Bitcoin Forum

instawallets new owner stole over $40,000 from me be careful people. i know some of you will call me a troll or a competitor or ask me to show proof. I dont really care at this point so time will tell and consider this your fair warning that you will lose all your hard earned money if you have coins in a instawallet.org wallet. I will remove this thread if they ever return my coins, but so far support has told me I sent my coins when I did not and only they can possibly have access to my account. I live alone and unless someone broke into my house and decrypted my external hard drive to find my wallet url address and left no other physical evidence then it could only have been them. sorry for the rammble but WTF!!!!!!!!!!!!!!!!!!!!!!!!

status: ive been robbed by instawallet !

I'm sorry for your loss...  but really??  $40k USD in an online wallet?  Recipe for disaster - bitcoin requires the user to have some semblance of common sense

http://funniestpictureever.com/upload/3791-38114/fish-thief.jpg

But really... $40k in an online wallet is hard for me to swallow.

Bitcoin puts you in control... why would you trust that much to a site that doesn't even use a password?

Why does anyone trust other people with their money?  Especially significant amounts of irreversible currency?

Thanks for the tip for the rest of us (whether it was instawallet or not is another matter), but man, you should have seen this coming!

This. ThisX1000

Dude,
You blamed some other company first without doing any real research into your coinange, I literally spent 30 seconds on your other thread a few days ago just following the transactions to a cold storage on Instawallet, now you are blaming Instawallet. More than likely they aren't really involved. lol you are just lashing out at any company that just might be involved. The thing is they also don't know where your coins went.

I think the next step for you is to hire a PI cause I bet you BTC40k that if I look into this any more I could find out what happened. Stop blaming companies that *might* be involved; because you don't really know what is going on, I told you before to not look into my findings to hard. This is because I spent half a minute to come to instalwallets cold storage after my listsless interest came upon your post. Instawallet more than likely has no idea where your coins are, and aren't involved. They might be, but I would say chances are pretty good that they are not. What I am trying to say is look into it more yourself/make your own findings because I sure as heck didn't spend much time on your coin capers case.

*Protip - you got phished. It's what happens when you don't use an offline wallet for 40k you peanut*

im over it.. back to square 1. Ill admit I was an idiot and I see that now so no need to preach to the quire or what ever. I learned alot and this will definitly not happen again haha. I will start keeping my wallet on and more secure wallet. well have a good day. and about lashing out yeah I was in a freaking fury but after talking to the NEW owner I realize there is nothing I can do so whats the point of it. here is the last email I received from them. and No body likes a taddle tail so no I wont be hiring a police report.. Im only posting on this forum to vent and warn people so this is good bye.. peace

id   wallet_key   amount   address   transaction_id   created_at

"431355   jY6LxRXwWqUhA2tECNgWWorrEEYvb0xXtg   920.71000000   1sbXm3rxu3mZ9v9XgmYnQrJgC1YM2fNeb   463e46a28cc142efe0e38aa4564bf518e2ae34a3d2994f6764d6630ad406639b   2013-02-07 08:27:00
433229   jY6LxRXwWqUhA2tECNgWWorrEEYvb0xXtg   -150.00000000   1KhbLcH5Pm8ihWYfkm4HacqEFBDG2kuUxr   a7de4d9a643288a2441fcfd1c296343631bd9919814da41314480adc065b20e9   2013-02-08 06:17:35
438082   jY6LxRXwWqUhA2tECNgWWorrEEYvb0xXtg   -22.35000000   1C7GTFaviBA9U5NKYBwyeLgqn1B9VWXxXR   3ce3d8708689b5ae33f5d6ad7c45fdd6b9e3b48ff7e10d03cbc4ecae9d378b31   2013-02-11 06:24:47
482810   jY6LxRXwWqUhA2tECNgWWorrEEYvb0xXtg   -15.00000000   15vNs674ZZJ3EBZcbpB1iGTGSQFsGMbLKj   730afdcc7503e6fcf4a866edb402f1e5411ea263e7e35283b2e857b51d0854d0   2013-03-02 08:27:24
488750   jY6LxRXwWqUhA2tECNgWWorrEEYvb0xXtg   -733.00000000   13XTTarweiy2BkP9kKuntuHVur1tuKVz9G   0740963ce8062647a3736f95e1e2945ae6af24a85f786e7ddddc11baa2b029e4   2013-03-05 06:44:35

We haven't been hacked, otherwise you wouldn't be the only one affected.
We also didn't steal your coins, if you don't trust us on that it's ok but I wanted to state it very clearly.

I had a look at our server logs to view the IPs that accessed your wallet, the sequence looks something like :
 - ****** IP( my ip was here...)
 - ...
 - ****** IP
 - And then an other IP connects, reads your wallet, and a few minutes later sends your coins away, looks like a Russian IP

We're really sorry for what's happening to you.

Please let us know if you wish to file a police report (which I strongly advise), we'll forward the information we have that might be useful (the webserver logs that pertain to your wallet).

Kind regards
David - Paymium support"

It was hard lesson learned. No need for such title though.

Well thanks for sharing that tale... it is a lesson to us who are new here not to repeat the same mistake.

What kind of person has that kind of money invested in something like this but wouldn't use a paper wallet? Especially if you didn't regularly touch it.

Google 'ColdStorage'

Damn shame.

Obviously most likely the wallet url address has been created on compromised computer already. No need to broke into your house.

It's possible that Instawallet has stolen your coins - they can do it to a small amount of people who store large amounts. It's also possible that your computer is compromised.

Please use cold storage next time, and don't trust anyone other than yourself.

Hi all.

Just a few of things :
 - We didn't steal coins, the thread title should be changed OR it should be moved to the "Scam accusations" board. OPs call.
 - Security isn't as straightforward as almost everyone here seems to suggest. OPs machine was compromised, in which case it doesn't matter whether you store your coins on Instawallet, Blockchain.info, on your local Bitcoin client, a paper wallet, or a multiple factor authentication setup. Compromised machine = stolen coins, period.

