Regarding the NiceHash security breach

https://www.nicehash.com/

by 6d6b73 • 9 years ago

169 110 9 years ago

nicehash.com

H99189• 9 years ago

"We are working to verify the precise number of BTC taken."

How is this not a simple task?

ktta3• 9 years ago

Seems like it was about $65 million from various comments on reddit. Address - https://blockchain.info/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh...

watoc2• 9 years ago

There might very well be other addresses used to transfer the stolen Bitcoins.

6d6b73• 9 years ago

They probably need to contact lawyers first

ktta3• 9 years ago

There's some discussion going on a reddit thread, and people there seem to think this is an inside job

https://www.reddit.com/r/NiceHash/comments/7i0s6o/official_p...

pjc50• 9 years ago

One of the great things about bitcoin is that unless someone confesses we'll probably never know if it was an inside job. Do we even know who runs nicehash and in which country?

adrr• 9 years ago

I always wondered how the hackers can get the money out of bitcoins to a fiat currency without exposing who they are. If they transfer it to an exchange, the exchange will know where the bitcoins came from being that transactions are open for everyone to see.

gt_2• 9 years ago

I looked it up before I started mining with them and concluded they were based in Amsterdam. Incase you’re wondering, I lost approx. $120.

avian• 9 years ago

Never heard about NiceHash before, but this story is currently being reported by Slovenian national media and NiceHash is presented as a Slovenian company.

Cyberdog• 9 years ago

The comment on their web site says that their payment system was compromised. If so, that means they had $64 million worth of bitcoin connected to their public-facing web site.

So I actually kinda hope for their sake it was an inside job, because that would be a lot less stupid.

provost• 9 years ago

Importantly, our payment system was compromised and the contents of the NiceHash Bitcoin wallet have been stolen. We are working to verify the precise number of BTC taken.

That should be easy to find via the transactions. Are they still in your wallet? What's the address? If they are still in there, then use a backup key to move the BTC now. Do you have a backup of the keys?

Being that it is connected to a payment system, it's surely the hot-wallet. No mention of a cold-wallet makes it seem they've been completely wiped.

Multi-edit: Stream of consciousness

dragontamer• 9 years ago

Various people online suggest its this wallet:

https://bitinfocharts.com/bitcoin/address/1EnJHhq8Jq8vDuZA5a...

4,736.42 BTC transferred.

mizzack2• 9 years ago

Even though I lost ~$500 here and I'm sure others lost many more, the biggest bummer here is that NiceHash is/was a great idea and service that will be forever tarnished.

wbkang• 9 years ago

Yeah same here I lost about a week worth of mining since Friday was their payout day. Thankfully i used my own wallet for payout so the damage is limited.

sundvor2• 9 years ago

Your rig is bigger than mine. Have been mining on and off for two months on my 1080TI to my own address (mainly overnight as days have been hot in Australia) and was just moments away from reaching the 0.01BTC payout threshold.

Glad I didn't trust them to use their wallet system - those are the ones who'd really get burned by this, if NH can't recover.

They really need to lower the minimum payout limit, or set that you can pay out e.g. every two weeks.

FLUX-YOU• 9 years ago

The fact that anyone still trusts Bitcoin services after all of the hacks still floors me.

mizzack2• 9 years ago

It's a nature of their payout structure caused by high bitcoin tx fees. Payout happens in rounds.

I didn't lose a penny of cash as a seller, but hash buyers did.

sudouser• 9 years ago

Same thought here, there are millions and millions lost every week

gt_2• 9 years ago

~$120 here. I will stick with mining Zcash now.

exhilaration• 9 years ago

Can someone explain what NiceHash is/was? I'm guessing an online Bitcoin wallet but there no longer seems to be any content on their website to verify that.

Tbeiko• 9 years ago

No, it's a mining pool. If you have a miner, you can direct it to Nicehash, and it gives you a proportion of all the pool's mining rewards. This way, it reduces the variance of rewards for individual miners, who may otherwise go months before mining an actual block.

dylz• 9 years ago

It's not quite a mining pool. You don't solve shares and get it back tied to that share.

You sell computing power for $x/hr, and you get paid $x-%/hr, as two completely unlinked things.

dgacmu• 9 years ago

A multi-pool: you point your miner at them and they switch automatically to the coin with the highest expected profit to mine. They pay miners in BTC. On the other side, they let people bid on mining power to direct to coins of their choice.

tellism2• 9 years ago

As others have pointed out, it's not a pool. They're a service for connecting people with miners to people who want to mine something. They're a hash reseller. A user bids for mining power and where they want it assigned. Miners post rates they're willing to mine at.

ixacto• 9 years ago

Nicehash is a bitcoin mining hash reseller. You could download their client and mine whatever cryptocoin was most profitable (ETH/BTC/LTC...) and get paid in bitcoin. Actually quite easy to use.

