What happened
On January 26, 2019, attackers hijacked the forum on LocalBitcoins, the Finland-based peer-to-peer bitcoin marketplace, and used it to phish users. LocalBitcoins said the entry point was a flaw in third-party software behind its forum feature. The attackers replaced the official forum link with a fake page that looked like LocalBitcoins and asked visitors to log in again, including their two-factor authentication codes, even though they were already signed in.
With those credentials the attackers got into at least six user accounts and withdrew about 7.9 BTC, roughly $27,000 at the time. One victim traced the receiving address, which had collected about 7.95 BTC (around $28,000) by the time Bitcoinist reported the theft.
LocalBitcoins paused outgoing transactions once it spotted the attack, around 10:00 UTC, then turned them back on after adding security measures. It disabled the forum until further notice and said it was still working out how many users were affected. None of the reports reviewed mention reimbursement.
How it happened
- The attackers exploited a flaw in the third-party software behind the LocalBitcoins forum feature.
- They used that access to point the site's forum link to a phishing page that copied the LocalBitcoins login.
- Users who clicked through to the forum were asked to sign in again and entered their passwords and two-factor codes, which the attackers captured.
- The attackers logged into at least six accounts with the stolen credentials and sent about 7.9 BTC to an address they controlled.
- LocalBitcoins halted outgoing transactions, stopped the attack, disabled the forum and later re-enabled withdrawals.
Protocol details
Evidence
- report LocalBitcoins Hacked By an 'Unauthorized Source,' Forum Suspended (Bitcoinist, Jan 26, 2019) bitcoinist.com
- analysis Most Significant Hacks of 2019: New Record of Twelve in One Year (Cointelegraph) cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis LocalBitcoins Reveals Security Breach With Some Crypto Wallets Affected (CoinDesk, Jan 28, 2019) coindesk.com
- analysis At least six accounts robbed in hack of Bitcoin exchange LocalBitcoins (Bitdefender, Jan 28, 2019) bitdefender.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
