Bitcoin Forum

TORWallet has not been allowing people to withdraw from there wallets for over one week with multiple users reporting the following messages when attempting to access or send bitcoins from there wallet.



TORWallet User: https://bitcointalk.org/index.php?action=profile;u=59945 (https://bitcointalk.org/index.php?action=profile;u=59945)

Forum posts
https://bitcointalk.org/index.php?topic=87387.160 (https://bitcointalk.org/index.php?topic=87387.160)
https://bitcointalk.org/index.php?topic=112201.0 (https://bitcointalk.org/index.php?topic=112201.0)

Totally bump  ;D

Seriously mark TORWallet please, people are still depositing coins.

They're probably milking it for all it's worth at this point by not responding, and taking advantage of people that have heard of or used the service before successfully.  They need a scammer tag, so that people smart enough to do a search of their name can see they're scamming before they deposit their coins.

I cannot agree more with this statement.  If they get their service working properly and return all coins, the scammer tag should be instantly removed.

Agreed.  As well as an explanation.

Are there actually any admins or moderators on this forum.

I have PM'd Admins and started this topic yet still TORWallet is not marked as a "Scammer"

The original topic is the 3rd result on Google when searching for TORWallet. If there is anything the community can do it is destroy the reputation of TORWallet in order to protect future users. The fact that they are still running and accepting coins means they are milking it for all it is worth.

https://bitcointalk.org/index.php?topic=87387.0 (https://bitcointalk.org/index.php?topic=87387.0)

https://www.google.com/?q=TORWallet (https://www.google.com/?q=TORWallet)


Please....Tag the user

Bump. Mods, this is important.

Bump.  This is indeed important.

Maybe the admins are the ones behind it.

Doubt that but at this stage there pretty much enabling and promoting TORWallet as a legitimate service...

Tweaked, thanks for the curl commands you posted earlier.  I didn't know the site had a functioning API.  I have been spamming them to send me back my coins the past few days.  I guess this is only thing we can do at this point.  From how the TORwallet representative spoke, it seemed the site was ran by multiple people (say 2 or 3).  If this is true, I wonder if only 1 person actually had possession of the coins at any given time, or if it was split equally with some sort of "checks and balances" in place?  If one of them decided to take off with the majority of the coins the service bounced around, you would think the other developers would have called foul to the community to let its users know the site went rogue.  Not a single person (besides the site's users) have come forward claiming to know why the site is "malfunctioning" (AKA stealing).  This makes me think TORwallet was run by one individual who manipulated the image of their mixing service to look more trustworthy.  This is all speculation and meaningless, but I'm just trying to contribute to the investigation and at least get the word out to steer clear of the site.  Mods, for fucks sake, please tag the user as a scammer.

well...c'mon now...didn't you see this one coming 100 clicks away?

Torwallet indeed. Next, we'll just call it "torsiphon.bit" and watch them all toss their coin at it.

i saw one user on irc using sr for a wallet. Seems way betta to me. You know they have a vested interest in keeping their wallet secure and available (and not stealing it themselves) they make much more running sr. :D

No problem SnafuKazoo they don't really have a working API but you can still send HTTP posts to the site. I'm still getting the "Hot wallet" message and I have been posting now since the service went down.

I'm not sure what sort of structure TORWallet had internally.  The thing that gets me about the "Hot wallet" message is the fact that the actual hot wallet cannot be exhausted due to the coins that users deposit to the site, so I think the message is just bullshit.



Guruvan, Did we see this coming ? No TORWallet operated perfectly for many months, coins where deposited and withdrawn without issues, plus they had many reviews on blog sites and on this forum. There was nothing untoward about the way the service was run just because it is behind TOR doesn't mean it is going to be a scam.

SR can be used as a wallet but that is not it's intended purpose.


To be honest I am now in serious doubt about this community if there are this many users stating that TORWallet is a scam and even the original topic has users reporting it's a scam, and still the admins/mods have not tagged the user as "scammer" plus the original topic is still bringing new users to there service.

