Bitfinex 2016 Hack and Bitcoin Custody Losses — CustodyStress

Documented Bitcoin custody cases associated with the Bitfinex exchange in the Bitcoin Custody Incident Archive. The August 2016 hack of Bitfinex resulted in the theft of approximately 119,756 BTC and the involuntary loss of approximately 36% of account balances across all customers.

The most frequently documented recovery path in these cases is Exchange Support (4 of 7 cases). 57% of determinate cases resulted in some form of access recovery.

Bitfinex was one of the largest Bitcoin exchanges by trading volume in 2016. On August 2, 2016, an attacker exploited vulnerabilities in Bitfinex's multi-signature wallet architecture — implemented in partnership with BitGo — to steal approximately 119,756 BTC, valued at approximately $72 million at the time. Rather than file for bankruptcy, Bitfinex implemented a socialised loss mechanism: all customer accounts were reduced by approximately 36%, regardless of whether the customer's specific funds had been stolen. Affected customers received BFX tokens representing claims against the platform, which were subsequently redeemed over the following eight months. In 2022, the US Department of Justice recovered approximately 94,000 of the stolen BTC.

Bitfinex at the time used a multi-signature wallet architecture developed with BitGo, in which each customer had a segregated multi-signature wallet requiring signatures from both Bitfinex and BitGo to authorise transactions. This architecture was intended to provide customer-level segregation but was implemented with a configuration that allowed the attacker to compromise the signing process at scale.

The hack exploited the multi-signature implementation to steal Bitcoin from customer segregated wallets. The custody architecture failed not through the multi-signature model itself but through its specific configuration and API implementation. The subsequent socialised loss mechanism meant that customers who had not been directly hacked lost approximately 36% of their balance. The custody failure was partially resolved through BFX token redemption and partially through the 2022 government recovery.

Archive cases involving Bitfinex document individual access failures associated with the 2016 hack and subsequent account haircut. The archive focuses on custody survivability failures — the forced reduction in customer balances through the socialised loss mechanism is the primary failure mode in scope.