LeakedSource has been at the forefront of many of the account breach disclosures. Recently they announced details about the breach of the last.fm page which showed that there had been 43 million account details which were compromised from an earlier 2012 hack. The website also said that they had several breaches and hacks to report, which will be published in bits every day.
The site said that it was going to take its time and publish the breaches once a day for the years to come. The site kept to its promise and has now released a new set of account breaches from Bitcoin, BTC-E.com and Bitcointalk.org, bitcoin exchange and Bitcoin discussion forum respectively.
Of the two, the Bitcointalk hack is already known because the organization’s Twitter account announced the hack back in May last year. In the tweet, the organization wrote that their server had been compromised after the social engineering of the ISP NFOrce.
There was further expansion of the hack by Theymos on Subreddit, which announced that the attacker had access to the server for 12 minutes before it was noticed and they had been kicked out. The attacker was not able to get hold of the entire database as a result. The website is said to have passwords which are hashed with 7,500 rounds of the SHA-56. They also contain a unique 12-byte salt.
According to data from LeakedSource, 499,593 accounts were actually compromised from the hack. The details which were part of the breach include usernames, passwords, birthdays, emails, secret questions, hashed secret answers and various other numerous internal data.
The site also confirmed that 91 percent of the passwords were actually encrypetd with the sha256crypt, and estimated that it would take anyone a year to decrypt close to 60-70 percent of the passwords. The site said that 9 percent of the remaining passwords were actually salted with a unique salt and hashed with the MD5, and LeakedSource had already managed to break into 68 percent of those passwords.
However, details about the BTC-E.com are the ones which are not clear at the moment. It might also be more serious because of the finance aspect such as wallets and bitcoins which might be involved in the hack.
Fortunately, LeakedSource says they have not encountered cases where users have complained about losing their bitcoins or suffering a financial loss. Only one hack of the site is known at the moment, and in January 2016 the Financial Underground Kingdom blog noted that there was only one known hack of the BTC-E.com site of which they had compensated all users who had lost something.
What is unclear at the moment is whether the hacking incident back then and that which LeakedSource is revealing might be the same thing. LeakedSource announced that site had had 568,355 of its users hacked back in October 2014.
They also noted that there was an unknown hashing method used on the passwords which made them hard to crack, but they noted that it wouldn’t take long to decipher them. They however noted that there were examples of cases whereby BTC-E users had complained of losing some of their bitcoins. This probably meant that there was someone out there who knew how the passwords were encrypted.
As always, be sure to practice good password management, and get yourself a powerful VPN.
