Bitcoin Forum

Get the following message when trying to transfer bitcoins out:

"Hot wallet exhausted. Please wait while we move coins in from our offline wallet."

Is this site a scam?  The user is on here as "TORwallet" but as a newbie I cannot message them.

Jase.

I've not heard any other complaints about them but I do know that it's common practice for sites that deal with a lot of coins to keep two wallets, one "hot wallet" that is live on the site and holds only a small amount of coin to handle expected daily tx volume and one "cold wallet" that is held offline or on a different PC so that it cannot be compromised by hackers gaining access to the server. It sounds like they just ran out of funds in their hot wallet. I'd give them a bit to transfer from cold storage before pulling the scammer trigger.

There are corroborating reports that other users of this Tor Wallet service are not getting their coins back:

 - http://bitcointalk.org/index.php?topic=87387.0

Appears to have been going on for at least four days, no answers to emails (mine included).  Isn't looking good for them - 500+ posts on this board seems to be their credibility.  Glad I never transfer more than I am willing to lose.

I've been having the same issue for like 5 days now. Hope Mr. TorWallet responds soon because I really like the concept.

Please tell me what is so appealing about giving ANY money to a complete stranger than you cannot track in any way.

Next time you need someone to hold your wallet, I'll hold it for you. And I totally promise not to steal it.

yes this puzzles me too, time and time again people loose thier small fortunes,  ???

keeping a local wallet, encrypted and archived when not in use, on a clean PC, cant go wrong!  ;)

You're missing the point. TorWallet isn't appealing because I enjoy giving money to some random stranger. It is appealing because it is a quick-n-dirty throwaway wallet. I only had a small sum stored on the service, mostly to test it out because I was curious.

That being said, there are ways to run this type of business while providing some reassurance to your users that you're not going to run off with their coins. If you are going to start a service like TorWallet, you should be willing to make your business more transparent. This includes putting actual contact info on your site, including your name, an office address, and a phone number. If you're a one-man operation, contract with a call-center service at the very least. Just because your service is only accessible through TOR and your users wish to remain super-anonymous, doesn't mean you need to keep your identity hidden, Mr. TorWallet.

wait something called the TorWallet isn't giving coins back, who would have thought.

Maybe I am. It's often hard to see the point when opportunities exist to point and laugh.

The latest Bitcoin-QT client supports TOR. Maybe this is what you're after?

Yes it does, how else would he run with your money?  ???

THIS MY FRIENDS... is why I myseldo not use darknet services that I do not build myself. fYou do realize that the TORwallet idea can be pretty much setup by a total noob without much money into the project right?  It's not PhD level computeing.

With that in mind maybe wait for the little boy to.get done with football practice and his homework. also remember his mommy and daddy might have grounded him from the family computer. Give it a few days more then scream in the scammer boards about it.. I'm being dead serious here.

Before last month.. I actually setup my own personal online wallet on our beloved darknet with the help of a .bit domain. I'm the type of asshole who breaks his phones in idiot ways, doesn't remember to pack a charger for my laptop. And in some cases am unable to carry that much shit with me.

So to cover my ass and I took a gamble. believe me with a little effort you can build something like this that is private enough to throw some petty coin in for those emergency payment/wants/needs.

Anyway like I always say. I hope this isn't a shady deal for the individuals who use this controled service. it always in my eyes adds up to being yet one more blow to the dome of this money experiment. Best wishes to you

Perhaps, but I think these events will also help strengthen the currency by giving users an incentive to demand certain reassurances from service providers. The tech is still young so it is still trying to find its footing.

For those who ask "Why use such a service" this is my reason.  I do not like being dependent on one bit of kit - while this is fine for some people:


It's not what I want to rely on.  That said, I wouldn't trust any current bitcoin web site with large amounts of funds.  I've lost £30 with TORwallet, it won't break the bank.  Still, it is important to raise awareness of sites with issues, hence I started this thread.

Interesting TORwallet's last activity was September 16, 2012, 04:58:15 PM and post was September 14, 2012, 11:49:43 PM:

https://bitcointalk.org/index.php?action=profile;u=59945;sa=showPosts


All this seems to be right before the current error message is displayed.  I wonder if timmah got his bitcoins back?

