Doge Vault Hack

Reported loss $51K
Other

What happened

On May 11, 2014, attackers compromised Doge Vault, a hosted Dogecoin online wallet, and moved coins out of its hot wallet. Doge Vault said the attackers had gained access to the node that hosted its virtual machines, giving them full access to its systems. By the time the administrator was alerted and halted the service, the attackers had already accessed and destroyed all data on those virtual machines.

The site went offline and asked users not to send funds to Doge Vault addresses while it investigated. Doge Vault said its recovery work included salvaging existing wallet data from an off-site backup. Early press estimates, based on a "mega wallet" holding about 111 million DOGE, put the loss near $51,000. Doge Vault's later statement said about 280 million DOGE had been taken from a hot wallet of roughly 400 million DOGE, that 120 million DOGE had been recovered to an address under its control, and that all passwords and private keys should be treated as compromised. It asked customers not to request their coins back yet and gave no timeline for resuming withdrawals.

How it happened

  1. The attacker gained access to the hosting node that ran Doge Vault's virtual machines, which gave full access to the wallet servers.
  2. From there the attacker moved about 280 million DOGE out of Doge Vault's hot wallet. Users reported coins leaving their addresses shortly before the site went offline.
  3. The attacker destroyed all data on the hosted virtual machines.
  4. Doge Vault halted the service, recovered 120 million DOGE to an address it controlled, and told users to treat all private keys as compromised.

Protocol details

Classification Token
Protocol Type Exploit/Other
Protocol links Website @dogevault

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.