Hackers Have Stolen Millions Of Dollars In Bitcoin -- Using Only Phone Numbers...
Just after midnight on August 11, self-professed night owl Jered Kenna was working at home in Medellin, Colombia, when he was notified the passwords had been reset on two of his email addresses.
He tried to set up new passwords himself by prompting the email service to send him text messages containing a code — but they never arrived.
“So I called the company to make sure I hadn’t forgotten to pay my phone bill, and they said, you don’t have a phone with us. You transferred your phone away to another company,” he says. A hacker had faked his identity and transferred his phone number from T-Mobile to a carrier called Bandwidth that was linked to a Google Voice account in the hacker’s possession. Once all the calls and messages to Kenna’s number were being routed to them, the hacker(s) then reset the passwords for Kenna’s email addresses by having the SMS codes sent to them (or, technically, to Kenna’s number, newly in their possession). Within seven minutes of being locked out of his first account, Kenna was shut out of of up to 30 others, including two banks, PayPal, two bitcoin services — and, crucially, his Windows account, which was the key to his PC.
While this would wreak havoc on anyone’s life, it had especially disastrous consequences for Kenna. “I’m an early bitcoiner,” he says. “I don’t think you have to say anything else.”
Kenna was so early in bitcoin that he remembers when he would plug his computer into the network and see only four other computers running it. Now, there are more than 5,000. Computers supporting the network are slated into a competition to win bitcoin roughly every 10 minutes. In the early days, the payout was 50 bitcoin each time; now it’s 12.5. Kenna recalls that at a certain point, when he was “only” winning 50 bitcoins a day, he stopped supporting the network, thinking it wasn’t worth it. At today’s price, he was giving up on $40,000 a day.
Though he did have some bitcoins in online services, particularly since his businesses accept bitcoin as payment, he kept almost all his bitcoins on an encrypted hard drive. “It was essentially my never-sell-this-until-it-goes-to-a-billion-dollars nest egg,” he says. He had kept it offline for most of the past several years, but had connected that device in recent weeks to move them somewhere more secure and sell some. Though he had locked it with a 30-character password, the hackers moved the coins off. And unlike a credit card transaction, a transfer of a cryptocurrency is irreversible.
When asked how many bitcoins he lost, Kenna laughs. Confirming only that it was millions of dollars’ worth, he says, “I was one of the first people to actually do anything in bitcoin and I no longer have any bitcoin to speak of,” he says. “I’ve got, like, 60 coins or something, which is nothing compared to — it’s a fraction.”
Plus, he still does not have his number back. (T-Mobile declined to discuss individual customer cases.)
In a larger wave of bitcoin scams that have hit everyone from everyday people to hospitals, Kenna’s experience is only one of a spate of recent hackings of high-profile cryptocurrency industry players such as venture capitalists, entrepreneurs, C-level executives and others who have had their phone numbers hijacked, some of whom have also suffered financial losses, several of whom have been threatened or ransomed, and one of whom was put in physical danger.
Their experience is part of a larger trend. In January 2013, the Federal Trade Commission received 1,038 reports of these incidents, representing 3.2% of all identity theft reports to the FTC that month. By January 2016, 2,658 such incidents were filed — 6.3% of all such reports that month. There have been incidents involving all four of the major carriers.
While it’s difficult to put a number on the cryptocurrency hackings, Coinbase, the highest-volume U.S.-based cryptocurrency exchange, says it is on track to see double the number of such cases from November to December among its customers. Industry-wide, targets have included venture capitalists Adam Draper, Brock Pierce, Bo Shen and Steve Waterhouse, an unnamed executive at Coinbase, Gem chief executive Micah Winkelspecht, former Bitfury executive Michael Golomb, early Bitcoiner and entrepreneur Charlie Shrem, miner Joby Weeks, developer Joel Dietz, six affiliates of a decentralized prediction platform Augur, a database on the Ethereum forum, and others who declined to be named for fear of being further targeted.
While many of them did not take a financial hit, several did, with Kenna’s losses among the largest. Shen had $300,000 of his Augur REP tokens taken, plus an undisclosed amount of bitcoin and other cryptocurrencies. Weeks lost about $100,000 worth of bitcoin, and was cleaned out of his holdings in lesser known cryptocurrencies such as Ether, Ripple and Monero. Additionally, his friends also collectively gave the hacker, who posed as Weeks requesting to “borrow” money, $50,000 worth of cryptocurrency. (Weeks has introduced many people to bitcoin over the years by giving away what he claims is about 1,000 bitcoins, so his friends are well-versed in sending digital currency to each other.) Kenna and other victims also said their hackers have been hitting up friends for bitcoin and other virtual currencies.
But the security weakness being exploited here is not one that only affects cryptocurrency industry players — they are simply being targeted first because such transactions cannot be undone. The security loophole these hackers are milking can be used against anyone who uses their phone number for security for services as common as Google, iCloud, a plethora of banks, PayPal, Dropbox, Evernote, Facebook, Twitter, and many others. The hackers have infiltrated bank accounts and tried to initiate wire transfers; used credit cards to rack up charges; gotten into Dropbox accounts containing copies of passports, credit cards and tax returns; and extorted victims using incriminating information found in their email accounts