Bitcoin Forum

Dear MtGox Customers and Bitcoiners,

As you are aware, the MtGox team has been working hard to address an issue with the way that bitcoin withdrawals are processed. By "bitcoin withdrawal" we are referring to transactions from a MtGox bitcoin wallet to an external bitcoin address. Bitcoin transactions to any MtGox bitcoin address, and currency withdrawals (Yen, Euro, etc) are not affected by this issue.

The problem we have identified is not limited to MtGox, and affects all transactions where Bitcoins are being sent to a third party. We believe that the changes required for addressing this issue will be positive over the long term for the whole community. As a result we took the necessary action of suspending bitcoin withdrawals until this technical issue has been resolved.


Addressing Transaction Malleability
MtGox has detected unusual activity on its Bitcoin wallets and performed investigations during the past weeks. This confirmed the presence of transactions which need to be examined more closely.


Non-technical Explanation:
A bug in the bitcoin software makes it possible for someone to use the Bitcoin network to alter transaction details to make it seem like a sending of bitcoins to a bitcoin wallet did not occur when in fact it did occur. Since the transaction appears as if it has not proceeded correctly, the bitcoins may be resent. MtGox is working with the Bitcoin core development team and others to mitigate this issue.


Technical Explanation:
Bitcoin transactions are subject to a design issue that has been largely ignored, while known to at least a part of the Bitcoin core developers and mentioned on the BitcoinTalk forums. This defect, known as "transaction malleability" makes it possible for a third party to alter the hash of any freshly issued transaction without invalidating the signature, hence resulting in a similar transaction under a different hash. Of course only one of the two transactions can be validated. However, if the party who altered the transaction is fast enough, for example with a direct connection to different mining pools, or has even a small amount of mining power, it can easily cause the transaction hash alteration to be committed to the blockchain.

The bitcoin api "sendtoaddress" broadly used to send bitcoins to a given bitcoin address will return a transaction hash as a way to track the transaction's insertion in the blockchain.
Most wallet and exchange services will keep a record of this said hash in order to be able to respond to users should they inquire about their transaction. It is likely that these services will assume the transaction was not sent if it doesn't appear in the blockchain with the original hash and have currently no means to recognize the alternative transactions as theirs in an efficient way.

This means that an individual could request bitcoins from an exchange or wallet service, alter the resulting transaction's hash before inclusion in the blockchain, then contact the issuing service while claiming the transaction did not proceed. If the alteration fails, the user can simply send the bitcoins back and try again until successful.

We believe this can be addressed by using a different hash for transaction tracking purposes. While the network will continue to use the current hash for the purpose of inclusion in each block's Merkle Tree, the new hash's purpose will be to track a given transaction and can be computed and indexed by hashing the exact signed string via SHA256 (in the same way transactions are currently hashed).

This new transaction hash will allow signing parties to keep track of any transaction they have signed and can easily be computed, even for past transactions.

We have discussed this solution with the Bitcoin core developers and will allow Bitcoin withdrawals again once it has been approved and standardized.

In the meantime, exchanges and wallet services - and any service sending coins directly to third parties - should be extremely careful with anyone claiming their transaction did not go through.

Note that this will also affect any other crypto-currency using the same transaction scheme as Bitcoin.


Conclusion
To put things in perspective, it's important to remember that Bitcoin is a very new technology and still very much in its early stages. What MtGox and the Bitcoin community have experienced in the past year has been an incredible and exciting challenge, and there is still much to do to further improve.

MtGox will resume bitcoin withdrawals to outside wallets once the issue outlined above has been properly addressed in a manner that will best serve our customers.

More information on the status of this issue will be released as soon as possible.

We thank you for taking the time to read this, and especially for your patience.

Best Regards,
MtGox Team

WHAT?!?!!? this is stunning in so many ways.


1. who are these "core developers"?

Gavin's latest posts are visible here:
https://bitcointalk.org/index.php?action=profile;u=224;sa=showPosts (https://bitcointalk.org/index.php?action=profile;u=224;sa=showPosts)

If he posts an update, whoever catches it first please provide a reference in this thread.

We should also expect official statements from CoinBase, BitPay, etc.

Unload some BTC if you haven't already.  Re-buy once panic bottoms.

Keep an eye on multiple exchanges in real time here:
http://bitcoinwisdom.com/ (http://bitcoinwisdom.com/)
or here:
https://www.tradingview.com/e/?symbol=BITSTAMP%3ABTCUSD (https://www.tradingview.com/e/?symbol=BITSTAMP%3ABTCUSD)
or here:
https://bitcoinaverage.com/#USD (https://bitcoinaverage.com/#USD)

Doesn't Gox use a custom version of the client?

The flaw isn't so much in Bitcoin as it is in exchange-systems. Many exchanges use the tx-id to uniquely identify transactions, but as it turns out, an attacker can change the tx-id without changing the actual transaction, rebroadcast the changed transaction (effectively creating a double-spend) and if his altered transaction gets accepted into a block instead of the legit transaction, the attacker receives his coins and can complain with the exchange that he didn't. The exchange will then check their db, fetch the tx-id from it, look it up in the blockchain and not find it. So they could conclude that the transaction indeed failed and credit the account with the coins.

A simple workaround is to not use the tx-id to identify transactions on the exchange side, but the set of (amount, address, timestamp) instead. If a user complains about not receiving their withdrawal, support can look it up using these 3 variables. It takes a little bit more work from support, but it prevents this attack from succeeding.

