We are now in a position to offer our customers and the public updates on a few key areas associated with the security breach that occurred on August 2nd. Specifically, we want to provide you with preliminary information about the breach itself and about security enhancements that have been made to prevent its recurrence. We also need to give you some further background on the commitment of resources to the effort to satisfy outstanding customer losses through the tokens.
Ledger Labs Inc., a top blockchain forensics and technology firm, is undertaking an analysis of our systems to determine exactly how the security breach occurred and to make our system’s design better going forward. We engaged Ledger Labs in the hours immediately after the attack happened. The investigation is ongoing. We are also in the process of engaging Ledger Labs to perform an audit of our complete balance sheet for both cryptocurrency and fiat assets and liabilities [See footnote for update]*.
The exact attack vector is as yet unknown, but Ledger Labs has already identified certain areas in our architecture that can be improved. Ledger Labs is working closely with our development and operations personnel to ensure that all of their recommendations are understood and fully implemented. The key security breach, which allowed the amount of bitcoins released by BitGo to be increased without BitGo realizing it or alerting us, has been squarely addressed. We have currently suspended use of the BitGo segregated multi-signature wallet solution and have re-implemented robust and safe multi-signature cold storage procedures, with minimal coins exposed on our hot wallet. We are reassessing our storage options, both internally and with potential third party multi-sig vendors.
We would like to address some stories that have circulated online stating that management has contributed no property to compensating our customers. This is false. Management has committed all reserves of the business with a view to making our customers whole. Moreover, any principals and employees of the business with any property on Bitfinex were subject to the loss allocation. In point of fact, two out of the top ten BFX token-holders are in our management team. We assure everyone that we feel the loss acutely, both as a company and as individual customers.
However, we need to be clear that we have also, after committing those resources, held back certain amounts to pay our forensic investigators, to hire auditors and other advisors to work through these issues, to build our systems so that this security breach does not happen again, and for other contingent liabilities—all of which takes time and money. Our best efforts to repay customers can only bear fruit with the determination and resources to make it happen. We are committed to deploying all of our resources to getting this done. To the extent that reserves are not needed for these purposes, they will be used to redeem token-holders as quickly as possible.
We are actively engaged with efforts to convert certain qualifying token-holders to shareholders of Bitfinex and to redeeming the remaining BFX tokens through a combination of new capital and earnings. We have re-enabled most of the features on the platform and are deeply grateful to our customers, who continue to trade with and help us rebuild our brand. As always, we continue to listen to our customers and welcome their feedback, questions, and concerns.
We will continue to provide further updates as and when we are able.
The Bitfinex Team
* Update (4-5-17): Ledger Labs has not been engaged to perform a financial audit of Bitfinex. When in initial discussions with Ledger Labs in August 2016, we had initially understood that they could offer this service to us. Our discussions with Ledger Labs were continuing at the time of publication of this blog post. However, we should clarify that Ledger Labs’s role was limited to security and investigative services related to the security breach. We understand that they do not offer auditing services to clients. We are in the process of engaging a reputable, third party accounting firm to audit our balance sheet, but this continues to take longer than anticipated and than we would want. We apologize for any confusion in this matter.