Kipcoin Hack

On February 18, 2015, Chinese New Year's Eve, the Chinese bitcoin exchange KipCoin said on Weibo that its wallet servers had been hacked and that it had lost more than 3,000 BTC, reported at about $700,000 at the time. It put services on hold and said it would relaunch after the Spring Festival. It also said no Chinese yuan had been stolen, only bitcoin.

According to KipCoin, the attacker got into its server the previous May and downloaded the wallet.dat file, which held the exchange's private keys. The attacker waited months before moving the coins, starting in December 2014. It is unclear why KipCoin did not move its funds to new keys once the breach was known. Bitcoin Magazine links the compromise to a breach of KipCoin's hosting provider, Linode, followed by a month-long fight to regain control of the server. KipCoin has not published a technical post-mortem.

KipCoin said the attackers had left clues to their identity, that it would work with police after February 25, and that it might drop the complaint if the coins were returned. Many customers doubted the story. The exchange had paid depositors about 22% annualized interest, and some called it a Ponzi scheme, weeks after the Chinese platform MyCoin collapsed. Those allegations are unproven.

Addresses KipCoin said belong to the hacker:

1Chg6NxMeTcZ3DQvYA9gocjU4RQwH1LtKD, 18zf9CWe4uBy8BesHU3BWqjpibDRRBoPLD, 1MYkHXvnWuZ5FaMJkNv4uCLoVC2Ztp2DXK, 152BSsbpcGMdj9WBGHq3wXHgJVuqQCs4aJ, 16j131w3cvkdAc13sg5nREMiiJj3zoRw5n, 16qHXy4RDeek56mNDN84d2F6niE96taQso, 175L5Sx81dZZBureP8RtLUyUXoruVdAj1E, 17ZJ1sqDRxq7oRVrnNLxoyrvHrtrjtPRfp, 17amdMD8JJPcipWqUEwzEtsAuYu1FzkVtg, 181qVdiaCcJmzGJV9PEobeYYnkC25PyJdT, 18ncsALSWGWRG3JK6yio4PXoiWBbvxAxng, 1XgAzaQEe9iDEohWCmdNXSH8XZ74uLBnd