9 ms·

Regarding the NiceHash security breach

169 points by 6d6b73 9y ago

mizzack 9y ago
Even though I lost ~$500 here and I'm sure others lost many more, the biggest bummer here is that NiceHash is/was a great idea and service that will be forever tarnished.
- wbkang 9y ago
  Yeah same here I lost about a week worth of mining since Friday was their payout day. Thankfully i used my own wallet for payout so the damage is limited.
  - sundvor 9y ago
    Your rig is bigger than mine. Have been mining on and off for two months on my 1080TI to my own address (mainly overnight as days have been hot in Australia) and was just moments away from reaching the 0.01BTC payout threshold. Glad I didn't trust them to use their wallet system - those are the ones who'd really get burned by this, if NH can't recover. They really need to lower the minimum payout limit, or set that you can pay out e.g. every two weeks.
    - joshvm 9y ago
      Same here, I had about 0.008 'saved' - kinda irritating. On the other hand, the profitable mining algorithms didn't really change much for me (cryptonight, kekkak, lyra2re), so you'd be better off just doing it on your own and then trading on an exchange. I'm not sure which coins exactly were being mined, but you can check here: http://whattomine.com http://whattomine.com
      - sundvor 9y ago
        Cheers; having a go of AwesomeMiner now and numbers are looking good. Pretty sure they'll claim somehow that the money they hadn't paid me is not their responsibility and if that happens there's no way I'm going back to NH.
- FLUX-YOU 9y ago
  The fact that anyone still trusts Bitcoin services after all of the hacks still floors me.
  - mizzack 9y ago
    It's a nature of their payout structure caused by high bitcoin tx fees. Payout happens in rounds. I didn't lose a penny of cash as a seller, but hash buyers did.
    - altern8tif 9y ago
      Depending on whether you used their internal wallet (which they heavily incentivised), sellers might have lost their earnings in BTC from selling their hashpower.
  - sudouser 9y ago
    Same thought here, there are millions and millions lost every week
- gt_ 9y ago
  ~$120 here. I will stick with mining Zcash now.
H99189 9y ago
"We are working to verify the precise number of BTC taken." How is this not a simple task?
- ktta 9y ago
  Seems like it was about $65 million from various comments on reddit. Address - https://blockchain.info/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh1mB4rq https://blockchain.info/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh...
  - watoc 9y ago
    There might very well be other addresses used to transfer the stolen Bitcoins.
- 6d6b73 9y ago
  They probably need to contact lawyers first
ktta 9y ago
There's some discussion going on a reddit thread, and people there seem to think this is an inside job https://www.reddit.com/r/NiceHash/comments/7i0s6o/official_press_release_statement_by_nicehash/ https://www.reddit.com/r/NiceHash/comments/7i0s6o/official_p...
- pjc50 9y ago
  One of the great things about bitcoin is that unless someone confesses we'll probably never know if it was an inside job. Do we even know who runs nicehash and in which country?
  - adrr 9y ago
    I always wondered how the hackers can get the money out of bitcoins to a fiat currency without exposing who they are. If they transfer it to an exchange, the exchange will know where the bitcoins came from being that transactions are open for everyone to see.
    - pmorici 9y ago
      In the case of past thefts high level executives of a Bitcoin exchange were in on the hack and facilitated laundering the stolen coins. https://www.reuters.com/article/us-greece-russia-cyber-extradition/greek-court-clears-u-s-extradition-of-russian-bitcoin-fraud-suspect-idUSKCN1C90QR https://www.reuters.com/article/us-greece-russia-cyber-extra...
    - ktta 9y ago
      They usually don't. They just stay in the attacker's addresses. I would say the best way to go would be to using bitcoin mixing services, but then the attacker would open themselves upto a huge risk of getting caught if the mixing wasn't perfectly secure, when they eventually go to an exchange.
    - volker48 9y ago
      There are a few ways I can think of. The first address they send the hacked coins to (a1) will most likely be black listed by some exchanges. However, the hackers could create thousands of new addresses and transfer the coins from a1 to the new addresses. Then do that again. All exchanges would have to monitor all addresses that a1 ever sent coins to. They could do this, but I'm not sure how many exchanges would actually do this. All it takes is one exchange to accept the hacked coins then the hacker can sell the BTC for something like ETH. Another option would be OTC trades, but that would take a really long time to sell 4000 BTC.
provost 9y ago
> Importantly, our payment system was compromised and the contents of the NiceHash Bitcoin wallet have been stolen. We are working to verify the precise number of BTC taken. That should be easy to find via the transactions. Are they still in your wallet? What's the address? If they are still in there, then use a backup key to move the BTC now. Do you have a backup of the keys? Being that it is connected to a payment system, it's surely the hot-wallet. No mention of a cold-wallet makes it seem they've been completely wiped. Multi-edit: Stream of consciousness
- dragontamer 9y ago
  Various people online suggest its this wallet: https://bitinfocharts.com/bitcoin/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh1mB4rq https://bitinfocharts.com/bitcoin/address/1EnJHhq8Jq8vDuZA5a... 4,736.42 BTC transferred.
