On August 2, 2016, Bitfinex detected a security breach that resulted in the theft of 119,756 bitcoin worth over $72 million. The theft has been under investigation since then, with Ledger Labs playing a crucial role in it. According to the report, the platform hired the services of Ledger Labs within hours of discovering the attack. In addition to an investigation of the security breach, Ledger is also carrying out an audit of Bitfinex’ balance sheets for both cryptocurrency and fiat assets and liabilities.
Nearly two weeks after losing more than $60m in customer funds, Bitfinex reports it has not yet identified how the theft was carried out.
Q1: Are you tracking the stolen coins?
As you are probably aware, all bitcoin transactions are visible on a public ledger, the blockchain. We are cooperating with the best blockchain forensics teams to track the bitcoins and transactions. We have also released a list of all transactions and addresses related to the theft.
Q2. Have you contacted law enforcement agencies?
Yes, we have proactively reached out to and are cooperating with the FBI and European authorities.
Q3. How was Bitfinex hacked?
We cannot disclose any information at this stage as there are ongoing investigations with third party investigators as well as multiple law enforcement agencies. We will share information as and when it becomes available.
Q4. Was user account information included in the theft?
Even though we have no evidence or reason to believe that any of our users’ personal information was stolen, we decided to err on the side of caution and require that all users change their password and two-factor authentication.
Q5. My account is on a five-day withdrawal hold as a result of executing the password reset I was required to do. Can this withdrawal hold be lifted?
The five-day withdrawal hold is triggered automatically when resetting a password. If you wish to make a withdrawal during the five-day withdrawal hold period, please submit the withdrawal as you normally would and we will process the withdrawal manually or contact the user if we need anything.
Q6. How did you arrive at the decision to allocate losses across all accounts?
The decision to allocate losses across all users and all currencies was made after considerable review with legal counsel. This is the closest approximation to what would happen in a liquidation scenario. Furthermore, we believe this outcome returned more funds to users faster and without the high costs of legal fees.
Q7. What have you done to improve security to prevent future thefts? Has a third party done a security audit?
First, we moved all of the bitcoins to our multisig cold wallet. Second, we completely rebuilt our servers, moved to a new datacenter, and ran a number of security checks in conjunction with Ledger Labs before being satisfied that it would be safe to resume operating the Bitfinex platform.
Q8. Why are some users’ accounts frozen due to BitGo? What do I need to do to fix this?
Part of the accounts that were set up to have their Margin Trading bitcoin wallet linked to a BitGo wallet were frozen on August 2. This was done to stop the attackers from having access to any remaining Bitcoin in those wallets.
In order to unfreeze your Bitfinex account / BitGo wallet, we kindly ask you to provide the BitGo recovery key you received during first setting up your Bitfinex account to be linked to BitGo.Here are the instructions for doing so:
- Make sure to have the recovery key / PDF provided to you upon wallet creation ready; The recovery key will be a text file or PDF file and will contain a string of random numbers and letters that starts with [ xprv…. ].
- Log into the Bitfinex website and navigate to the verification section. Click the “manage documents” button.
- Upload the key file / PDF from step 1.
- Email support@bitfinex.com to notify that you have completed this last step.
Q9. What should I do if I am unable to provide the BitGo recovery key for the frozen BitGo wallet?
If you will not be able to provide this private key, BitGo requires the user to agree to an agreement they have published on https://www.bitgo.com/bitfinex-agreement ( you need to log in to your BitGo account using the email address linked to both your BitGo and Bitfinex accounts ).Please send a confirmation to support@bitgo.com and a reply to this email once completed. Your frozen BitGo wallet will be unfrozen and your Bitfinex account will be unlocked as soon as possible afterward.
Q10. Why are some users’ accounts frozen due to Synapse?
Reconciliation of USD balances between the Bitfinex platform and our banking partner’s platform is not done in real time but is executed periodically. Because we were forced to suspend operations on August 2nd, reconciliation of USD balances had not taken place for all our users. Some users had USD transactions in their Bitfinex account that were not synchronized with the balances our banking partner has on record. Affected accounts are on hold because we need to verify whether or not the accounts’ balances are correctly synced. Unfortunately, this is a manual and time-consuming process. We are processing all accounts as fast as we can.
