BitMEX Says Quality Check 'Failure' Led to Email Privacy Breach
The crypto-derivatives exchange says poor internal checks caused most of the exchange's clients to be exposed to privacy risks.
BitMEX says its internal processes "failed" last week, subsequently exposing thousands of the exchange's clients to privacy risks.
In a company blog posting on Monday, the crypto-derivatives exchange said its mass emailing operation failed causing “most BitMEX users” to have their email addresses publicly exposed via carbon copy (CC) on Nov. 1.
Data provider Skew says BitMEX has some 22,000 daily users, though the number of email addresses exposed is likely significantly higher.
With major email servers imposing restrictions on bulk emailing, the firm said:
The exchange said it sends emails to all users very rarely, the last one of this size shipping in 2017. To expedite the process, the exchange's email systems API was changed at the last minute, but did not undergo the typical checking process.
“BitMEX is a global business that sends emails to many different email providers,” said deputy chief operating officer Vivien Khoo in the blog posting. “Unfortunately, this makes the job of large services such as BitMEX difficult at times.”
The exchange says it stopped further batches of emails being sent out upon recognition of the issue.
In response to the leak, BitMEX says they employed password resets and human review on endangered accounts. All users lacking two-factor authentication (2FA) and also holding account balances had passwords reset after the exchange noted hostile attempts to access accounts.
In an email to CoinDesk last Friday, Khoo reiterated that no other personal information was divulged.
BitMEX CEO Arthur Hayes image via BitMEX
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.
Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.