Bitcoin Forum

How badly will this effect the price?

http://www.reddit.com/r/Bitcoin/comments/1xtsrq/silk_road_got_hacked_all_funds_stolen_cheap_coins/ (http://www.reddit.com/r/Bitcoin/comments/1xtsrq/silk_road_got_hacked_all_funds_stolen_cheap_coins/)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

I am sweating as I write this.

Christmas brought grave news. I cannot adequately express how deeply honored I was by your unconditional support of my staff.

I do not expect the same reaction to today's revelations. This movement is built on integrity, and I feel obligated to be forthright with you.

I held myself to a high standard as your leader, yet now I must utter words all too familiar to this scarred community:

We have been hacked.

Nobody is in danger, no information has been leaked, and server access was never obtained by the attacker.

Our initial investigations indicate that a vendor exploited a recently discovered vulnerability in the Bitcoin protocol known as "transaction malleability" to repeatedly withdraw coins from our system until it was completely empty.

Despite our hardening and pentesting procedures, this attack vector was outside of penetration testing scope due to being rooted in the Bitcoin protocol itself.

This attack hit us at the worst possible time. We were planning on re-launching the new auto-finalize and Dispute Center this past weekend, and our projections of order finalization volume indicated that we would need the community's full balance in hot storage.

In retrospect this was incredibly foolish, and I take full responsibility for this decision.

I have failed you as a leader, and am completely devastated by today's discoveries. I should have taken MtGox and Bitstamp's lead and disabled withdrawals as soon as the malleability issue was reported. I was slow to respond and too skeptical of the possible issue at hand. It is a crushing blow. I cannot find the words to express how deeply I want this movement to be safe from the very threats I just watched materialize during my watch.

I've included transaction logs at the bottom of this message. Review the vendor's dishonest actions and use whatever means you deem necessary to bring this person to justice. More details will emerge as we continue to investigate.

Given the right flavor of influence from our community, we can only hope that he will decide to return the coins with integrity as opposed to hiding like a coward.

It takes the integrity of all of us to push this movement forward. Whoever you are, you still have a chance to act in the interest of helping this community. Keep a percentage, return the rest. Don't walk away with your fellow freedom fighters' coins. DPR2 returned the cold storage. I didn't run with the gold. But two people alone cannot move us forward. It takes an entire community committing to integrity - and though this crushing blow will not stop us, it sure is a testament to how greedy some bastards truly are.

Being a part of this movement might be the most defining thing you do with your entire life.

Don't trade that for greed, comrades.

I will fight here by your side, even the greedy bastards amongst us.

This community has suffered great financial loss over and over again, and I am devastated that it has happened again under my watch.

Hindsight is already suggesting dozens of ways this could have been prevented, but we must march onward.

The only way to reverse a community's greed is through generosity. Our true character is revealed during trying times.

If this financial hardship places you at risk of physical harm, contact me directly and I will do my best to help you with my remaining personal funds.

Now what.

Never again store your escrow bitcoins on a server.

Silk Road will never again be a centralized escrow storage.

This week has shown the collateral damage we can cause by being a huge target and failing in just one unforeseen area.

I am now fully convinced that no hosted escrow service is safe.

If I cannot trust myself to keep a hosted escrow solution safe, I cannot trust anyone.

Multi-signature transactions are the only way this community will be protected long-term.

I am aggressively tasking our devs on building out multi-sig support for commonly-used bitcoin clients. Expect a generous bounty if you have the skill to implement this.

Until then.

    We will never again allow ourselves to be a single point of failure. We will never again host your Escrow wallets.

    Vendor registration is closed while we regroup.

    All listings on Silk Road are now No-Escrow (Finalize-Early) for 1-2 months while we implement multi-signature transactions and lobby for mainstream Bitcoin client multi-sig support.

    All unshipped orders have been cancelled.

    Vendors may link to other marketplaces on a trail basis until we launch multi-sig, then we will re-evaluate based on community input. We do not want to be a centralized point of failure, but we also do not want to lead our buyers into dangerous waters.

    From this point forward DO NOT trust markets with centralized escrow. Use multi-signature transactions whenever possible, with trusted third parties as escrow providers.

Everything will be offline for 24-48 hours to minimize variables as we continue to investigate. The evidence we have below will be expanded based on our findings.

No marketplace is perfect. Expect any centralized market to fail at some point. This is precisely why we must unite in the decision to decentralize.

We are relieved that our security procedures protected user identities, and that no servers were compromised. This was not a worst-case scenario: nobody will be getting arrested from this. Financial loss is terrible, but will not put all of us behind bars.

The details we have on the hacker are below. Stop at nothing to bring this person to your own definition of justice.

Humbled and furious,

Defcon

Oh yeah, let's use malleability problem we never heard of before to steal your coins :D

We might hear few of these more.

So, what happened to everyone spitting on Gox when they first blamed the protocol? Maybe I'm wrong but it seems like they've done quite the service for spotlighting this issue.

I don't really think malleability problem got  the coins stolen. I think there was either some other exploit on the site or the admin stole them. He could then post the information of a vendor that caused him problems and it'd be win win for the admin.


Mtgox is the only exchange so far that would have double spent bitcoins due their poor wallet coding not waiting for confirmations before withdrawing users funds. Basically mtgox was withdrawing and depositing imaginary bitcoins.

The guys a fraud. This is not a vulnerability and probably not even a bug, it's just part of the protocol that certain kinds of people were too lazy/incompetent to account for and which scammers use to claim they "lost" coins they were holding. Non-issue.

Reminds me of Sheep Marketplace's initial reaction to their 'hack'

How many coins were roughly stolen? Any estimates? Retards might dump via market sell on exchange.