That being said I want to re-state very firmly that this kind of theft sickens me on multiple levels, that I feel very sorry for OPs loss and that Instawallet will cooperate fully if the OP decides to file a police report or investigate this himself.

Wait, so instawallet advised you to file a police report, even gave you a nudge in the right direction, but you're not going to bother? For $40K?

Somethin' ain't passing the smell test.

I don't speak Russian and asking the cops to find  your bitcoins would be like asking them to investigate someone that stole your world of warcraft gold or something. my computer has not been compromised im assuming someone in Russia is just brute forcing instawalet? most of the money was won by gambling so ill probably just start over..score 1 for russia

Ummmm... wut?

You had $40k... in an instawallet... ?

Oh oh I see... you're the kinda guy who believes in "hidden in plain view"?  That URL was access to your $40k... anyone watching traffic could have snooped it.

Whether this is legit or not (I find legit hard to believe), a fantastic lesson in responsibility.

SSL encryption, makes it impossible to compromise a wallet by sniffing traffic between the client and the server.

This just happened to a friend of mine too, a substantial amount of bitcoins lost from an instawallet account a few hours after sending them there.

The only device used to access instawallet was an iphone that he had control over at all times between first accessing the account and the theft, so there is only two possibilities here:

• There is an iphone wallet stealer trojan or similar in the wild.
• Instawallet was hacked or the theft was internal.

My advice is to not use this kind of service, use something where only you can control the private keys to eliminate one risk factor.
If you need to use instawallet or similar services, send the coin somewhere more secure as fast as possible.

There is another possibility: was he possibly using a wifi network? It is incredibly easy to hack routers using WEP/WPA/most wifi encryption algorithms to intercept information. In fact this is one of the most widely used, and easiest, ways to steal personal info.

Please people never use WEP(cracked in 1997, considered exceptionally compromised, yet is still widely used).
Try to use WPA2 or a direct connection while sending passwords over any network. If you aren't  sure; do not use it! It is worth the annoyance. You do not want to risk using a wifi network that is not properly encrypted.

Stay safe, and keep updated on the latest security issues :)

Your friendly online battmann.

I highly doubt a bitcoin attacker just happened to be listening on wifi and wanted to steal bitcoins. Plus the website prob used ssl.
Why not just say Apple stole them? That is about as likely.

Lol what? You're joking right? The possibility of stealing personal info by wifi cracking is very possible. Especially if someone geeky and close to the victim knew about his stash; heck even just a random wardriver doing what he does best is more plausible than a well known company (that encourages opening a police case to settle particularly annoying customers claims) stealing from their customers.

I edited my post as you were typing. The site prob also used ssl.
But wecan dream up many hypothetical ways to get owned and sniffing over wifi is near the bottom of the list to me.
Hell, he might have been using att network. They stole the coinz!

Oh, and I dislike Instawallet. I wouldn't use their services ever; I did once, was quite disappointed, and immediately switched to a different service.

I just want people to know that unless you educate yourselves on security issues you are open to easy discovery/attack by wardrivers, and other 'hackers' of any sort. Oh, I also hate The Big Bang Theory. Fuck that show.

@mattypoo yeah I noticed your edit, and I don't think you understand how wardriving works. I don't really care to educate you on the ins and outs of the subject; but a good wardriver isn't 'sniffing' just one ssl encrypted site. People use the same password for other sites too ;)

Just...understand that some people are more creative than you. Just because you think you're safe doesn't mean you are; at all.

There is nothing common about common sense.

I hadn't looked at instawallet before.

So the wallet url is the password?

More then likely someone at this provider just scans proxy logs or put some monitor script?

wtf. That's like humongeously stupid... instawallet. Or am I not getting something?

There are numerous possibilities, unfortunately and AFAIK, nobody notified the support about this problem. And without any way to identify the wallet there is obviously no way for me to investigate. Let's have a look at the facts before starting to guess.

People debating about the security of wifi forget that the traffic is SSL-encrypted anyway.


I'll add as a kind reminder that SSL sits on top of TCP but under HTTP, meaning that the secret URL is never sent in clear over the internet.

Please don't forget what about ssl encryption:


Never doubt the stupidity of people. Just because a direct route of information is ssl encrypted  does not mean every place he could have sent relevant information is encrypted as well. Information gathering is key to an operation, and if the reward is high enough plenty of these 'hackers' would spend enough time to not only gather info from unencrypted data, but also try to get a keylogger or any other type of malicious software onto the victims computer. If the reward is high enough, the difficulty doesn't matter; It is only a matter of time. Is it the easiest possibility? No, so occam's razor applied you might find that it is a simple case of misplaced coins from a fallible human being.

Just please don't think the use of one ssl encrypted site means much to a dedicated wardriver. Trust me; it doesn't.

On chrome, if you paste a URL in the bar (or look it up by typing its first letters) it will be prefetched. So the following can happen: you paste your non-https instawallet URL in your bar with the intent of changing it to https, but it's already too late since it has been sent in cleartext by the prefetch mechanism.

Wait wait wait what? Davout, you bought instawallet? Why would you burden yourself with such a customer service nightmare?

Because it was going to close down if his company hadn't bought it, if my memory doesn't fail me.

Good riddance, I'd say.  :D

Well, that also goes if anyone tries to access the https wallet directly through http.
If you access the base URL with http it will redirect you first to the https version before redirecting you to a wallet.

Because I love customers :D
Also psy is right, the previous owner wanted to sell it, it wasn't going to close though, other buyers were interested.

Sounds like some kinda weird fetish thing.  :P

I can confirm that instawallet.com is down, won't respond to ping, and won't load. It also appears that its host instahost.net is also offline, ns1.instahost.net and ns2.instahost.net don't respond to ping. Maybe the host for instawallet.com is having issues? My guess would be server issues, but well see.

Instawallet works fine.

Have you been recently pounding hard on the API ? On Bitcoin-Central's API ?
Have you been running vulnerability scanners against either of these ?

Because if that's the case you'll automatically end up with your IP blacklisted in iptables.