VNC and VPN might go a long way :)

Command line options might be a good way to go too. I haven't looked into those too much yet. Maybe have a special user which runs a very restricted shell, with multiple levels of escalation, one-time pass-codes etc and throw putty on a thumb-drive (though it's a very simple/small download in any case).

If you want a quick throwaway wallet use a site like blockchan.info. Not only are your funds in your actual account(not consolidated into some giant wallet), but the private key is never revealed to the server. They could not take your coins even if they wanted to.

Take a backup of the unencrypted keys from blockchain.info and you can import them into any client if the site goes down.

You should be on the watch for their javascript changing though.

This is an excellent site - perfect for what I want.  (Note, it should be blockchain.info (http://blockchain.info))

Fallacy, has been discussed before here (https://bitcointalk.org/index.php?topic=86278.0)

TL;DR : Your bitcoins can easily get stolen if the server gets compromised, the owner threatened or if he goes rogue, and that's simply because javascript is dynamically served from the server, it can be modified at will by anyone accessing the server.

Since you did not quote the part where I warned about that then I assume you did not read it:


There are plugins for browsers that will warn you if the javascript changes. With this plugin an attacker cannot change the system to reveal your keys without you getting a warning. The source code as it stands now is very easy to read. With such a plugin I would consider it to be reasonably safe. It does however compromise you ability to be anonymous if that is your thing.

There is even a plugin just for and by blockchain to protect against js modification attacks: https://blockchain.info/wallet/verifier - however I prefer to use a generic version for the aformentioned potential of the operator going rouge.

You also forgot to mention man in the middle attacks which can take place at a tor exit node, but that would require the servers ssl cert to be compromised.

Wasn't that an edit ? Sorry if it wasn't and I overlooked it :)

Yep, but that isn't blockchain.info anymore, that's blockchain.info + a plugin.

My mom still has issues with the concepts of copy and paste :)

I do agree, but many people still think it's some kind of security silver bullet where they don't have to trust the operator since he "doesn't have access to your keys". Honestly, how much people do you think use some kind of JS verifier ?

Oh, that may have been an edit, but within minutes of the original post. I agree that for Mom and Pop using it that they are vulnerable. Good point about now having to trust the plugin, a valid concern.

I know a little perl, I may try to directly interface with their API if I can figure out local signing and decryption of keys.

Note this thread:

https://bitcointalk.org/index.php?topic=112327.0 (https://bitcointalk.org/index.php?topic=112327.0)

Any updates on this site?  It is up and running again - and scamming.

Found this update to the story !

http://www.reddit.com/r/Bitcoin/comments/1z9jmy/just_noticed_my_tor_wallet_emptied_a_couple_of/

Looks like you will not get your BTC back.

wow, that is a really old thread

I just recently used my Tor wallet successfully, but today trying to log in to my account I got error message "Invalid username or password. Please login below."
 I am 100% sure I used correct username and password
Then if I try to recover password to the registered email I get message:

"Thank you! Please check your e-mail for further information."

What the F*CK is going on` ??? ??? ??? ??? ??? >:( >:( >:( >:( >:(

This incident takes all credibility from your service!! What a joke!!
I have 0 trust on this site!

As you can see by the other posts in this thread, TOR Wallet is a scam. Sorry for your loss. It's tough to learn first hand that sending money to an anonymous stranger on the internet is generally a bad idea.

There are many negative reviews regarding this. This is why it is best to use blockchain.info online wallet, if you want an online one, the Bitcoin-qt wallet, if a software is needed and a hardware/paper wallet is best if you are talking about holding significant BTCs.

I have had no problem using this site id yo try again and did yu manage t sort at the problem I h0pe you have if just keep  trying you should be able to get your coins....

Sadly people will continue to get burnt by shit like this. Seriously how many times does it have to be stated -

If you are not the sole owner of your private keys then they are not your bitcoin's

I don't have experiences with this TOR wallet but I see many people here have issues. Maybe they wanted to attract people with the fact that is TOR so more anonimous and now they are taking advantage of it. Maybe that you shift to another wallet like blockchain or something?