Bitcoin service provider Purse suffers user funds theft

Hacking scandals have plagued the digital currency world for at least three years, and they don’t seem to be stopping anytime soon.

Purse.io, a Bitcoin P2P service provider, has reportedly had some of its users’ Bitcoin funds stolen (officially 10.235 BTC), forcing the site to go offline for several hours on Sunday.

Purse users first saw the alert on the r/Bitcoin forum on Reddit, where many users said they received emails from Purse.io asking them to change their passwords. Soon after the users did so, their funds were withdrawn.

Purse.io's response so far: It shut down for a few hours for "maintenance," then published a blog post citing the security issue, saying:

“Current information leads us to believe that one of our third-party e-service providers was compromised and reset some users’ passwords without authorization. We quickly discovered this, secured funds, and reset tokens for affected users. All users’ funds are safe, and service has been restored.”

Aaronsta1 responded to other Purse.io users’ experiences on Reddit:

“I have 2FA enabled on my account. I received an email saying my bitcoin was withdrawn… When the site was offline, I was able to log in to change my password and saw my account showed 0.00. I contacted customer service via email and they responded to please be patient.”

Purse.io CEO Andrew Lee told CoinDesk that technical details of the attack will be released in the coming days, adding:

"Accounts that had 2FA enabled were not affected. Reports that 2FA accounts were affected were inaccurate. Some users enabled 2FA only after receiving a password reset email."

－－－－