What happened
On May 10, 2013, attackers drained Vircurex's hot and warm wallets. The cryptocurrency exchange was about three months old. Its May 2013 report to shareholders puts the losses at 1,454 BTC, 225,263 TRC (Terracoin) and 23,400 LTC.
No exchange code was exploited. The attacker obtained login credentials for Vircurex's VPS control account at its hosting provider and asked for the root passwords of all servers to be reset. The provider did so and posted the new credentials in a helpdesk ticket, not through the usual email to Vircurex's 2FA-protected address. The provider's option to allow management-console logins only from Vircurex's IP range was supposed to block this, but it was not working. With root access, the attacker withdrew the wallet funds.
Vircurex moved all services to a new provider that required 2FA on every login. It said it would buy back the missing coins from monthly dividends, which it expected to take 9 to 12 months. The report lists the book value as -102.33 BTC for May 2013.
Withdrawals, per the report:
- 706 BTC to
17gPdCyzEMRXdNTBpHrUhsM4FaiWMHhx2Q(txcbce6bd1e274a9ea9d6946feaf4a1b0f80a5885a8482f4ebf3caa052f22bb4bf) - 748 BTC to
1PWQJu9AskoXEBYMod1KqPE6TTG4VYNz1P(tx85489430661f3041608749acb3019a1dcbf07a60f22e4bc43acfd05b46496cc9) - 130,263 TRC to
1Mu1wbyfkcrRarPveiihy5iuceLGC91Z4T(tx33011a0e26fe1c3515c699eecdae9d7550218779ae72fe7af063fffc80361d64) - 95,000 TRC to
1MeY3VVudFUV91gxVZsaY92TguRWy7eQbE(tx90239779a08243883f54bdb2503f4f40be2541487c2ef2383ef4d8277660e88b) - 23,400 LTC to
LV8VnCDYJzd3FYNwn6n3Kyi1i7PB2MvXPo(tx30231aee25900b9cb1fba16f1a8923a0cd866d60b01e542be1a4b26f92d9d10f)
How it happened
- The attacker obtained the login for Vircurex's VPS control account at its hosting provider.
- The provider's IP allowlist for the management console, which should have limited logins to Vircurex's own IP range, was not working, so the attacker could log in.
- The attacker asked for a root password reset on all Vircurex servers. The provider posted the new credentials in the helpdesk ticket, not by email to Vircurex's 2FA-protected address.
- With root on the servers, the attacker withdrew 1,454 BTC, 225,263 TRC and 23,400 LTC from the hot and warm wallets in five transactions.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
