Customer Bitcoins Stolen in Purse Email Breach

Bitcoin startup Purse has disclosed that 10.235 BTC in customer funds were stolen over the weekend during a security incident.

AccessTimeIconOct 12, 2015 at 9:16 p.m. UTC
Updated Sep 11, 2021 at 11:56 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Bitcoin startup Purse said today that 10.235 BTC (roughly $2,500) in customer funds were stolen over the weekend during a security incident.

Eleven customers had their accounts emptied, according to Purse representatives, who reported they had covered the bitcoins withdrawn with company funds.

Claims that funds were stolen first emerged over the weekend, with customers reporting that they had received emails about password resets and withdrawals. Purse.io’s website was later taken offline for several hours.

The bitcoin-focused e-commerce company said on 11th October that it believed one of its email service providers had been compromised. At the time, the company said that "all funds are secure".

CEO Andrew Lee told CoinDesk that funds controlled by the company were temporarily moved into an offline wallet following the shutdown, including its profit accounts, while the team began investigating the thefts.

“We actively monitor our customer liabilities against the funds we control. During our downtime, we determined funds we control exceeded customer liabilities [and] the unauthorized withdrawals (10.235 BTC) implying user funds were secure," he said in an email. "Profit from one to two days was used to reimburse the withdrawals.”

Lee added that Purse “will publish technical details of the attack in the coming days”. He also denied reports that funds were stolen from accounts with active two-factor authentication (2FA).

“No accounts with 2FA enabled before the attack were affected. Reports of accounts with 2FA being compromised are not accurate. Some users enabled 2FA after they received reset password emails,” he said.

Theft image via Shutterstock

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.