But they just got hacked for $52million...

stephengillie2• 9 years ago

Their rates were about 4 BTC to rent 1 TeraHash/s of mining capacity for 24 hours. Some of their pools for rent had 1800 miners, some were solo operations. I was looking into renting mining time through them a few days ago.

At this price rate, the ~4000 BTC could be 1 or 2 days of rental fee for a couple hundred transactions. No idea about their volume of transactions or cash flow.

nikanj• 9 years ago

It’s really scary in Bitcoin land. Either you store your coins online and worry about hackers, or you store them offline and worry about burglars, fires, etc.

I’m starting to appreciate the government enforced protections a traditional bank account provides.

Johnny5554• 9 years ago

If you can store it offline, why can't you just store it online in an encrypted file using a strong encryption key?

codewithcheese• 9 years ago

A bitcoin 'wallet' is a strong encrypted key. The question is where do you keep that key.

cdancette• 9 years ago

But where do you store the key?

teraflop• 9 years ago

The whole point of offline storage is to guard against the risk of whatever internet-connected device you use to store your keys getting compromised.

If you make a mistake or fall victim to an attack that lets someone steal the encrypted file containing your key, there's a good chance the attacker will also be able to install a keylogger and get your passphrase.

tellism2• 9 years ago

There are other options in Bitcoin land to protect against theft. If the online wallet uses multisig then it requires a signature from yourself before they can take the funds. If they're hacked then the hacker can't spend the coins.

watoc2• 9 years ago

And no insurance company (understandably) wants to fully cover Bitcoins.

https://seekingalpha.com/article/4099912-coinbase-insurance-...

beached_whale• 9 years ago

A safe deposit box with the digital copies of wallet may work

skissane3• 9 years ago

I would like to see banks operate Bitcoin accounts.

The bank operates its own wallets, you transfer your Bitcoin to theirs (or just buy it from them.) Keeping the Bitcoin safe is their responsibility. If you want to spend the Bitcoin, you can transfer it back to your own wallet, or directly to the payee. You pay them some fee to do this.

Now, it has obvious downsides. Less privacy. Easier for the government to confiscate your Bitcoin. The bank could go bankrupt. But, a person might rationally reason that those possibilities are less likely than them stuffing up a wallet maintained by themselves. Especially if it was a major bank that they might reason is unlikely to go broke. Obviously the Bitcoin account would not be government insured so if the bank goes bankrupt you might lose it all.

If criminals break into your account and steal your Bitcoin – if it is due to a problem at your end, e.g. a key-logger on your machine, the bank shouldn't owe you anything. If it is because the bank screwed up, they should be liable to compensate you for the loss.

GhostVII• 9 years ago

If the bank is holding your Bitcoin, what is the point of using Bitcoin at all? It is just an extremely inefficient centralized currency at that point.

mdasen• 9 years ago

Isn't that mostly the situation we're in with the places that are getting hacked?

BitcoinBank holds your bitcoin. Keeping the bitcoin safe is their responsibility. They get hacked and someone takes the bitcoin from them. They're liable to compensate you for the loss, but they don't have the money to compensate you with - someone stole it all.

Is the difference that a bank like Bank of America would have non-bitcoin assets to compensate you with? That is to say, the hypothetical BitcoinBank gets $65M of bitcoin stolen and that's 100% of their assets so you're out of luck. BitcoinBank owes you money, but doesn't have any. However, if Bank of America had $65M stolen, you could expect them to have other assets to cover that loss and make you whole.

I think the issue is that would cost a lot of money. Would you be willing to pay 2% of your bitcoin per year for this insurance?

I think one of the reasons that our current financial system works well against fraud is the ability to undo many transactions and detect fraud in addition to swallowing losses. If you try to spend $10M, that's likely to cause fraud alerts. If you're shipping goods to someone else and they're expensive, you'll again get fraud alerts. If you're transferring money between banks, it can have certain fraud-protection oversight and has a certain ability to be undone. A lot of this comes from lack of anonymity and limitations. A $5 transaction isn't suspicious and doesn't carry the same risk as a $5M transaction. Most bank to bank transfer systems have daily and monthly limits on them. The banks know who owns the accounts and can confirm if it's the same person. Banks generally have some latitude to undo transactions. Banks can see where you purchase things and determine whether it's suspicious. Banks have centralized places where they determine whether to permit a transaction.

