What happened
On June 20-21, 2011, attackers took 4,019.43 BTC from MyBitcoin, a custodial Bitcoin web wallet, by logging into users' accounts with passwords taken from the Mt. Gox breach. Around June 19, Mt. Gox's user database had leaked, including weakly salted (mostly MD5) password hashes for about 61,000 accounts. Weak passwords were cracked, and anyone who used the same password on MyBitcoin was exposed. MyBitcoin estimated about 1% of its users were affected; contemporary reports put it at about 600 accounts, emptied in under an hour.
All the stolen coins went to one address, 1MAazCWMydsQB5ynYXqSGQDjNQMN3HFmEu. MyBitcoin itself was not breached. The losses came from password reuse combined with the Mt. Gox leak. A month later MyBitcoin collapsed in a separate, much larger incident, the July 2011 MyBitcoin theft.
How it happened
- Around June 19, 2011, Mt. Gox's user table leaked, including usernames, emails and weakly salted password hashes.
- Attackers cracked the weaker hashes.
- They tried the recovered username and password pairs on MyBitcoin, where some users had reused the same credentials.
- From the accounts they could open, they withdrew the balances to
1MAazCWMydsQB5ynYXqSGQDjNQMN3HFmEu, taking 4,019.43 BTC in under an hour.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
