Bit LC Inc. Hack

Reported loss $51K
Access Control

What happened

Bit LC Inc. ran a Bitcoin mining service at bitlc.net. On February 13, 2013, founder Jim Nelin published a notice closing all services immediately, because miners' balances could no longer be paid.

According to that notice, the company's monitoring system warned in January 2013 that the hot wallet was running low. A later warning showed both the hot wallet and the backup storage wallet were close to empty. Nelin said he did not see this until around January 19, while he was off sick. He blamed the drain on several large withdrawals and many small transactions' fees over the previous months, not on a breach. The pool had also not found a block in over a month.

Most reserves were in a cold-storage wallet on an encrypted USB drive kept in a safe deposit box in New York. The box was registered to Erick, whom Nelin described as a larger shareholder than himself and the only other person with deep access to the systems. Only Erick had physical access to the drive, while Nelin said he held the encryption key. Nelin estimated the drive held at least 1,500 to 2,000 BTC, about the same as the shortfall in user balances. Erick had not answered calls or emails for weeks and, according to the notice, had not logged into any server for about three months. His keys and system access were revoked.

Bit LC shut down everything except the web server and said it would seek advice on bankruptcy or liquidation. Nelin offered to hand over the whole business for free to anyone who would repay the miners. The BitcoinTalk list of major thefts estimates the loss at 2,000 BTC (about $51,000). It calls the case a suspected theft by Erick that could also be a misunderstanding, and notes there is no proof he took the coins on purpose.

In April and May 2013, users said on BitcoinTalk that they were still owed amounts from 1-2 BTC up to 100-200 BTC. They also said an advertised auction of the domain and assets to repay members had been taken off the site.

Protocol details

Classification Token
Protocol Type Exploit/Access control
Protocol links Website

Understand the attack patterns

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.