After Shapeshift stole Bitcoin (BTC) and paid it $ 900,000, Shapeshift is now seeking damages in court against former chief software engineer Azamat Mukhiddinov.
“A lot of time and legal costs were wasted cleaning up,” Shapeshift chief legal officer Veronica McGregor told Cointelegraph, explaining that customers’ money was safe throughout the ordeal. “ShapeShift is not a trustee, so customers’ funds have never been at risk,” she said.
Mukhidinov, who worked in a senior shapeshift position, reportedly used his access to the backend of the exchange to steal nearly 90 bitcoins worth nearly $ 900,000 at the time of the theft in May 2020. This emerges from a legal complaint filed by Shapeshift on August 26, 2020.
The document states: “Azamat began stealing Bitcoin in November 2019 and continued until the theft was discovered on May 21, 2020.”
Mukhiddinov joined Shapeshift on September 4, 2018 as a senior software engineer in the company. Shapeshift gave Mukhiddinov access to much of his private and sensitive inner workings, referred to in the file as “computer infrastructure” and including aspects such as the company’s software and servers.
Shapeshift hired Mukhidinov to oversee the backend of their services, including strengthening their defenses against potential threats, the document says. Before starting work at the company, Mukhidinov reportedly signed documents, one of which indicated that he would not benefit from these important specialized systems.
The guidelines also specifically prevented the employee from adding apps to the system without the company’s approval. However, Mukhidinov has installed his own software somewhere on the system that works as unnoticed to steal Bitcoin from Shapeshift.
The program reportedly exported around 0.5 BTC at a time to Mukhiddinov’s possession, exploiting a security flaw in the Shapeshift background.
The Shapeshift team finally noticed the missing coins and spoke to him on May 25, 2020 following an investigation that led to Mukhiddinov. “Azamat admitted to having installed and operated the program that stole the company’s bitcoins,” said Legal Deposit.
“Ultimately, Azamat returned in one form or another all the $ 900,000 bitcoin he had stolen,” the legal complaint read. “However, ShapeShift does not make these payments in full for damage caused by Azamat’s actions.”
Shapeshift’s lawsuit against Mukhiddinov seeks damages for the lengthy investigation into the case, including the time and resources spent trying. The company reportedly had to delay the release of its mobile app for several months. “The new ShapeShift mobile app launched in July,” said MacGregor, adding, “It is a self-service crypto interface with built-in trading.”
This is not the first iteration of internal shapeshift functionality. Another incident in 2016 resulted in hundreds of thousands of dollars stolen. MacGregor noticed no link between the 2016 incident and this year’s edition.
“After the 2016 incident, we implemented monitoring and operational security steps as well as important procedural steps,” she said. “This act helped us to arrest the perpetrator and we were able to recover all the stolen property directly.”
Shapeshift has been active in the cryptocurrency sector since 2013. It was founded by Erik Vorhees, listed by Cointelegraph as the 37th Most Important Person in the Crypto and Blockchain Industry.