HACK ATTACK

In June 2011, Bitcoin was attracting attention from all quarters. And not all of those eyeing the rising digital currency were interested in its ability to facilitate peer-to-peer trade or serve as an uncensorable store of value. Gawker’s Silk Road feature at the start of the month had sparked fevered interest in the cryptocurrency, causing its first major rally that took the price of BTC as high as $30.

It was against this backdrop that the first known hack in Bitcoin history went down. And it wasn’t a nominal sum involved either – the 25,000 BTC stolen was then worth around $500,000. June was the month when several of Bitcoin’s early adopters found themselves rich for the first time. For the fittingly named “allinvain” it was to prove a fleeting sensation.

On the morning of June 13th, 2011, allinvain logged onto his computer and made a horrifying discovery: 25,000 BTC were gone from his wallet. The coins had been removed in a single transaction. Naturally, he went straight to the Bitcointalk forum to share his predicament in a thread titled “I just got hacked – any help is welcome!”

“I feel like killing myself now,” lamented allinvain, before editing the message to note that he had calmed down a little. While his first concern was naturally for his Bitcoin balance, allinvain was also mindful of the effect the heist might have on the market should the hacker elect to dump the coins. “It would suck if bitcoin price tanked because of me,” he rued.

No Back Button

While the hack was devastating for allinvain, one silver lining – at least for the broader community – was that it hit home the need to take security precautions. Bitcoin has no back button, its strong transaction finality one of the reasons why the network is so valuable. Given these properties, there was little the community could do other than offer its sympathies.

The incident exposed two areas of Bitcoin that were then underdeveloped: wallet encryption (which wouldn’t arrive until late 2011) and onchain tracking tools to follow the money as it moved between addresses. Not to be deterred, allinvain began tracking the hacker’s haul using software he wrote himself.

It was to no avail: the coins were gone, and while fractions of them would eventually show up all over the Bitcoin network, there was no putting them back in the jar from which they’d been forcibly removed. The likely cause of the hack wasn’t a flaw in Bitcoin’s wallet software. Rather, it was likely malware that was able to access his unencrypted wallet.

Upon finding an unencrypted wallet.dat on the PC, the malicious software could simply copy the private keys and then perform a transaction sending all coins to the attacker’s address. “If only the wallet file was encrypted on the HD… I feel like this is my fault for not moving that money to a separate non-Windows computer,” allinvain confessed.

Within days of the theft, security researchers uncovered a new piece of malware targeting Bitcoin wallets. Symantec reported a trojan that specifically searched for Bitcoin wallet files on Windows machines. Dubbed Infostealer.Coinbit, the malware would scan the default wallet directory and then email the wallet.dat to an attacker’s server.

Bitcoin was rapidly attracting professionals, and not just pro miners, traders, and developers, but professional hackers. With enemies in their midst and potentially in their hard drives, community trust would never be quite the same again.