Flexicoin Bitcoin Bank and Poloniex Bitcoin Exchange hacked
“Users who put their coins into cold storage will be contacted by Flexcoin and asked to verify their identity,” the statement continues. “Once identified, cold storage coins will be transferred out free of charge. Cold storage coins were held offline and not within reach of the attacker. Flexcoin will attempt to work with law enforcement to trace the source of the hack.”
How Did It Happen?
The hacker found a vulnerability in the code that takes withdrawals. Here’s what happens when you place a withdrawal:1. Input validation.2. Your balance is checked to see if you have enough funds.3. If you do, your balance is deducted.4. The withdrawal is inserted into the database.5. The confirmation email is sent.6. After you confirm the withdrawal, the withdrawal daemon picks it up and processes the withdrawal.The hacker discovered that if you place several withdrawals all in practically the same instant, they will get processed at more or less the same time. This will result in a negative balance, but valid insertions into the database, which then get picked up by the withdrawal daemon.What Did Poloniex Do Wrong?The major problem here is that the auditing and security features were not explicitly looking for negative balances. They add deposits and withdrawals and check that accounts are in balance. If you have 2 BTC, withdraw 10 BTC, and are left with -8 BTC, the software would see that you deposited 2, withdrew 10, and have exactly what you should: -8.Another design flaw is that withdrawals should be queued at every step of the way. This could not have happened if withdrawals requests were processed sequentially instead of simultaneously.
“Please understand that this is an absolute necessity–if I did not make this adjustment, people would most likely withdraw all their BTC as soon as possible in order to make sure they weren’t left in that remaining 12.3%. Aside from the obvious drawback of most of the BTC being taken out of the exchange, this would not be fair–some people would get all of their money right away, and a few would get none right away.”