Klathmon• 9 years ago

You are describing coinbase.

canoebuilder• 9 years ago

I would like to see banks operate Bitcoin accounts.

This is completely antithetical to bitcoin. Upon reading that sentence, I thought surely this is a joke.

Not only is a bank account for bitcoins completely antithetical to the very notion of bitcoin, but it eliminates any need for bitcoin's central innovation, a distributed, unified verification system in the form of a 'blockchain,' generated by a clever utilization of P and NP.

Money is fungible, it doesn't really matter if I have dollars, or pesos, or yen in my bank account. The only reason you want a bank account for bitcoin is because you want a bank account with magic internet money that magically, irrationally increases in value until it doesn't. And you don't want the headache of worrying about all the potential missteps when messing about with your magic internet money.

s_tec• 9 years ago

There are three widely-used approaches to managing your own keys:

1. Store the keys on your own device, and also write them down on paper as a backup.

2. Store the keys on a dedicated piece of hardware, and also write them down on paper.

3. Encrypt the keys with a username/password and back that up to the cloud.

Option 2 protects against all kinds of malware, including keyloggers. The device has its own screen and buttons, so you can see the backup keys and verify the destination of the funds without trusting you PC.

For the paper backups in options 1 and 2, there are fireproof options like cryptosteel.

Option 3 gives a really nice UX, since it's feels like a standard username/password login. This is what Lastpass does for passwords, but applied to Bitcoin. Keyloggers are still a threat, and if your password is weak, someone might brute-force it in a database breach situation. Depending on your use-case, this may be worth the tradeoff.

The company I work for, Airbitz, implements option 3. In our experience, far more people lose funds accidentally than due to hackers (at least with self-managed keys). Therefore, a familiar UX is crucial to helping users retain control of their funds. Plus, most people aren't willing to invest in specialized hardware, at least at first. If crypto-currencies are ever going to go mainstream, there needs to be a software-only on-ramp.

scoggs• 9 years ago

While I tend to fully agree with everything you are saying wouldn't it be a nice side effect if Bitcoin / crytocurrency dominance forced the average computer user to get serious about password creation and management?

nodesocket• 9 years ago

We should not be supporting these criminals, most likely based out of Russia or China. It's my biggest gripe with Bitcoin. By buying Bitcoin you are indirectly supporting them.

Full disclosure: I am biased; a US citizen.

midnitewarrior• 9 years ago

This makes no sense.

dogma1138• 9 years ago

Multiple copies and store them in a deposit box?

Like it’s not as complicated as people pretend heck encrypt it again so the wallet file cannot be profiled and store it on a cloud service.

kbody3• 9 years ago

There's a very simple solution if you care about security.

Buy a hardware wallet (e.g. Trezor in my example) note down the 24 words that are basically your privatekey. But enable the passphrase (25th word/phrase) which you type yourself and could keep just in your mind.

You have the safety of multiple backups for the 24 words and the extra security from burglars and others with the 25th passphrase.

https://blog.trezor.io/hide-your-trezor-wallets-with-multipl...

It also serves as a plausible deniability because when you input your passphrase it will never say it's incorrect, it will merely open a different wallet (generate a different private key).

Helps with the $5 wrench attack. You could setup a "fake" wallet with some activity and a low amount of Bitcoins, and have a different passphrase for the real wallet with the big amount.

BYOB, freedom comes at a price.

username2232• 9 years ago

My "bank account" holds "money" "insured" by the FDIC. Enjoy your "freedom."

illumin8• 9 years ago

This sounds pretty good, but what if the $5 wrench attacker knows your real wallet needs 25 words, and not just 24... Wouldn't they just hit you with the wrench a few times until you added the 25th word?

celdon254• 9 years ago

If you're handling millions of bitcoins, belonging to other people, I would go with something more hardened than a Trezor. Hardware Security Module with M of N authentication... Use that as a main vault. Keep a smaler number available as liquid. I don't understand why this isn't common sense among these people.

scotty79• 9 years ago

You can store your bitcoins online (in multiple places for redundancy) in encrypted file you never decrypt. You can still send new bitcoins to that wallet.

When you finally do need to withdraw some bitcoins you just set up clean linux system, download the file, decrypt it, make a transfer, encrypt it again and upload (if you don't withdraw often you can skip that because such offline wallet (at least the one generated by bitcoin core client) can handle few dozens outgoing transfers before you need to update it).

Then you don't have to worry about burglars, fires or hackers. You just need to worry about remembering your password. And about the portion of bitcoins you keep elsewhere to pay for things or trade.

