Doge Vault Hack
What happened
On May 11, 2014, attackers compromised Doge Vault, a hosted Dogecoin online wallet, and moved coins out of its hot wallet. Doge Vault said the attackers had gained access to the node that hosted its virtual machines, giving them full access to its systems. By the time the administrator was alerted and halted the service, the attackers had already accessed and destroyed all data on those virtual machines.
The site went offline and asked users not to send funds to Doge Vault addresses while it investigated. Doge Vault said its recovery work included salvaging existing wallet data from an off-site backup. Early press estimates, based on a "mega wallet" holding about 111 million DOGE, put the loss near $51,000. Doge Vault's later statement said about 280 million DOGE had been taken from a hot wallet of roughly 400 million DOGE, that 120 million DOGE had been recovered to an address under its control, and that all passwords and private keys should be treated as compromised. It asked customers not to request their coins back yet and gave no timeline for resuming withdrawals.
How it happened
- The attacker gained access to the hosting node that ran Doge Vault's virtual machines, which gave full access to the wallet servers.
- From there the attacker moved about 280 million DOGE out of Doge Vault's hot wallet. Users reported coins leaving their addresses shortly before the site went offline.
- The attacker destroyed all data on the hosted virtual machines.
- Doge Vault halted the service, recovered 120 million DOGE to an address it controlled, and told users to treat all private keys as compromised.
Protocol details
Evidence
- report Post-mortem medium.com
- report Report dogevault.tumblr.com
- analysis Dogecoin off the leash after Doge Vault admits server attack theregister.com
- analysis Doge Vault hack: Millions of Dogecoins have disappeared from the online wallet slate.com
- analysis Doge Vault Investigates Cyber Attack securityweek.com
- analysis Supposedly secure Dogecoin service Dogevault goes offline theregister.com
- analysis Dogecoin vault vanishes after attack welivesecurity.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.