Tweet This
When a cryptocurrency exchange gets hacked, whose fault is it?
You’d think the answer would be simple. The exchange, of course. Should have used multi-sig keys – or if they were, should have enforced them more strictly. Should have kept funds in cold storage. Should have watched for suspicious transactions. If an exchange gets hacked, it must have had a security weakness. It’s hard to see that anyone other than the exchange’s developers and operators are responsible for this.
A surprisingly large number of people also blame the users. Shouldn’t have been stupid enough to keep coins in a hot wallet on an unregulated exchange. Unregulated exchanges aren’t banks. They don’t have an equivalent of FDIC protecting depositors from losses. If you leave coins in a hot wallet on an exchange, they are only as secure as the exchange’s security – and as we all know by now, exchanges aren’t necessarily secure. The recent hacking of the Japanese exchange CoinCheck was simply the latest in a long line of very expensive security failures.
But now there is a new culprit. The developers of the cryptocurrency that has been stolen. It’s all their fault, apparently.
So claims the owner of BitGrail, an Italian cryptocurrency exchange which has managed to lose an estimated 17 million Nano coins with a value of (now) about $132 million. (Nano was until about 2 weeks ago known as “Raiblocks.” It rebranded itself at the end of January 2018.) Last week those coins were worth $170 million, but Nano’s price has crashed since the loss was disclosed.
In a conversation with Nano developers (leaked by the developers), BitGrail’s owner, Francesco Firano (also known as “The Bomber”), claimed that bugs in Nano’s software had enabled coins to be “double spent” without the exchange noticing:
Due to an xrb bug that caused the node to crash, the attackers forced the system to get double payments for which we have no trace of time due to another bug in xrb official explorer
Double spending is a form of fraud in which the same coins are used for multiple transactions. Cryptocurrency software typically has built-in checks to prevent this, so accusing a cryptocurrency of permitting double spending is a serious criticism of its developers.
Unsurprisingly, the Nano developers hit back. Summarily rejecting Firano’s accusation, they alleged that the exchange’s own software was deficient:
From our own preliminary investigation, no double spending was detected on the ledger and we have no reason to believe the loss was due to an issue in the Nano protocol. The problems appear to be related to BitGrail’s software.
And they went on to cast doubt on Firano’s veracity:
We now have sufficient reason to believe that Firano has been misleading the Nano Core Team and the community regarding the solvency of the BitGrail exchange for a significant period of time.
A look through the Twitter stream of Nano dev Zack Shapiro reveals that this is self-defense. For some time before the loss was disclosed, people were asking if BitGrail was insolvent, or even a scam, only for Shapiro to reassure them. He’s now taking a certain amount of flak for this on Twitter.
Meanwhile, Firano accused the Nano devs of “not cooperating.” What did he mean by this?
The leaked email conversation reveals that Firano asked the Nano devs to fork the blockchain at a point before the coins went missing, enabling him to retrieve the funds:
Is there any possibility to fork the chain and get xrb from burned address? Seems the only solution for me right now.
This was not quite as unreasonable as it sounds. When the DAO was hacked in 2016, Ethereum developers executed a hard fork to retrieve the funds and prevent further thefts. Their action was not entirely successful, since a proportion of the Ethereum community objected to it: as a result, two versions of Ethereum are now actively mined, the forked chain (ETH) and the original (hacked) chain (ETC). Nonetheless, Ethereum’s action did set a precedent for forking the blockchain to retrieve stolen funds. Firano no doubt had this in mind when making his request.
The Nano devs thought about it overnight. Then on February 9, 2018, they refused. “We are not making a statement with you,” they said. Firano was on his own – and he knew it. Though he warned them of the consequences if they didn’t agree to “cooperate” as he wished:
We will say that the devs refuse to cooperate despite the proposed solutions.
We are going to report the incident to the police, first and then we will explain what happened.
Millions of dollars of your supporters depend on your decision.
I hope you have understood this before making the decision not to cooperate.
The devs have indeed condemned their supporters to losing millions of dollars’ worth of nano coins. Of course, that doesn’t make the hacking their fault.
But there is something funny about all of this. In the case of the DAO, the Ethereum devs in effect accepted responsibility for the error in the DAO’s smart contract that allowed an attacker to drain it. Firano is similarly asking Nano devs to accept responsibility for BitGrail’s loss. But the DAO was experimental code running on the Ethereum platform, whereas BitGrail is an independent exchange. Why might its owner think Nano devs would dig him out of a hole?
As far as I can ascertain from a forest of Reddit posts and threads, shortly before the hack is alleged to have happened the Nano developers issued a software update that affected all exchanges trading Nano at that time. BitGrail had some problems with the update, which both its own devs and the Nano devs were involved in fixing. The timestamps visible through the explorer on transactions at this time seem to have been arbitrarily set at this time, rather than reflecting the actual date of the transaction. Firano is therefore correct that the explorer showed the wrong dates. And it is fair to say that this might have prevented BitGrail’s operators noticing suspicious transactions around this time. So perhaps Firano thinks that the problems with Nano's update left the exchange with an exploitable weakness. If so, the Nano devs would bear some responsibility.
But other comments from Firano cast doubt on this. It seems that Bitgrail stored most of its funds in a “cold” (i.e. offline) wallet. And it was that wallet that was hacked, not the “hot wallet” which is open for transactions and therefore vulnerable to attack. Furthermore, many of the suspect withdrawals took place on days when withdrawals from BitGrail were suspended for normal users because of a massive backlog of verifications and continuing problems with the Nano node. It is hard to see how funds can be withdrawn from a cold wallet by an external attacker, particularly if the exchange is closed to withdrawals. This is beginning to like an inside job.
As ever with suspected cryptocurrency frauds, Reddit users are on it. One bright spark did some digging, and discovered that at the same time that BitGrail was being drained, similar transactions were taking place on another exchange that trades Nano, Mercatox:
From that I have come across evidence that Bitgrail AND Mercatox were BOTH SENDING MILLIONS of NANO to the SAME addresses…at the SAME time…..As you can see some of these amounts came directly from BitGrail Representative 1 which is supposed to be “Bomber’s” cold wallet…..and during a time we were told that withdrawals were either frozen or unavailable by both sites:
Between January 17th-19th Bitgrail AND Mercatox sent these addresses millions worth of NANOLINKS:
Archive Link: http://archive.today/yPtkk
And he asks:
Why were MILLIONS worth NANO being sent from Mercatox AND Bitgrail to the SAME addresses at the SAME time while withdrawals were either frozen or closed by both exchanges?
I’d like to know that too. As, I’m sure, would those whose Nano coins have been stolen. So was Firano's appeal to the Nano devs to fork the blockchain really a genuine attempt to recover the funds, or an attempt to deflect blame?
Well, consider this. Shining through the Reddit and Twitter threads is another, deeper story. For months before the loss was announced, BitGrail users had been complaining that they could not withdraw funds. Not just Raiblocks/Nano, but other coins too. Shapiro, somewhat kindly, said that BitGrail was “overwhelmed” by demand and having difficulty implementing know-your-customer rules. But others have suggested that all this was smoke and mirrors, and BitGrail has in fact been insolvent since about last November. In the cryptocurrency world, liability is unlimited....
Shapiro should have heeded the users who warned that BitGrail was insolvent, or worse, a scam. And he should not have been blinded by his evident friendliness with Firano. Users being unable to withdraw funds for months on end is a clear indicator that the exchange is in trouble. BitGrail’s collapse didn’t come out of the blue. As so often with corporate insolvencies, the signs were there long before – for those who had eyes to see.
