What happened
In early September 2012, an attacker stole about 24,000 BTC, worth roughly $250,000 at the time, from the US Bitcoin exchange BitFloor. Founder Roman Shtylman said several servers were compromised. On them the attacker found an unencrypted backup of the wallet keys, made during an earlier manual server upgrade, and used those keys to move the coins.
The theft took most of the bitcoin the exchange held. BitFloor paused all trading and said it lacked the capital to cover the loss right away. The Bitcoin Wiki records partial repayments that stalled after December 2012.
The exchange shut down in April 2013 after its bank said it would close the account.
How it happened
- The attacker compromised several BitFloor servers.
- On one of them they found an unencrypted backup of the exchange's wallet private keys. Shtylman said the live keys were kept in an encrypted area, but he had copied a backup to an unencrypted disk partition during a manual upgrade.
- With the keys, the attacker signed transactions moving about 24,000 BTC out of the exchange wallet, most of the coins BitFloor held.
- BitFloor suspended trading once the theft was found.
Protocol details
Evidence
- analysis Bitfloor Hacked, $250,000 Missing bitcoinmagazine.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
- analysis Hack Robs Bitfloor of $250,000 securityweek.com
- analysis Bitcoin Exchange BitFloor Loses $250K to Hackers, Stops Trading nbcnews.com
- analysis Bitfloor - Bitcoin Wiki en.bitcoin.it
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
