Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/5/2015
02:52 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Major Bitcoin Exchange Suspends Service, Suspecting Attack

Bitstamp suspends service, citing a wallet compromise, one day after a significant drop in the value of Bitcoins.

In what they call an "excess of caution," Bitstamp, the world's second-largest Bitcoin exchange, suspended service today, pending investigation of a suspected compromise. However, some skeptics in the finance industry suggest that Bitstamp might just be temporarily shutting things down to insulate themselves from the effects of a significant drop in the price of Bitcoins Sunday.

Saturday's high of $314.77 fell to $260.84 late Sunday. That's more than $100 less than the price of Bitcoins was just one month prior: $369.15 on December 4.

As the Bitstamp home page currently reads:

We have reason to believe that one of Bitstamp’s operational wallets was compromised on January 4th, 2015.

As a security precaution against compromises Bitstamp only maintains a small fraction of customer bitcoins in online systems. Bitstamp maintains more than enough offline reserves to cover the compromised bitcoins.

IN THE MEANTIME, PLEASE DO NOT MAKE DEPOSITS TO PREVIOUSLY ISSUED BITCOIN DEPOSIT ADDRESSES. THEY CANNOT BE HONORED!

Jeffrey Robinson, author of BitCon: The Naked Truth about Bitcoin told CNBC, "Don't believe Bitstamp. It's a matter of liquidity... Who's next? It's as if Bitstamp realized they couldn't internalize the risk anymore so just decided, Let's suspend operations until everything settles down."

If we take Bitstamp at their word, this is just the latest in a string of attacks on Bitcoin exchanges, which peaked in February 2014, when Bitstamp, Mt. Gox, and BTC all fell victim.

At that time, in February, Bitstamp temporarily suspended processing of Bitcoin withdrawals, citing "inconsistent results reported by our bitcoin wallet, caused by a denial-of-service attack using transaction malleability to temporarily disrupt balance checking." Bitcoin exchange BTC suspended trading due to a DDOS attack. Most notably, Tokyo-based Bitcoin exchange Mt. Gox suspended its services February 10, reporting that 850,000 Bitcoins -- worth roughly $500 million at the time -- had been stolen. Mt. Gox filed for bankruptcy 18 days later.

Researchers have said that over 100 flavors of malware were stealing Bitcoins and other forms of cryptocurrency, via wallet-stealing and credential-stealing. In March, Android apps were discovered that contained malware designed to steal other cryptocurries less valuable than Bitcoins.

Bitcoin users have also been targeted directly, via phishing and other methods.

Some criminals, however, might not want to completely shut the exchanges down, because many ransomware operators request ransom payments be made in Bitcoins.

Bitstamp has not yet released any details about the compromise or any estimate about when the exchange will be up and running again.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/6/2015 | 9:22:42 AM
Re: Safeguards
Well there are many potential benefits to the bitcoin. It behaves similar to a stock in that it appreciates and depreciates. But it is a volatile currency. The digital medium of the currency makes it easy to store and transport. It is non-government regulated which also has its ups and downs but its an alternative means of currency and that is what I attribute to its largest value. Not indicative of national restraints. Universal value.

But as you say @Marilyn Cohodas, with it being a completely digital nature of the bitcoin exposes it to a plethora of exploits.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/6/2015 | 9:09:11 AM
Re: Safeguards
Have to admit, I haven't warmed up -- or even totally understand -- the concept of Bitcoin and the potential for exploitation scares me. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/6/2015 | 8:51:04 AM
Safeguards
I know a big proponent to the bitcoin is that they are not government regulated. But there are a few inherent flaws with the digital currency, which I know from experience of owning a couple of bitcoins myself. First is that when you have a bitcoin wallet, you most likely have it stored locally. Bitcoin banks need to treat their distribution of coins more closely to regular banks.

I think the main question here is: Are bitcoin distributors safeguarding their "data" in a similar fashion as banks treat their data? This isn't to say they will still not experience a breach because it happens to banks anyway but to minimize risk it would behoove these organizations to try and implement similar security frameworks. I would say due to the previous events the answer is most likely no.
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27585
PUBLISHED: 2020-11-30
Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on the settings password.
CVE-2020-27586
PUBLISHED: 2020-11-30
Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text.
CVE-2020-27587
PUBLISHED: 2020-11-30
Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force attack on the password.
CVE-2020-29395
PUBLISHED: 2020-11-30
The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
CVE-2020-17901
PUBLISHED: 2020-11-30
Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.