Bitcoin Forum
May 05, 2024, 09:47:33 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: BTC-e Exchange Compromised, trading halted (now resumed)  (Read 3925 times)
Maged (OP)
Legendary
*
Offline Offline

Activity: 1204
Merit: 1015


View Profile
July 31, 2012, 02:03:52 PM
Last edit: July 31, 2012, 03:03:55 PM by Maged
 #1

From https://btc-e.com/news/81:
Quote
Dear users of the Exchange Btc-e.com

The exchange is not going to close. We will refund all losses from our reserves.

Neither the servers nor the database were compromised. There were no SQL injections.

At 04:07 MSK (GMT+4) our LR API Secret Key was compromised. It's 16 uppercase, lowercase letters and digits. They may have bruteforced it for long.

Using the key the hacker imitated LR deposits from many accounts and bought up Bitcoins, Namecoins and Litecoins.

We lost our daily volume, approx. 4500 BTC. The attacker couldn't withdraw more
as most BTC were distributed over several offline wallets.

At 10:30 we restored the database to the state it was at 04:00, right before the attack. All trades after 4:00 are reverted.

People who attempted withdrawals before 04:00 MSK will get their funds withdrawn later today.

For people who deposited BTC, LTC and NMC after 04:00 MSK the funds will be put to their balances before market opens.
We are working on the scripts for this.

If you deposited USD after 04:00 MSK you should send us your login, amount and payment system used by email or PM.

Our plan:

1. The trade will be disabled until we restore the balances to the point before market crash.

2. After that, the trade and deposit/withdrawal will be back on, approx. within 1-2 days.

Icq - 610112128
Skype - btc-e.support
E-mail - support@btc-e.com
Most of the discussion on this can be found here:
https://bitcointalk.org/index.php?topic=96802.0
https://bitcointalk.org/index.php?topic=96831.0
https://bitcointalk.org/index.php?topic=96811.0

Once a transaction has 6 confirmations, it is extremely unlikely that an attacker without at least 50% of the network's computation power would be able to reverse it.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1714902453
Hero Member
*
Offline Offline

Posts: 1714902453

View Profile Personal Message (Offline)

Ignore
1714902453
Reply with quote  #2

1714902453
Report to moderator
1714902453
Hero Member
*
Offline Offline

Posts: 1714902453

View Profile Personal Message (Offline)

Ignore
1714902453
Reply with quote  #2

1714902453
Report to moderator
1714902453
Hero Member
*
Offline Offline

Posts: 1714902453

View Profile Personal Message (Offline)

Ignore
1714902453
Reply with quote  #2

1714902453
Report to moderator
Maged (OP)
Legendary
*
Offline Offline

Activity: 1204
Merit: 1015


View Profile
July 31, 2012, 03:02:28 PM
 #2

[7/31/12 10:49:33 AM] btc-e.com: Started trading!

Since the attack started about 8pm Eastern last night, I have been awake until about now (11am EST) working with BTC-e on the investigation.

From the moment they woke up and I broke the news to them, until now they have handled it exeptionally well.

Within only a few hours they posted an update https://btc-e.com/news/81

It sounds like they also adopted good security practices and because of it only lost 4500 BTC.

Bitinstant will resume to work with BTC-E, however even though trading is resumed we will not be enabling deposits/withdrawals in and out of BTC-e to protect customers funds for the next few hours.

Thanks

-Charlie
https://bitcointalk.org/index.php?topic=96912.0

John (John K.)
Global Troll-buster and
Legendary
*
Offline Offline

Activity: 1288
Merit: 1225


Away on an extended break


View Profile
August 01, 2012, 07:57:20 AM
 #3

Update Bitinstant <--> BTC-E Enabled now

It sounds like they also adopted good security practices

Explaining the external use of their LR key with "brute forced" has me worried, I don't see how that's computationally possible: https://bitcointalk.org/index.php?topic=96831.msg1068030#msg1068030

What additional security practices are put in place in case the hackers are able to extract new replacement keys easily?



They are preparing a full write up for the community including screenshots, ect.
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!