Bank robbery redefined: million dollar Bitcoin heists

12 Years Ago Updated 12 Years Ago happygeek 0 712 Views

According to BitcoinWatch the current market capitalization of the virtual currency stands at an incredible $10.4 billion. A single Bitcoin is now worth more than $800. In the ongoing aftermath of the Silk Road takedown many people wrongly assume Bitcoin is some kind of criminal currency, used to trade in anything and everything illegal online. However, be in no doubt that cyber-criminals are, indeed, attracted to Bitcoin: they are targeting it in virtual bank robberies.

5b4b2c065952977ce6e1c623f7639471 Last month reports surfaced of an Australian Bitcoin 'bank' called inputs.io being hacked and the owner relieved of some 4,100 Bitcoins worth $1.3 million. Now we hear that the Danish company Bitcoin Payment Solutions (BIPS), another Bitcoin startup, has lost a reported $1 million worth of Bitcoins (1295 BTC) after an attacker managed to compromise the hosting account through fairly straightforward email account password resetting and server-side vulnerability that left the two factor authentication in place about as useful as a chocolate teapot.

This latest robbery is thought to have occurred between the 15th and 17th November, and word on the IT security grapevine is that the breach can be traced back to a Russian origin. The virtual-robbers used the increasingly common tactic of staging a Distributed Denial of Service (DDoS) attack on the site as a smokescreen behind which the real attack, the Bitcoin robbery, could take place. The smokescreen analogy is very apt, as when a site is hit by a DDoS attack then all efforts go into dealing with that emergency and it's all too easy for cyber-criminals to then sneak into the site while attention is elsewhere and do pretty much whatever they want.

Amichai Shulman, CTO of Imperva, says: "Regarding the consequences to Bitcoin, it turns out that the same characteristics that made this payment system so popular are the ones that now prevent people from getting their stolen money back. A potential deterrent for such events would be to introduce a black-listing mechanism into the Bitcoin protocol which would prevent people from cashing out on stolen wallets (which would take out the incentive for stealing them in the first place – assuming that BCs are not traded into money before the theft is detected). For now, all that victims could do is sit back and watch how their stolen Bitcoins are being anonymously traded (since all transactions in Bitcoin are public)."

Dani AI

Generated 10 Months Ago

This thread from frames the core lesson from early, high-dollar Bitcoin thefts: attackers often combine obvious noise (DDoS, fake alerts) with quieter intrusion and recovery attacks to steal keys or administrative access. Defenders should treat DDoS not just as availability risk but as a potential diversion that opens windows for privilege abuse and credential attacks. (See discussion of DDoS as a diversionary tactic.) https://www.paloaltonetworks.com/cyberpedia/what-is-a-ddos-attack

Concrete mitigations for services and operators:

Remove single points of failure: split custody (hot/cold), use multisignature or multi-party custody so one breached account does not yield all keys (multisig basics and tradeoffs). https://en.bitcoin.it/wiki/Multi-signature
Harden recovery and admin paths: disable single-step email password resets for privileged accounts, require hardware-backed 2FA (U2F), limit and log all admin actions, and keep a tamper-evident change-control process.
Put most assets offline and under air-gapped signing (cold storage) or certified HSM/MPC custody; make withdrawals auditable and rate-limited so large transfers trigger human review.

Advice for users and first-response steps if theft is suspected:

Move long-term holdings to a hardware signing device rather than keeping large balances on exchanges; hardware wallets keep private keys offline. https://trezor.io/what-is-a-hardware-wallet
Immediately collect TXIDs, revoke API keys and linked OAuth tokens, change passwords, gather server/log evidence, and contact the exchange plus local cybercrime authorities — speed helps because on-chain tracing can identify cash-out paths before laundering. Forensics and chain analysis can trace flows but are time-sensitive; consider professional blockchain-forensics help and beware “recovery” scams. https://appliednetsci.springeropen.com/articles/10.1007/s41109-020-00261-7
Practical triage checklist: capture TXIDs/timestamps, freeze accounts where possible, rotate secrets, preserve logs, and escalate to a forensic partner or law enforcement while avoiding third-party recovery offers. (See guidance on engaging forensic services.) https://neverstate.net/blog/how-to-engage-blockchain-forensics-to-trace-and-freeze-stolen-crypto

These points build on the scenario described and focus on practical, low-latency controls operators and users can apply today.

Be the first to reply

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.