The schadenfreude of Bitcoin enthusiasts over Ethereum’s recent troubles ended abruptly last week. A major Bitcoin exchange, Bitfinex, was hacked and nearly 120,000 BTC (around $60m) was stolen. The price of Bitcoin promptly crashed, and Bitfinex was forced to suspend trading. Suddenly, Ethereum was not the only basket case cryptocurrency around.
It appears that Bitfinex’s security was seriously compromised. Customer coins were held in individual wallets secured with a 2 of 3 multisig arrangement: keys were held by Bitfinex itself and Bitgo, a professional custodian and signatory, with a third (backup) key held in secure offline storage. Customers could not withdraw funds from the wallets until any borrowings had been cleared. It was, if you like, a form of escrow. And it should have been secure.
But it wasn’t. Somehow, the hacker managed to gain access to hundreds of customer wallets. Not only did the hacker gain access to the wallets, he/she also overrode Bitgo’s withdrawal limits. It was a well-planned and comprehensive security breach by someone who knew exactly what they were doing. Funds were moved to thousands of addresses over a short period of time. Bitfinex, it seems, was powerless to stop it.
This is one of the largest Bitcoin heists ever, dwarfed only by Mt. Gox in 2014. It is comparable in size to Ethereum’s DAO theft only a couple of weeks ago. And it is going to result in a lot of people losing a lot of money. All of Bitfinex’s customers, in fact. The company has announced a haircut of 36.067% across the board:
After much thought, analysis, and consultation, we have arrived at the conclusion that losses must be generalized across all accounts and assets. This is the closest approximation to what would happen in a liquidation context. Upon logging into the platform, customers will see that they have experienced a generalized loss percentage of 36.067%. In a later announcement we will explain in full detail the methodology used to compute these losses.
Although the loss is estimated as the amount the customers would receive if the company were liquidated, this is a bail-in. Bitfinex has no plans to cease trading:
We intend to come online within 24-48 hours with limited platform functionality. Additional announcements will be made as we progressively enable more platform features and return to full operations.
It’s not at all clear what the legal basis for this bail-in is. There will no doubt be court cases to establish it. Though Bitfinex seems to be hoping for some gullible investors to make good the losses:
We are actively discussing various strategic options with numerous potential investors as part of our strategy to fully compensate our customers. Such discussions, however, are in early stages and will likely take time to play out.
A very long time, I should think.
So how did this happen – and who was responsible? Unsurprisingly, Bitfinex blamed everyone except itself. Color me unconvinced. I may be wrong, but I think this theft was most likely planned and executed by someone within Bitfinex, using the CTFC’s recent investigation into Bitfinex’s margin trading activities as cover.
In June, Bitfinex was issued with a cease-and-desist order by the CTFC for breaking the Commodities Act by executing illegal off-exchange margin trading deals and failing to register as a futures commission merchant. In its judgment, the CTFC notes that during the investigation, Bitfinex twice changed its procedures for storing customer money:
From April 2013 to August 2015, when a customer purchased bitcoins on Bitfinex, the purchased bitcoins were held for the benefit of the buyer in Bitfinex’ s omnibus settlement wallet. The individual customer interests in the omnibus settlement wallet were accounted for in real time on Bitfinex’s database. However, the omnibus settlement wallet was owned and controlled by Bitfinex and Bitfinex held all “private keys” associated with its omnibus settlement wallet…..
In August 2015, Bitfinex changed its model so that bitcoins purchased using the Exchange Trading feature were held in multi-signature wallets established by a third party firm that were individually enumerated for each trader. Bitcoins purchased using the Exchange Trading feature were settled to the Blockchain on an intra-day basis. However, Bitfinex retained control over the private keys to these wallets as well.
In January 2016 and for the remainder of the Relevant Period, during the course of the Division of Enforcement’s investigation, Bitfinex changed its model again so that bitcoins purchased using both the Exchange Trading and Margin Trading features were held in individually enumerated, multi-signature wallets. However, Bitfinex continued to retain control over the private keys to those wallets.
It has been alleged that the CTFC forced Bitfinex to change its storage arrangements, introducing a weakness into the system which the hacker could exploit. Keeping customer money in individual multi-signature wallets in the custody of a neutral third party is apparently not as safe as keeping it offline in a very large bucket with a single set of keys.