Hackers compromise Bitcoin site, make off with over $1 million in digital currency

It may no longer be safe to store Bitcoin, the digital currency that we have been hearing a lot about, on the Internet, according to an entrepreneur going by the name TradeFortress. The source, who is the founder of an inputs.io company which used to store Bitcoins in digital wallets for people around the world now says, “I don’t recommend storing any Bitcoins accessible on computers connected to the internet.”

While the idea of not being able to store digital currency on the Internet may seem a bit of an oxymoron, the source seems to know what he is talking about. According to a series of posts on the bitcointalk forum, the site run by TradeFortress was recently hacked, and more than a million dollars worth of Bitcoins have been reported stolen.

According to Wired, the site was first compromised on October 23, and again on October 26, with hackers making off with 4,100 Bitcoins worth $1.2 million in two separate attacks. The company waited until this week to notify customers of the attack, although the hack has only affected certain users. A small number of Bitcoins that belonged to the entrepreneur’s other business, CoinLenders, were also reported stolen, according to an email interview.

$1.2 million worth of Bitcoins, out in the open! (Image credit: Casascius)

Inputs.io does not have the funds to pay back everything that was stolen, but TradeFortress has said that he will be issuing partial refunds. According to the email interview, the entrepreneur said that, “I’m repaying with all of my personal Bitcoins, as well as remaining cold storage coins on Inputs, which adds up to 1540 BTC.”

He went on to say that this was a social engineering attack, essentially meaning that the attacker pretended to be someone else in order to gain access to the site’s systems on cloud-hosting provider Linode. Explaining this, he said, “The attack was done through compromising a chain of email accounts which eventually allowed the attacker to reset the password for the Linode server.”

The first step for the hacker was to recover an email address that TradeFortress set up six months ago. In the forum post, the inputs.io founder said, “The attacker rented an Australian server to proxy as close to my geographical location so it won’t raise alarms with email recoveries.” In a post on the company’s official website, TradeFortress said, “I know this doesn’t mean much, but I’m sorry, and saying that I’m very sad that this happened is an understatement.”