Ok, an update:

The guy I was referring to did not use wifi when logging in to instawallet at the time the site was accessed to get the qr-code and bitcoins were transferred there, since that event took place in my car.
He could of course have checked in between that and the time the bitcoins disappeared.

Yeah, it's a possibility that he first tried to connect via http and then got redirected to https, then it could have been someone at the mobile provider.

I sent him a link to this thread, and got a reply that "it somehow sorted itself out, not sure how", so this indicates that maybe the error was between the chair and keyboard this time (or chair and phone).

davout, if you're interested and want to look into it I could PM you the tx info.

He's pinging instawallet.com
Shouldn't it be instawallet.org?

Because instawallet.com also doesn't resolve here, but instawallet.org does work.

Damn, davout... don't you recognize your own domain name and nameservers?

Whoops

BRB, building instawallet clone on .com address for phishing attack.

Be careful, you'll end up with customers.

By the way, can someone change the title of this thread ?
You don't have to trust me, but if you want to accuse me, do it in a scam accusations thread.

So you're saying that a wardriver, who knows that Bitcoin is only used by 0.007% of the population, is driving around, looking for open or crackable WiFi, in the hopes that one of those 0.007% of people is actually using Bitcoin instawallet (used by even fewer people), and that person just so happens to be accessing their instawallet at the same time said wardriver is watching their network, and that person also just so happens to be accessing their instawallet via http instead of https (even though instawallet is always accessed through https, so there would be no reason for an instawallet URL to be stored as http)?

I feel like it would be more likely for me to win the lottery twice than for this to happen.

I think what he's trying to say is that wardrivers will also go around randomly and infect people with malware through whatever vulnerability they can find. Honestly I haven't heard about this and I think it's doubtful that this is what happened.

See:

https://bitcointalk.org/index.php?topic=150724.msg1609919#msg1609919

give up. he made a suggestion and he will stick by it no matter the debate. his .0001% guess overrides all the other more likely guesses. he is obviously right. :-)

So the wardriver sets up a fake instawallet and redirects the user's traffic to said fake instawallet.  Wouldn't the SSL certs prevent this from happening?  The user's browser would warn him that it is not a valid cert, this looks like the wrong website, etc?

Otherwise, I don't know what you are attempting to infer by sending me to that link.

I'm saying you need to start playing the lotto. It's perfect for you ^.^

The lotto is a stupid way to lose a lot of money.  You're still not getting your point across.  Please say whatever you mean instead of attempting to make inferences through irrelevant links and phrases.

To the bitter end. The idea I suggested is the one and only possibility; I will accept no substitutes! There can only be ONE!!1!!!one!

Lol. If you like you can go back to my first post to attempt to understand what my 'point' was/is :)

On this report:

Quantitative Analysis of the Full Bitcoin Transaction Graph

http://eprint.iacr.org/2012/584.pdf

Page 11

Instawallet has 633,606 in accumulated incoming BTC

At 47.50 it is worth 30 Million Dollars!!!!

If Instawallet has fallen, this is Bitcoin's biggest theft.

Nope, you're wrong. Instawallet is stealing all the coins. To think otherwise is stupids.

www.shitsstupid.com

I am not saying who stole what.

I am just saying the SIZE!

Oh I know broski I'm just being a dick. Also plugging my site shitsstupid.com (http://shitsstupid.com) my ladyfriend free drew that for my birthday ^.^ she thinks she cant draw, she did that in about 8 hrs overall. Shits awesome.

So you're implying that a wardriver randomly driving by a place:
1) Knows that the person uses Bitcoin
2) Knows that the person is a wealthy Bitcoin holder
3) Finds a security hole in the person's computer allowing the insertion of a keylogger or other malware

Does this not seem unlikely to you?  How does said wardriver know #1 and #2?  In my city of 300,000 people, only 21 of them (average) use Bitcoin.  Does someone drive all around Eugene, Springfield, and the surrounding area looking for hackable wifi and inserting malware into the networks in the hope that they randomly come across someone computer-savvy enough to use Bitcoin, but not so computer-savvy that they know WEP is broken?  And they hope that at least one of those 300,000 people actually has a decent amount of Bitcoin stored up, in an instawallet, so that they can grab it?

It still seems like winning the lottery would be far more likely to happen than a random wardriver hacking someone's Bitcoins away.  Much more likely, in my mind, would be a friend or relative of OP knew about his Bitcoin holdings and got greedy.  It would be trivial to take the Bitcoins with physical access to the computer.

Thank you for reiterating my main 'point' as you put it; not exactly the word choice I would be using, but whatever works for ya.

Oh, and to answer your list "no" you need to do your homework honey. Piiissseee

And I still don't know what your point is.  Is it that a wardriver would randomly stumble across a Bitcoin user, or that a relative/friend is the likely culprit?

I'm gonna go see Dan Deacon at the house of blues.

I have gotten several pms from people saying they had the same thing happen. apparently the day the ownership changed is the day my cash got hacked. this is a big scam and obviously several people have been employed to cover it up. well have fun with that im sure what you deserve will come around eventually. seriously the same day ownership changes and a Russian hacker robs me!? I call bullshit. but seriously good job your like Hitler huge accomplishments but really fucked up

Because he stole all the Jew Gold?  ???

Wait... What??

OK, in which day did the ownership change, mind telling us?

The ownership changed? HUH?
What ownership? :P

Those are some serious allegations. You better put some more info here along with them.

And not one of them bothered to post in your thread? Doubtful.

Hahahahaa oh man my sides! I wish i was employed by Instawallet!  Lol this is hilarious, they offered you a police investigation AND YOU REFUSED on a 40k btc issue. This couldn't sound more made up. I mean I dislike the company, but you must really hate them.

If you don't remember windy guy I was the one who spent a half a minute to lead you to the instawallet cold storage...its like your five!

Man, I cannot wait to see who you start flaming next. I think I saw Blockchain.info steal your coins, go go go! ^.^

Pretty sure the dude got his system keylogged, so we might be in for some more fun.

"Blockchain.info colluding with instawallet owners - they stole from me too!"