exhilaration 9y ago
Can someone explain what NiceHash is/was? I'm guessing an online Bitcoin wallet but there no longer seems to be any content on their website to verify that.
- Tbeiko 9y ago
  No, it's a mining pool. If you have a miner, you can direct it to Nicehash, and it gives you a proportion of all the pool's mining rewards. This way, it reduces the variance of rewards for individual miners, who may otherwise go months before mining an actual block.
  - dylz 9y ago
    It's not quite a mining pool. You don't solve shares and get it back tied to that share. You sell computing power for $x/hr, and you get paid $x-%/hr, as two completely unlinked things.
- dgacmu 9y ago
  A multi-pool: you point your miner at them and they switch automatically to the coin with the highest expected profit to mine. They pay miners in BTC. On the other side, they let people bid on mining power to direct to coins of their choice.
  - tellism 9y ago
    As others have pointed out, it's not a pool. They're a service for connecting people with miners to people who want to mine something. They're a hash reseller. A user bids for mining power and where they want it assigned. Miners post rates they're willing to mine at.
- ixacto 9y ago
  Nicehash is a bitcoin mining hash reseller. You could download their client and mine whatever cryptocoin was most profitable (ETH/BTC/LTC...) and get paid in bitcoin. Actually quite easy to use. But they just got hacked for $52million...
- deleted 9y ago
deleted 9y ago
[deleted]
nikanj 9y ago
It’s really scary in Bitcoin land. Either you store your coins online and worry about hackers, or you store them offline and worry about burglars, fires, etc. I’m starting to appreciate the government enforced protections a traditional bank account provides.
- Johnny555 9y ago
  If you can store it offline, why can't you just store it online in an encrypted file using a strong encryption key?
  - codewithcheese 9y ago
    A bitcoin 'wallet' is a strong encrypted key. The question is where do you keep that key.
  - cdancette 9y ago
    But where do you store the key?
    - Johnny555 9y ago
      In my head? The same place I store the passphrase to my password manager.
      - brucen 9y ago
        With no backup? What if you suffer a massive head trauma (or an unfortunate death), no way to recover your millions of dollars for friends and relatives? I'm guessing people put this stuff in their wills these days, how secure is a will?
        Johnny555 9y ago
        I have an encrypted file with online banking passwords, account numbers, etc for my wife. It's on a USB stick in our fire safe, and also in our safe deposit box along with a passphrase hint that my wife or daughter would understand, but is not obvious to an outsider.
didibus 9y ago
Is it possible to know with those breaches if it was truly stolen by a hacker, or if it was stolen by them or someone internal?
quadcore 9y ago
I dont think reddit is reliable here. Some redditor shows up and affirm he has the hacker btc address. How come he knows that. Im supprised bloomberg report the 63$ million number as it seems very weak sourced.
- lasc4r 9y ago
  Bitcoin transactions are done on a distributed ledger that everyone can see. 4700BTC went from NiceHash -> Hacker
  - quadcore 9y ago
    I know but how do you get what's at the left of the arrow exactly?
fpgaminer 9y ago
It looks like people are saying ~4000 BTC got stolen. That's ... an incredible amount of coin to be stored on the service. I would never have thought NiceHash had that much usage. Not that I thought NiceHash's usage was low, but ... well let's put this into perspective. Only 1,800 BTC are mined on Bitcoin per day. Now, NiceHash is _not_ a Bitcoin mining pool; they just pay out in Bitcoin. But that should give some perspective as to the magnitude of funds NiceHash was playing with. I've seen some people mention cold storage, etc. NiceHash isn't a service for storing coin. The intended usage is to only keep your (the user) profits on there long enough that it exceeds their minimum withdrawal limits. I'm sure some people leave coins on there for a bit longer, to reduce the % of their profits consumed by TX fees. But, for most intents and purposes, the funds on NiceHash are 100% hot funds. So we're talking about 4,000 BTC of _hot_ funds. It's hard to fathom what their user base must be. It'd be like walking into a department store and finding out they have $56 million in their cash registers; not for any other reason than that they have enough business to justify it.
- SilverSlash 9y ago
  I'm not very familiar with how crypto currencies work but when such an incident happens, how hopeful can the company be that they will get their BTC's back? I ask because they're saying on their reddit thread that they are working towards "solving this issue". What does that mean here?
  - grufftech 9y ago
    almost zero, unless they have verifiable evidence that the funds were seized by someone internal, and can somehow exact the wallet's private keys from said individual.
- twelve40 9y ago
  weren't they pretty transparent by definition? if you are listing X offers of Y hashrates, all this data is public... or was public anyway until they put up that placeholder.
- Kiro 9y ago
mlamat 9y ago
The Slovenian media is reporting that the majority owner of NiceHash is the father of the programmer who created the Butterfly bot (Mariposa botnet) and got busted by the FBI. I heard he taught as an assistant at the CS school I went to some time ago.
pknerd 9y ago
What are best multi currency offline or hardware wallet options to store various alts? I hold Eth, Ark, Strats, PAY and a few more.