Seriously what is the point of standing there and going, "c'mon guys this was always going to happen"??


 

Tagged.

Anonymous EWallets should never be trusted. Unlike anonymous stores, coin mixers, and most other services, anonymous EWallets have absolutely no economic incentive to not steal their users' coins.

No offense intended, but I have emails from a googlegroup from right when Torwallet was announced. Seemed to everyone on that list though it was the most likely new way to lose your coins.

A successful con will run clean for a while to maximize return on the investment for the scam. With a service like torwallet, you run it until you start to see the early adopter wave start to thin out, and bail right before the majority of them do. (a few months is about right) and hit it at just below the peak of deposits.

Hi Guruvan,

Would be nice to see the link for this googlegroup ?

The only way to really find out if it is a scam or not is to use the service, which many of us did, Is it not ok to assume that there are good people that create quality services out there ? Should we always instantly think that something is a scam.... it's not within our nature.

It was a very successful con... shame that  :)

Yes the only way to find out if it's a scam it to use the service (or wait for others to do so)

No, it is not ok to assume that the new, anonymous people you're sending your money to are good people. You should presume that they are trying to con you, and allow them to slowly earn your trust. Slowly, because the long con nets the most of your money.

When attempting to verify such a service, you must presume that any and all coins sent are gone, and be pleasantly surprised if they're returned. The more complete the anonymity of the service, the less likely that service can ever build significant trust. There's no telling how long the con is!!

Community trust is not an acceptable measure of the trustworthiness of a service. It's very common in all social networks (online and off) for a con artist to befriend multiple people in the same network, establishing trust relationships quickly among all the new friends based on the newly gained trust of the other new friends. With this method, one can become very popular, well known, and trusted in a short time in a tight social group.
Obviously this quickly leads to amplified returns on such a scam as this appears to be. (works better with pseudonomous people rather than anonymous people...pirate got a lot more out of the people than torwallet....he's a friendly guy)

When you have no financial incentive for the service to stay honest, and they're anonymous, you have no way other than limiting your exposure to limit your risk. You have no way to inflict a penalty, so there is exactly zero consequence to relieving you of funds. Your funds should, at most, go in, and right out.

But, there's more....Say you do use a somewhat less anonymous, well known anonymous mixing wallet, like Silk Road. Well....they provide a service which is illegal in most jurisdictions that I know. So, if you move coin from your Mtgox account (with your real name on it) into SR, and SR is discovered, you now have exposed yourself to risk of law enforcement contact (at least). Or, maybe, the people who run SR got tipped off they were about to be discovered, and had to close up shop unexpectedly, and for any number of reasons...say...destruction of data in a high speed chase w/ crash ending...your btc is gone. With any anonymous service, it's impossible to truly evaluate the operation's overall security posture - if the operation is illegal in any jurisdiction, that makes your risk analysis much more complex (especially if you're not an experienced criminal!) So, still, you only move the coins you really want mixed, and move them out asap. 

Yeaah. Even if they're super nice guys - there's reasons not to trust anonymous services that collect your funds. Even with economic incentive, there may be significant risks. The less obvious the risks are, the less you can evaluate them, the more that risk goes up.

You must not assume that people asking for your money are the good people that they might be. And the second you see red flags in their behavior, you and your BTC must flee! :)

Finally, you really have to ask yourself: "Am I even achieving what I thought I was by mixing my coins, and did I even need to do that in the first place?"

Most of the time, most people do not have the experience with fiat money systems or bitcoin to successfully obfuscate the source of funds. While the mixing service may work effectively enough, the tracks on either side of the mixing service are usually going to expose you. This means that all that's really been achieved is exposing the mixing service's addresses.

You know, after reading some of the scam threads, I wonder if they could be cooperating with an investigation and not letting anything go out.  Are they not allowed to talk about an ensuing investigation?  

I know I'm probably grasping at straws, but it's just a thought.

That's cute.  :D

Thanks for that long winded speech guruvan.

I completely agree with what you have said.

