade-able in coming weeks and the company will notify users of that as the process of fixing the back end continues.

Even then most of their customers will not come back to them even if they lose nothing, because the trust is shaken. Why will they now risk even.
there are plenty for other site where they can exchange coins and also without fear  :)

This should be rule #1 for anyone putting their total confidence in any exchange or any service online for that matter. Once you hand over your personal information, it is out there for anybody to take if they intend too get it. It is sad but true in this day and age.

This is not an exchange, it was just currency exchange site. No perons coins was there at the site.
So it was not that big destruction.

Now many here talking, it is bad to store your coins on exchanges, and those kind of sites, but if you like to trade or you want to sell or buy your coins you need those web destinations. :-X
If you store your coins in cold wallet for future and everyone does the same, then bitcoin has no future.
Bitcoin must be used not only stored!
Risk is high but we can talk about that what should be done..

I think shapeshift didnt invest on more security protection for their site and the hackers notice it and they successfull hack and make it down. Just like vixtrade they are knew trading site and they are attack by hackers and now they are not recover their lose thats why they are down now. I lose some btc and altcoin in vixtrade.

To think that I recieved my payment from shapeshift not a day before the hack... Phew.

Has shapeshift gone through with their promise? Has everyone who used the system been paid out?

This is the flaw in centralized services and will always be vulnerable to attacks. Bitcoin was built to be more robust, with the decentralized nodes and this increase it's security

and decrease it's vulnerability. You use these centralized services at own risk and you should not blame the Bitcoin protocol when these services gets hacked. Well, it still has to

be proven that these services are actually hacked from someone outside of the service, and not people working within these services.  ::)

The only positive news about this ShapeShift flop is that apparently people are not recognizing this platform as a major pillar of bitcoin community.
Therefore I didn't see any price reduction in response to this event. It wasn't as big problem as I expected it will to be?

I noticed quite a few alts were down by double-digit percentages this morning. I'm guessing it's related to this Shapeshift hack. But if Shapeshift is accurate in saying customer funds were not hacked or at risk, this looks like a buying opportunity based on the market over-reacting.

I thought this service never held any coins, as in I thought you would just choose what coin you want to convert in, and then the transaction would only happen once there are available coins so they never need to held coins, now that's decentralized. If they held coins.. that's just shit and someone needs to come up with a solution where no 3rd party holding coins is needed.

The only people I see losing money in a Shapeshift hack is Shapeshift itself. Customers should feel safe just by how the site operates

People posting not to leave coins on exchange are correct, but that sentiment does not apply to this situation

Yes, the Shapeshift  should be careful now and make their network more strong.

Wow I couldn't see this one coming at all. I thought ShapeShift had a pretty high level of security, they even were integrated by BitGo into their own wallet to make coin conversions on-site. I guess BitGo aren't too happy either with the bad publicity surrounding Bitcoin businesses.
Fortunately customers' funds weren't affected but I am wondering how ShapeShift hot wallets were compromised. I guess with the plethora of alt coins they are trading they must be running Desktop wallets for each coin right?

It might be the case, but this will still hurt their reputation is any component of their site was hacked and coins stolen. The other users might lose confidence in them and quit using this service. They will have to push a lot into press releases and marketing to inform the public and to change their opinions about this service. 

I have only used them once, the fees are horrendous!

This is really bad for shapeshift users and their investment is now lost just like in Mt. Gox this is why we must be careful where we put our money so that we wont lose it in any hack attempt.

I was just reading at coindesk and I found this "Digital Currency Exchange ShapeShift Claims Hack Was Inside Job" : http://www.coindesk.com/digital-currency-exchange-shapeshift-claims-hack-inside-job/

I was really have a though that shapeshift is not hack for a website owner investing in real trading site i think they will invest on perfect security measures if they want long term transaction to their website and for what happen for shapeshift is just another like hyips stories that their website is hack and had alibi to their investor so they can run the money.

Every time I read a story like this, I'm happy that I don't keep the majority of my funds on exchanges. But it's still negative press for Bitcoin sadly..

Here's the full story: https://news.bitcoin.com/looting-fox-sabotage-shapeshift/

Who's Bob?

Unfortunately lately, this is becoming a very known practice, that at sometime, some of the best exchanges use their excuse an inside hack and take people money, thats very sad, no matter who has the fault, some inside worker or the owner, thats sad and thats why I never keep money in online exchanges, you never know what can happen tomorrow to your coins.

Well shape shift doesn't even store your coins in it. It converts them at ones and sends them to your address.  So, people just talking without info need to understand that it's totally legit.  Used by me hundreds of times

Ty

Shapeshift is definitely the safest exchange out there.

A pseudonym for the thief - I guess they can't release his name until he is charged with theft. That is, if the libertarians at Shapeshift believe in getting govts and law enforcement involved.