169 points by 6d6b73 9y ago

Even though I lost ~$500 here and I'm sure others lost many more, the biggest bummer here is that NiceHash is/was a great idea and service that will be forever tarnished.

wbkang 9y ago
Yeah same here I lost about a week worth of mining since Friday was their payout day. Thankfully i used my own wallet for payout so the damage is limited.
- sundvor 9y ago
  Your rig is bigger than mine. Have been mining on and off for two months on my 1080TI to my own address (mainly overnight as days have been hot in Australia) and was just moments away from reaching the 0.01BTC payout threshold. Glad I didn't trust them to use their wallet system - those are the ones who'd really get burned by this, if NH can't recover. They really need to lower the minimum payout limit, or set that you can pay out e.g. every two weeks.
  - joshvm 9y ago
    Same here, I had about 0.008 'saved' - kinda irritating. On the other hand, the profitable mining algorithms didn't really change much for me (cryptonight, kekkak, lyra2re), so you'd be better off just doing it on your own and then trading on an exchange. I'm not sure which coins exactly were being mined, but you can check here: http://whattomine.com http://whattomine.com
    - sundvor 9y ago
      Cheers; having a go of AwesomeMiner now and numbers are looking good. Pretty sure they'll claim somehow that the money they hadn't paid me is not their responsibility and if that happens there's no way I'm going back to NH.
FLUX-YOU 9y ago
The fact that anyone still trusts Bitcoin services after all of the hacks still floors me.
- mizzack 9y ago
  It's a nature of their payout structure caused by high bitcoin tx fees. Payout happens in rounds. I didn't lose a penny of cash as a seller, but hash buyers did.
  - altern8tif 9y ago
    Depending on whether you used their internal wallet (which they heavily incentivised), sellers might have lost their earnings in BTC from selling their hashpower.
- sudouser 9y ago
  Same thought here, there are millions and millions lost every week
gt_ 9y ago
~$120 here. I will stick with mining Zcash now.

