NiceHash Lost Its Bitcoin, Then Spent Three Years Repaying Users

1. Marketplace Operations

NiceHash operated as a cryptocurrency broker and mining hash power marketplace founded in 2014. Slovenian computer programmer Matjaž Škorjanc and Marko Kobal established the platform to connect buyers and sellers of mining capacity. The company operated offices in Maribor while maintaining corporate registration in the British Virgin Islands. The platform grew rapidly alongside rising global interest in cryptocurrency mining.

The marketplace facilitated peer-to-peer hashing power transactions.

2. The Security Breach

On December 6, 2017, unauthorized parties breached NiceHash systems via an alleged spear-phishing attack. Attackers accessed the company payment system and stole approximately 4,700 bitcoins. At the time of the incident, the stolen digital assets were valued at $64 million. The sudden loss paralyzed platform operations and shocked the global mining community.

Hackers drained corporate wallets of extensive bitcoin reserves.

3. Executive Resignation

In the wake of the security breach, CEO Marko Kobal announced his resignation from the company. The leadership transition occurred alongside emergency board meetings addressing the financial crisis. Company founders faced intense scrutiny from users regarding internal security failures. Remaining executives worked to stabilize infrastructure and communicate with concerned miners.

Management restructuring followed the disastrous security compromise.

4. Marketplace Restart

NiceHash resumed platform operations on December 21, 2017, just weeks after the hack. Company engineers deployed upgraded security architecture and overhauled user authentication procedures. Executives pledged to formulate a comprehensive plan to reimburse victims for their lost balances. The resumption allowed miners to resume selling hashing power on the platform.

Platform services returned online with reinforced security measures.

5. Repayment Commitment

NiceHash established a formal repayment program to return stolen funds to affected users. The company dedicated a portion of ongoing operational revenues toward clearing historical balances. Despite severe financial strain, management maintained consistent progress on the compensation schedule. Users tracked their reimbursement status through dedicated account dashboards.

Corporate revenues funded gradual reimbursement for impacted users.

6. International Indictments

Law enforcement agencies investigated the origins of the 2017 cyberattack. On February 17, 2021, United States authorities indicted members of the North Korean hacker group Lazarus for the hack. Investigators connected state-sponsored hacking syndicates to complex financial crimes targeting cryptocurrency exchanges. Global authorities shared intelligence to track the perpetrators across borders.

International prosecutors filed charges against state-sponsored hackers.

7. Founder Background

Co-founder Matjaž Škorjanc faced separate legal scrutiny regarding historical malware operations. Škorjanc previously served a prison sentence in Slovenia for creating the Mariposa botnet. In 2019, United States law enforcement reopened investigations into the botnet gang and issued new arrest warrants. Škorjanc was detained in Germany before extradition requests were rejected under double jeopardy rules.

Legal proceedings addressed historical malware development charges.

8. Full Compensation

NiceHash announced completion of its repayment program in 2020 after returning amounts to users over several years. That was the company’s reported repayment outcome following the December 2017 theft. It was separate from recovering the original stolen Bitcoin from the intruders. The program’s installments connected the early breach with later user balances rather than reversing the original blockchain transfers.

The company announced repayment after a multi-year program.

Sources

• Original narrative adaptation — CC BY-SA 4.0
• Wikipedia contributors — NiceHash (CC BY-SA 4.0)