The only ownership that changed is when you sent your coins to some web wallet. You owned them, then gave ownership to someone else. For convenience sake that may make sense for a hundred bucks or less. For $40,000...

http://www.thomasverbeek.com/blog/wp-content/uploads/2011/08/super-cool-story-bro.png

But what about how many bitcoins have gone out?

EDIT: actually even if that number is right- it doesn't mean it's worth 30 millions dollars. Technically it's worth nothing as they don't make a profit (as far as I know). If they steal it all, that's another story.

I'm not familiar with how instawallet works.  But i hear that the site sends you a javascript app which is run in the browser.  Your wallet is stored on the server in an encrypted form.  In order to steal bitcoin you must have the wallet.dat's priv keys. 

Lets assume instawallet folks are on the up and up, how would this attack have occurred.
So for a 3rd party to steal your coin he would have to:

1) obtain your encrypted wallet and brute force it:

-Intercept it by snooping your network
or
-crack the instawallet server and dl them all

If SSL is setup properly, i understand that is nearly impossible to intercept it.  even if you can sniff every packet (See diffe-helman exchange)
Crackin the instawallet server, maybe it happened and they do not know/wont admit

But then your wallet would still be password protected.  And unless you used a simple password (rainbow attack) this would not result in stolen coins.

2) Obtain your encrypted wallet + password
Again, he would need to crack the exchange, or some how defeat ssl AND have a keylogger on your machine

3) Send you a poisoned version of the javascript code that redirected your password entry to a 3rd party server in the clear:
--some type of dns attack, but even then the SSL cert should fail (not too knowledgable in this)

4)--Some type of malware (you've been rooted):
 caught your encrypted or unencrypted wallet when it was paged/cached to disk by your browser (not sure how all browsers handle it)
caught the link to your wallet from history/bookmarks
caught you pass from keylogging

4) social attack:  some one had physical access to your device, copied the link from your bookmarks/history and installed a keylogger/knew your pass

Any other attack vectors we can think of, and how likely are each above?  What device/os did this occur on and is this the only device you accessed the wallet on?  how long was the account open, and how long were the coins there before the theft?  i'm guessing "a while" because you say you won this playing SD.   

doobadoo:
You write too much. You should read more. Maybe even triple read you replies before clicking the Post button...
Maybe with a bit more reading you wouldn't confuse Instawallet.org with Blockchain.info....






What the hell is going on with this forum today? Half of the users got brain paralysis or what?

Instawallet wallets are not password protected.

Well, there's your problem right there.  Again, i said in my post that i don't know how instawallet worked.  I assumed (yes asses out of you and me) that they worked like blockchain.info....

Still how did the hacker get the copy of hte wallet (assuming instawallet didn't rip him off)?   it would still be encrypted by ssl.  does the browser page it off to disk?  is all you need to access the wallet is knowing the url?  unbelievable weak security if true.

Well, it's gotta be saved somewhere on the local computer in order for you to access it again in the future.  Unless you like typing long random strings of characters...

It is very weak security, but that doesn't stop people from using it.  I've used it before too.  It's very simple, convenient, and fast to use, which is nice.  Just don't put significant funds (LOL $40k) in it.

So if instawallet has access your coin isn't this just a matter of time till they are hacked, or "hacked" and they all run off with the coins.

One could speculate as much, though I'd say davout is one of the more trustworthy members of this community.  Certainly, $30M worth of BTC is a tantalizing prospect, but many people (myself included) still have morals they won't compromise no matter the dollar figure in question.

yeah he offers me help with police investigation but after emailing him some more he says there is no way I will get any money back so why would I waste my time convincing a police man to help me get my virtual wealth back.. lol its like if someone stole you monopoly money and you couldn't have family game night anymore. it seems like the owner of the site would try to help me track down a robber from his site, but since he is most likely letting it be hacked or helping with it..im screwed no my computer has not been compromised and yes I have my url on a written piece of paper that I type every single time.. I want my jew gold back lol.. correct me if I am wrong but ownership(went over seas) changed on 3/2/13 didn't it? I could be mistaken but that is what other members have told me that have also been robed in the last few weeks.. everyone get your coins out of instawallet if you don't want to lose them all.. this is a pretty fair warning to not screw up like I did.

Ok, i call troll at this point.  You lose $40K, and start making jokes about jews?  Seriously.

Did something happen?
On Instawallet's site, whatever webpage you try to go to, it gives a "We're sorry, but something went wrong." message.
WTF? :P

Critical: Current Bitcoin network fork. Action needed by mining pools. Merchants should hold transactions.

Valid reason ?
But apparently our bitcoind version is not affected. Should be back to normal in minutes.

LOLk
I guess I didn't see that :D I posted before that alert went up.
What's with the alert, anyway?
Instawallet's back up, so yeah :)

At the exact moment I was about to go to bed I check my mailbox and I have this e-mail from a Bitcoin-Central user that I know, basically says "SHUT YOUR BITCOIND NAOOO".
Which I did. There was a chain fork due to a bug in 0.7 that was triggered by 0.8. The choice was made to have chains converge on the 0.7 version.

Since instawallet runs a patched client that is 0.6 it isn't affected and will work fine as soon as the chains converge, until then transaction confirmations will slow down.

Up to this thread, I wasn't concern, but you made me look. It's up, and all my coins are still there. Damn, I don't want have seconds thought about IW, for I believe them to be up-and-up.

I sure the hell would hate to come here in the future joining some choir, then being told that I shouldn't have had all my coins in one place as I've read 100's of times on this forum, but to date have ignored said advice.

davout is about the last person on this board I'd suspect to pull a stunt like that.

Of course, now that I've said that, he'd be able to pull a stunt like that and no one would suspect him.  :-\

Just like Pirate... ::)

There was a guy yesterday who claimed that he invested 40K USD in bitcoin, and then the fork happened, and he was sweating all over because his wife didn't know.. Same guy ?

Online wallets are only for amounts you can afford to lose.

