Incident Overview
The attack started with an email sent to BitPay's Chief Financial Officer (CFO), Bryan Krohn. According to court filings, the email's sender is David Bailey. David Bailey claimed to be from yBitcoin, a digital currency newspaper and asked for Mr. Krohn's opinion on a bitcoin industry whitepaper.
David Bailey's computer had apparently been hijacked as well, and the email forwarded to Mr. Krohn pointed him to a hacker-controlled website. Mr. Krohn was requested to give his login credentials for his workplace email account on the hacker's website. The hacker was subsequently able to transfer unlawful transactions using Mr. Krohn's work email account utilizing those credentials. This occurred on December 11th and 12th, 2014.
The hacker initially investigated how BitPay conducted business. He then used Mr. Krohn's email account to send emails to BitPay CEO Stephen Pair. Mr. Pair was instructed in the emails to send 1,000 bitcoins to a customer's wallet, which he did. Mr. Pair then received a second email requesting that he give another 1,000 bitcoins to the same buyer, which he did.
The hacker became more daring the next day. In his email, he requested that the BitPay CEO give an additional 3,000 bitcoins. Mr. Pair wrote an email to Mr. Krohn asking for confirmation this time, not realizing that Mr. Krohn's email had been hijacked. It was found because Mr. Pair duplicated the customer on the 3,000 bitcoin transfer. The consumer said that they had not bought any bitcoins.
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to BitPay, these are the critical security checks that could have prevented this incident (September 2014).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
-
03
Web Archive https://bitpay.com/
Learn to Prevent the Next BitPay
The BitPay hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.