The Negotiations Behind the Bter NXT Theft

As many of you are likely aware, there was a theft from the Chinese altcoin exchange Bter approximately a week ago. A thief somehow broke through their security and stole approximately 50MM NXT, the equivalent of about 3400BTC, or $1.7MM USD if you prefer to think in fiat.

After this happened, the thief attempted to ransom the NXT back to Bter. Why would they do this? Presumably because it’s easier than exchanging it all for BTC – they can’t just send the NXT to some other exchange and sell it, because the exchange could just freeze the hacker’s account. The thief has to transact his NXT into BTC off-exchange. Doing so might not be terribly fun.

As such, the ransom began.

A situation like this can be tricky. There are very, very few entities – if any at all – that both parties could consider trusted. The thief is unlikely to agree to escrow, because they are quite likely to get nothing – many potential agents would simply return all the funds to Bter (they are, after all, stolen). Bter likely won’t agree to any agent the thief would agree to – after all, the only thing worse than getting a huge amount of money stolen from you is getting even more money stolen from you. As a result, the only reasonable option is piece-by-piece payment. From here on, the story is going to be a little uncertain, as the details have not been completely released. This information comes from the NXT blockchain’s messaging function itself. Here’s a link to the hacked wallet – feel free to read some for yourself.

The exchange begins with Bter and the thief haggling over price. The thief demands 100 BTC, Bter offers 50. Bter threatens the thief if the situation doesn’t get resolved quickly. A bunch of random NXT accounts threaten the thief with a rollback, suggesting they return 90% of the stolen funds in order to prevent a rollback from occurring. Bter sends the thief 1 BTC of 50, without the thief having accepted their offer of 50. The thief demands they send 10 at a time for a total of 100. Bter sends the thief 10 BTC. The thief sends Bter 5 million NXT. And then it gets interesting. The thief begins to get frustrated with the pace of transaction. He sends an irritated note a mere 5 minutes after he sent the first 5 million NXT: “This is taking too long. I don’t have all night.”

Bter retorts 10 minutes later, asking the thief to send the rest of the NXT, and then they will send the 90 remaining BTC. Or, if the thief prefers, they’ll send 20 BTC at a time instead. 10 minutes pass. The thief replies to ask them to hurry up – he’s tired of waiting. Another 10 minutes pass, and the thief sends another note: “Deal is off. Good night.” Bter appears to panic, and sends 20 BTC, along with 5 or so notes, urging the thief to get back to the deal. A pair of observers step in, one-upping Bter’s offer to purchase – the first by 50%, the second offers double what Bter is paying.

Then Bter really, really messes up. They send 70 BTC more to the thief. He’s got his 100 BTC, and Bter has 5 million NXT. The thief has 45 million NXT. And 100 BTC. Ouch.

Since this happened, Bter managed to work out a different deal to get 43 million of the remaining NXT back from the hacker. They still have 8 million NXT. In total, it looks like it cost Bter around 300 BTC to deal with this problem. Not really all that bad, to tell the truth.

I do hope that Bter – and those of you who read about this incident – will learn one thing from all of this: if you’re dealing with a clearly unscrupulous individual, and they try and play hardball when negotiating, just back away. Recklessly giving up your initial deal to throw away 90 BTC like that is just what the thief wanted. It put them in a much better bargaining position, and ended up more than tripling what they would have received otherwise.

Best of luck catching the thief, Lin.