BitPay the Atlanta-based Bitcoin payment processor had been hit by a massive phishing attack costing the company $1.8 million. Verified by the documents owned by the Atlanta Business Chronicle, in this massive con pulled by a hacker pretending to be BitPay CFO Bryan Krohn, sent fake emails from his account in December sanctioning the transfer of 5,000 bitcoins in three separate transactions to SecondMarket from whom it does not require advance payment.
First one to be compromised was the email account of David Bailey, founder of the quarterly yBitcoin. Soon after, Krohn received an email allegedly from Bailey requesting he reviewed the modifications made in a Google document. Coincidently at the time they were in consultations about the purchase of BitPay’s magazine business by yBitcoin, as claimed by the documents filed by BitPay.
Krohn has reason to believe that his login credentials were lifted when he fed them in to access the supposed document. Not only did the hacker impersonate Krohn, he suspects the hacker also acquired details about the procedure of BitPay’s transactions with its customers, like SecondMarket’s advance payment immunity.
On Dec. 11 someone pretending to be Krohn emailed BitPay CEO Stephen Pair demanding the transfer of 1,000 bitcoins to SecondMarket at an identified wallet address. It was sent about an hour later and shortly after, Pair received another email requesting he send another 1,000 bitcoins to the same address. That transaction was sent from the company’s wallet on Bitcoin exchange Bitstamp.
The next morning, the hacker again emailed Pair as Krohn, requesting another 3,000 bitcoins to be sent to SecondMarket at a completely different wallet address.
After the funds were transferred from Bitstamp, Pair in fact confirmed the transaction in an email to Krohn and SecondMarket’s Gina Guarnaccia, who immediately denied that her company purchased the bitcoins also that she sent a previous email verifying the 3,000 bitcoins and the wallet address.
It was only after few days delay that BitPay filed a claim for losses, which was denied by its insurance company, Massachusetts Bay Insurance Company, in a June 8 letter. On Sept. 15 BitPay filed a suit against MBIC for breaching the contract, bad faith, failure to pay and statutory damages. It is looking for $950,000 in damages plus court fees.
In another similar incident, BITPAY was again hacked and 5000 BITCOINS were stolen:-
The most recent victim of a series of gigantic hacking scams is the Bitcoin payments processor BitPay Inc (bitpay.com). It has literally rocked the cryptocurrency community. The Atlanta-based Bitpay was hacked three times in December of 2014 resulting in the theft of 5 000 plus bitcoins. BitPay earlier claimed it to its insurer Massachusetts Bay Insurance Company, and they declined to pay, the matter is now in court.
A Dubious Email:-
It all started with an email sent to BitPay’s Chief Financial Officer (CFO) Bryan Krohn. Court documents identify the email’s sender as David Bailey. David Bailey was supposedly from yBitcoin, a digital currency publication and he demanded Mr Krohn’s comment on a bitcoin industry document.
Deceptively, David Bailey’s computer had also been hacked, and the email sent to Mr. Krohn directed him to a hacker-controlled website. The hacker’s website obtained and manipulated Mr. Krohn login credentials to transfer illegal transactions on the day of December 11th / 12th 2014. The hacker first learned BitPay transaction methods and then sent emails to BitPay CEO Stephen Pair using Mr Krohn’s email account which conned Mr. Pair into transferring 1,000 bitcoins to a customer’s wallet. Next con victim, Mr. Pair was lured into transferring another 1,000 bitcoins to the same hacker.
Next day the hacker had the nerve to ask BitPay CEO to send an additional 3,000 bitcoins. This time around, Mr. Pair sent an email to Mr. Krohn asking for confirmation unaware that Mr. Krohn’s email had been hacked; the customer then denied purchasing 3,000 bitcoins.
Insurer denies Paying:-
BitPay’s next move was to get its insurer to cover the loss to the amount of US$ 950,000. Nevertheless, Massachusetts Bay Insurance Company declined payment, that urged BitPay to go to court in June 2015. The insurer maintained that they were only responsible for DIRECT mishaps within the same premises not carried through by an intervening body such as the hacker that comes within the “indirect losses” in this case. The matter remains unresolved to date.
[src src=”source” url=”http://www.americanbanker.com/news/bank-technology/bitcoin-payment-processor-bitpay-loses-1m-in-phishing-hack-1076722-1.html”]AmericanBanker[/src]
