Bitstamp problem and warm wallets

We are publishing an exciting report on Peatio exchanger soon and I've got quite a few thoughts on how to make exchangers' architecture and wallets more secure.

Then I see this. Five. Million. Dollars. In a hot wallet.

Ok, sure it's not everything they had. It's a small part of their assets. But I'm not going to believe this hack is not a big deal for them. I bet they are a little bit upset right now.

Bitcoin exchangers must understand one simple thing: you're going to be hacked. That's the truth you have to accept and build your entire architecture around this axiom (think of Erlang's fault tolerance "let it fail") . And your business shouldn't collapse after it.

Bitstamp clearly wasn't ready to be hacked. That's the point.

The following idea might be useful for all medium-sized+ exchangers:

The warm wallet application is an application on a separate server with only one API call exposed to main application: createWithdraw. This dramatically reduces attack surface. Ideally someone should create, thoroughly audit and open source such app, so any exchange with any stack would benefit from using it.

Another thing warm wallet should do is basic calculation of your total assets: bitcoins, fiat and payment systems. Previously btc-e's private key was bruteforced, attackers "stuffed" the exchanger with fake "add funds" requests and it costed them over 4000 BTC. Before every major withdrawal it must reaudit all exchanger's assets to ensure 2+2=4.

With warm wallet system the attackers have to hack application server first. Then they have to hack the warm wallet app which, surprise, has only 1 API call. They know nothing else about the warm wallet. After hours of playing around they will steal your tiny hot wallet and your admin will patch the hole.

If you want to successfully run an exchanger you need to deal with the fact Bitcoin apps are now target #1 for cyber criminals:

1. While blockchain is not exactly anonymous, it's nearly impossible to track the stolen money. You cannot get them back. Ever.
2. Most apps were written by "web developers" (read "amateurs"), not enterprise-level bank engineers (i'm not stating those are any better but they at least know what transaction is).
3. Do you know how to make a bitcoin exchanger's developer cry? Say "race condition".
4. The result of attackers' work is money. Not passwords, not l33t deface or private data on pastebin. Just cash. Awesome!

This post makes an assumption Bitstamp didn't have a warm wallet-like system. The breach details are not public yet.

If you have any questions contact our security firm