|
Title: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: zhoutong on March 02, 2012, 03:37:39 AM We didn't have the opportunity to scan our whole system for suspicious transactions that were not initiated from our customers because we had to shut down the system immediately after we've discovered the huge loss. We did get a rough estimate and we published a press release to warn our users about the deposit address replacement.
However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. For transparency, we would like to disclose all the suspicious transaction ids in this incident: { "account" : "", "address" : "1F3czt4VGUGdmrXW4qbh8hbQZ1hcHpwFGT", "category" : "send", "amount" : -1999.00000000, "fee" : -0.01750000, "confirmations" : 99, "txid" : "5a09f4ef0e91bc7bc044365cd27236fe4ac3c02088ac21ab51c93c8a11d33d4b", "time" : 1330584607 }, { "account" : "", "address" : "1DMuVKe9PKpx3dbs2b2MnXuVmLfA4drHif", "category" : "send", "amount" : -20555.00000000, "fee" : 0.00000000, "confirmations" : 99, "txid" : "7b45c1742ca9f544cccd92d319ef8a5e19b7dcb8742990724c6a9c2f569ae732", "time" : 1330584607 }, { "account" : "", "address" : "13CmJpbAueuWiPKw3UYU4vXEcZ4WzP6nxt", "category" : "send", "amount" : -3000.00000000, "fee" : 0.00000000, "confirmations" : 99, "txid" : "901dbcef30a541b8b55fae8f7ad9917ef0754bda5b643705f3773e590785c4d3", "time" : 1330584607 }, { "account" : "", "address" : "1978kFf3WKYiZsy89WX6qJ8vxWAbRWFGLq", "category" : "send", "amount" : -0.01002773, "fee" : 0.00000000, "confirmations" : 99, "txid" : "901dbcef30a541b8b55fae8f7ad9917ef0754bda5b643705f3773e590785c4d3", "time" : 1330584607 }, { "account" : "", "address" : "1JL7vc2Ecn8QeeBYdpAP22pVpaSP6Cni3J", "category" : "send", "amount" : -3000.00000000, "fee" : 0.00000000, "confirmations" : 99, "txid" : "a57132e2cbc580ac262aa3f7bac1e441d6573f9633118bc48009618585a0967e", "time" : 1330584607 }, { "account" : "", "address" : "13CmJpbAueuWiPKw3UYU4vXEcZ4WzP6nxt", "category" : "send", "amount" : -3000.00000000, "fee" : 0.00000000, "confirmations" : 99, "txid" : "a82ad85286c68f37a2feda1f5e8a4efa9db1e642b4ef53cb9fd86170169e5e68", "time" : 1330584607 }, { "account" : "", "address" : "15WoJ7L4AUfGHWdGj45NY9rFNiwU48woX2", "category" : "send", "amount" : -0.01002644, "fee" : 0.00000000, "confirmations" : 99, "txid" : "a82ad85286c68f37a2feda1f5e8a4efa9db1e642b4ef53cb9fd86170169e5e68", "time" : 1330584607 }, { "account" : "", "address" : "1NRy8GbX56MymBhDYMyqsNKwW9VupqKVG7", "category" : "send", "amount" : -2000.00000000, "fee" : 0.00000000, "confirmations" : 99, "txid" : "ff04763e3e8c93e43799dbbca833e183faad7e2611f20f136f47c2f1049481ae", "time" : 1330584607 }, { "account" : "", "address" : "1AaXeH5DuP6FpPxdCn9RGXKWhSG4r9Hq9q", "category" : "send", "amount" : -10000.00000000, "fee" : 0.00000000, "confirmations" : 99, "txid" : "0268b7285b95444808753969099f7ae43fb4193d442e3e0deebb10e2bb1764d0", "time" : 1330584607 } Again, we would like to reassure that trading will not be in any way affected and we are already in the process of contacting Linode regarding this incident. The Bitcoinica system has not been compromised and our reserves are more than sufficient for regular trading activities. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: theymos on March 02, 2012, 03:39:23 AM How can you reimburse that much? Have you really made that much profit?
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 03:39:58 AM unbelievable. and you're going to be able to reimburse all your customers?
