What happened
On July 26, 2011, Polish Bitcoin exchange Bitomat lost access to roughly 17,000 BTC after the virtual machine holding its wallet.dat file and backups was deleted during a server-resource change. Contemporary reporting says the exchange's private keys were on non-persistent EC2 instance storage, making the user funds inaccessible. Bitomat offered the business for sale to fund customer repayment; later reporting says Mt. Gox acquired the service and migrated users.
How it happened
- Bitomat stored its active wallet.dat file and backups on the same Amazon EC2 virtual-machine storage.
- When the operator addressed a server resource problem by changing the instance configuration, the virtual machine was deleted or reset.
- The instance's non-persistent storage was wiped, including the only wallet file and its private keys.
- Without the keys, Bitomat could no longer spend the roughly 17,000 BTC held for users.
- The operator sought a buyer to help repay users; later accounts report that Mt. Gox acquired Bitomat and migrated its users.
Protocol details
Classification
CeFi
Protocol Type
Exploit/Access control
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