Pirate wasn't a Django Reinhardt fan, was he?  :(

I mean, we wouldn't have been screaming our heads off for weeks on how pirate was going to scam people exactly as he did weeks later, if he was a Django Reinhardt fan.

If you at least looked at the date the thread was started you wouldn't even ask...

Exactly - not difficult to find an IP in Russia and log in from there.. When the incentive is high enough, even law abiding citizens may become thieves. But this is just a general comment, not directed at anyone in particular.

wow I wonder how much he paid for instawallet.org? and he made 30,000,000. talk about a good investment! I wish everyone could be notified that has a instawallet before everyone gets robbed.

just wait till all the coins vanish as mine have! that info will be so solid you can eat it.. and trust me it does not leave a good taste in your mouth

He's made nothing.  $30,000,000 is the rough value of the coins currently deposited in instawallets, but that has nothing to do with how much profit he has made.

Unless he's implying that's what he would make if he runs.

Will somebody please put my mind to ease on this. IW is my wallet of choice, and you guys are starting to scare me.

~Bruno K~

Run, Forrest, run!

I have no reason to keep warning people I already consider my coins gone.. lol and yes im implying he is going to run with all the cash. he does in fact own all the coins stored at instawallet!

I feel much better now. For a while there I thought I owned my coins. That takes a lot of pressure off of me.

The lesson to be learned: Never keep anything more in an online wallet then you can afford to lose.

Or on an exchange, for that matter.

Or in your hotwallet, for that matter.

Or in any wallet whose private key has been generated by a computer connected to a network or having a wireless connection or an USB port or a printer...

I told my girlfriend that old piece of shit laptop would come in handy one day.

For others reading this, you have not been scammed if you have failed to do your own security. $40k should NEVER be online unless you are about to buy something for $40k. In an online wallet I would not want more than $300. Because that is how much I am willing to loose and not cry. Also consider paying for a VPN.
If I use two factor authentication over a VPN to access $100. I am not among the low hanging fruit.

I have a Raspberry Pi that is not connected to a network and only runs the wallet generation software over Linux. It is in an office that has 2 recording security cameras watching both entrances and this is in the middle part, not seen by a camera. I was told to put it in a safe when I am not there, and I could, but that is too much as I will anyway be aware if someone enters the premises, because of the alarm.

My 52.39 btc is also 'missing' sent from one instawallet to another address and the coins are not showing up in the block chain, and the new address isn't showing up either cause its never been used.....

and yet on the address where the 52.39 btc were sent from shows unspent coins but they are no longer in the instawallet :(

http://blockchain.info/unspent?active=17iQhdkNpoxYcNNcXodPjTWUqSuTC8XaF4&format=html   

yodog, send a PM to user Davout here in the forum. He's the only one who can help you.

https://bitcointalk.org/index.php?action=pm;sa=send;u=1929

40k in a online wallet? we official reached a new low in intelligence...

I did no response, I also left a message in the instawallet thread... and wow I sent 1 email to support, and posted the same situation a couple times where others had same issue and the guy tore my head off... (see below)

im actually an itelectual bad ass I was about to send the 740 btc to a secure wallet I was just using instawallet as a quick holder for a few days as I built my new system and poof it was gone.. yeah i cant really afford to lose that.. your right

I like IW, but something has changed recently and I can't put my finger on it.

Before, I was able to see my wallet in BlockChain and it will have the same amount as I view it on IW's URL page. Now the BlockChain continues to read 0 available with the coins set to some other address(es), yet still see a balance on the IW URL page. I'm still able to send coins and they get to their destination rather quickly.

To see what I mean, here's an address I set up to pay out a bounty: http://blockchain.info/address/1JppeHVdYQEBGR4uHVTqLQsb2FY1wUTziH

The wallet shows $0, yet at IW I clearly have 0.105 BTC of which I can still send, hopefully.

I look forward to having some light shed on this.

~Bruno K~

PS: To be clear, the wallet address is 1JppeHVdYQEBGR4uHVTqLQsb2FY1wUTziH

Calling troll on this one.

Wait one fuckin' minute!:


The title of the thread is "bit instant has been hacked".

THEN...


Thread title for above: please if you know anything about bitinstant stealing coins post here

...

Now he's claiming to have lost funds he's able to afford via InstantWallet--not Bit Instant.

Well, somebody blow me, jack me off, and stick a finger two fingers three fingers up my ass.

It seems the "intelectual badass", translation: moron, can't even tell the difference between bitinstant and instawallet.
Or maybe it was his autocorrect that changed dumbass to badass... ::)
Intelectual dumbass would really fit perfectly. Damn you, autocorrect!

Thus, deserves to loose his money. I'm guessing he went to Pattaya and still is bitter about paying for services when he picked up the wrong gender. (think about that last sentence)

I'm pretty sure that it's because Instawallet transfer BTC from their mass amount of wallets, so like if you transfered BTC1 to that wallet, and somebody requested a payout of BTC1, it would get the coins from your wallet to save on fees.

Dear Bruno,

Instawallet has always worked like a shared wallet, nothing has ever changed in this respect.

The fact you used to see coins remain at the deposit address simply means that :
 - there used to be less coin turnover,
 - the cold storage was less used,
 - any combination of the previous reasons.

Some stuff does change though, you used to get your transaction ID back immediately when sending coins, that's not the case anymore, sends are now asynchronously handled by a background worker. That's much more secure in terms of potential race conditions, much more robust in terms of infrastructure, much more maintenable (since now I can simply stop the worker, do some work on bitcoind and switch it back on).

The traffic also increases a lot, to give you an idea, our average weekly turnover is around 10kBTC in, and 10kBTC out, it recently peaked at around 50kBTC/week.

Your wallet has exactly the amount you expect to be available, you can't rely on blockchain.info to tell you how much is available in an account on a shared wallet.

This is how your balance is calculated :

https://dl.dropbox.com/u/52452135/Capture%20d%E2%80%99%C3%A9cran%202013-03-17%20%C3%A0%2001.00.31.png

Hope it's clearer :)

You've always being running a fractional reserve bank through.