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 03:40:51 AM there goes Zhou's tuition.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bbit on March 02, 2012, 03:41:47 AM my mouth dropped :o
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: tonto on March 02, 2012, 03:43:36 AM *whew* my coins are still safe on his server. :D
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: jimbobway on March 02, 2012, 03:44:16 AM :-[ :-[ :-[
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: zhoutong on March 02, 2012, 03:44:31 AM How can you reimburse that much? Have you really made that much profit? Yes, our historical profit is fairly sufficient to cover the loss from this incident, and we believe that it's the best interest for the community to keep running the business. We will take appropriate strategies and implement more security features to prevent this from happening ever again, even with the presence of dishonest partners or employees. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 03:45:38 AM http://status.linode.com/2012/03/manager-security-incident.html Quote Manager Security Incident Ensuring the security of our platform is our top priority. We maintain a strong security policy and aim to communicate openly should it ever be compromised. Thus, we are posting to describe a recent incident affecting the Linode Manager. Here are the facts: This morning, an intruder accessed a web-based Linode customer service portal. Suspicious events prompted an immediate investigation and the compromised credentials used by this intruder were then restricted. All activity via the web portal is logged, and an exhaustive audit has provided the following: All activity by the intruder was limited to a total of eight customers, all of which had references to "bitcoin". The intruder proceeded to compromise those Linode Manager accounts, with the apparent goal of finding and transferring any bitcoins. Those customers affected have been notified. If you have not received a notification then your account is unaffected. Again, only eight accounts were affected. The portal does not have access to credit card information or Linode Manager user passwords. Only those eight accounts were viewed or manipulated -- no other accounts were viewed or accessed. Security is our number one priority and has been for over eight years. We depend on and value the trust our customers have placed in us. Now, more than ever, we remain committed to ensuring the safety and security of our customers' accounts, and will be reviewing our policies and procedures to prevent this from ever recurring. ok, 8 accts: Zhou, Gavin, Slush. who are the other 5? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Clipse on March 02, 2012, 03:47:54 AM I cant help but know some Linode employee wont be at work tomorrow.
This all is way way way to convenient, seems like an inside job planned overtime with the knowledge of who runs worthwhile bitcoin services and on which VPS accounts. This is alot of money, please for all of us make its your top priority to get compensation out of Linode otherwise any future losses less than this would be seen acceptable by these crappy hosting companies or other services. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: jimbobway on March 02, 2012, 03:48:20 AM ok, 8 accts: Zhou, Gavin, Slush. who are the other 5? Seems likely an attacker would have or has had a linode account as well... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Jointops420 on March 02, 2012, 03:48:42 AM Bravo to you and slush. I am sure it will come back to you in trust but what a mongrel act that's been committed.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: mb300sd on March 02, 2012, 03:50:53 AM http://status.linode.com/2012/03/manager-security-incident.html Quote Manager Security Incident Ensuring the security of our platform is our top priority. We maintain a strong security policy and aim to communicate openly should it ever be compromised. Thus, we are posting to describe a recent incident affecting the Linode Manager. Here are the facts: This morning, an intruder accessed a web-based Linode customer service portal. Suspicious events prompted an immediate investigation and the compromised credentials used by this intruder were then restricted. All activity via the web portal is logged, and an exhaustive audit has provided the following: All activity by the intruder was limited to a total of eight customers, all of which had references to "bitcoin". The intruder proceeded to compromise those Linode Manager accounts, with the apparent goal of finding and transferring any bitcoins. Those customers affected have been notified. If you have not received a notification then your account is unaffected. Again, only eight accounts were affected. The portal does not have access to credit card information or Linode Manager user passwords. Only those eight accounts were viewed or manipulated -- no other accounts were viewed or accessed. Security is our number one priority and has been for over eight years. We depend on and value the trust our customers have placed in us. Now, more than ever, we remain committed to ensuring the safety and security of our customers' accounts, and will be reviewing our policies and procedures to prevent this from ever recurring. ok, 8 accts: Zhou, Gavin, Slush. who are the other 5? I would hope zhou dosen't keep 40k btc on one server :o, I assume more than 1 was bitcoinica Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: jimbobway on March 02, 2012, 04:02:12 AM zhoutong, thx for being part of the bitcoin community and being a class act. I hope Linode provides you with all of the compensation.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Rassah on March 02, 2012, 04:07:51 AM I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stick_theman on March 02, 2012, 04:11:21 AM Thanks Bitcoinica for keeping cool and maintain your integrity.
