ShapeShift Lost About $230k to Three Hacks Within One Month

Erik Voorhees, the CEO of ShapeShift, has made public some of the details and findings from the investigation into the recent cyber attacks on his company. The bottom line is that about $230,000 worth of Cryptocurrencies were stolen from its hot wallets, but we are assured that none of it was clients' funds and that the service will be back in operation on Wednesday.

The new world of online trading, fintech and marketing – register now for the Finance Magnates Tel Aviv Conference, June 29th 2016.

ShapeShift, a site that allows users to instantly cross-convert over forty cryptocurrencies, has already been down for over a week, with a notice on the site saying that it will likely be down for a few more days for an infrastructure upgrade.

Bringing credibility to the process, the forensic audit of ShapeShift was conducted by Michael Perklin of Ledger Labs, a Toronto-based consulting and development firm that applies decentralized systems and principles to the fields of security, finance, and governance. Perklin is an information security expert with experience in performing digital forensic examinations, cyber investigations, and incident response postmortems. He has testified about blockchains at the Canadian Senate's Committee on Banking, Trade, and Commerce and has been qualified as an expert witness in the courts of Canada.

ShapeShift's management decided to re-architect the exchange's infrastructure entirely, using greatly enhanced security protocols and methods, under the supervision of Mr. Perklin.

Unfolding of the event according to Erik Voorhees:

"On March 14th, ShapeShift had 315 Bitcoins stolen from its hot wallet. It was quickly discovered that an employee at that time had committed the theft. It was reported to relevant authorities, and a civil suit was opened against the individual. As we had quickly figured out who it was, and how to resolve it internally, we were able to keep the site running uninterrupted. We planned to get the stolen property returned, and thought that was the end of it.

On April 7th, last week, as we were about to migrate the service to a new host (having worked for a couple weeks on new infrastructure in the wake of the theft), we noticed three hot wallets had been hacked, Bitcoin , Ethereum, and Litecoin (roughly 97 BTC, 3600 ETH, and 1900 LTC). We were initially unable to determine how it had happened. We took the site offline, and decided to assume the infrastructure itself and all keys were potentially compromised. We cycled all keys and spun up brand new infrastructure on an entirely new host, once again, 24 hours later.

During that rebuild, contact was established with the hacker, who indicated that the rogue employee from the month prior had given the hacker the information needed to carry out the attack.

We relaunched the site on this third set of infrastructure (Friday night). When we awoke Saturday morning, it was discovered that Bitcoin and Ethereum had yet again been stolen from the new hot wallets. 57 BTC and 2200 ETH. This didn't make any sense as none of the keys used had been shared with prior infrastructure. This happened less than 48 hrs after the prior incident.

During the following days, two chat sessions occurred between myself (Erik) and the hacker, who went by the name, Rovion Vavilov. In these sessions, evidence was provided showing how the hacker breached both environments, using information he had purchased from the former employee."