KipCoin's Linode-hosted servers were compromised when attackers gained access to the wallet.dat file in May 2014. The attacker remained dormant until December 2014, when they began moving the 3,000+ stolen BTC.

KipCoin announced that the attacker gained access to the server in 2014 and downloaded the wallet.dat file. A few months later, the attacker stole more than 3,000 BTC.