While it'd be nice if the tx-id isn't malleable, blaming this problem on a flaw in the protocol is quite a stretch.

The flaw isn't so much in Bitcoin as it is in exchange-systems. Many exchanges use the tx-id to uniquely identify transactions, but as it turns out, an attacker can change the tx-id without changing the actual transaction, rebroadcast the changed transaction (effectively creating a double-spend) and if his altered transaction gets accepted into a block instead of the legit transaction, the attacker receives his coins and can complain with the exchange that he didn't. The exchange will then check their db, fetch the tx-id from it, look it up in the blockchain and not find it. So they could conclude that the transaction indeed failed and credit the account with the coins.

A simple workaround is to not use the tx-id to identify transactions on the exchange side, but the set of (amount, address, timestamp) instead. If a user complains about not receiving their withdrawal, support can look it up using these 3 variables. It takes a little bit more work from support, but it prevents this attack from succeeding.

While it'd be nice if the tx-id isn't malleable, blaming this problem on a flaw in the protocol is quite a stretch.

I thought it might be worth pointing out for the Bitcointalk users who hate altcoins, this kind of thing is precisely why altcoins should be encouraged if it's true.

Note that this will also affect any other crypto-currency using the same transaction scheme as Bitcoin.

This isn't good at all. Naysayers will have a field day with this. Panic sellers probably gonna panic.

To introduce these new rules in the network, we add both nVersion=3 blocks and nVersion=3 transactions (nVersion=2 transactions are skipped in order to keep the version numbers synchronized).

Hmm this website just released this: http://www.businessweek.com/news/2014-02-10/bitcoin-exchange-mt-dot-gox-says-users-can-withdraw-cash-as-normal (http://www.businessweek.com/news/2014-02-10/bitcoin-exchange-mt-dot-gox-says-users-can-withdraw-cash-as-normal)

They say everything will be ok i dont know why everyone is selling there coins?

I think that's just happened :(

This is a blame game - they want to buy some time.
If the procol got bugs, how come it's only MtGox that has detected this bug?

very clear explanation of what's happening:

http://www.reddit.com/r/Bitcoin/comments/1x93tf/some_irc_chatter_about_what_is_going_on_at_mtgox/cf99yac

$513

Also, why has it gone 5 years before the bug was found, this is pure Bull, i dont believe it.


 >:(

Hmm this website just released this: http://www.businessweek.com/news/2014-02-10/bitcoin-exchange-mt-dot-gox-says-users-can-withdraw-cash-as-normal (http://www.businessweek.com/news/2014-02-10/bitcoin-exchange-mt-dot-gox-says-users-can-withdraw-cash-as-normal)

They say everything will be ok i dont know why everyone is selling there coins?

http://
Hit $102 on btc-e.

It's probably not even a bug just gox passing blame.

Why do we drill "mainstream" people with "Decentralized" when one exchange's not so legit announcement can do to the market what mtGox did today? How is that not centralized?

Why do we drill "mainstream" people with "Decentralized" when one exchange's not so legit announcement can do to the market what mtGox did today? How is that not centralized?

People's decision to sell (at 120 USD at BTC-e for example) was a perfectly decentralised decision. No one else was forced to buy or transact at such valuations!  :D

I don't get why people would sell that low. Surely they can only be losing money.

So much FUD in here I dont even think people REALIZE that theyre FUD'ing

http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/
http://blog.oleganza.com/post/76213549017/mtgox-and-malleable-transactions

Sure, it's BTC fault haha.
Again, I only regret not having any buy orders at 150. It's not malice if people give you money themselves, right.

We all know what the doomsday scenario is - a flaw in the protocol renders the currency worthless. I do suspect that they are insolvent and are using this as a last ditch attempt to manipulate the market to buy back in to balance their books. The coins that they prevented people from withdrawing have been pumped to other exchanges, then bought back in at the bottom.

If their solvency issues miraculously solve themselves in the next few days, we'll know why.

This is a f cking bad news!!! That mean the core developers better hurry. I want to withdraw!!

I think it's reached the point now where we should just organise a mass boycott campaign against Gox.  They're more trouble than they're worth.  Just because they were the biggest exchange at one point, doesn't afford them any special privilege to shit all over our new digital economy to further their own ends.

For all those that are panic selling.....I'm panic buying.

Thanks for the early birthday present.  :)

We all know what the doomsday scenario is - a flaw in the protocol renders the currency worthless. I do suspect that they are insolvent and are using this as a last ditch attempt to manipulate the market to buy back in to balance their books. The coins that they prevented people from withdrawing have been pumped to other exchanges, then bought back in at the bottom.

If their solvency issues miraculously solve themselves in the next few days, we'll know why.

The only people to blame are Gox and panic sellers.

This is a f cking bad news!!! That mean the core developers better hurry. I want to withdraw!!

MOTHERFCKING GOX BULLSHITTING TO SCARE NOOBs. This is not a FLAW but the design of wallet to validate transactions. It has BEEN FIXED by reference design. But fcking retard Marks still didnt get his shitty wallet software updated.

Mark, you're a worthless POS.

http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/

Sure, it's BTC fault haha.

So this is pure FUD by gox? When are these guys actually going to go under? Cannot fathom how they're still in business.

Dont listen to GOX. Reference wallet software does have this problem

MOTHERFCKING GOX BULLSHITTING TO SCARE NOOBs. This is not a FLAW but the design of wallet to validate transactions. It has BEEN FIXED by reference design. But fcking retard Marks still didnt get his shitty wallet software updated.