IncRnd2• 9 years ago

You can store your bitcoins online (in multiple places for redundancy) in encrypted file you never decrypt.
Then you don't have to worry about burglars, fires or hackers. You just need to worry about remembering your password. And about the portion of bitcoins you keep elsewhere to pay for things or trade.

This accounts for confidentiality but does not preserve the integrity or availability of the wallet and for those reasons is far less secure than you believe.

pteredactyl• 9 years ago

Is that sarcasm?

didibus• 9 years ago

Is it possible to know with those breaches if it was truly stolen by a hacker, or if it was stolen by them or someone internal?

quadcore3• 9 years ago

I dont think reddit is reliable here. Some redditor shows up and affirm he has the hacker btc address. How come he knows that. Im supprised bloomberg report the 63$ million number as it seems very weak sourced.

lasc4r• 9 years ago

Bitcoin transactions are done on a distributed ledger that everyone can see. 4700BTC went from NiceHash -> Hacker

quadcore3• 9 years ago

I know but how do you get what's at the left of the arrow exactly?

fpgaminer• 9 years ago

It looks like people are saying ~4000 BTC got stolen.

That's ... an incredible amount of coin to be stored on the service. I would never have thought NiceHash had that much usage. Not that I thought NiceHash's usage was low, but ... well let's put this into perspective.

Only 1,800 BTC are mined on Bitcoin per day. Now, NiceHash is _not_ a Bitcoin mining pool; they just pay out in Bitcoin. But that should give some perspective as to the magnitude of funds NiceHash was playing with.

I've seen some people mention cold storage, etc. NiceHash isn't a service for storing coin. The intended usage is to only keep your (the user) profits on there long enough that it exceeds their minimum withdrawal limits. I'm sure some people leave coins on there for a bit longer, to reduce the % of their profits consumed by TX fees. But, for most intents and purposes, the funds on NiceHash are 100% hot funds.

So we're talking about 4,000 BTC of _hot_ funds. It's hard to fathom what their user base must be. It'd be like walking into a department store and finding out they have $56 million in their cash registers; not for any other reason than that they have enough business to justify it.

SilverSlash• 9 years ago

I'm not very familiar with how crypto currencies work but when such an incident happens, how hopeful can the company be that they will get their BTC's back?

I ask because they're saying on their reddit thread that they are working towards "solving this issue". What does that mean here?

grufftech• 9 years ago

almost zero, unless they have verifiable evidence that the funds were seized by someone internal, and can somehow exact the wallet's private keys from said individual.

twelve40• 9 years ago

weren't they pretty transparent by definition? if you are listing X offers of Y hashrates, all this data is public... or was public anyway until they put up that placeholder.

Kiro• 9 years ago

As a buyer you transfer BTC to NiceHash. You basically top up your account with credits.

quadcore3• 9 years ago

It seems they are using the service of bitgo to store bitcoin though the following post is old. A reddit user seems to say that it talk to them via the support 2 months ago and they were saying they are using bitgo.

https://webcache.googleusercontent.com/search?q=cache:LV7jr0...

snuxoll• 9 years ago

NiceHash only makes payouts once a day - they could easily keep their wallet offline, generate the payment transaction with the public key of their wallet and sign it on the offline machine. As far as the buyers who deposit funds to purchase hashing power, I'm sure they couldn't get to miffed about any withdrawals being delayed to ensure attacks like this just don't happen.

TaylorGood• 9 years ago

From Reddit: The owner of the company with a share capital of half a million euros is Bitorious (45%) based in Dornberk, its director is Marko Kobal, and 55% of the company is owned by H-Bit. The owner of H-Bit is Martin Škorjanc. An interesting fact is that Martin Škorjanc is the father of Matjaž Škorjanc, who was arrested by Slovenian police a year ago for online cyber crime with the help of the US FBI in Maribor.

https://www.zurnal24.si/slovenija/okradli-slovensko-podjetje...

tibbon• 9 years ago

I had about $60 BTC in Nicehash. I'm aware to not store BTC in places like this, but given transaction fees, it's also not something where if you're working with a small amount of mining (just a single GPU) that you can transfer out daily without getting destroyed for transfer fees.

I'm guessing there were a lot of users like this.

mlamat2• 9 years ago

The Slovenian media is reporting that the majority owner of NiceHash is the father of the programmer who created the Butterfly bot (Mariposa botnet) and got busted by the FBI.

I heard he taught as an assistant at the CS school I went to some time ago.

pknerd• 9 years ago

What are best multi currency offline or hardware wallet options to store various alts? I hold Eth, Ark, Strats, PAY and a few more.

Regarding the NiceHash security breach

Related Stories