Bitcoin Payment Processor BitPay Loses $1.8M in Phishing Hack

1. CFO is using Gmail without 2-factor authentication<p>2. CFO enters his Google credentials on a random website<p>3. CEO takes CFO e-mail as valid without checking for the existence and verifying a PGP signature<p>4. CEO sends Bitcoin for an existing customer to a new address he got by e-mail rather than to the established one<p>On the positive side, the CEO eventually sought confirmation from the customer.

So many screw ups here because of bad or no company policy. It&#x27;s hard to feel bad for these guys. No live&#x2F;voice confirmation between the CEO and CFO during the transfer of <i>$700,000 worth</i> of Bitcoins? No confirmation with the purchaser? No two factor authentication on their Google accounts?<p>Sorry for your loss BitPay, but that&#x27;s on you.

The legal case about whether the insurer must pay the claim is pretty interesting. The insurer&#x27;s position is that hack was pure social engineering and that no systems were compromised - everything operated as it should.<p>That&#x27;s correct, but the effect was the same as a system hack.

You would have thought they would have had systems in place to ensure that it would take more than just a simple email from the boss to transfer thousands of bitcoins.

I&#x27;ve used bitpay and liked their service. Seems like these social engineering hacks can happen to most anyone. Although Im suprised such emails wouldnt require a two-factor authenitication or at least a PGP-signature.

Been going through their compliance process recently and all of a sudden no response. Looks like they have their hands full. Can anyone recommend any alternatives to BitPay?

Theft has been a recurring problem with bitcoin and everyone ends up blaming the users or the institutions.

I don&#x27;t believe the story.

I know it&#x27;s kind of sad and I honestly wish all the luck to the BitPay guys - it&#x27;s not an easy situation. However, this is why we&#x27;ve built Mycelium Gear: we don&#x27;t hold merchant&#x27;s money at all and anyone who wants to accept Bitcoin and cares about privacy and security should consider using it: <a href="https:&#x2F;&#x2F;gear.mycelium.com" rel="nofollow">https:&#x2F;&#x2F;gear.mycelium.com</a>