Use easywallet.org for this kind of stuff:
- I know the operator
- He receives 0.0335% daily fee for the storage so he does not need to steal
- There is an automatic, functioning mixer

That's a fine explanation I can live with. Thanks, bud.

~Bruno K~

definitely.

EDIT: why use an online wallet to temporarily store sizable amounts of coins. Use a paper wallet or vanitygen or whatever for fucks sake.

EDIT2: shit, I fell for the troll

The coins showed up to the sent wallet, so everything has been resolved. I know for next time to just use a bitcoin mixer and just pay the 1-3% fee...

You really want to lose your coins, don't you? ;D

If you definitely want to do that, use the easywallet.org. The only online service that I have been able to keep BTC100 for an extended time without anything happening.

I have filtered 1000$'s of dollars worth of btc thru bitcoinfog, not once has the coins been held up like this on instawallet, or entire wallet disappearing from blockchain.info It had about 3500$ worth of my coins, luckily I had backed up the wallet!!!

Instawallet has been leaking wallet URLs to Google making them fully indexed/searchable.

Absolutely devastating security hole. I can't see ever trusting them again:

http://www.adaptiveglass.com/?p=656

I feel like I knew about this a long time ago somehow.  Did this happen before?

It did.
They said it was because it created a new wallet when google bot visted them. Very quick to write it off.
I'll try and search the thread later. Great lolz will follow :)

Sweet.  My memories are vindicated.

I found this:  https://bitcointalk.org/index.php?topic=87387.msg982779#msg982779
It might have been TorWallet you were thinking of.

But I did find this:  https://bitcointalk.org/index.php?topic=6785.msg387831#msg387831
Didn't follow the thread much further.  Obviously, Google indexing instawallet pages is a problem that has existed since it started.  It seems like this post wasn't taken seriously at all.

What if a person sets up an RSS feed from Google, informing him each time the phrase "instawallet.org/w" is indexed? All the person would have to do is check the complete URL to see if it's funded.

I'm sure there are, or will be, people who'll think they're protected, posting the URL to their InstaWallet on some public domain.

Instawallet now has a robots.txt file that blocks Google from indexing all Instawallet URLs with "/w/" in them.
:D

@davout

I trust your site, but allow me to play Devil's advocate.

Could a scammer do somthing similar to the following?

He meets his mark at Starbucks where one of his comrades has already sat up a URL sniffer. He has the mark whose new to the Bitcoin scene go to instawallet.org. A new wallet it generate. Money and bitcoins change hands.

A wise scammer would wait several days before attempting to steal back the funds with the hope that more would be in it now that the mark feels comfortable using the system, being too lazy to get another IW or exploring another client.

If I lived in Chicago and my name were Rockso, this is what I would attempt.

Isn't it true that several certificate authorities have had their signing certificates stolen, meaning that it's possible for attackers to initiate man-in-the-middle attacks on SSL sites without alerting the end user?  I don't know the details, but I'm sure I've read in several places that SSL isn't particularly secure given the number of CAs that most browsers trust by default.

http://blog.g0tmi1k.com/2009/07/video-stripping-ssl-sniffing-https.html

Yes, I've seen that before, and experimented with it, but it's not what I'm thinking of.  That technique tricks the user into making a regular HTTP connection by modifying links.  So if you visit http://yourbank.com/ and it has a link to https://online-banking.yourbank.com/ they effectively just remove the 's' after 'http' so you make a regular unencrypted connection, which they can then sniff.

http://www.computerworld.com/s/article/9219663/Hackers_may_have_stolen_over_200_SSL_certificates is more the kind of thing I'm talking about.  I break into a Dutch certificate authority's computers, and generate myself a certificate for instawallet.org.  I then poison your DNS so you come to me instead of directly to instawallet.org, I present you with my ill-gotten certificate, and your browser shows you that you're connected securely and everything's encrypted and fine.  I can choose to pass you on through to the real instawallet.org, or I can just steal your secret URL and present you with a message saying "restarting bitcoind takes all day, sorry" or similar.

The matter about google indexing instawallet's pages was brought up on Torwallet's thread, yes.
Here is Davout saying it doesn't matter: https://bitcointalk.org/index.php?topic=87387.msg979815#msg979815

3.2 BTC stolen from me, and 3.2 from a friend of mine

Looks like the whole site is offline now.

Wow, shitty.

Aaaaaaaaand it's gone. Forever. This is an ex-change, wait, I mean, this ship has banked, wait, I mean, it's bubble has popped.

Find out who was on the board of this company.  Do not use lawyers (except to consult with them perhaps)  BUT LITIGATE LOCALLY AND PERSONALLY AGAINST THOSE BOARD-MEMBERS!  Board-members have access to all IT people, through the nature of IT.

Time is money, so do it now.  I only had < ten bucks in instawallet but will gladly advise any legal team.  The only way to FORCE wallet holders on the web to be real, is to use the power of court fines against them.  It is a fiscal responsibility of all who accept holding the money of the people of earth, that you harden your system, and act immediately, and openly, and FAST, when you get hacked.

What if Batman had 100,000 in instawallet?  BTC I mean?  The batcave miners need to hear what I am saying.  Every hour you should be asking how many fly by night companies you will allow in your network.

Board-Members? IT people? I don't think you understand how bitcoin businesses work.

Here's a picture illustrative of the typical bitcoin companies main office.

http://3.bp.blogspot.com/_Ek0TdUtS6yM/SYDNz7qtJMI/AAAAAAAABmM/kqhjOSc9ciA/s400/bunny2quickblogig0.jpg

This ain't good!


It was down yesterday also.

Phinn, go look in Service Discussions. They have served their last bit(coin), their media is write-protected, ENDOFLINE.

Greyhawk are you for real?  Because I see a mess of bullshit in your post.

This website has been involved with gambling website and others.  They have stolen from gangsters.  Do you think Internet memes are funny to gangsters?  No, they're not.

I work in IT.  If there is anyone who wants to pay me BTC to consult, I will give you a 12 month guarantee that your funds will not be absconded with like this.  Security in IT is at a premium.

