From 4 Jan to 6 Jan 2015 Bitstamp experienced a loss of nearly 19,000 Bitcoins from it's operational hot wallet (CoinDesk has a nice writeup about the issue). A reddit thread identified what it believed to be the destination address for the stolen coins: 1L2JsXHPMYuAa9ugvHGLwkdstCPUDemNCf. Evidence on the blockchain is consistent with this allegation.
First, this address was not seen prior to 4 Jan 2015, and within 24 hours it had amassed nearly a 18,000 BTC balance.
First, this address was not seen prior to 4 Jan 2015, and within 24 hours it had amassed nearly a 18,000 BTC balance.
A graph of the transactions that involve the alleged address shows a lot of interaction between other addresses.
Older transactions tend to be to the right of this graph, and they form peel chains that in some cases are combined multiple times into one transaction. It is interesting to note that some of the transactions form exact sums of the collected coins. To the left of the graph we start to see some of the "dusters" putting dust amounts into the 1L2J wallet.
One of the concerns on the reddit thread was that the cold storage may be leaking. If the address found in another comment is to be believed, then their cold storage is not leaking.
One of the concerns on the reddit thread was that the cold storage may be leaking. If the address found in another comment is to be believed, then their cold storage is not leaking.
If anything coins are being moved into cold storage based on the uptick on 4 Jan 2015, so there is no evidence of a cold storage leak.
So how could this happen? (Warning, baseless speculation follows). There are two ways this could be done, first the private keys of the input addresses could have been leaked. This would be consistent with their request to stop deposits. The other possibility is that the attackers somehow are inducing their software to send all the bitcoins to an address of their choosing.
What would indicate private key compromise is continued activity and continued theft. While we see continued activity on 6 January 2015 it appears to be of the "dust tagging" variety. Consider this peel chain:
100 bits are peeled off four times from the same source address. This is not consistent with the earlier transactions where the change addresses were single use interior addresses.
Second, there is evidence of deposit addresses not being cleared out after the bulk of the movements occured. Consider the address 18unRBGev1pkTo35zqCtCscSWUg4r9RNrh that looks to be a P2Pool payout address.
So how could this happen? (Warning, baseless speculation follows). There are two ways this could be done, first the private keys of the input addresses could have been leaked. This would be consistent with their request to stop deposits. The other possibility is that the attackers somehow are inducing their software to send all the bitcoins to an address of their choosing.
What would indicate private key compromise is continued activity and continued theft. While we see continued activity on 6 January 2015 it appears to be of the "dust tagging" variety. Consider this peel chain:
Second, there is evidence of deposit addresses not being cleared out after the bulk of the movements occured. Consider the address 18unRBGev1pkTo35zqCtCscSWUg4r9RNrh that looks to be a P2Pool payout address.
There were five deposits that were stolen durring the hack, but 2 addresses appear to be untouched on the 6th of January. If the hacker had the private keys (along with bitstamp) then there would be a race to cash in those deposits. If bitstamp was worried about a private key theft surely they would aggressively sweep it within the hour, instead of waiting nearly 8.
So why didn't BitStamp simply pull the plug the moment they were sure they were hacked? Maybe they did and this was just the remaining transactions propagating through the system. Or perhaps they were attempting to sweep what they could to their cold storage. There was over 6,000 BTC of movement into cold storage near the tail end of the hack, representing $1.5 Million of value saved.
It could have been worse.
So why didn't BitStamp simply pull the plug the moment they were sure they were hacked? Maybe they did and this was just the remaining transactions propagating through the system. Or perhaps they were attempting to sweep what they could to their cold storage. There was over 6,000 BTC of movement into cold storage near the tail end of the hack, representing $1.5 Million of value saved.
It could have been worse.
This analysis was performed when the blockchain was at height 337832, so any transactions after that block are not reflected in this post.
No comments:
Post a Comment