The Ledger Labs document said the tokens accessed by the hacker were associated with a generic “admin” email address and another linked to “giancarlo,” belonging to Bitfinex CFO and shareholder Giancarlo Devasini, a former Italian plastic surgeon with a checkered business history. The document did not lay blame for the hack with Devasini.
Devasini did not respond to multiple requests for comment.
The document said that storing multiple keys and tokens on a single device was “a violation of the CryptoCurrency Security Standard,” referring to an industry-led best-practice initiative, though it is unclear whether this specific device was the one compromised in the hack. It said other basic security measures were also absent, including the logging of server activity outside of the server itself and a “withdrawal whitelist”—a security feature that permits cryptocurrency transfers only to verified or approved addresses.
Bitfinex told OCCRP the analysis was “incomplete” and “incorrect” and that there was “evidence of negligence…on the part of other counterparties that led to the hack.” Bitgo declined to comment. Ledger Lab did not respond to a request for comment.
The hacker covered their tracks with a data destruction tool, used to permanently delete logs and other digital artifacts that might have identified the initial entry point into Bitfinex systems, meaning it’s not clear how they got into the exchange’s systems, only the security weaknesses that they took advantage of once inside. The transfer of the more than 119,000 bitcoins from over 2,000 users’ accounts to wallets under the thief’s control took just over three hours. The cryptocurrency sat there for months until, starting in January 2017, someone started sending small amounts zig-zagging through other accounts. The money was eventually cashed out or used to make small online purchases.
Investigators managed to follow the money and, six years after the hack, arrested the couple on charges of laundering the stolen bitcoins. Burner phones, fake passports, and USB sticks containing the electronic security keys to the wallet holding $3.9 billion worth of bitcoin were found under the couple’s bed in their New York apartment. Both have pleaded not guilty, and are awaiting trial.
It is unclear whether the lessons from the Bitfinex hack have led to changes in the company’s procedures. The company told OCCRP that the report was “incorrect” and that there was “evidence of negligence…on the part of other counterparties that led to the hack.” Bitgo declined to comment.
Karen A. Greenaway, a former FBI agent and cryptocurrency specialist, says she thought Bitfinex’s security lapses were due to its desire to “put through more transactions more quickly” and thereby raise profits. “The fact that [Bitfinex] have not provided a [public] report accepting responsibility and remedying the security failures that led to the hack says more than any admission or denial on their part ever would,” the agent said.
Security experts say that the crypto industry is in general less vulnerable to the kind of relatively straightforward hacks that were happening around the time of the Bitfinex breach, but that the size and complexity of the industry has grown dramatically since then.