How was South Korean Bitcoin exchange Bithumb hacked?

Question

I've read a news article saying that a South Korean Bitcoin exchange had been hacked by someone. My question is: how does this happen? Isn't the Bitcoin network's cryptography safe enough to prevent these events?

Answer 1

The security of Bitcoin is unrelated to someone's Bitcoin wallet being hacked. The network provides the guarantee that given just the data on the blockchain, no one can get your private keys (assuming you haven't exposed them in some way on the blockchain). It does not secure anything related to the environment on which your private keys are stored on. If you were to store your private keys unencrypted on your computer, so long as no one can access your private keys, you would be fine. However your Bitcoin is not safe as if you were to get malware which finds your unencrypted wallet file and sends it to the malware authors, then your coins will be stolen. Your coins being stolen there is related to poor security practices on your computer, not with the Bitcoin network's security.

The same can happen to an exchange. If hackers were to get a backdoor onto the exchange's systems, they could steal the private keys and anything else necessary to access them (e.g. passwords or encryption keys). That the private keys were stolen has nothing to do with the Bitcoin network and everything to do with the exchange poorly securing their private keys.

Answer 2

Yes Bitcoin cryptography is safe enough. If Bitcoin's crytpography was ever hacked that would mean any website using hash functions (Bitcoin's cyptography) would also be open to attack including online banking, email hosts and pretty much most password encrypted sites. If you want your Bitcoin to be virtually impossible to steal you keep the private keys yourself, preferably off the internet, on a hardware or paper wallet.

Answer 3

I would disagree with both answers provided.

• How was the exchange hacked?

I did not read any statement, but if you google I am sure you will find something. If not, you could write them and ask them gently if they already know how it happened and if they could provide that information to the public so that other exchanges could close a potential risk.

• aren't bitcoin network cryptography safe enough to prevent from these events?

Your definition of "safe enough" is very unclear. By cryptography it is very safe, but like everything else, it can be cracked/hacked where the question would again lie only in mathematical calculations. Good example are different key generators, you can produce per second around 20K bitcoin private keys with an modern i7 cpu. There are also vanitypools and much, much more which is related to security and how to improve crypto in general. Other side are the theories, like that you would need really :) huge amount of time to get a private key for some specific address, the number is huge, however, in theory it is also possible that you will find that same key in just 1 second.

In most cases the biggest fault is user itself which is in most cases responsible for the loss, just like in real life, if you forget your wallet somewhere and it is gone 1 day later, then it is your fault that you've forgot your wallet.

Question was not asked, but I assume that many would ask: "How is then bitcoin secure?". Or "How is my address secure?"?

First of all, yes bitcoin is most secure cryptocurrency (depends on views). And yes, you can use many ways how to prevent theft or even the example above where somebody really does generete a key for your address.

One of the solutions which is a very good implemented Multisignatures feature. You can use it in different ways, ie. as 2FA, 3FA (Multifactorauthentification). If you use one address, set amount of number of addresses has to approve any transaction. In case above, attacker would have only 1 private key which would not be sufficient to do anything. Now those who really think, that there is a possibility that 2 keys are :) generetaed in some time, then you could use at least 3 addresses for any transaction.

We see clearly, it depends on the usecase. If I would store big amount of bitcoins somewhere, then I mostly do not move it that often, here is not a mistake to add even 50 multisigs if you will not touch it in years.

Exchanges use already different methods, including multisignature and theft should actually not be possible if staff is competent enough. Today, in IT most do not have really clue about crypto, just look at latest ransomware attacks which prove you how obsolete so many big companies are which have enough funds not to be obsolete.

You can read more about multisignature here: https://en.bitcoin.it/wiki/Multisignature