Shapeshift Hack

Between March and April 2016, ShapeShift, the instant crypto exchange run by Erik Voorhees, lost as much as $230,000 from its company hot wallets in three separate thefts. No customer funds were lost, because ShapeShift did not hold customer balances.

The first theft, on March 14, 2016, took 315 BTC (about $138,000). It was traced to an employee who managed the company's servers, office IT and security; he was fired the next day. ShapeShift moved its service onto new infrastructure, but on April 7 an outside hacker stole 97 BTC, 3,600 ETH and 1,900 LTC. After the site was taken offline and security was reinforced, a further 57 BTC and 2,200 ETH were taken within about two days.

The hacker later revealed that the employee had sold him ShapeShift's source code, server IP addresses and an SSH key, and had installed a remote desktop (RDP) server on a coworker's office machine. The hacker said he used that RDP access to the internal office network to break in again on April 7, using an SSH key newly created for the rebuilt hosting environment. Voorhees paid the hacker 2 BTC (about $880) for information about how the hack worked. ShapeShift brought in Michael Perklin of Ledger Labs, rebuilt its infrastructure from scratch, drafted security policies and started a civil suit against the former employee, planning to reopen around April 20, 2016.