History cannot predict, but it can reveal risk · 2012

Bitcoinica's Three Breaches: The Warning That Was Not Enough

Bitcoinica suffered three major incidents within a few months. The central question is why the first warning left room for a second failure—and why the aftermath of the second opened a path to the third.

First incident: 43,554 BTC

On March 1, 2012, an intruder accessed several Bitcoin-related customer accounts at hosting provider Linode. Bitcoinica's infrastructure was among the targets.

The next day, founder Zhou Tong reported a loss of 43,554 BTC and published the suspicious transaction IDs. The company said accumulated profits would cover customer losses.

The loss was acknowledged and reimbursement promised. But the larger question remained: why was so much BTC reachable through a hosting account?

Reimbursement does not repair architecture

Covering a loss can temporarily restore confidence, but it does not remove the cause. A compromise requires a fresh review of keys, servers, backups, passwords, external services, and large-withdrawal controls. Hidden access may survive the visible incident.

Second incident: 18,547 BTC

On May 11, Bitcoinica stopped again after finding a transaction for 18,547.66867623 BTC that, according to the platform, no owner had initiated. Its servers were now hosted by Rackspace, which was asked to lock down the infrastructure.

An early statement said more than 80% of BTC had been offline. The reachable remainder was still enough for an enormous loss. “Most is in cold storage” says nothing about whether the hot remainder is safely sized.

The platform lost more than BTC

The condition of Bitcoinica's database and customer balances became a serious issue after May. A custodian must preserve two separate things: control of the assets and an accurate record of what it owes each customer.

The blockchain can show how much BTC left an address, but not how the platform should distribute what remains. Incomplete internal records turn repayment into a separate crisis.

The third incident came after shutdown

Bitcoinica did not return to normal operation after the second breach. A claims process began. Yet on July 13, another unauthorized access was announced, this time involving Bitcoinica's Mt. Gox account and a reported withdrawal of 40,000 BTC.

The published account pointed to reused secrets. A password-manager password matched a previously compromised access credential. Some data had changed after the earlier incident, but a connected secret remained exposed.

Trading had stopped, but accounts and assets still existed—and therefore remained targets.

Changing people does not erase old access

Responsibility moved among the founder, investors, consultants, and prospective liquidators. Every handover raised questions: who knew the passwords, who controlled the keys, which copies remained, and who was authorized to move funds?

A new team does not inherit a clean system. It inherits every unknown decision made before it. Without a complete access inventory, control cannot be shown to have truly changed.

The Bitcoin network kept working

None of these incidents was a breach of the Bitcoin protocol. The network continued to verify signatures and record valid transactions. A transfer signed with an available key is valid to the blockchain; it cannot know whether the company owner or an unauthorized person used that key.

There was no single failure

Large reachable balances, dependence on external services, reused secrets, incomplete post-incident review, complex handovers, and disputed internal records reinforced one another.

The first breach was a warning. The second showed that architecture and governance had not been fully rebuilt. The third demonstrated that old access can outlive the business itself.

The lesson for a BTC holder

Self-custody carries the risk of personal error. Custody by an intermediary replaces it with another risk: users cannot see how many people have access, how backups work, or whether old credentials were truly revoked. Depositing BTC means surrendering the ability to verify how it is held.

After a breach, changing one password is not enough. The entire chain of trust must be treated as compromised.

Historical and educational material. Some circumstances were publicly disputed; this article does not assign responsibility to an individual without a confirmed finding.