<p>There are many ways theft can occur.</p>

<p>Even though the cases where hackers have stolen from exchanges or from individuals, in terms of the number of bitcoins lost that amount is chump change compared to the amount of coins lost to scammers such as PirateAt40 and other scams, including loans not being repaid or currency trades that go bad.</p>

<p>But as far as bitcoins lost to hackings, yes -- the thefts have been due to poor security practices being implemented by exchange operators and other businesses where an attacker takes advantage of that to steal funds.</p>

<p><a href="http://bitcointalk.org/index.php?topic=83794.0" rel="nofollow noreferrer">The list</a> of the top thefts in which these hackings includes some of the details for various incidents.</p>

<p>Security is difficult and expensive, and Bitcoin startups generally don't have the revenue and profits sufficient to attract the capital that would allow top-notch security to be implemented.  As a result, they become juicy targets for the attackers.</p>

<p>Even following the recommendations for <a href="http://en.bitcoin.it/wiki/Securing_online_services" rel="nofollow noreferrer">securing online services</a> does not ensure that there is no risk of theft, but most losses from theft thus far were because those recommendations weren't followed.</p>

<p>As far as the term "cracking" ... that generally refers to discovering passwords.  In June 2011 when an attacker obtained the list of accounts and password hashes from Mt. Gox, cracking was able to discover passwords for many accounts due to there having been poor security on the password hashing method implemented by Mt. Gox at the time.  Most Bitcoin-related service operators are smarter than that but that incident has helped any that weren't to become a little more aware of proper password security methods (e.g., BCrypt).</p>

<p>Password cracking might also be used by an attacker to gain access to a system which which may hold coins in an unecrypted wallet, or that breach may lead to credential that provide access to additional systems which hold coins in an unencrypted wallet.</p>

<p>The reason hackers are successful when compromising these server systems used by exchanges and other bitcoin businesses is because if software needs the ability to send outgoing payments then the attacker who has compromised the system then gains that same capability.  Even if the wallet is encrypted, the software would use the passphrase to unencrypt it so either the Bitcoin client is responding to requests after the passphrase has already been provided or the passphrase is avaialble to the software to make such requests.  And thus if that system is compromised there is no protection possible for those coins in the wallet on that system.</p>

<p>For this reason, any exchange or bitcoin business using hosting for their systems where the hosting service has any access to the hosted service whatsoever, those coins are at risk.  But most Bitcoin businesses are not at the scale necessary to justify proper security at data centers (e.g., using their own hardware colocated in locked cages in <a href="http://www.thebunker.net/colocation/facilities/" rel="nofollow noreferrer">highly secure facilities</a>). </p>

<p>Even with that, that is just the security for the hot wallet containing a fraction of the service's bitcoins needed for daily operations.  Security for the offline wallet might involve using paper wallets stored in bank vaults, or access protected with <a href="http://bitcointalk.org/index.php?topic=23938.msg1177353#msg1177353" rel="nofollow noreferrer">Shamir's Secret Sharing</a> method even.</p>

<p>Much more common than breaches of security at Bitcoin exchanges and services are compromises of individual EWallet accounts at these online services.   This often happens when an individual shares a username and password for their exchange account with another service.  For instance, after the Mt. Gox passwords were leaked, other exchanges went on lockdown because so many accountholders had common login credentials on both services.  A protection against that is for the exchange to offer <a href="https://bitcoin.stackexchange.com/questions/4113">multi-factor authentication</a>.</p>

<p>Individual users of the Bitcoin.org client can protect their wallets with passphrase encryption.  This still leaves them vulnerable to a replay attack should their system be compromised with a keylogger or similar malware.  For this reason, <a href="http://bitcoinarmory.com/index.php/using-offline-wallets-in-armory" rel="nofollow noreferrer">offline/cold wallet</a> and "air gap" systems are recommended when the amount of bitcoins held are significant.  A similar <a href="http://krebsonsecurity.com/banking-on-a-live-cd/" rel="nofollow noreferrer">recommendation</a> exists for online banking, so compromised systems aren't specific to Bitcoin users.</p>

CC BY-SA 3.0
2014-02-06T16:26:07.290Z
Shamir Secret Sharing is great. If you're looking for a straightforward, easy-to-read python implementation, I'd check out secretsharing: https://github.com/halfmoonlabs/secretsharing.
Ryan Shea
CC BY-SA 3.0
2012-10-24T17:24:23.433Z
2012-10-24T17:30:46.300Z
2017-04-13T12:47:33.743Z
Stephen Gornick
<p>When reading many stories about bitcoin theft, what is the usual gist? Dont most of these hackers get digital wallets that are encrypted? How do they make use of it, crack it...or its not encrypted at all?</p>

CC BY-SA 3.0
2012-10-24T17:37:45.590Z
Bitcoin-related thefts seem get a lot of attention compare to the much more common banking-related or payment service theft.  http://mashable.com/2012/10/24/barnes-noble-pin-pad-hack/
Stephen Gornick
CC BY-SA 3.0
2014-02-06T16:28:02.207Z
I would NEVER trust an app to split my secrets. Only use an open source library, and make sure you download the code and run it yourself on a computer that's disconnected from the internet (ideally never been connected to the internet). Try this python implementation: https://github.com/halfmoonlabs/secretsharing.
Ryan Shea
<theft>
How is all this bitcoin theft happening?
Takahashi Nakamoto
# How is all this bitcoin theft happening?