Mark, you're a worthless POS.

so gox's latest ploy, blame bit coin, yet it work for everyone else you are just running you own bad software client thats not updated

well, this is one giant fuck up. either MtGox is outright lying or bitcoin will go on in a coma. perhaps MtGox justs wants to buy cheap who knows. but this can have serious implications for trust in developers.

FFS I missed the crash, how long was it at 110 for?

FFS I missed the crash, how long was it at 110 for?

I really don't understand why some were panic selling as low as $500??
(Now price are back to reasonable levels)

This Gox statement of shifting blame is obviously another excuse not to pay out, it only affects people with fiat/bitcoins inside Gox.

Gox has been trading below other major exchanges for days now, Gix pulling away is kind of expected, right? For those who have coins in exchanges elsewhere, there is little to worry... why doesn't those people see that?

MtGox has been the cause of most of the crashes. They are not incompetent but are malignant, otherwise they would of closed their doors. But instead they are making good money with throwing the market at any direction they want.

But the Bitcoin community is a flock of emus, who are not able to organize, to finally root out MtGox from the entire market system. When a proposal is made about doing something to protect the integrity of the market, then all the emus will hide their heads in sand and hope that the free market fixes everything...
Most of the bitcoin enthusiasts are moronic get-rich-quick people, who dream about getting rich while doing nothing...

The media are going to love that volatility story.

It went lower than that. Was at about $100. I've no idea who was selling for that low. Why would they? It's baffling.

It went lower than that. Was at about $100. I've no idea who was selling for that low. Why would they? It's baffling.

Wait wait wait. So someone got bitcoin for ~$100?

IF and big IF Mt.Gox survive this you would have to be a fool to stay with them, they are done now, R.I.P Mt Gox

http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/

Sure, it's BTC fault haha.
Again, I only regret not having any buy orders at 150. It's not malice if people give you money themselves, right.

IF and big IF Mt.Gox survive this you would have to be a fool to stay with them, they are done now, R.I.P Mt Gox

Wait wait wait. So someone got bitcoin for ~$100?

This is a f cking bad news!!! That mean the core developers better hurry. I want to withdraw!!

I think they know they're done. This is probably just their death-rattle. If people still use them after this then I can't even.

A shitload went for 102.

There will be many many more loosers in that flash crash than winners. About 4k BTC were bought and sold throughout the 2mins of the crash and recover on BTC-e. So it's likely that people entrusting their money to auto-trading robots saw those Bots sell their holdings on the way down sell, sell, sell. That's likely what caused the crash.
Depending on the settings they were using the Bots will have either not bought back or tried to buy back and failed/got a worse price than they sold for. There will have been many manual buy's at the low levels and they would have been buying the Bots panic sells. This is another reason NOT to use a Bot. They do not win over the long run.


http://en.wikipedia.org/wiki/2010_Flash_Crash (http://en.wikipedia.org/wiki/2010_Flash_Crash)

Fucking Japanese mafia.

They are not Japanese, American mafia maybe?

Mark is French

A shitload went for 102.

Mark is French

This is GREAT news. It means Gox has identified the problem and is taking steps to correct it.

Sorry GOX you failed to get your coins back cheaper  :'(  :'(  :'(  :'(  :'(  :'(

Well done to the smart bitcoin community, I'm not very technical but your quick responses made it clear this a non-issue & GOX FUD.

Bitcoin community 1               MTGox 0

(I actually think the people who tried to cause crash on this news have actually lost money because of the swift rebound.)

 

Not entirely. A shitload went for prices ranging from $600 to $102. ALL open buy orders in that range were filled, only the few at the very bottom went for $102.

This is what happens if some retard dumps 10,000+ coins in a no-limit order :)

"the retard" might be a leverage trading platform that make margin calls..... so many ppl lost money because of this FUD and its out of their control.

Not sure why you put retard in quotes. Someone dumping 10,000+ coins at an average price of, say, $300 (not sure, depends on how buy orders where distributed in that $102-$600 range) which are worth $600 each a minute later, how is that not retarded?

Not sure why you put retard in quotes. Someone dumping 10,000+ coins at an average price of, say, $300 (not sure, depends on how buy orders where distributed in that $102-$600 range) which are worth $600 each a minute later, how is that not retarded?

...and away we go.

http://www.pcworld.com/article/2096060/bitcoin-price-plunges-as-mt-gox-says-flaw-in-protocol-allows-fraud.html

???Is this bug fixed already in other software?

So who can tell how long it will take MtGox to upgrade their withdrawl system to a correct version?

The malleability issue seems real enough.  Something was published on it on 21 january on bitcoin.it, maybe someone had to try it out

Is it actually a flaw in the Bitcoin protocol, or something wrong with Gox's software?

21 January 2013‎

...and away we go.

http://www.pcworld.com/article/2096060/bitcoin-price-plunges-as-mt-gox-says-flaw-in-protocol-allows-fraud.html

...and away we go.

http://www.pcworld.com/article/2096060/bitcoin-price-plunges-as-mt-gox-says-flaw-in-protocol-allows-fraud.html

Not entirely. A shitload went for prices ranging from $600 to $102. ALL open buy orders in that range were filled, only the few at the very bottom went for $102.

