Another Bitcoin exchange has been hacked. Canadian Bitcoins , an exchange based in Ottawa, has lost over $100,000 worth of Bitcoins in a heist that happened during an incident on October 1st 2013.
The story is different from Mt. Gox or any other hacking events. The hacker didn’t even need to actually ‘hack’ the system. Warning: the following story may sound unbelievable…
On October 1st 2013, a random person opened an online chat session with a technical support worker at Granite Networks. Granite Networks, now owned by Rogers Communications , hosts Canadian Bitcoins’ server. The random person claimed to be James Grant, owner and CEO of Canadian Bitcoins.
During the chat session, ‘fake’ James Grant said he had a problem with their server and asked the support worker to reboot it into recovery mode, thus allowing him to bypass security on the server.
“It’s ridiculous,” said the real James Grant when asked about the incident. “There was absolutely zero verification of who it actually was.”
Canadian newspaper the Citizen obtained a text copy of the chat session. This copy proved that, at no point during the nearly two-hour-long conversation, was the caller asked to verify his identity. In fact, the support worker did everything the caller asked. He gained access to Grant’s locked server pen, plugged in a laptop and gave the caller access to Canadian Bitcoins’ servers. The hacker emptied a wallet containing 149.94 Bitcoins. Estimated value at that time as about $100,000.
Luckily, Canadian Bitcoins only keeps a small amount of coins in its active online wallet. The rest of the coins are safely stored in an inactive wallet which is locked in a safety deposit box. In order to gain access to this wallet, customers and employees need to go through the necessary paperwork.
“Even so, $100,000 in Bitcoins was lost, and Canadian Bitcoins had to reimburse this missing amount out of their own pocket”, Grant said. He also moved their computer equipment out of the facility.
When asked for a response, Rogers Communications acknowledges the incident in an official statement.
“The situation surrounding this customer is unique to this customer, and does not apply to any other customer of Rogers Data Centres. Rogers has been fully co-operative with authorities in the investigation,” according to a statement from the company. “Rogers Data Centres provides the highest level of security in the Canadian datacentre industry. Its security protocol is operationally certified and in accordance with industry best practices. We have reviewed our security processes and continue to work with our customers to make sure they take advantage of all of our security features.”
A ‘credit’ has been offered to reimburse a part of the losses Canadian Bitcoins had to suffer. Grant replied that the credit was nowhere near sufficient to cover the amount of Bitcoins that were stolen. Canadian Bitcoins is now contemplating legal action in a last effort to regain what was lost.
Funny fact, when Grant himself wanted to get to the servers, safety measures seemed to have gone up. He needed to call two hours in advance to alert Rogers officials about his visit. He then needed a key card to enter the building, enter the lobby, activate the retinal scanner, pass through two more sets of locked doors and then he had to provide a numeric code to unlock the padlocked gate on the cage of his servers.
“It’s completely ridiculous, it’s nearly impossible for me to gain access but a hacker gets in straight away.”, said Grant. “All they did was go on the chat session and say, ‘Hi, I’m James Grant, and I have a server with you’ and the datacentre said, ‘Yes you do, what can we do for you?”
Rogers bought Granite Networks for $6.25 million in late September. The data breach happened while the facility was still in the process of being transitioned to Rogers ownership.
