Community post

Tracking the BitFinex Heist

Last week, 119,754 BTC worth around $80 million USD were stolen from the BitFinex exchange in what was probably the second biggest Bitcoin theft of all time.

Yesterday their Director of Community Zane Tackett posted a list of the transactions made by the thief.

I was curious to check whether any of the coins had been spent since the theft, and also wanted to check that the published total was correct. So I made a new Bitcoin Core wallet and imported all the theft addresses as "watchonly". After rescanning the blockchain all the transactions showed up. I was surprised to find that not a single Bitcoin has been spent yet:

wallet overview

Here's the wallet sorted by amount, showing the biggest thefts at the top. The thief rather sensibly emptied the biggest accounts first, so we see the biggest thefts at around 2am:

sorted by amount

And here it is sorted by date, showing the newest transactions first. Notice the top 5 transactions are all tiny. They were likely made by victims of the theft in an attempt to track their coins. Other than those 5 we see the smallest thefts (around 4 BTC each) happening 3 hours later, at 5am. The whole theft took 3 hours to complete, although it is possible that most of that time was spent waiting for confirmations:

sorted by date

I have made a copy of the wallet available for download if you want to load it into your own Bitcoin Core client to monitor for future spends. If I see the coins start to move I will make another post about it, and link to it from here.

Edit: I don't know if it matters or not, but I made the wallet using a release candidate of version 0.13 of Bitcoin Core. I wouldn't be totally surprised if the wallet.dat is incompatible with earlier versions of the client.

Edit2: I was asked how I made the 'watchonly' wallet. I put a list of all the addresses I wanted to watch into a file, then did this:

cat address.txt | while read x; do
    echo  $x; bitcoin-cli importaddress$ x '' false
done

The false causes the client not to rescan the blockchain after adding each address. At the end I did this to cause it to rescan the blockchain:

bitcoin-cli importaddress $x '' true

Replies (34)

My bitcointalk profile has a Bitcoin address of mine, and here's a signed message using it:

> signmessage 1Doog7asLrYah3yeUppBVj8nUYnFkmXm2N \
    'dooglus on bitcointalk, reddit, bitcoin-otc.com, and steem are all the same dooglus'
G1XjLn9Y9/y5Wby+6q21SmPAxyriiaUcWjf9KHrlPMRLAMiZfNeY4j5QDopDl2bmAG81w4TJO5hkE59dlJeVWW0=