Talk to me more greyhawk about how instawallet had no servers?  No outside partners?  IS it a PC in someone's basement?

I have been in the newb forum for a while, so forgive me if I say that your reply is poor.

I am sure someone with a suit, was hired by this website (instawallet) at some point.  I want web links to litigation info, and am ready to assist any victims.  I am not a lawyer but am damn good in court and can file briefs like nobody's business.

You still don't seem to understand.

Let me show you.

Here's Instawallet's business adress:

https://maps.google.com/maps?q=10755-F+Scripps+Poway+Pkwy.+%23472&hl=de&biw=1680&bih=925&um=1&ie=UTF-8&sa=N&tab=wl

Yes, that's a hair and nail spa in a San Diego shopping mall.


But "wait", you say, "that french dude bought Instawallet and France is not in San Diego."

Alrighty then, so let's look at the french dude who now owns instawallet. Quickly grab his business adress of one of his other assets and...

https://maps.google.com/maps?q=34+Rue+Charles+Chefson,+92270+Bois-Colombes,+Frankreich&hl=de&ie=UTF8&ll=48.917822,2.276246&spn=0.002908,0.006968&sll=37.0625,-95.677068&sspn=56.637293,114.169922&oq=34+CHARLES+CHEFSON+++BOIS-COLOMBES,+92270&t=h&hnear=34+Rue+Charles+Chefson,+92270+Bois-Colombes,+Hauts-de-Seine,+%C3%8Ele-de-France,+Frankreich&z=18

...and it's a poor people apartment building in a Paris suburb.

See where I'm going here?

Thanks for your excellent reply.

French bitcoiners:  Watch this street for signs of Interpol.  If they are not on this person's trail, fire them as a police organization.  Remember, Interpol was made by Germans and babysat by the Nazis so if they aren't on this address within 24 hours, that smells like a rat.  Why allow Globo-Cop if they let financial criminals slip by?

Where's the 24 hour camera on this french street?  Bitcoiners want the URL.  somebody get one of these cheap a[artments and hang a tcpip cam out the window, I am sure the batcave miners will watch it 24/7 for any suspicious individuals.

Can you tell me if there are any serious wallets online?  Are any backed by real corporations?  That have IT departments I mean.

Any info on HOW MUCH was paid by some French dude, for instawallet?

Also are there any copyright lawyers drafting litigation based on pending patents?

As I said, I am ready to do prosecutorial work for any legal minded people on this issue.  What was that domain worth?  What did it "sell" for and who were the original owners (who sold it?)

Thanks for being helpful.

What's Instawallet business model? Is it a non profit organization?

Well profit is made when someone sells.

But if the site has no IT security, well, I would not have ever used it, even if I did have only pocket change, the opportunities for theft are amazing.  Much better to be a criminal in the bitcoin mind trust than smart I guess?  Crime does pay when you tell people with big accounts (as instawallet is doing) that they will be dealt with on a case by case basis.  This means they lost money, and that's fiduciary irresponsiblity.

Where were their servers hosted?

Where's the pastebin link to read more?

It's hard to tell as well if it was a 'hack' or an insider job.

Purchase wallet service with loads of coins stored for 10K USD worth.

Then, site gets 'hacked', and coins worth 100K USD or more gone...

That's a good ROI...

Sure hope it all works out though, but goes to show users must be careful!

Not that I'm aware of, no.

Its hard to tell, if the owners abscond.

But uncle Vito knows, that you should always know who is holding your wallet!

Wow.  Okay, so nobody knows if there is even one secure web based wallet out there.  I guess people use these to tumble their cash?  Hmm, pretty stupid to steal from uncle Vito.

Somehow I read this post in such a way as to not worry any longer after adding my two cents to this thread. I felt secure enough to leave well enough alone. Boy did I fuck up.

Copyright law and patent law are two separate beasts.  You're not inspiring a whole lot of confidence in your legal capabilities.  Even if you have some special insight, what standing do you have to represent anyone else in court?  In most jurisdictions you cannot practise law without a licence.  You can choose to represent yourself in a legal action, but you can't generally act on behalf of someone else unless you're a properly qualified and licensed lawyer in the relevant jurisdiction.

Right now it hasn't even been confirmed that funds have been lost. 

Also, Interpol is a clearing house.  The relevant local law enforcement agencies need to be involved before Interpol can be used to facilitate co-operation between the different national agencies involved.

Whether or not anything was stolen from Instawallet (and that's unclear right now), a computer crime has likely been committed.  I'd certainly like to know to which authorities Instawallet has reported that crime or whether they're not going to report it because they don't want the service they were operating coming under scrutiny.

I demand that they file a police report if they were hacked. They need to come here within 24 hours and show proof of some sorts that they did such. If not, then theymos should most definitely give 'em the tag, for it would surely show that a hack did not occur.

There should be no mother fucking reason for not filing a report and I will not accept ANY excuse for it not being done.

~Bruno K~

Good point. Did you have coins jammed up in this Bruno ?

Bruno, for as much time as you put into weaving your investigations together, you never got around to getting a real wallet? Sucks dude.

Yes!


This is exactly correct, and deserve all coming to me and blaming no one but myself for not getting a real wallet sooner, but was seriously exploring the option as of late, yet kept putting it off. I felt it safe since never having a problem in the past, starting with small amounts, then adding a nest egg, opting to not touch two accounts. I had a third account with less than a full bitcoin in it due to a recent purchase to satisfy a bounty.

What I find odd is that two separate sites of theirs are down at the same time. Surely they weren't both on the same server or were they?

Well, all of their sites respond from the same IP.

