TradeFortress, who says he wishes to remain anonymous and is "not much older than 18", says more than 4,100 Bitcoins worth about $1.1 million have been stolen from his website, Inputs.io.

Bitcoin is a distributed, peer-to-peer digital currency that functions without the intermediation of any central authority, and ironically the safest way to store them is with paper print-outs of keys.

In an announcement posted on Thursday TradeFortress said his website, which was used as an online bank of sorts for Bitcoin, faced two separate attacks on 23 and 26 October.

"The attacker compromised the hosting account through compromising email accounts (some very old, and without phone numbers attached, so it was easy to reset). The attacker was able to bypass 2FA due to a flaw on the server host side."

The stolen bitcoins are owned by the users of his website, who had trusted their bitcoins to him. They are unlikely to get their money back, as Bitcoin transactions can't be reversed.

The Bitcoin transaction trail is designed to be anonymous, which has led to speculation this was an inside job and that TradeFortress took the coins for himself.

Inputs.io doesn’t have the funds to pay back everything that was stolen, but TradeFortress says he’s going to issue partial refunds. “I’m repaying with all of my personal Bitcoins, as well as remaining cold storage coins on Inputs, which adds up to 1540 BTC,” he told WIRED magazine.

The magazine also reported TradeFortress says that this was a social engineering attack, meaning that the attacker masqueraded as someone he wasn’t in order to get access to the site’s systems on cloud-hosting provider Linode.

“The attack was done through compromising a chain of email accounts which eventually allowed the attacker to reset the password for the the Linode server,” he said.

The hacker’s first step was recovering an email address for an account that TradeFortress set up six years ago.

The “attacker rented an Australian server to proxy as close to my geographical location so it won’t raise alarms with email recoveries,” TradeFortress said in a forum post.

“I know this doesn’t mean much, but I’m sorry, and saying that I’m very sad that this happened is an understatement,” TradeFortress wrote on the inputs.io website.

The hack follows the shutdown of Silk Road, an online drug and weapon marketplace, back in October.

After its shutdown the FBI took control of 1.5% of Bitcoins in circulation.