This is a blame game - they want to buy some time.
If the procol got bugs, how come it's only MtGox that has detected this bug?

from gmaxwell
21 January 2013‎
And you'll note that page is citing a forum thread from 2011.  Bitcoin v0.8 rolled out the first round of fixes to eventually remove malleability way back then too... and we've seen bouts of amounts of malleability use on the network, back in 2012 if not sooner— I haven't grepped my logs.

I was online at that moment, took me 30 sec to refresh, already was just line down, and back to 500+, so a guess would be: 3 secs :D
Basically someone just blindly believed mtgox statement and did their own doom. I mean, to be roughly even on sale at 1xx USD, you'd have to have bitcoins since when? 2012? LOL.

Gee, I wonder.. Would it be Bitcoin's fault, or MtGox's?

https://i.imgur.com/edOnkZ2l.jpg (https://i.imgur.com/edOnkZ2.jpg) (click for full res)

21 January 2013‎

Well, not exactly.  The price was in the low 100's not too long ago - last September.  In 2012 you got Bitcoins still much, much cheaper than $ 100!  Seems like the memory is really short in the Bitcoin world. ;)

Great, this non issue got real FUD potential outside Bitcoin land.

I hope that MtGox already realized that this update they published on a problem in theIR bitcoin software will back fire really bad on them.
From a business perspective I would fire whoever is responsible for the published "excuse"

Great, this non issue got real FUD potential outside Bitcoin land.

I hope that MtGox already realized that this update they published on a problem in theIR bitcoin software will back fire really bad on them.
From a business perspective I would fire whoever is responsible for the published "excuse"

This type of stuff must and will happen. 

BTC has never been stress-tested in the public eye in its history ever before like this, and thus this situation is nothing more than an excellent PR opportunity for the BTC community to demonstrate the innate resiliency of the network as a whole.

Who knows how many bitcoins MtGox may have been lost(double spent to the attackers) due to this bug before they notice it?

Do they still have enough coins for withdrawal?

This type of stuff must and will happen.  

BTC has never been stress-tested in the public eye in its history ever before like this, and thus this situation is nothing more than an excellent PR opportunity for the BTC community to demonstrate the innate resiliency of the network as a whole.

Agreed. The more you break bones, the stronger they heal together.

This type of stuff must and will happen.  Sucks for the people who have their coins in Gox, and nothing can be done to alleviate that feeling or loss.

BTC has never been stress-tested in the public eye in its history ever before like this, and thus this situation is nothing more than an excellent PR opportunity for the BTC community to demonstrate the innate resiliency of the network as a whole.

I overlooked the 2013  :(

But if it did occur, then a spend with the same input,output and quantity should have shown up to the receiver address right? Just not with the original txout. It wouldn't explain a transaction delay where nothing is transacted or would it?

Trying to dumb this down for me so I can understand it better and explain it to my friends:

I request $1,000 to be wired to me from Company A. Since there are so many wires with Company A, they have developed their own automated process. I notice a flaw in their code, so that after they send the wire, I can screw with the receipt that they get from the bank, making it seem to them that the wire didn't go through. Their flawed system doesn't check the bank balance, it just goes off of their flawed receipt. Therefore, I can request they send again.

Is this about accurate?

I haven't read this entire thread yet, but i......................

I haven't read this entire thread yet, but is this true? The TX ID can be modified and re-broadcast to effectively double-spend? If this is the case, not only is MtGox justified in their issues, but they've also demonstrated to the entire world how stupid this community is to believe BTC is without flaw and can't be taken to $0 if the right individuals were to go through this protocol with a fine-toothed comb. What a terrible concept to implement. What is the purpose of a TX ID if not to identify a TX? What could possibly be achieved by allowing such an ID to be modified?

Let me explain further, ppl dont receive their coins isnt because of this. Its because Gox system (bookkeeping) got messed up and send out non available coins since all tx are chain-linked.

I haven't read this entire thread yet...

It seems more like a protocol exploit than a bug or failure.
But it's one that has now been seen in the wild at least twice:
the ghash.io double-spend attacks against SD and now with withdraws from Gox.

Even if it is an exploit that affects certain types of business practices rather than a real protocol-level failure, it still seems serious.
At the time of the ghash double spend I remember gmaxwell saying essentially 'that's what you get if you base your business model on unconfirmed transactions," which I thought was a bit flip, but now it sounds like mutated transactions can make it into the block chain which seems to cement the obfuscation into a kind of "he said, she said" scenario.  

Even if it has been known about for several years, it has now come to life in a big way. Not good.

Let me explain further, ppl dont receive their coins isnt because of this. Its because Gox system (bookkeeping) got messed up and send out non available coins since all tx are chain-linked.

MtGox, continuing to prove the dunning-kruger effect

Their incompetence and arrogance really boggles the mind-- have they really not hired a consultant, ever?  They really feel like they're this brilliant powerhouse that discovered this (non)-issue?

I'm willing to bet an exploit using this very tactic was reported dozens of times, only to fall into customer support limbo.  And if that's the case, they deserve whatever lawsuit and/or criminal punishment is coming to them.

"The brillianty smart-people at MtGox have created a new way to store coins long term, in an encrypted zip file!  MtGox a hub of innovation and security!  A pillar of the community!  We discover critical security flaws only after they've made us insolvent!  HOORAY!"


Seriously this shit makes me rage so hard.  Fade into irrelevance MtGox, you served your purpose, and now you're like a herpes sore that just refuses to dry up.