Ping wird ausgeführt für instawallet.org [188.165.203.58] mit 32 Bytes Daten:
Antwort von 188.165.203.58: Bytes=32 Zeit=54ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=52ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=80ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=93ms TTL=57

Ping-Statistik für 188.165.203.58:
    Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
    (0% Verlust),
Ca. Zeitangaben in Millisek.:
    Minimum = 52ms, Maximum = 93ms, Mittelwert = 69ms

Ping wird ausgeführt für bitcoin-central.net [188.165.203.58] mit 32 Bytes Daten
:
Antwort von 188.165.203.58: Bytes=32 Zeit=61ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=63ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=105ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=107ms TTL=57

Ping-Statistik für 188.165.203.58:
    Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
    (0% Verlust),
Ca. Zeitangaben in Millisek.:
    Minimum = 61ms, Maximum = 107ms, Mittelwert = 84ms

Ping wird ausgeführt für paymium.com [188.165.203.58] mit 32 Bytes Daten:
Antwort von 188.165.203.58: Bytes=32 Zeit=55ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=52ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=92ms TTL=57
Antwort von 188.165.203.58: Bytes=32 Zeit=83ms TTL=57

Ping-Statistik für 188.165.203.58:
    Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
    (0% Verlust),
Ca. Zeitangaben in Millisek.:
    Minimum = 52ms, Maximum = 92ms, Mittelwert = 70ms

Sorry for your loss. Best of luck sorting it out (If you havn't already!)

A wallet got created every time someone hit instawallet.org, so that wouldn't surprise me.

I suspect, from the bottom of my sleeve, that there are maybe 100,000 addresses with any balance whatsoever, and of these, 10,000 hold a balance greater than BTC1. A few lucky guys maybe holding BTC100.

So the amount of data is reasonable, and they are well positioned to return all bitcoins to their rightful owners, and everything is proceeding as planned.

The 90 day account freeze is a must, because some owners may not access their wallet every week. Further, I believe they will have a claims department open ever after for anyone who wakes up late but remembers his URL. In my opinion, Instawallet team may recover their reasonable costs from the amount returned, if a claim is late for more than 1 year.

The positive side is, your bitcoin wealth is frozen at the exact time you might be most tempted to sell it, and you should thank the "hacker" for this ;)

Hi there! 

Lawyers are a criminal cadre.  That is why they prosecute and damage, anyone who tries to muscle in on their turf.  Lawyers, drag their feet, and lose on purpose.  Lawyers, require their client to declare themselves incompetent, that is the nature of an agreement with a lawyer.

Lawyers get trained by the law sage cult, in London, called the barristers association or "The Bar" ...In the old days, it was a series of restaurants where lawyers and so forth, would meet and conspire.

Lawyers are relics of Napoleon, most of the law which law students have to memorize is black letter law which derives from Napoleon's Code.  He was a tyrannical asshead.

In some countries like Ireland, there are levels of those who can help others with their legal issues.  But yes, you are correct, in most countries, you have to obey the law cult of the London cadre, or be punished.  However, as they fail more and more, their whole cadre is facing extermination.  The more theivery that goes on, the more finite, will be the life of their group.  Lawyers, in fact, have destroyed the notion of justice, which they admit, has nothing to do with their practice.

I am simply saying that I will be happy to share data I have gained on this crime, to anyone who has been harmed.  Even just by offering to help for free, I place myself well above the lawyer class, who are antihuman shite-people. 

I am just a guy who likes to help identify incompetent authorities.  The authority hates bitcoin, and they are not likely to pursue this matter with any speed.  It is up to the community to do it for themselves, and hiring lawyers is a waste of money unless you are rich and can afford to use the lawyer as a weapon.  Rich people can feed money like ammo, into the lawyer-cannon and damage people, but the common man, cannot afford to wield the weapons called "lawyers".  I am just an info collector, that's all.

it is legal or not ? what I can do if my wallet will steal someone ?

The general history of bitcoin "businesses" and "services" suggests their is a precedent for this services users to express some skepticism that the claims process will be executed smoothly to its completion. Another precedent suggests there is a sufficiently large number of bitcoin users who simply don't care to know better that might have chosen to use installation as a long term storage solution for more than small amounts of coins.


This all depends on how a person would be tempted to sell it and in what portion. Bitcoin has incredible supply inflexibility that could keep this rally going to the moon, but this week's rise has me concerned enough I've bought myself into a healthy precious metals position (a mix of silver and rhodium) as a hedge. If we are back to $20 or even $85 in a month my hedge would have been untenable, because I've elected not to use an online wallet I had the decision making power to do this. Even if we are pushing four digit USD/BTC prices I'd be sore that the power to make this decisions was not allowed to me by these nebulous things known as "circumstances."

hahahhahahah look at instawallet now! I hate to tell you all this but.. I told you so! he either took the money or gave someone a backdoor way to steal all the wallets. go ahead make a claim he wont return any bitcoins guaranteed!

Don't be such an arrogant ass just yet.

FTFY.

So you don't like lawyers then?

does anyone know a computer genius lawyer that will work for $15 per hour? send him my way lol..

and this thread still has a title that is flat out defamation.

does anyone knowwhat I can do if my wallet will steal someone ?  it is legal or not ?

Sincerely not being an ass here, but would you be so kind as to reword your request so that I or some other can answer your questions.

Thanks, bud. (sincerely)

~Bruno K~

I was going to rage at him, but I thought that I should let somebody else do it, because I'm not that good at insulting people politely :P
But yes. I don't believe that your wallet will steal anyone anytime soon :)

Come on guys, don't be harsh with us non english natives.

For injust: no, it's not legal for someone to steal your BTC. Anyhow you will have a hard time demonstrating to a judge that a certain Instawallet was YOURS (well, you just have an URL...)

And then, I bet that for 99% of the judges Bitcoin is still "play money".

Seriously, I wasn't being an ass, for I truly wanted to make sure that his concern was addressed in this case. I see that an attempt has been made, and for that I thank you(s).

Peace, Mike.

~Bruno K~

Never send your bitcoins to any online service. They will all eventually screw you over. Its almost guaranteed.

But start a myriad of online wallets so that you can be the screwer: https://www.google.com/search?q=33.786541133&aq=f&oq=33.786541133&aqs=chrome.0.57j62l2.4926j0&sourceid=chrome&ie=UTF-8

if someone has my wallet.dat file(it is encrypted and with password) is there something that this person can do with it ?

If the password is strong enough, the answer is no.

If the password is weak, the answer is YES.