Bitfinex Refutes Data Breach Allegations, Asserts No Evidence of Compromise

Hacking group Fsociety's alleged breach of cryptocurrency exchange Bitfinex's database and leak of customer data has been refuted by Bitfinex's chief technology officer, Paolo Ardoino. Ardoino asserts that the absence of ransom demands or evidence of database penetration casts doubt on the authenticity of the claims, further supported by the mismatch between the leaked data and Bitfinex user records.

Bitfinex Denounces Alleged Data Breach, Claims No Evidence of Compromise

London, May 5, 2023 - Bitfinex, a leading cryptocurrency exchange, has vehemently denied claims by hacking group Fsociety that it successfully breached its database and compromised customer data.

Paolo Ardoino, Bitfinex's chief technology officer, categorically dismissed the allegations as "fake" in a statement released on May 4. He emphasized that a genuine hacker would have contacted Bitfinex directly through its established channels, such as the bug bounty program, customer support, or social media platforms, to demand a ransom.

"We have meticulously examined our systems and found no evidence of any such request," Ardoino asserted.

He further clarified that Bitfinex employs robust security measures to protect user information. "We do not store plaintext passwords or 2FA secrets in clear text, ensuring that even if a breach were to occur, sensitive data would remain inaccessible," Ardoino explained.

Regarding the leaked data, Ardoino confirmed that only about 22% (approximately 5,000) of the 22,500 email and password combinations released by Fsociety actually match with Bitfinex user accounts. He suggested that the hackers likely aggregated data from multiple unrelated breaches and falsely attributed it to Bitfinex.

"Unfortunately, many users adopt the careless practice of using the same email address and password across various online services," Ardoino noted. "This makes it easier for malicious actors to compromise multiple accounts with a single successful attack."

Ardoino also cited information provided by a security researcher, who theorized that Fsociety's motive for fabricating the Bitfinex breach was to promote a data retrieval hacking tool.

"By creating a buzz around their supposed success in hacking high-profile companies and universities, they aim to showcase the capabilities of their tool and entice potential buyers to exploit vulnerabilities in target organizations," Ardoino explained.

Despite the allegations, Ardoino reassured users that Bitfinex is conducting a thorough investigation and has not detected any evidence of a breach to date. He emphasized that "all funds are safe" and urged users to remain vigilant against potential phishing attempts.

Bitfinex has faced scrutiny over data breach concerns in the past. In 2023, a customer support agent's compromised account led to phishing attacks targeting Bitfinex users, although the company reported minimal damage. More significantly, in 2016, Bitfinex suffered a major security breach resulting in the theft of approximately $70 million worth of Bitcoin, which would be valued at over $7.6 billion today.

Bitfinex remains committed to maintaining the highest levels of security for its customers and will continue to invest in its infrastructure and protocols to safeguard their data and assets.