I'm sure at this point they realize that but are going to "punish" the community (and by extension the core developers) by suspending withdrawals until it's fixed. As "trendy" as it is to blame Gox, there's enough blame to go around to both the developers and Gox. Mistakes on both sides that have cost many people a lot of money.

hmmmmmmmm.........?!

http://content.screencast.com/users/Mike-Socialised.de/folders/Jing/media/151f2b06-435d-4a22-9750-e98eef34d9ab/2014-02-10_1558.png

I haven't read this entire thread yet, but is this true? The TX ID can be modified and re-broadcast to effectively double-spend?

It's not true. Both versions of the transaction will have the same inputs, outputs and amounts; they are two different ways of expressing the same transaction, and only one will be accepted by the network, so there is no double-spend. No-one should care which version of the transaction gets accepted. (MtGox did care, and that's their mistake.)

Why is a year old bug not addressed in code? Are we really relying on wikis to maintain this protocol?

I'm sure at this point they realize that but are going to "punish" the community (and by extension the core developers) by suspending withdrawals until it's fixed. As "trendy" as it is to blame Gox, there's enough blame to go around to both the developers and Gox. Mistakes on both sides that have cost many people a lot of money.

In an instance like this, the statement from Gox had to have been approved by the CEO. Also, he must have known the exact consequences the statement's release would have on the market.  I guess, let the conspiracy theories begin but I would love to have a Gox insider give some insight as to what the decision process was. And also who outside of Gox was in on the action? Hey, maybe the Fed offered to bail them out if they agreed to try and crash the market.

This is equivalent to the head of the NY Stock exchange saying on a monday morning before the market opening that every stock exchange has a significant flaw and hence they alone will not open. Further that they will freeze every trader's funds. Of course the BTC market is mostly self-policing.... That MF pissed off a lot of people today (and by no means the first or last time). Perhaps one day he will piss off the wrong people.

We're not, it was fixed years ago by the bitcoin devs and every other exchange on the face of the planet kept up to date, but gox were shit and useless and didn't bother.  End of story.

It's not true. Both versions of the transaction will have the same inputs, outputs and amounts; they are two different ways of expressing the same transaction, and only one will be accepted by the network, so there is no double-spend. No-one should care which version of the transaction gets accepted. (MtGox did care, and that's their mistake.)

I think this txid mutability doesn't cause double-spend by itself. But if the sender (i.e. Mt. Gox) thinks (erroneously) the coins didn't arrive because they didn't see the txid and somebody complained and they did the spend again, then it depends. If the sending address still holds enough coin, or if they use a different address then the sender does a double-spend. It could be that somebody acquired knowledge of their accounting flaw and used it to their advantage.

Note that this will also affect any other crypto-currency using the same transaction scheme as Bitcoin.

It's not true. Both versions of the transaction will have the same inputs, outputs and amounts; they are two different ways of expressing the same transaction, and only one will be accepted by the network, so there is no double-spend. No-one should care which version of the transaction gets accepted. (MtGox did care, and that's their mistake.)

Recently released MtGox´s statement at https://www.mtgox.com/press_release_20140210.html is largest pile of BS FUD I ever saw - does anybody actually believe them? No reference to anyone from BitCoin devs, no proof of anything, just bullcrap. They picked up (or made up, whatever) minor, hardly achievable and easilly trackable flaw and build a story around it, which in the end sounds to me like arguing that someone with time machine can pause time and rob Your pockets meanwhile.. They fucked up badly with their amateurish coding sklills, thats all. And the most horrible about theese sick fucks is that they are trying to drag whole cryptoscene to hell with them, as they know this is theirs end:


Pricks..

They are trying to come up with any plausible excuse to prevent a massive bank run.

The question I have is,  if this is a Bitcoin problem, then why are there also delays for withdrawing USD?

This is just poor bookeeping on Mt.Gox side.

How can we get MT Gox stripped from the Bitcoin Foundation along with it's CEO, Mark Karpeles?

This is doing tremendous damage to the community and they're still plastered all over the face of the Foundation that is supposed to be helping the community grow.

Keep protesting and demanding he resign or be booted out.

If that's the case, I'd hope that the core developers would continue working on Bitcoin's problem with scaling, and not escalate the malleability thing much at all.

This is just poor bookeeping on Mt.Gox side.

If 5 BTC is sent from address X to address Y,  then it will be permanently on record in the block chain.  Does not matter which TXID was used.

This is exactly what it is. Poor bookkeeping, nothing more, nothing less.

Worst thing is not to panic sell. Rather it is to purchase at the start of the panicking process.
MtGox manipulate the market indirectly this is so effin apparent.

There is never any legitimate excuse for any financial services company to not immediately return a customer's money upon request. Mtgox has delayed customer withdrawals for almost a year now. This means Mtgox is insolvent. Do NOT keep any more money there than you are willing to lose.

http://www.businessweek.com/news/2014-02-10/is-bitcoin-over-mt-dot-gox-pauses-withdrawals

Sigh

I think this txid mutability doesn't cause double-spend by itself. But if the sender (i.e. Mt. Gox) thinks (erroneously) the coins didn't arrive because they didn't see the txid and somebody complained and they did the spend again, then it depends. If the sending address still holds enough coin, or if they use a different address then the sender does a double-spend. It could be that somebody acquired knowledge of their accounting flaw and used it to their advantage.

I think my point was that there is not real utility in allowing a TX ID to be modified. I'd be open to hearing what I might be overlooking but at face value it seems like a very poor decision in design.

