In this the post, we will keep you updated on the incident.

Contract address : [0xD0f706bF4738732145344Dc407d36b88859C3349](https://etherscan.io/address/0xD0f706bF4738732145344Dc407d36b88859C3349)

Incident: [Breach in standard Parity multisig contract](http://www.coindesk.com/30-million-ether-reported-stolen-parity-wallet-breach/)

*23:02 PM local time 19 July 2017*
Has been withdrawn to unknown destination all ethers and all tokens except AIR and ANT. Working on withdrawing MYS.

*23:10 PM local time*
According to Etherscan this hack was likely rescued by White hats

![](https://habrastorage.org/web/977/5ed/012/9775ed0128a74826af62c3629096020a.png)

*23:38 PM local time*
Current estimated impact: $7 641 533 as of last clearance round

![](https://habrastorage.org/web/f55/d35/2c7/f55d352c74cc4b439d6714ba33b43654.png)

*00:06 AM local time 20 July 2017*
At the moment investment process has been stopped because Ethereum blockchain software is under attack. SPIES tokens are safe (issued by BitShares)

*00:12 AM local time*
Currently,, address [MultisigExploit-WhiteHat](https://etherscan.io/address/0x1dba1131000664b884a1ba238464159892252d3a) sending transactions to (probably) new multisig contracts

*00:52 AM local time*
Estimation of vulnerable code based on contract version where White hats are sending values.
![](https://imgp.golos.io/0x0/http://s019.radikal.ru/i632/1707/99/74999fa9f793.png)

8 lines updated

*01:00 AM local time*
[Parity Blog](https://blog.parity.io/security-alert-high-2/)
Published new version of contract in Parity [Github PR](https://github.com/paritytech/parity/pull/6103).

UPDATE (20/07/17, 00:26 CEST): Future multi-sig wallets created by versions of Parity are secure. Fix in the code is https://github.com/paritytech/parity/pull/6103 and the newly registered code is [https://etherscan.io/tx/0x5f0846ccef8946d47f85715b7eea8fb69d3a9b9ef2d2b8abcf83983fb8d94f5f](https://etherscan.io/tx/0x5f0846ccef8946d47f85715b7eea8fb69d3a9b9ef2d2b8abcf83983fb8d94f5f).

*11:52 AM local time*
We are waiting for the the annnouncement by White Hats Group. 2 scenarios:
1. If they send funds back losses will be 0.8% of Satoshi•Pie (MYST token)
2. If not losses will be 39.2% of Satoshi•Pie (all ETH and tokens except ANT and AIR)

According to our intuition, the 1 scenario is likely to happen but we cannot predict the time. We are starting to process yesterday deposits and withdrawals as they should happen before incident timestamp [Jul-19-2017 06:34:46 PM +UTC](https://etherscan.io/tx/0x0c4965707952e498515b438ba0ba1fec77341d7688e6f1f01897f3e4e691831d).

*02:44 PM local time*
![eth-parity-breach-satoshipie-estimation](https://habrastorage.org/web/7d2/14e/9f9/7d214e9f92244f18bd50e57902a3960c.png)

Damage valuation as of current valuation round:
![eth-parity-breach-satoshipie-estimation-details](https://habrastorage.org/web/ec6/c15/574/ec6c15574a3e4bf186551304d42b25fc.png)

*04:03 PM local time*
Official statement by (Satoshi•Fund) and Fund managers
(to be published in all official channels)

# Working on vulnerability in Etheruem multisig contract
Yesterday in Jul-19-2017 06:34:46 PM first transaction hit our multisig Satoshi•Pie contract. The majority of funds was siphoned in 2 minutes (all ETH) and all ERC20 tokens except ANT, AIR, and MYST) in 1 hour. The breach led to not identified accounts. We reacted in less than 2 hours and successfully use exploit to drain remaining tokens ANT and AIR to address under our control. MYST attempts were unsuccessful. The history can be audited using [Etherscan](https://etherscan.io/txs?a=0xd0f706bf4738732145344dc407d36b88859c3349). Incident Log can be found in [English](https://steemit.com/ethereum/@hipster/updates-satoshi-pie-ethereum-multisig-has-been-hacked) and [Russian](https://golos.io/ethereum/@litvintech/obnovlyaetsya-multisig-koshelek-ethereum-satoshi-pie-vzloman-uyazvimost-kontrakta-multisig-by-parity)

