BitPay Hack

In December 2014, a spear-phishing attack tricked BitPay, the Bitcoin payment processor, into sending 5,000 BTC to an attacker. BitPay's court filing valued the coins at about $1.85 million. The attacker first compromised the email of David Bailey, founder of yBitcoin/BTC Media, who was negotiating with BitPay at the time.

From Bailey's account, they sent CFO Bryan Krohn a link to a supposed Google document. Krohn entered his BitPay email credentials on the fake login page, which gave the attacker his mailbox. Posing as Krohn, the attacker emailed CEO Stephen Pair asking him to send bitcoin to SecondMarket, a real client.

SecondMarket was the only BitPay client not required to prepay, so the request looked routine. The fraud surfaced when Pair copied a SecondMarket employee on a confirmation email. She replied that SecondMarket had not bought the bitcoins.

The loss became public in September 2015, when BitPay sued Massachusetts Bay Insurance Company for $950,000. The insurer had denied the claim, arguing that the policy covered hacking of BitPay's own systems, not losses from a third party's compromised computer. The case was dismissed in May 2016 after the parties settled, and the terms were not disclosed.