Cyber Incident Victim: CoinWallet
Date:
Apr 2016
Location:
United States of America
Summary
A Bitcoin trading platform ceased operations following a cyber attack exploiting a vulnerability introduced through a service update, which allowed malicious code injection via an unfiltered user input field. This triggered unauthorized database manipulation, though secondary security measures prevented theft of customer funds. The incident compromised encrypted and salted user passwords, prompting advisories for password changes across other services using the same credentials. The breach eroded confidence in the platform's security sustainability, leading to its permanent shutdown and urgent user fund withdrawals. This marked the fourth consecutive Bitcoin service termination linked to cyber attacks within a short period, reflecting broader industry vulnerabilities highlighted by contemporaneous disruptions to other traders.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early April 2016, CoinWallet suffered a cyber attack linked to a recent service update intended to introduce new features. The update introduced an input field that lacked proper filtering mechanisms, allowing attackers to inject malicious code. This code executed on CoinWallet’s servers, triggering unauthorized database calls that manipulated the service. The breach was detected following abnormal system behavior, though the exact timeline between exploitation and discovery remains unspecified in public reports. CoinWallet confirmed no customer funds were stolen during the incident, attributing this to secondary security controls designed to block unauthorized transactions. The company acknowledged that while user passwords were encrypted and salted, they remained vulnerable to compromise and advised users to change passwords immediately, especially if reused elsewhere. This incident marked the fourth Bitcoin platform shutdown due to cyber attacks within a month, following Coinkite Inc.’s closure after sustained DDoS attacks.
The attack prompted CoinWallet’s owner to announce service termination by May 1, 2016, urging users to withdraw funds before the shutdown. The breach undermined the company’s confidence in its security model, citing unsustainable risks and operational costs. At the time of the incident, CoinWallet supported trading across 82 cryptocurrencies, including Bitcoin, Dogecoin, Cannabiscoin, Solarcoin, and Metalcoin. Its closure coincided with an April 7 attack on ShapeShift, another Bitcoin exchange that halted operations to rebuild its infrastructure. CoinWallet’s shutdown notice included an offer for potential acquisition, though no further details were provided. The incident highlighted recurring security vulnerabilities in cryptocurrency platforms during this period, with multiple services collapsing under attack pressures.