In parallel become known that withdrawn has been done by [White Hats Group](https://etherscan.io/address/0x1dba1131000664b884a1ba238464159892252d3a). Now we are waiting for refund according to [this statement](https://www.reddit.com/r/ethereum/comments/6obofq/a_modified_version_of_a_common_multisig_had_a/) of WHG on Reddit. After fast investigation become clear that damage is not existential and we are able to continue operations. 2 hours ago we processed yesterday deposits and withdrawals that anyway should happen before incident timestamp.

Our strategy is the following:

1. We are going to continue to provide best in breed blockchain asset management service.
2. We are changing valuation cycle from 24 hours to 1 week for Satoshi•Pie product.
3. That means that since now all withdrawals and deposits will be possible once in a week. If recovery will happen earlier we will let to withdraw on a daily basis for everybody during this transmission week.
4. We are implementing a hard limit on deposits and withdrawals at 10 BTC for one transaction. Fewer transactions should go through the market.
5. We consider moving Ethereum holdings (if recovered) to [Zeppelin smart contract framework](https://github.com/OpenZeppelin/zeppelin-solidity).
6. If not recovered by White Hats Group in 1 week we will provide us a path for alternative recovery strategies.
7. We are going to publish bug bounty program.

Thank you that you are with us. For those who are not happy with our service please be patient. You will be able to withdraw all your funds according to [our terms](https://docs.google.com/document/d/1QbzZyAgev5On7hrBFCq1t4TAsfFoDeSRjBf-gZpzWVE/edit). 
The new version of Satoshi•Pie white paper will be published with updates soon.

*00:16 AM local time* 22 July 2017
Starting to audit [calculations](https://github.com/Giveth/WHGBalanceVerification) based on [this announcement](https://www.reddit.com/r/ethereum/comments/6oqgp3/balances_parameters_for_the_new_multisig_wallets/)

*01:00 PM local time* 22 July 2017
[We confirmed](https://www.reddit.com/r/ethereum/comments/6oqgp3/balances_parameters_for_the_new_multisig_wallets/) to WHG that setting parameters for deployed contracts are valid.

Now we are waiting until WHG get enough evidence from a community that all calculations are correct before deploying new contracts.

*00:16 PM local time* 23 July 2017
The [new contract](https://etherscan.io/tx/0xbeb8a365aca5bd7da514ea63d1b42650abfc4845b55b616209b7bbfe2f9ea839) deployed by WHG [has been verified](https://www.reddit.com/r/ethereum/comments/6owvor/the_replacement_multisig_wallets_have_been/dklo6f8/)

*05:18 PM local time* 25 July 2017
All values has been returned under SatoshiPie control. [The new  contract](https://etherscan.io/address/0xc2216632beddb98f88e35b4e2cd8b9f140bb20cd).
Until full security audit will not be finished in order to reduce risks some part of holdings will be under direct control of fund managers using this accounts:
- [0x3AF5f67d0762B55EDDaEd71A5045D3f316Ee8b37](https://etherscan.io/address/0x3AF5f67d0762B55EDDaEd71A5045D3f316Ee8b37)
- [0x80BC9035Cf978f7A8D0Fd9FB39e131106E87B225](https://etherscan.io/address/0x80BC9035Cf978f7A8D0Fd9FB39e131106E87B225)
- [0x00073103C819211EF56D0A8ba7f71c11a84Aa55f](https://etherscan.io/address/0x00073103C819211EF56D0A8ba7f71c11a84Aa55f)

Версия лога на русском by @litvintech [на Голосе](https://golos.io/ethereum/@litvintech/obnovlyaetsya-multisig-koshelek-ethereum-satoshi-pie-vzloman-uyazvimost-kontrakta-multisig-by-parity)