H99189 9y ago

"We are working to verify the precise number of BTC taken." How is this not a simple task?

ktta 9y ago
Seems like it was about $65 million from various comments on reddit. Address - https://blockchain.info/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh1mB4rq https://blockchain.info/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh...
- watoc 9y ago
  There might very well be other addresses used to transfer the stolen Bitcoins.
6d6b73 9y ago
They probably need to contact lawyers first

ktta 9y ago

There's some discussion going on a reddit thread, and people there seem to think this is an inside job https://www.reddit.com/r/NiceHash/comments/7i0s6o/official_press_release_statement_by_nicehash/ https://www.reddit.com/r/NiceHash/comments/7i0s6o/official_p...

pjc50 9y ago
One of the great things about bitcoin is that unless someone confesses we'll probably never know if it was an inside job. Do we even know who runs nicehash and in which country?
- adrr 9y ago
  I always wondered how the hackers can get the money out of bitcoins to a fiat currency without exposing who they are. If they transfer it to an exchange, the exchange will know where the bitcoins came from being that transactions are open for everyone to see.
  - pmorici 9y ago
    In the case of past thefts high level executives of a Bitcoin exchange were in on the hack and facilitated laundering the stolen coins. https://www.reuters.com/article/us-greece-russia-cyber-extradition/greek-court-clears-u-s-extradition-of-russian-bitcoin-fraud-suspect-idUSKCN1C90QR https://www.reuters.com/article/us-greece-russia-cyber-extra...
  - ktta 9y ago
    They usually don't. They just stay in the attacker's addresses. I would say the best way to go would be to using bitcoin mixing services, but then the attacker would open themselves upto a huge risk of getting caught if the mixing wasn't perfectly secure, when they eventually go to an exchange.
  - volker48 9y ago
    There are a few ways I can think of. The first address they send the hacked coins to (a1) will most likely be black listed by some exchanges. However, the hackers could create thousands of new addresses and transfer the coins from a1 to the new addresses. Then do that again. All exchanges would have to monitor all addresses that a1 ever sent coins to. They could do this, but I'm not sure how many exchanges would actually do this. All it takes is one exchange to accept the hacked coins then the hacker can sell the BTC for something like ETH. Another option would be OTC trades, but that would take a really long time to sell 4000 BTC.

provost 9y ago

> Importantly, our payment system was compromised and the contents of the NiceHash Bitcoin wallet have been stolen. We are working to verify the precise number of BTC taken. That should be easy to find via the transactions. Are they still in your wallet? What's the address? If they are still in there, then use a backup key to move the BTC now. Do you have a backup of the keys? Being that it is connected to a payment system, it's surely the hot-wallet. No mention of a cold-wallet makes it seem they've been completely wiped. Multi-edit: Stream of consciousness

dragontamer 9y ago
Various people online suggest its this wallet: https://bitinfocharts.com/bitcoin/address/1EnJHhq8Jq8vDuZA5ahVh6H4t6jh1mB4rq https://bitinfocharts.com/bitcoin/address/1EnJHhq8Jq8vDuZA5a... 4,736.42 BTC transferred.

exhilaration 9y ago

Can someone explain what NiceHash is/was? I'm guessing an online Bitcoin wallet but there no longer seems to be any content on their website to verify that.

Tbeiko 9y ago
No, it's a mining pool. If you have a miner, you can direct it to Nicehash, and it gives you a proportion of all the pool's mining rewards. This way, it reduces the variance of rewards for individual miners, who may otherwise go months before mining an actual block.
- dylz 9y ago
  It's not quite a mining pool. You don't solve shares and get it back tied to that share. You sell computing power for $x/hr, and you get paid $x-%/hr, as two completely unlinked things.
dgacmu 9y ago
A multi-pool: you point your miner at them and they switch automatically to the coin with the highest expected profit to mine. They pay miners in BTC. On the other side, they let people bid on mining power to direct to coins of their choice.
- tellism 9y ago
  As others have pointed out, it's not a pool. They're a service for connecting people with miners to people who want to mine something. They're a hash reseller. A user bids for mining power and where they want it assigned. Miners post rates they're willing to mine at.
ixacto 9y ago
Nicehash is a bitcoin mining hash reseller. You could download their client and mine whatever cryptocoin was most profitable (ETH/BTC/LTC...) and get paid in bitcoin. Actually quite easy to use. But they just got hacked for $52million...
deleted 9y ago

