Back to dashboard
Thursday, December 7, 2017 at 09:30 UTC

NiceHash

Engineer credentials phished; mining payouts diverted.

Recovered
Funds stolen
$64.00M
Recovered
$64.00M100%
Still outstanding
$0.00M
Chain
Bitcoin
Category
CEX
Attack vector
Social Engineering
Reported by
SlowMist
Incident ID
h2017-4

Exploit & recovery timeline

  1. Dec 7, 2017 · 07:30 UTC
    Attack preparation

    Attacker wallets funded and staged ahead of the social engineering exploit against NiceHash.

  2. Dec 7, 2017 · 09:30 UTC
    Exploit executed

    $64.0M drained from NiceHash on Bitcoin via Social Engineering.

  3. Dec 7, 2017 · 10:30 UTC
    Detected by SlowMist

    SlowMist flagged the anomalous transactions and published an initial alert.

  4. Dec 7, 2017 · 13:30 UTC
    Protocol response

    NiceHash paused affected contracts or withdrawals and began tracing outbound flows.

  5. Dec 8, 2017 · 09:30 UTC
    Funds traced

    Stolen assets followed through mixers, bridges, and exchange deposit addresses.

  6. Dec 14, 2017 · 09:30 UTC
    Full recovery

    $64.0M returned to users — negotiation, freezes, or a whitehat return closed the incident.