On April 7, the Shapeshift Bitcoin trader suffered a data breach during which the company's servers were accessible by an unauthorized party that appears to have stolen some funds, but nothing belonged to its customers.
Shapeshift CEO Erik Voorhees says the attackers only managed to escape with what the company calls a “hot wallet inventory fund.” This is its own stock of Bitcoin, which is used to make interim transactions until the real ones are approved.
In terms of design, Shapeshift is unique among all other Bitcoin traders because it does not require users to create accounts. The service allows users to transfer funds from one Bitcoin wallet to another using a universal trading dashboard
Because of this unique design, attackers were unable to steal money from users who use the Shapeshift service.
«By design, Shapeshift does not hold customers' balances, so that even in the event of a security breach, customers' funds are not at risk», said Mr. Voorhees. «We built consumer protection into our platform – hacks may be inevitable, but customer losses should not be. Not a single cent of customers' capital was lost, nor could it have been lost».
After the incident, Shapeshift staff took down the website and, just to be safe, decided to rebuild their entire infrastructure. No timeline has been given for when this operation will be completed.
Last March, a similar incident occurred at another Bitcoin, BitQuick, which was also forced to shut down for two to four weeks to upgrade its infrastructure. Even worse, after a series of intense cyberattacks, CoinKite decided to shut down its Web-based trading service and continue with its Bitcoin hardware instead.
Shapeshift had no intention of moving in this direction, but as its CEO made clear: the service will continue to operate. Before this breach, Shapeshift was one of the few services where users could also trade Ether, a new cryptocurrency that runs on the new Ethereum blockchain platform.