P.S. That article was a good read

So let me get this straight , by reading the story, basically these guys were stolen, but no user funds were touched or risked, and now they are building everything from the beginning? If that is the case a big congrats to them if they managed to save user funds and they are back in operation or at least trying to be.

that's really normal for instant exchanger to take a "little bit higher" fee than any other exchanger which require you to verify your ID by uploading so many important identifier thing and it's really disturbing i'd say

i don't think you can save your btc on shapeshift,it'll exchange your coin and send the selected coin directly to your address

That's what I assumed how it works. The model business is that hey offered a way to exchange coins without having to deposit them, which would make the risk of getting your coins stolen impossible. The profit they would make, is from the fees of the transaction. Now, what I assume that was stolen, is this amount of fee money they made (their money) and not anyone's elses money. In case im wrong then someone please explain it better.

yeah i'm also feel happy that i dont use shapeshift or other exchange that scamming people,but yes its sadly when happen for bring name of bitcoin,people will start aware and smoothly leave bitcoin because scammed and upset for that.

You are correct - it was their profits from fees that were stolen. Props to Voorhees for sharing the detail of the story - that way other exchanges can improve security - such as getting an external security expert to audit weaknesses and sweep the servers for trojans such as the one "Bob" placed in the Shapeshift set up.

Wow. I just read that whole article.

You can really feel Erik's frustration in this article. I can't imagine the stress that him and his team, with 4 brand new employees nonetheless, must have felt. I'm sure 'Bob' is going to get what's coming to him. I hope to hear when he does.

https://shapeshift.io/index.html#/inputs/1
now online again..?

Same here. Glad to see that Erik's been able to figure things out as far as he has, rather than hitting dead ends. We can hope 'Bob' will soon be caught, face justice, and that Shapeshift will ultimately come out of this much wiser and maybe even made whole again.

If they have trouble catching up with 'Bob', I wonder if it might be worth it for them to share all they know of him to help find him in real life. There are a lot of bitcoiners out there who could be eyes and ears for Shapeshift and for the sake of justice would be willing to help nail him.

Human factor...  :-\

http://www.itgovernanceusa.com/blog/shapeshift-loses-230000-in-bitcoin-data-breach-ex-employee-to-blame/ (http://www.itgovernanceusa.com/blog/shapeshift-loses-230000-in-bitcoin-data-breach-ex-employee-to-blame/)

I dont think that most of customers will not use shapeshift provided if they process transactions of their customers as they said.Risk is in every exchange site .In today's world you are not 100% secured.There are many flaws that remains undiscovered by the sites technical staff which can be exploited if hacker discovers it first.Same here happened with Shapeshift.

At least this is not incident: MT GOX 2.0
Shapeshift was an instant service and the company lost their incomes after this incident.

The major drawback would be the collapse of services which are integrated with shapeshift. 

Without reversibility it seems this will always be a problem.  Even with multisig, etc, insider theft will always be a risk it seems in crypto.

Just to let you know (those who don't already know) , It's online once again. I don't think it's necessary to tell you it's not safe to hold your coins in an exchange .

Which isn't relevant for Shapeshift. That was one bit of very good news out of this whole episode.

Since this hacking thing is increasing now a days, i guess we should be more careful with our Coins and the wallets and exchanges we use.
We should be careful in choosing the wallet and exchanges. below is my recommendation.


Xapo  for web wallet
Electurum  for desktop wallet

In exchanges you should not keep the money. Do the transcation and move the money back to your wallet.

State the facts correctly. Shapeshift does not hold customer's funds at all. Even if it is online from yesterday that does not mean it is unsafe for customers again. All hacks that happened had significant losses to their own funds on hot wallets.

I wonder if ShapeShift will ever be able to bring its trust back ?
Once you lose a trust, it is difficult to gain it back

Read the prior post, or mine a couple above. No customer lost a satoshi. Stop spreading FUD.

It is very annoying news for the people who hold their accounts in there. Although Shape Shift does claim that they does not hold customer balances on that site  ???   Now it’s hard to convenience and bring back the trust which people had before.

shapeshift has no account system, do you even know what are you talking about?

The fact is, there are no many chances for mistakes in cryptoland.

it is good to see a good service like shapeshift coming back even after such a big hack. i hope they never have any trouble again.

This. What brought down Mintpal is that the owners decided to hire someone (Moolah) who appeared to be a trustworthy person, but as soon as he was put in charge of managing the site, he looted it.

true, there is a possibility that shapeshift has come back in a much better State than it used to be. It is possible that shapeshift do very strict security, so that the possibility of a small hacking will happen

Wow, it takes some time to read all of it but its deeply frustratin most of the time.
At least it gives a real pov of how much "balls" you need to have to be on such startups. My question is if that is going to destroy or add in Shapeshift's reputation. Personally, after read all the details, I kind feel more willing to deal with them. Hope they get along with no problem in this new year...