I think this txid mutability doesn't cause double-spend by itself. But if the sender (i.e. Mt. Gox) thinks (erroneously) the coins didn't arrive because they didn't see the txid and somebody complained and they did the spend again, then it depends. If the sending address still holds enough coin, or if they use a different address then the sender does a double-spend.

I haven't read this entire thread yet, but is this true? The TX ID can be modified and re-broadcast to effectively double-spend? If this is the case, not only is MtGox justified in their issues, but they've also demonstrated to the entire world how stupid this community is to believe BTC is without flaw and can't be taken to $0 if the right individuals were to go through this protocol with a fine-toothed comb. What a terrible concept to implement. What is the purpose of a TX ID if not to identify a TX? What could possibly be achieved by allowing such an ID to be modified?

That's not actually a Bitcoin double-spend, though.

Had Mt Gox been competent at all when designing their custom wallet software, they would have noted that tx-ids are mutable

You overstate your case, unless you wish to argue that Satoshi was not competent.

In any case, the reissue fraud is more or less independent of mutation.  The way you protect yourself against double payment when reissuing is that you must spend at least some of the same coins so that only one transaction or the other can get mined.  If you do this, no amount of mutation will result in funds loss (though it might confuse people!),  if you don't do this then you can still have payments doubled up even with no mutation at all.   (E.g. first payment delay, second authored, second gets confirmed, first gets rebroadcast and makes it in too).

Now, can somebody hack their news CMS so we can modify the statement?

We must all do our parts to counter this bad press by creating Positive PR in the Media . Please support the bitcoin space mission https://bitcointalk.org/index.php?topic=441303.0


I am trying to generate positive NEWS for Bitcoin

This. Quit talking about double spending, this is confusing. Notice that MtGox communication don't talk about double spend at all, either.
It's just a voluntary MtGox double send.

You overstate your case, unless you wish to argue that Satoshi was not competent.

In any case, the reissue fraud is more or less independent of mutation.  The way you protect yourself against double payment when reissuing is that you must spend at least some of the same coins so that only one transaction or the other can get mined.  If you do this, no amount of mutation will result in funds loss (though it might confuse people!),  if you don't do this then you can still have payments doubled up even with no mutation at all.   (E.g. first payment delay, second authored, second gets confirmed, first gets rebroadcast and makes it in too).

I haven't read this entire thread yet, but is this true? The TX ID can be modified and re-broadcast to effectively double-spend? If this is the case, not only is MtGox justified in their issues, but they've also demonstrated to the entire world how stupid this community is to believe BTC is without flaw and can't be taken to $0 if the right individuals were to go through this protocol with a fine-toothed comb. What a terrible concept to implement. What is the purpose of a TX ID if not to identify a TX? What could possibly be achieved by allowing such an ID to be modified?

with reissuing fraud possible because of the bitcoin protocol itself , there needs to be a software applied which guarentees

that the same coins being tried to use

no exchange uses this up to date....so  EXCHANGES ARE UNSAFE

that the same coins being tried to use

no exchange uses this up to date....so  BTC is UNSAFE

with reissuing fraud possible because of the bitcoin protocol itself , there needs to be a software applied which guarentees

that the same coins being tried to use

no exchange uses this up to date....so  BTC is UNSAFE

FTFY

 ;D

All of the old world institutions that worship ‎John Maynard Keynes will be shamed.

We need to amass an army of commenters at the bottom of every single article like this one to refute such foolishness with facts and history about the bitcoin network's resiliency rating.

The BTC train has already left the building.  Get on or get flattened.

We must all do our parts to counter this bad press by creating Positive PR in the Media . Please support the bitcoin space mission https://bitcointalk.org/index.php?topic=441303.0


I am trying to generate positive NEWS for Bitcoin

Follow up question?  Do all the other crypto currencies have the same potential transaction malleability risk? (since they may all be derived from bitcoin in one form or another?)

cryptos are serving there purpose of transfering value at any price....BTC at 10 cents is as valuable as at 1000 dollars

The stupidity of this action by mtGox is beyond comprehension. Is the CEO suicidal or what? Did he forget what his business-model is supposed to be and what he is supposed to be selling?

Either he is a complete and utter moron who thinks he can fix things by destroying the product he's selling in the public eye, or he's organizing some major inside trading scheme.

I thought it was incompetence for a long, long time. I'm starting to wonder...

I thought it was incompetence for a long, long time. I'm starting to wonder...

People's decision to sell (at 120 USD at BTC-e for example) was a perfectly decentralised decision. No one else was forced to buy or transact at such valuations!  :D

everyone seems to forget that Mark is NOT a native english speaker, nor are the JAPANESE people. whoever wrote the press statement in the ENGLISH language may not have carefully analyzed every word used and chosen the best one. people forget that MTGOX is a japanse company run by a french guy

Nice response here...

https://bitcoinfoundation.org/blog/

everyone seems to forget that Mark is NOT a native english speaker, nor are the JAPANESE people. whoever wrote the press statement in the ENGLISH language may not have carefully analyzed every word used and chosen the best one. people forget that MTGOX is a japanse company run by a french guy

Sounds like he is basically saying Bitcoin is broken and that Gox should have implemented their own way to find out if a transaction is real or not.  I hate to say it but if a flaw like that really does exist how can one say it's not broken. 

Their grasp of English isn't the problem.  Their grasp of code (or distinct lack thereof) is.  Whatever language they chose to say it in, they said the fault lies with bitcoin, when it was no one's fault but their own.

The problem is the way they run their business and how they handled this situation. Appalling on all fronts.

