What happened
Inputs.io, an online Bitcoin wallet service operated by TradeFortress, reported that two attacks on October 23 and October 26, 2013 left it unable to cover all customer balances. The operator said roughly 4,100 BTC was taken, valued at about $1.18 million to $1.2 million in contemporaneous reports. According to the operator's account, attackers used a chain of compromised email accounts to reset access to the hosting account and bypassed two-factor authentication through a hosting-provider-side flaw.
Inputs.io offered partial customer repayments using its remaining cold storage and the operator's personal BTC, but those funds were substantially below the reported shortfall.
How it happened
- The attacker compromised a chain of email accounts, including old accounts that could be reset because their recovery protections were weak.
- That access was used to reset the password for the hosting account that controlled Inputs.io's infrastructure.
- The operator said an issue at the hosting provider also let the attacker bypass two-factor authentication.
- Two attacks, on October 23 and October 26, together removed about 4,100 BTC and left the service unable to meet all user balances.
- Inputs.io proposed partial repayments from its remaining cold-storage coins and TradeFortress's personal BTC, rather than claiming a full recovery of the loss.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