He said the wallet was completely drained so all of them. It's probably in the 1000s would be my guess.

I agree, this guy is using FUD to rip people off.  So we're still thinking that bitcoin exchanges and their operators don't need to adhere to some level of oversight regulation and audit?   ::)

wait a second - how the hell would this vulnerability allow withdrawing unlimited amount of bitcoins?

if you withdraw coins and dupe the TX with a wrong hash you are not getting double coins in any way and why would a marketplace then refund the customer? it doesn't make any sense.

if you deposit coins and dupe the TX with a wrong hash then you may see "unconfirmed" coins under your balance that will never get any confirmations.

explain me if I misunderstand anything here

The guy could be a fraud.  Or the site was legitimately hacked.  Or .. there is another protocol weakness resulting in missing coins on exchanges/retailers that people are misattributing to tx malleability.

I'm guessing it happened with mutating the tx ids.

User requests withdrawal
Wallet sends funds, user mutates tx
wallet checks tx, cant find it, resends funds or credits user's account.
rinse/repeat

Just a guess, no clue how viable that really would be.

Most people are not tech savvy. They see "flaw in bitcoin!" in the news or hear it from their friends, and scammers like this SR guy use that as a pretext to steal peoples coins, hoping to get away with it.

This.

What if Mt.Gox also has no coins ? Maybe that guy just stole all the coins and wants to get out.

It wouldn't. However in mtgox's case they had their wallet set to auto approve these requests and were just giving people bitcoins out of their hot wallet that they didn't own. Basically they were giving people attempting to fraud them other people's bitcoins.

Reddit users speak about 88,000 coins. Seems serious money got hacked.

http://www.reddit.com/r/Bitcoin/comments/1xtv92/breaking_silk_road_2_hacked_over_88000_bitcoins/

Wow...

:o

SELL ALL YOUR COINS PEOPLE

Maybe it was Steve?

LOL

:D

So my bitcoin just got rarer now ?

Hackers are not hodlers, but sodlers.

this. but i cannot believe there's no accounting code in the bkground doing daily checks.

no one believes it was an outside job from what I'm reading on the web. These guys better pray they can't be tracked

Even if they did steal it and their identities were published, I don't think any harm will come to them.  Lots of empty threats and that's about it.

Leaving btc on an exchange run by criminals dealing in illegal wares - what could go wrong?

They were operating an illegal website, who is going to contact the authorities to track them down.

That is what made the real SR so unique, it was run for a long time without the operator running away with everyone's coins the first chance he got. DPR could have quietly disappeared after 1 year with >100,000 coins, but instead he stuck around and continued to run the service.

In the end this is why DPR got caught as the smart thing to do when running a website where the entire US government is after you is to cut out after making enough and run. The operators of SR 2.0 seemed to have learned the lesson well.

If they are identified they wont last a few months.

gotta say that occurred to me too  ..... all the hints he was dropping  ....

Re the malleability issue ,  with Gox publishing it so ...publicly, I bet these kind of attacks went up....oh maybe 10,000% ?

There are no "attacks". Just lazy software managers and incompetent bookkeepers and a bunch of scammers.

If you aren't the sole controller of your private keys, you don't have any bitcoins.

It is logically impossible to prove that you are the sole "controller" of the private key associated with a wallet, so I argue that no one owns any bitcoins.

SR 2.0 stolen coins adress

https://blockchain.info/address/1DKH2oZtrcAAoZXsNJQnKBwKYaYdx5KrVV
also this:

http://www.theverge.com/2014/2/12/5403708/utopia-silk-road-style-marketplace-seized-by-dutch-police


Bitcoin seems to be mainly used for criminal activities, black markets or to support terrorism and money laundering the other part is for gambling and speculation.
Kinda sad for a grassroots currency , that was made to save the masses. :(

There were no coins stolen at SR 2.0, only bitcoin IOUs.

i doubt that.

the feds have been very effective at getting inside tor markets.

silkroad2 should have never came out with the previous compromises.

security needs to be improved. at least make the feds work for it.

Junkie fucks, I have no sympathy, they ruin Bitcoins image even if it is undeserved attention.

agreed

So just because somebody wants to put a substance in their body that the nanny government says is illegal, they deserve to have their money taken?

Let's hope the SR 2 folks turn themselves in to the authorities before their customers find them.

The wrath of a horde of potheads, terrifying.

What they gonna do, blow smoke on them and call them names? Pull a bong over their heads?

Nah, but I'm sure a few coke/meth dealers that lost a good bit would have no problem putting a cap in them.

basically, this. to people who really think that was "bitcoin problem", learn to think.

step1: site operator moves all of the funds to the hot server for no reason
step2: site operator knows that most exchanges closed withdrawals due to mutated tx problem but does not give a crap
step3: site operator does not check account balances and does, hundreds of times, credit one user with a "failed" transaction
step4: site operator does not have any insight into the balance of the hot wallet where they put all funds, so they don't see it painfully slowly being emptied

either all of the above, or,
step1: site op wants to steal 3 mil but does not have an excuse to, finds one, proceeds.

Hmm which one is more realistic, let me think...

That's bullshit. It's only small % of the transactions.

I just read over 88,000 coins were stolen. I had no idea those darknet sites were so popular. How long has it been since silk road 1 was shut down? Seems just a few months. Amazing that a darknet tor site would amass such holdings in such a short period of time, and then not secure it.

What makes you think that is the address?  Did SR2 identify it? 

Dunno, smells of BS to me. ::)

Who gave this guy  bitcoins?

Nobody, I worked for them like the rest of us.  People get killed over relatively small amounts of drugs/money all the time, what makes you think somebody wouldn't do it to somebody that took millions?