Bitcoin community has been time and again rocked by hacking scandals and thefts in the six years of bitcoin’s inception. The latest addition in the list is Purse.io, a San Francisco based peer-to-peer service provider that connects users across the globe through decentralized commerce.
On Saturday, the company announced via blog post: “We have received word today of unauthorized password reset notification emails. We are aware of the issue and have secured all funds. All user balances are accounted for and upon completing our investigation, service will resume shortly.” and added “Purse is back online”.
The following day, in another post, Purse said that one of its third-party email service providers was compromised causing unauthorized password resets for some users. However, as the issue was detected soon enough, it was able to secure funds and reset tokens for affected users.
As a security measure, users who received unauthorized password reset emails will not be able to access their account until they contact support for further verification. Purse further said that hot / cold wallets and users with two factor authentication (2FA) were not affected. It urged all users to activate 2FA, and said that it is looking into making it mandatory.
“11 users were affected and 10.235 Bitcoin were withdrawn. All affected accounts have been reimbursed. Reports of accounts with 2FA being compromised are not accurate. Some users enabled 2FA after they received reset password emails. Accounts that were affected will soon regain access. We will publish technical details of the attack in the coming days”, it said.
Affected users took to Reddit to report their stolen bitcoins which ranged from less than 1 bitcoin to 36 BTC in one case.
One user going by the name Christophe_ said, “My account has been compromised too. Lost 2,6 btc :( ” and added, “Same method: I got an email to change my password, a withdrawal request and a withdrawal confirmation. I think someone is reading support@purse.io emails, in order to have the secret token for the reset password. I have sent 1 btc to my Purse wallet this morning, after not having used my account for over a month...”.
