What happened
On July 13, 2012, Bitcoinica disclosed that about 40,000 BTC and roughly $40,000 in cash had been taken from its account at Mt.Gox, worth about $350,000 in total. It was the exchange's third theft that year, two months after the May 11 breach.
After the May hack, Bitcoinica changed its passwords but left its LastPass password as it was, believing it had not been exposed. That password was a duplicate of a credential that had been compromised in May; reports say it was the Mt.Gox API key. The attacker used it to open the LastPass vault, which held the rest of Bitcoinica's credentials, and then took the funds held at Mt.Gox. In the bitcointalk announcement, the operator who posted it (genjix) said he regretted getting involved with such a badly secured site.
How it happened
- In the May 11, 2012 breach, attackers obtained a credential that Bitcoinica also used as its LastPass master password.
- Bitcoinica rotated its other passwords but kept the LastPass password, believing it was safe.
- The attacker logged into Bitcoinica's LastPass vault with the old credential and got the stored logins, including access to its Mt.Gox account.
- The attacker took about 40,000 BTC and about $40,000 from that Mt.Gox account. Bitcoinica announced the loss on July 13, 2012.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