Well imagine you pay a plumber $100 dollars with a check and a week later he says he lost the check and wants another one. What would you do??

If your answer is that you would write the plumber another check for $100 without thoroughly checking with the bank first, then you would be like Mt Gox.

They are stupid beyond belief.

That is a good analogy.  So basically Mt. Gox was supposed to but did not implement in their wallet software a way to verify the funds in that transaction.

That is a good analogy.  So basically Mt. Gox was supposed to but did not implement in their wallet software a way to verify the funds in that transaction.

wow.. hang on.. you must not have a bank

daily limits, AML query's and that such. look at Cyprus and other noteworthy government led bank blockages

although i morally agree that no financial service of any kind should block peoples funds... it does happen.

and i totally agree that there is no viable reason to block a bitcoin transaction, bitcoins are stored on private keys.. so blaming a protocol is simply blaming software, which can be altered/replaced

its not only gox------ all exchanges don´t have no more the real BTC´s....alll raided the same way....the digits there are just that- digits- not to be withdrawn anymore.....

Cheers

In the meantime, exchanges and wallet services - and any service sending coins directly to third parties - should be extremely careful with anyone claiming their transaction did not go through.

its not only gox------ all exchanges don´t have no more the real BTC´s....alll raided the same way....the digits there are just that- digits- not to be withdrawn anymore.....

Cheers

"We fucked up badly with our trading system because we ignored long time known and well documented minor issue. We have lost XXX coins and have to completely rewrite our trading platform. It´ll take XXX days/weeks and during this time trading will be disabled and withdrawals suspended. We deeply apologize for any inconvenience."

"Nothing is our fault - we are victims of huge flaw in Bitcoin code and everyone in cryptoworld will be exploited same way. We will donothing until someone else fix it. If You don´t like it, go fuck yourself!"

This is precisely the reason why I advise people not to keep any more money in banks than they are willing to lose. The global monetary and banking systems are also insolvent at the most fundamental level.

"Who broke the window?"
"He did!" :)

But then  you would have to use Gox and you wouldnt get your money or bitcoins back :P

I personally consider the Gox show is over  ;D

BitStamp and BTC-e are both trading around $700 and Gox has hovering around $600.
I am so glad the market has decoupled from Gox.

I just hope the less informed bitcoin holders will read up on the transaction malleability issue
and realise Gox is just shifting blame blame with a feeble excuse.

Once Gox re-enable withdrawals, it will just be an empty shell.
R.I.P Gox

Once Gox re-enable withdrawals, it will just be an empty shell.

MtGox caused havoc in the markets today with their dramatically worded and damaging announcement. They diverted blame from themselves and placed the full blame on the Bitcoin protocol and making a minor technical issue (that already existed for years) seem like a critical widespread panic issue by the way the announcement was started and worded throughout. Most traders are non-technical users and their first reaction would be to panic after reading such a statement. Up to 15,000 bitcoins were dumped down to 102 at Btc-e on this news resulting in millions of dollars lost. Bitfinex also had thousands of BTC dumped down to 100, mainly margin liquidations. I would be surprised if the MtGox CEO did not know beforehand the effects and impact and knock on effects that such an announcement would have on traders and on the markets in all exchanges. It is amazing and scary how one person could have had such an influence in the marketplace.

Mark and/or his friends could have easily sold bitcoins on the other exchanges such as Btc-e or Bitfinex and placed low buyback orders before making the announcement. They could have set up accounts with fake details, Tor etc. Hundreds, maybe thousands of bitcoins could have been bought back for cheap netting them potentially in excess of $1m+ gain on the traders panic.

It is no longer simply a case of being Goxed again and joke about it like in 2011 or 2012. We are now dealing with very serious amounts of money, millions of dollars worth of bitcoins were made and lost on this single announcement across all exchanges not only MtGox.

I am not even a customer of MtGox (I left them a year ago), yet I have been adversely affected (as have thousands of other non-Gox exchange users) by their negligence and adverse affect their announcement has had on the other exchanges namely Bitfinex and Btc-e. The other exchanges are operating fine and do not have the same technical issues that Gox is facing. Yet, MtGox goes and ahead and basically says that the issue affects everyone else:


I cannot believe after all that has happened with MtGox, that they would have the cheek to tell other exchanges what to do regarding this non issue that only affects MtGox

Anyone defending MtGox without acknowledging the extraordinarily negative impact their announcement has had to the entire bitcoin trading community either work for MtGox or have their head in the sand. Defending MtGox after years of endless f***ups and BS excuses is completely inexcusable at this stage.

The MtGox CEO should be investigated for negligence and for potential insider trading fraud.



Bulls***

Wow...

btw do you think the price will go down even more? im thinking about moving my money to bitstamp (in USD) tp buy more bitcoins... Whats the possibility that gox doesnt have all the BTC it claims (fractional banking appliedto BTC exchange)?

Dear Bitstamp users

Bitstamp’s exchange software is extremely cautious concerning Bitcoin transactions. Currently it has suspended processing Bitcoin withdrawals due to inconsistent results reported by our bitcoind wallet, caused by a denial-of-service attack using transaction malleability to temporarily disrupt balance checking. As such, Bitcoin withdrawal processing will be suspended temporarily until a software fix is issued.

No funds have been lost and no funds are at risk.

This is a denial-of-service attack made possible by some misunderstandings in Bitcoin wallet implementations. These misunderstandings have simple solutions that are being implemented as we speak, and we're confident everything will be back to normal shortly.

