BLOCKCHAIN.INFO

DESCRIPTION OF EVENTS

"The world’s most popular crypto wallet. Over 80 million wallets created to buy, sell, and earn crypto." "As they say, not your keys, not your crypto. Blockchain.com Private Key Wallets are the most widely-used wallets for self-custody of your crypto. We make it easy for people who are ready to control their private keys to hold them with a Secret Private Key Recovery Phrase." "When it comes to ensuring that your crypto is secure, we think about every last detail so you don’t have to."

"My account was hacked on Aug 1st." "Someone was able to empty out my blockchain.info account." "It appears someone got into my blockchain.info account and transferred coins out of it just a few minutes ago." "Yes, it's an annoyance to lose the coins, but what I'm concerned about is understanding how this happened, because I thought things were pretty buttoned up." "Any help would be appreciated."

"I've found no evidence that my email was compromised, and was using two-factor authentication at the time." "I have 2 factor enabled. Was logged into btct and bitfunder at the time (but not blockchain.info)" "The coins were literally sitting in the online wallet for just a few hours, as well."

"I checked the ip address of recent logins. Everything seems to be in order. I don't have 2FA set in gmail, but my password is fairly strong."

"So many people don't realize that nearly every email they send bounces around the internet completely unencrypted in plaintext for hackers to read."

"If your password protecting your blockchain.info wallet was weak, then a hacker could capture it as it travels from blockchain.info to Google, and then check it against a rainbow table. The 2 factor is only for logging into the website to receive the encrypted wallet. Once they've got the wallet, they don't need the 2FA at all."

"My best guess would be a password that exists in a rainbow table, but I suppose there are other possibilities."

"How can I determine if this was caused by the rng exploit? I was using Chrome at the time."

"I do have the blockchain info wallet backup sent to my email. Even if they had this, would they be able to extract the private keys? I still had 2FA on." "[T]hey can empty your wallet without doing login on blockchain.info wallet by importing your backup wallet into any client that supports it."

A blockchain.info user reports that their wallet was emptied, and the transaction referenced has 8.4 BTC. Blockchain.info used to send backup information to people's email addresses, which is a possible way that the wallet was breached. Another possibility is that they were another victim of the failures in the Blockchain.info random number generator, with the attack sending funds to a second address.

HOW COULD THIS HAVE BEEN PREVENTED?

The blockchain.info wallet is web-based, which makes it a form of hot wallet. Hot wallets are vulnerable to breach, and should not be used to store large sums of money. Always store the vast majority of funds offline in a cold storage medium which is not connected to the internet.

Check Our Framework For Safe Secure Exchange Platforms

Blockchain.info security [FUNDS STOLEN] (Mar 19)
Hacked (Mar 26)
Blockchain.com Wallet - Store and Invest in Crypto (Dec 23)
Blockchain Wallet Review: Learn How To Buy Bitcoin On Blockchain (Dec 23)
Transaction: 1174e27cd6de043ec081a68b52f455ba1548f35949c2ba2ddd3abc60f5a29840 | Blockchain Explorer (Mar 27)
https://ca.investing.com/crypto/bitcoin/historical-data (Mar 15)

More case studies

Blockchain.info
Roommate Fund Theft

Blockchain.info
Transaction Signing Flaw