But, wtf @ Linode?!!! Where's that Vice President?!!! We need him to get on the forum ASAP!!!!!! This has to be an inside/co-ordinated job. All these happened at the same time. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: The-Real-Link on March 02, 2012, 04:12:03 AM Wow that's one heck of an attack. Terribly sorry to hear about the loss but hopefully you can recouperate in some way with the company or community.
Is Linode like a version of Linux or server software, or just a hosting company such as 1&1, Dreamhost, GoDaddy etc.? I suppose whether it is Windows, Linux, or Mac, if someone knows what they are doing it doesn't matter what software runs the wallet. A user could get to the right files if they know. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 04:13:50 AM Zhou, talk to Mark at mtgox. i bet there's something he can do to intercept at least some of these coins as the thief tries to cash out on mtgox.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cablepair on March 02, 2012, 04:21:39 AM You’re a class act for standing behind your business and accepting the burden of loss yourself. Your losses can be decreased substantially if you wait to reimburse your clients until after the associated market drop that will follow this event. +1 but I have to ask, is there something I am missing here, why was this wallet with over $200k worth of bitcoins not encrypted with a strong password? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kiba on March 02, 2012, 04:22:05 AM Maybe you should consider reducing your hot wallet? A little inconvenience is a lot better than losing that much money.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cablepair on March 02, 2012, 04:23:08 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted?
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 04:24:26 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? you would think so ::) whats the excuse for not doing this? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stick_theman on March 02, 2012, 04:24:42 AM Wow that's one heck of an attack. Terribly sorry to hear about the loss but hopefully you can recouperate in some way with the company or community. Is Linode like a version of Linux or server software, or just a hosting company such as 1&1, Dreamhost, GoDaddy etc.? I suppose whether it is Windows, Linux, or Mac, if someone knows what they are doing it doesn't matter what software runs the wallet. A user could get to the right files if they know. Looks like Linode is just a hosting company. Link: http://en.wikipedia.org/wiki/Linode I heard from Slush's thread that the Super Admin at Linode can login to any of the virtual server/websites, including Slush's mining pool and Bitcoinica. I think MtGox should take note... possibly migrate to a non-US server?? I bet there's a team of people, be it insider or outsider, poppin' toasting champagne right now, as this is a concerted effort to bring down bitcoins. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: zhoutong on March 02, 2012, 04:24:49 AM You’re a class act for standing behind your business and accepting the burden of loss yourself. Your losses can be decreased substantially if you wait to reimburse your clients until after the associated market drop that will follow this event. +1 but I have to ask, is there something I am missing here, why was this wallet with over $200k worth of bitcoins not encrypted with a strong password? The root password has been changed via the customer service interface at Linode. The ruby gem we were using to process Bitcoin withdrawals did not support encrypted wallets. We have already migrated to a secure hosting with only intranet incoming access. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kiba on March 02, 2012, 04:26:04 AM Looks like Linode is just a hosting company. Link: http://en.wikipedia.org/wiki/Linode I heard from Slush's thread that the Super Admin at Linode can login to any of the virtual server/websites, including Slush's mining pool and Bitcoinica. I think MtGox should take note... possibly migrate to a non-US server?? I bet there's a team of people, be it insider or outsider, poppin' toasting champagne right now, as this is a concerted effort to bring down bitcoins. This doesn't hurt bitcoin. It makes bitcoin stronger. What doesn't kill us makes us stronger, more aware of the danger. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: chrisrico on March 02, 2012, 04:26:12 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? you would think so ::) whats the excuse for not doing this? If payments were automated, it would have to decrypt the keys at some point... What may have prevented this is multi sig transactions. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bearbones on March 02, 2012, 04:26:43 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kiba on March 02, 2012, 04:27:43 AM Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. Zhou could have reduced his loss significantly by reducing the amount of bitcoin that were in the hot wallet. It could be 10,000 bitcoin, for example. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cablepair on March 02, 2012, 04:27:59 AM so basically the problem here is no one was using encrypted wallets because the web apps they were connected to were not compatible
damn what a shame thats a lot of money :( props to the OP for doing the right thing. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: smickles on March 02, 2012, 04:31:49 AM so basically the problem here is no one was using encrypted wallets because the web apps they were connected to were not compatible yeah... noTitle: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Clipse on March 02, 2012, 04:33:32 AM Not trying to heat up the waves but whats the chances the recent dump is related to these coins.
