{"id":15361,"date":"2021-08-02T20:02:00","date_gmt":"2021-08-02T20:02:00","guid":{"rendered":"http:\/\/ci0289af2f50002560"},"modified":"2021-08-02T20:02:00","modified_gmt":"2021-08-02T20:02:00","slug":"hodlhodl-forced-liquidations-compromised","status":"publish","type":"post","link":"https:\/\/bitcoinmagazine.com\/business\/hodlhodl-forced-liquidations-compromised","title":{"rendered":"Hodl Hodl Resurfaces With Explanations After Announcing Forced Liquidations, Lacking Communication"},"content":{"rendered":"
<\/div>

On August 1st, peer-to-peer bitcoin trading and lending platform Hodl Hodl tweeted that the company was upgrading its security measures<\/a> and contacting users individually through email. A few hours later, the firm shared it was force-liquidating some contracts<\/a> in its lending platform, without further explanations. But today, Hodl Hodl released a PGP signed statement<\/a> explaining the events and apologizing for the lack of proper communication.<\/p>\n

\u201c[We] have started migration\/liquidation of user contracts to prevent the potential loss of funds,\u201d the statement read. \u201cUnfortunately, our recent internal and external audit identified that some user payment passwords might have been compromised. This affected a limited number of contracts, but we are taking proactive measures to ensure that everyone is safe.\u201d<\/p>\n

Hodl Hodl\u2019s escrow-based lending system has three keys; the lender\u2019s, the borrower\u2019s, and another held by the company itself. These keys comprise the platform\u2019s 2-of-3 multisignature<\/a> escrow, where two signatures, and thus two keys, are required for spending funds locked in a lending contract\u2019s multisignature address.<\/p>\n

User private keys, from both lender and borrower, explained @6102bitcoin<\/a>, \u201care generated using a user-specified \u2018payment password\u2019 in combination with a client-side random number generator.\u201d If this password is weak, Hodl Hodl or a man-in-the-middle could discover what one or more keys are through brute-force attempts and steal the funds.<\/p>\n

Additionally, Hodl Hodl\u2019s platform was down<\/a> for some time, stopping users from releasing funds since the company\u2019s decryption mechanism is not yet public. If it was, users could decrypt the lend contract key using their own payment password and make a release transaction, sign it, and broadcast it in situations like this. Hodl Hodl previously said<\/a> it planned to make the decryption tool public in Q3 2021.<\/p>\n

It is still unclear, however, what the specific compromise has been. HodlHodl said that the company is still investigating these issues and building tools to facilitate the migration of funds from old escrows to new ones. Hodl Hodl said it is \u201cgoing to publish a transparency report\u201d once it finishes the investigations.<\/p>\n","protected":false},"excerpt":{"rendered":"

After arousing confusion with incomplete communication and forced liquidations on lending contracts, Hodl Hodl explains what happened.<\/p>\n","protected":false},"author":2572,"featured_media":15362,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[1852,1376,2917,468],"class_list":["post-15361","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-hodl-hodl","tag-liquidation","tag-p2p-lending","tag-trading"],"author_data":{"id":2572,"name":"Namcios","nicename":"namcios","avatar_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2024\/12\/pfp-96x96.png"},"featured_image_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2024\/11\/hodl-hodl-launches-exchange-api.png","_links":{"self":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/15361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/users\/2572"}],"replies":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/comments?post=15361"}],"version-history":[{"count":0,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/15361\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media\/15362"}],"wp:attachment":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media?parent=15361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/categories?post=15361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/tags?post=15361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}