(Asked by: username_0 on 2012-10-24)

When reading many stories about bitcoin theft, what is the usual gist? Dont most of these hackers get digital wallets that are encrypted? How do they make use of it, crack it...or its not encrypted at all?

**Tags:** theft

> **Comments:**
> **username_1**: Bitcoin-related thefts seem get a lot of attention compare to the much more common banking-related or payment service theft.  http://mashable.com/2012/10/24/barnes-noble-pin-pad-hack/  
> **username_2**: I would NEVER trust an app to split my secrets. Only use an open source library, and make sure you download the code and run it yourself on a computer that's disconnected from the internet (ideally never been connected to the internet). Try this python implementation: https://github.com/halfmoonlabs/secretsharing.  

---

## 1 answers

### Answer by username_1 on 2012-10-24. Score: 3 | Accepted answer

There are many ways theft can occur.

Even though the cases where hackers have stolen from exchanges or from individuals, in terms of the number of bitcoins lost that amount is chump change compared to the amount of coins lost to scammers such as PirateAt40 and other scams, including loans not being repaid or currency trades that go bad.

But as far as bitcoins lost to hackings, yes -- the thefts have been due to poor security practices being implemented by exchange operators and other businesses where an attacker takes advantage of that to steal funds.

[The list](http://bitcointalk.org/index.php?topic=83794.0) of the top thefts in which these hackings includes some of the details for various incidents.

Security is difficult and expensive, and Bitcoin startups generally don't have the revenue and profits sufficient to attract the capital that would allow top-notch security to be implemented. As a result, they become juicy targets for the attackers.

Even following the recommendations for [securing online services](http://en.bitcoin.it/wiki/Securing_online_services) does not ensure that there is no risk of theft, but most losses from theft thus far were because those recommendations weren't followed.

As far as the term "cracking" ... that generally refers to discovering passwords. In June 2011 when an attacker obtained the list of accounts and password hashes from Mt. Gox, cracking was able to discover passwords for many accounts due to there having been poor security on the password hashing method implemented by Mt. Gox at the time. Most Bitcoin-related service operators are smarter than that but that incident has helped any that weren't to become a little more aware of proper password security methods (e.g., BCrypt).

Password cracking might also be used by an attacker to gain access to a system which which may hold coins in an unecrypted wallet, or that breach may lead to credential that provide access to additional systems which hold coins in an unencrypted wallet.

The reason hackers are successful when compromising these server systems used by exchanges and other bitcoin businesses is because if software needs the ability to send outgoing payments then the attacker who has compromised the system then gains that same capability. Even if the wallet is encrypted, the software would use the passphrase to unencrypt it so either the Bitcoin client is responding to requests after the passphrase has already been provided or the passphrase is avaialble to the software to make such requests. And thus if that system is compromised there is no protection possible for those coins in the wallet on that system.

For this reason, any exchange or bitcoin business using hosting for their systems where the hosting service has any access to the hosted service whatsoever, those coins are at risk. But most Bitcoin businesses are not at the scale necessary to justify proper security at data centers (e.g., using their own hardware colocated in locked cages in [highly secure facilities](http://www.thebunker.net/colocation/facilities/)).

Even with that, that is just the security for the hot wallet containing a fraction of the service's bitcoins needed for daily operations. Security for the offline wallet might involve using paper wallets stored in bank vaults, or access protected with [Shamir's Secret Sharing](http://bitcointalk.org/index.php?topic=23938.msg1177353#msg1177353) method even.

Much more common than breaches of security at Bitcoin exchanges and services are compromises of individual EWallet accounts at these online services. This often happens when an individual shares a username and password for their exchange account with another service. For instance, after the Mt. Gox passwords were leaked, other exchanges went on lockdown because so many accountholders had common login credentials on both services. A protection against that is for the exchange to offer [multi-factor authentication](https://bitcoin.stackexchange.com/questions/4113).

Individual users of the Bitcoin.org client can protect their wallets with passphrase encryption. This still leaves them vulnerable to a replay attack should their system be compromised with a keylogger or similar malware. For this reason, [offline/cold wallet](http://bitcoinarmory.com/index.php/using-offline-wallets-in-armory) and "air gap" systems are recommended when the amount of bitcoins held are significant. A similar [recommendation](http://krebsonsecurity.com/banking-on-a-live-cd/) exists for online banking, so compromised systems aren't specific to Bitcoin users.

> **Comments:**
> **username_2**: Shamir Secret Sharing is great. If you're looking for a straightforward, easy-to-read python implementation, I'd check out secretsharing: https://github.com/halfmoonlabs/secretsharing.  

---