There's also some interesting notes to be taken. I'm fully aware of what needs to be achieved in "mixing" coins.


Even if both sides of the transaction (in/out) are obvious, eg. funds came from this exchange and went out from this exchange, if the coins are mixed in between you cannot link the two transactions meaning they could have come from anywhere. So even if the original transaction is exposed there is no way to link it to the transaction out of the network. This is just my view anyway.

I really don't have time to reply to everything you have said  :(

From now on I will be setting up my own anonymous VPS with a headless Bitcoin client running and use those addresses, at least then I have access to the private keys.

:P

The hosting provider where TORWallet.net is hosted (which is also the domain registrar/reseller) will consider a takedown request, but my takedown request was denied because I personally am not a party (I never used TORWallet, was not scammed).

So, if anyone is willing to contact the hosting provider to assert that fraud is occurring, please PM me and I will provide the e-mail address for the hosting provider.

Another thread on the issue:

TORwallet Microtronix Webhosting Bitcoins
 - http://bitcointalk.org/index.php?topic=131992.0

So any word on if its a confirmed scam yet?

if it wouldnt, coins would be able to be withdrawn or the owner of TORWallet would have posted here (or put some informations on his site)

Back in August TORwallet vanished for two solid weeks. When it came back online I pulled my very small amount of coin out of it. lots of others at that time did the same.

it was sketchy from day one. this doesn't suprise me

These e-wallets or what ever never seem to last.

For those of you who insist on using online wallets, please consult my signature.

Can someone please explain to be how a online wallet like blockchain.info is better then other ewallets?

It is.

When you access http://Blockchain.info/wallet and enter your password, that password is not being sent to blockchain.info/wallet.  Instead the Javascript code running in your browser uses that password decrypt the wallet that it obtained from blockchain.info/wallet (where only an encrypted copy of your wallet is stored).   So, Blockchain.info/wallet doesn't have access to your private keys inside your wallet.

Because of this, it is not considered a hosted (shared) EWallet, but instead it falls under the category of a hybrid EWallet.  (Hybrid, because it acts like a locally installed client yet is accessible from a browser with no software installation required.)

There is the possibility that the site is compromised and the attacker replaces the Javascript that is served with the site with a version that captures the wallet identifier and password and then uses that to steal your bitcoins.   The protection against that is Blockchain.info's tool called the Javascript Verifier, available as a browser plugin or Java applet.  The verifier will alert if the Javascript code served by the site is different from the version that Blockchain.info has checked into GitHub.
 - https://blockchain.info/wallet/verifier

The .net site appears to be down now, but the tor site is still up.

Still can't move my couple bitcoins, and they haven't moved from the deposit address either.

No online wallet is safe. I run a wallet service as well (hotwallet.ca) and I am paranoid that one day it will be hacked, so I put up a shut down notice and warned users not to deposit any money unless it is for a temporary purpose.

The profit model I had set up was a few bitcoin games (dragon dice) and I was planning on moving to some sort of fee-based model, like 0.1% on all deposits. But there's very little money to be made. It would take around 1,000 BTC of deposits and reasonable time spend on the games before I could even begin to justify hosting fees. That's the reality of running a wallet. It's not profitable unless you're in the top two (and torwallet probably was not in the top 2). Since they had no other profit model I am guessing they decided to scam since they're completely anonymous.

Anyway.... since you know their hosting provider, if you can demonstrate loss you can get their address. The ISP has a legal obligation to reveal their address so they can be served. But you have to go through a lawyer and it will cost at least a few hundred dollars just for that.

Its just a trap on tor to pull people in now.

I'm glad I only put in a few bitcoins, I knew there was a risk with it being anonymous.

Can someone explain how the coins have not even moved from the address?  If they are "running away with the coins,"  how are the coins still in the wallet and have not moved? 

Nobody else has the private keys for the wallet so there's no need to spend the coins.     The time that a wallet has been hacked and the funds are spent by the thief right away is because that is what the thief needs to do to prevent the rightful owner from spending the funds.  But in this case, there's no other party with the private keys.