Withdrawals which failed on the 10th and 11th of February will be canceled and the amounts added back to the customer account balances.

We will communicate any further developments regarding this issue.

Thank you for your understanding!

Best regards
Bitstamp team

looks like the devs tried to defend themselves too quickly.

are people going to go after btce and bitstamp now?

looks like it's a PR stunt/nightmare for everyone. including the devs.

guess there was more truth in gox's statement than people care to give them credit for.

(i'm not saying that they aren't incompetent by all means)

don't worry 99%+ of all bitcoins should still be there

looks like the devs tried to defend themselves too quickly.

are people going to go after btce and bitstamp now?

Why would they?  Is Bitstamp blaming everyone but itself, while making terrorist threats to hold customer funds forever unless other people meet their demands?

No, they're doing what Gox SHOULD have done.  Implementing a fix immediately without whining and crying and pointing fingers everywhere but themselves.

Agreed ...the jury is still VERY much out that this is a systemic problem affecting anyone but GOX

Bitstamp are just check to confirm due to the mud being flung by GOX

Mt.Gox is blaming the core-devs while they *could* implement a fix (apparently) and keep their business running.

Mt Gox CEO Mark Karpeles Responds To Widespread Bitcoin Criticism

http://www.forbes.com/sites/leoking/2014/02/13/mt-gox-ceo-mark-karpeles-responds-to-widespread-bitcoin-criticism/

Mt Gox CEO Mark Karpeles Responds To Widespread Bitcoin Criticism

http://www.forbes.com/sites/leoking/2014/02/13/mt-gox-ceo-mark-karpeles-responds-to-widespread-bitcoin-criticism/

its not only gox------ all exchanges don´t have no more the real BTC´s....alll raided the same way....the digits there are just that- digits- not to be withdrawn anymore.....

Cheers

http://www.reddit.com/r/DarkNetMarkets/comments/1xtqty/sr_has_been_hacked/

so just another hoax in the blame game ??

From this point forward DO NOT trust markets with centralized escrow.

The devs don't have a "business."  They're maintaining an open source project.  They don't need this terrorism.

Also, they can't simply just roll out a fix.  That idea is bullshit, and is basically Gox propaganda.  First, any problems resulting from this non-optimal implementation are easily avoidable by people who are not morons, but second, fixing it will take literally years.  This isn't because of the inherent technical issues, but because it will require re-writing existing clients as well.  So the devs can't just roll out a fix, the community has to absorb the brunt of the change as well.

The devs may be wizards, but they're not gods, and at this point, Bitcoin is widespread enough a lot of the software people are using is NOT under their control.  Wreaking havoc to fix Gox's problem is not something that makes any sense.

I get that, i think you misunderstood. "they" was meant to be Gox. I'm sure everyone is trying to help. Gox does have a business but is blaming devs instead of rolling out a fix (like most other exchanges have or are). In return devs start blaming Gox.

Gox led with an attack.  The fact that their problem is their fault is just that, a fact.  It isn't an "attack" to point that out.  Their false claims that this is somehow the fault of the devs, though, are, well, false.  They had every opportunity to avoid making this mistake, and made it anyway.  Apparently, so did other exchanges, but Gox is unique in not rolling out a fix and instead blaming everyone else for their shoddy implementation.

Has any other exchange behaved in this atrocious manner?

I'll compare, for instance, Bitstamp.  Did they go around blaming everyone other than themselves?  No.  Their own press release was basically "Whoops.  Made a mistake, we're fixing it now."  And then they IMMEDIATELY fixed it.  That's how you do it if you're a professional.  Gox isn't unprofessional because they made a mistake.  Everyone makes mistakes.  They are unprofessional because of their pathetic and disgusting attempts at damage control, which involved trying to deflect blame to the entire world other than themselves.

Gox isn't unprofessional because they made a mistake.  Everyone makes mistakes.  They are unprofessional because of their pathetic and disgusting attempts at damage control, which involved trying to deflect blame to the entire world other than themselves.

Gox led with an attack.  The fact that their problem is their fault is just that, a fact.  It isn't an "attack" to point that out.  Their false claims that this is somehow the fault of the devs, though, are, well, false.  They had every opportunity to avoid making this mistake, and made it anyway.  Apparently, so did other exchanges, but Gox is unique in not rolling out a fix and instead blaming everyone else for their shoddy implementation.

Has any other exchange behaved in this atrocious manner?

I'll compare, for instance, Bitstamp.  Did they go around blaming everyone other than themselves?  No.  Their own press release was basically "Whoops.  Made a mistake, we're fixing it now."  And then they IMMEDIATELY fixed it.  That's how you do it if you're a professional.  Gox isn't unprofessional because they made a mistake.  Everyone makes mistakes.  They are unprofessional because of their pathetic and disgusting attempts at damage control, which involved trying to deflect blame to the entire world other than themselves.

I'll just leave this here:

https://www.change.org/en-GB/petitions/petition-to-remove-mark-karpeles-from-the-board-of-the-bitcoin-foundation

I'll just leave this here:

https://www.change.org/en-GB/petitions/petition-to-remove-mark-karpeles-from-the-board-of-the-bitcoin-foundation#share

Ofcourse we (i assume no BTC newbies) agree on all your arguments. But to the outside world that is not important.

I send PM to Vircurex :)

asking them would they do something before they get attacked.

Let see what is going to be in reply :)
I will post it later if they answer