What happened
On November 29, 2013, 5,896.23 BTC was taken from both the hot wallet and the cold wallet of PicoStocks, an early Bitcoin stock and crowdfunding exchange. At late-2013 prices that was several million dollars.
PicoStocks said it saw no sign that its systems had been broken into, and that the two wallets were stored on different computers. Its explanation was that someone who had access to the system in the past had copied the wallet files and decrypted them. No attacker was publicly identified or charged. The stolen coins left in transactions d99281bae8acafc6c96cefb54d37f81e5f78898fd8ccb12493f89236bec476e6 and 28c9d7b0b31c9262958b88c42b1703098d44574e0830173c0b5cfe2a79490881. Quadriga reports that the thief left them untouched until February 2014.
PicoStocks promised to return customer funds, set up a new hot wallet and change every user deposit address. It reportedly covered the full loss, so creditors were not hurt.
Protocol details
Funds Recovery
Recovered
$6.4M
Net Loss
$0
Evidence
- report Report bitcointalk.org
- analysis Web Archive web.archive.org
- analysis List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses (PicoStocks entry) bitcointalk.org
- analysis Picostocks "Cold Wallet" Hack - Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository quadrigainitiative.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