Q11. Why did I receive this amount of BFX tokens?
You were credited BFX tokens equal to the amount of the loss on your account converted to the USD equivalent using the settle prices specified in this announcement on August 3rd.
Q12. What can I do with my BFX tokens?
At this time you can exchange them now on the open market through the pairs BFXUSD and BFXBTC, you can opt-in to using their value as collateral for financed trading (See Account > Margin Trading), or you can hold them while we investigate methods for enabling the exchange of BFX tokens for equity in Bitfinex
.Q13. Is Bitfinex buying back BFX tokens on the market?
No, Bitfinex and Bitfinex employees are barred from buying or selling any BFX tokens. Bitfinex is, however, making every effort to redeem the outstanding tokens at 1 USD each. There are several initiates we are investigating to make this possible.
Q14. Are you going to allow BFX tokens to be used as collateral for margin trading?
Yes, non-U.S. Persons will be able to use BFX tokens as collateral for financed trades (margin trading). This means that the value of BFX tokens in your Trading Wallet will contribute to your margin trading “tradable balance”. You can opt-in to this feature by visiting your Account page and seeing the section “Margin Trading”.
Q15. Can I redeem my BFX tokens for shares of Bitfinex? What value are they redeemed at, current market value or 1 USD? Is there anything else I can use my BFX tokens for?It is our full intention to redeem all BFX tokens for their face value of $1. In order to redeem these tokens, we are exploring several options: (1) the recovery of the stolen coins; (2) outside investment in Bitfinex; (3) operating our trading platform with periodic redemption of the tokens issued and outstanding; (4) exchanging BFX for equity in Bitfinex. Options (1), (2), and (4), would mean a relatively quick redemption of the BFX tokens; option (3) would take longer.
Pursuant to option (4), above, we have begun working with BnkToTheFuture, www.bfxtrust.com, and others on exactly how BFX tokens can be converted to equity of Bitfinex. Because we operate a company with international customers in multiple countries, this is not a straightforward process. The goal is to give as many BFX token holders as possible the ability to participate. We are still in the early stages of this process and ask for your patience as this develops.
BFX Tokens can also be used as collateral in financed transactions (for non-U.S. persons) (Enable on Account > Margin Trading).
Q16. I am a verified U.S. resident, what can I do with these BFX tokens?
U.S. verified users can sell their BFX tokens on the market for USD or BTC, hold on to the BFX until they can be redeemed at their 1USD face value, or transfer the token to another Bitfinex customer. However, verified U.S. users may not purchase BFX tokens. We are also working with several companies to allow qualified U.S. investors to exchange BFX for equity in Bitfinex. You can read more about that here
Q17. I am a verified NY State resident, what can I do with these BFX tokens?
NY State residents can convert these tokens to USD by placing a market sell order. By doing this they will transfer the rights associated with these tokens to the buyer. We generally encourage our users (subject to applicable restrictions) to retain these tokens in order to be able to receive the full face value of these or participate in possible equity exchange plans.
Q18. I have an unverified account and I think that I may have pressed that I am a U.S. resident by mistake, what can I do?
If you did this in error then you can change this setting here:
https://www.bitfinex.com/us_resident. Please note that Bitfinex monitors IP login addresses but we are aware that some ISPs routinely route a connection through the U.S. and also a number of our customers utilize a VPN for logging in. This means that some non-U.S. residents are incorrectly logged in our system as U.S. residents. They can change this information in the account settings
Q19. When will margin trading be re-enabled for U.S. residents?
We are exploring all options to enable functionality for the entire platform for all of our customers. This will take time. We are trying to ensure compliance with various U.S. requirements. We will clearly announce any change to our policy going forward.
Q20. I have more questions. Who can help me?
We are happy to answer any additional questions you might have. Please contact us at support@bitfinex.com.
Please, follow me for daily updates from the world of BITCOIN.
-----------------------------------------------------------------------------------------------------------------
Sources:
[1] http://blog.bitfinex.com/
[2] The Internet