As much as I hate regulation of any kind, I hope Mark can look at the person(s) dumping right now and see if the coins they moved is part of the coins stolen. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cablepair on March 02, 2012, 04:33:41 AM yeah .... no?
explain to me how I am wrong. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bitcoinBull on March 02, 2012, 04:34:11 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cablepair on March 02, 2012, 04:34:35 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. thank you. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: drakahn on March 02, 2012, 04:35:29 AM so basically the problem here is no one was using encrypted wallets because the web apps they were connected to were not compatible damn what a shame thats a lot of money :( props to the OP for doing the right thing. even if the 'web apps' were compatible, they would need to know the encryption key, so anyone with access would also have the encryption key Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: smickles on March 02, 2012, 04:36:00 AM yeah .... no? as was mentioned before, the wallet would have to be decrypted at some point in time to use it, the attacker had root access so they would see the unencrypted wallet. This means that an encrypted wallet would not have help out at all.explain to me how I am wrong. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kiba on March 02, 2012, 04:36:23 AM In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. AND mutlisignature AND low amount of BTC in your hot wallet in case your defense in depth got bypassed. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: smickles on March 02, 2012, 04:38:02 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bbit on March 02, 2012, 04:38:08 AM In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. AND mutlisignature AND low amount of BTC in your hot wallet in case your defense in depth got bypassed. this ^^ Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: btc_artist on March 02, 2012, 04:41:13 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Clipse on March 02, 2012, 04:41:32 AM Watch MTGOX, Im telling you someone is dumping these coins right now.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: smickles on March 02, 2012, 04:42:35 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bbit on March 02, 2012, 04:44:01 AM Watch MTGOX, Im telling you someone is dumping these coins right now. This is right . Why not catch the thief at this part of the chain? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: btc_artist on March 02, 2012, 04:44:51 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: rjk on March 02, 2012, 04:45:00 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kiba on March 02, 2012, 04:45:40 AM Watch MTGOX, Im telling you someone is dumping these coins right now. The limit for withdrawal is 10K USD for verified account, and he would need to pass fake information to MtGox's money laundering office. So the thief would need to create multiple accounts, multiple identity or compromise several mtgox accounts. IANASE, but keep in mind that AML increase barrier of entry, reducing competition and privacy of users. Keeping record of user identity is also a security liability if identity thieves get their hand on it. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: mrb on March 02, 2012, 04:45:56 AM We didn't have the opportunity to scan our whole system for suspicious transactions that were not initiated from our customers because we had to shut down the system immediately after we've discovered the huge loss. We did get a rough estimate and we published a press release to warn our users about the deposit address replacement. However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. When you introduced Bitcoinica, you claimed one of your security advantages was that you "did not operate a Bitcoin wallet" and that "all your funds are stored on MtGox". Source: https://bitcointalk.org/index.php?topic=42267.msg514429#msg514429 However this theft makes it apparent that you changed your mind, as you lost a wallet. Why did you change your mind about hosting the wallet on your own servers? You had a great idea, you should have stuck with it. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Sergey (imcex.com) on March 02, 2012, 04:46:10 AM zhoutong, I do appreciate what your are doing for the community. This is a hell of responsibility your are taking, good job.
