The company that helps you chase down your money lost all its clients’ keys
A company that specializes in finding out “where the money went” lost every single one of its customers’ keys. Names, usernames, password hashes, and live login tokens. Every customer. Not one was spared.
The real trouble is those last four characters: tokens.
Password hashes have to be cracked. Tokens don’t. The moment you log in successfully, the server hands you a little piece of paper. Whoever has that paper is you. No cracking, no guessing—and it’s still valid.
It happened in October. The first notice came on the 30th, saying that only information it considered non-sensitive—IDs, names, and email addresses—had leaked. After a weekend, the investigation expanded the scope to everyone, but they didn’t correct the notice until Wednesday.
The company never explained why it stayed quiet for those two days. It only said they’d found and fixed the point of entry. Where that entry was, nobody knows to this day. Is that an explanation?
Then it simply shut down half its business. The login page, tracking dashboard, transaction monitoring, and address screening—all down at once. To restore access, customers had to submit their company’s fixed IP address for allowlisting, then change their passwords and rotate their keys.
A lot of people think on-chain analytics are inherently safe because the ledger is public. Only the ledger is public. The login server isn’t on the blockchain. It’s in a server room, and the logs show who went in.
If your withdrawal gets blocked and you’re asked for more documents, the decision may not have been made entirely by the exchange itself. Companies like this actually sell a database of labels: who owns each address, and how many times a particular sum of money has passed through intermediary addresses. When the database goes down, everything goes down.
The ledger for $BTC has been public since day one. Anyone can download the full dataset and run their own analysis. This business exists precisely because the ledger is public, while the people who interpret it are not.
Its client list includes Microsoft, Barclays, and the exchange $COINB . They didn’t lose anything themselves. What was lost was that piece of paper held by their supplier.
Bitcoin: 75774. Not much happening today. These kinds of incidents never show up on the price chart. They show up in the next compliance sign-off. I think the most expensive thing isn’t the data.
If your business is selling “I can tell you who this money belongs to,” then your most valuable asset is the fact that nobody got in. The database comes second. And that asset has no backup. You can’t restore it.
Any business that packages trust into a company and sells it will sooner or later run into trouble right here.
Because the ledger can be public, but the keys can only be locked in one room.
A company that specializes in finding out “where the money went” lost every single one of its customers’ keys. Names, usernames, password hashes, and live login tokens. Every customer. Not one was spared.
The real trouble is those last four characters: tokens.
Password hashes have to be cracked. Tokens don’t. The moment you log in successfully, the server hands you a little piece of paper. Whoever has that paper is you. No cracking, no guessing—and it’s still valid.
It happened in October. The first notice came on the 30th, saying that only information it considered non-sensitive—IDs, names, and email addresses—had leaked. After a weekend, the investigation expanded the scope to everyone, but they didn’t correct the notice until Wednesday.
The company never explained why it stayed quiet for those two days. It only said they’d found and fixed the point of entry. Where that entry was, nobody knows to this day. Is that an explanation?
Then it simply shut down half its business. The login page, tracking dashboard, transaction monitoring, and address screening—all down at once. To restore access, customers had to submit their company’s fixed IP address for allowlisting, then change their passwords and rotate their keys.
A lot of people think on-chain analytics are inherently safe because the ledger is public. Only the ledger is public. The login server isn’t on the blockchain. It’s in a server room, and the logs show who went in.
If your withdrawal gets blocked and you’re asked for more documents, the decision may not have been made entirely by the exchange itself. Companies like this actually sell a database of labels: who owns each address, and how many times a particular sum of money has passed through intermediary addresses. When the database goes down, everything goes down.
The ledger for $BTC has been public since day one. Anyone can download the full dataset and run their own analysis. This business exists precisely because the ledger is public, while the people who interpret it are not.
Its client list includes Microsoft, Barclays, and the exchange $COINB . They didn’t lose anything themselves. What was lost was that piece of paper held by their supplier.
Bitcoin: 75774. Not much happening today. These kinds of incidents never show up on the price chart. They show up in the next compliance sign-off. I think the most expensive thing isn’t the data.
If your business is selling “I can tell you who this money belongs to,” then your most valuable asset is the fact that nobody got in. The database comes second. And that asset has no backup. You can’t restore it.
Any business that packages trust into a company and sells it will sooner or later run into trouble right here.
Because the ledger can be public, but the keys can only be locked in one room.