deleted 9y ago

[deleted]

nikanj 9y ago

It’s really scary in Bitcoin land. Either you store your coins online and worry about hackers, or you store them offline and worry about burglars, fires, etc. I’m starting to appreciate the government enforced protections a traditional bank account provides.

Johnny555 9y ago
If you can store it offline, why can't you just store it online in an encrypted file using a strong encryption key?
- codewithcheese 9y ago
  A bitcoin 'wallet' is a strong encrypted key. The question is where do you keep that key.
- cdancette 9y ago
  But where do you store the key?
  - Johnny555 9y ago
    In my head? The same place I store the passphrase to my password manager.
    - brucen 9y ago
      With no backup? What if you suffer a massive head trauma (or an unfortunate death), no way to recover your millions of dollars for friends and relatives? I'm guessing people put this stuff in their wills these days, how secure is a will?
      - Johnny555 9y ago
        I have an encrypted file with online banking passwords, account numbers, etc for my wife. It's on a USB stick in our fire safe, and also in our safe deposit box along with a passphrase hint that my wife or daughter would understand, but is not obvious to an outsider.

didibus 9y ago

Is it possible to know with those breaches if it was truly stolen by a hacker, or if it was stolen by them or someone internal?

quadcore 9y ago

I dont think reddit is reliable here. Some redditor shows up and affirm he has the hacker btc address. How come he knows that. Im supprised bloomberg report the 63$ million number as it seems very weak sourced.

lasc4r 9y ago
Bitcoin transactions are done on a distributed ledger that everyone can see. 4700BTC went from NiceHash -> Hacker
- quadcore 9y ago
  I know but how do you get what's at the left of the arrow exactly?

fpgaminer 9y ago

It looks like people are saying ~4000 BTC got stolen. That's ... an incredible amount of coin to be stored on the service. I would never have thought NiceHash had that much usage. Not that I thought NiceHash's usage was low, but ... well let's put this into perspective. Only 1,800 BTC are mined on Bitcoin per day. Now, NiceHash is _not_ a Bitcoin mining pool; they just pay out in Bitcoin. But that should give some perspective as to the magnitude of funds NiceHash was playing with. I've seen some people mention cold storage, etc. NiceHash isn't a service for storing coin. The intended usage is to only keep your (the user) profits on there long enough that it exceeds their minimum withdrawal limits. I'm sure some people leave coins on there for a bit longer, to reduce the % of their profits consumed by TX fees. But, for most intents and purposes, the funds on NiceHash are 100% hot funds. So we're talking about 4,000 BTC of _hot_ funds. It's hard to fathom what their user base must be. It'd be like walking into a department store and finding out they have $56 million in their cash registers; not for any other reason than that they have enough business to justify it.

SilverSlash 9y ago
I'm not very familiar with how crypto currencies work but when such an incident happens, how hopeful can the company be that they will get their BTC's back? I ask because they're saying on their reddit thread that they are working towards "solving this issue". What does that mean here?
- grufftech 9y ago
  almost zero, unless they have verifiable evidence that the funds were seized by someone internal, and can somehow exact the wallet's private keys from said individual.
twelve40 9y ago
weren't they pretty transparent by definition? if you are listing X offers of Y hashrates, all this data is public... or was public anyway until they put up that placeholder.
Kiro 9y ago

mlamat 9y ago

The Slovenian media is reporting that the majority owner of NiceHash is the father of the programmer who created the Butterfly bot (Mariposa botnet) and got busted by the FBI. I heard he taught as an assistant at the CS school I went to some time ago.

pknerd 9y ago

What are best multi currency offline or hardware wallet options to store various alts? I hold Eth, Ark, Strats, PAY and a few more.