But, please, explain me - how could you be keeping the whole bunch of Bitcoins in a single wallet running on the VPS (!!!) in the wild? Having $200,000-250,000 worth customers' funds would make me invest my own money in renting dedicated server at least. Or two. Considering even this not being totally secure - it still would provide much more security at $50/month cost. But hell, who cares about security at $50/month! Being a hero at $200 grands is much more effective! Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Clipse on March 02, 2012, 04:47:18 AM Watch MTGOX, Im telling you someone is dumping these coins right now. The limit for withdrawal is 10K USD for verified account, and he would need to pass fake information to MtGox's money laundering office. So the thief would need to create multiple accounts, multiple identity or compromise several mtgox accounts. If Mark isnt aware of watching for this, he might just let this guy withdraw all the funds over a few days, Im not sure what the endgame is however some individual(yes it was way to coordinated, watch the graphs) solely dumped just over 20k BTC allready. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cablepair on March 02, 2012, 04:47:37 AM i mean seriously, could not this whole thing been prevented if the wallet was just encrypted? Obviously the software running against the hot wallet has to have access to it. This means that if someone roots the server, they'll be able to have the same access to the hot wallet. Encryption would not have entered into it. Zhou, good on you for covering this! I'm having a hard enough time covering the BTCinch theft; I can only imagine how pissed you are at linode. In this case, encryption would have protected the wallet because the attacker was only able to get root access after a reboot. it would take multiple fails for this scenario to be successful and the bottom line is an encrypted wallet would likely have saved this money. The problem is these web applications have not been developed to the level where they are able to interact with encrypted wallets. point blank. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cablepair on March 02, 2012, 04:49:28 AM and again +200k to the op for being a man and taking care of this in a responsible way, im just trying to bring awareness on how we can secure bitcoin for the future. I have only like 80 bitcoins in my wallet right now but you can damn well better believe it is in encrypted with a completely uncrackable password.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: rjk on March 02, 2012, 04:50:04 AM Why did you change your mind about hosting the wallet? my bet: mtgox limitations Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bbit on March 02, 2012, 04:50:15 AM Watch MTGOX, Im telling you someone is dumping these coins right now. The limit for withdrawal is 10K USD for verified account, and he would need to pass fake information to MtGox's money laundering office. So the thief would need to create multiple accounts, multiple identity or compromise several mtgox accounts. If Mark isnt aware of watching for this, he might just let this guy withdraw all the funds over a few days, Im not sure what the endgame is however some individual(yes it was way to coordinated, watch the graphs) solely dumped just over 20k BTC allready. The thinking is as someone told me on another thread is these thief(s) steal Bitcoin and spend bitcoin at silkroad etc., etc., which seems totally stupid to me then again I'm not a thief. What again happened the allinvain person again - did that thief cash out the BTC at the $10,000 a mo. @ Mt.Gox ? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Eveofwar on March 02, 2012, 04:50:41 AM and again +200k to the op for being a man and taking care of this in a responsible way, im just trying to bring awareness on how we can secure bitcoin for the future. I have only like 80 bitcoins in my wallet right now but you can damn well better believe it is in encrypted with a completely uncrackable password. Nothing is "uncrackable" given the amount of time. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: rjk on March 02, 2012, 04:51:07 AM Watch MTGOX, Im telling you someone is dumping these coins right now. The limit for withdrawal is 10K USD for verified account, and he would need to pass fake information to MtGox's money laundering office. So the thief would need to create multiple accounts, multiple identity or compromise several mtgox accounts. If Mark isnt aware of watching for this, he might just let this guy withdraw all the funds over a few days, Im not sure what the endgame is however some individual(yes it was way to coordinated, watch the graphs) solely dumped just over 20k BTC allready. The thinking is as someone told me on another thread is these thief(s) steal Bitcoin and spend bitcoin at silkroad etc., etc., which seems totally stupid to me then again I'm not a thief. What again happened the allinvain person again - did that thief cash out the BTC at the $10,000 a mo. @ Mt.Gox ? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kiba on March 02, 2012, 04:52:09 AM Nothing is "uncrackable" given the amount of time. If you don't remember your password, it's as good as lost(Unless you found a way to crack them in a reasonable amount of time). There's a tradeoff between convenience and security. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Clipse on March 02, 2012, 04:59:24 AM and its still dumping, will probably create a false panic selloff.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 05:00:37 AM i would hold off on the congrats to Zhou until he actually delivers the coins. that is a lot to deliver.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: k9quaint on March 02, 2012, 05:01:53 AM Maybe the attacker will pull an "Omar" and sell the coins back to him for 40 cents on the dollar. :o
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Etlase2 on March 02, 2012, 05:02:05 AM bananas
B-A-N-A-N-A-S 3k was one thing, but 44k? damn Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: zhoutong on March 02, 2012, 05:04:07 AM i would hold off on the congrats to Zhou until he actually delivers the coins. that is a lot to deliver. We are not discontinuing the service. Trading, deposits and withdrawals will all go back to normal in a few hours (once our new Bitcoin server has caught up with the current block). We are honoring every single withdrawal request, large or small. No account had any balance deductions resulted from this incident. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 05:04:58 AM i would hold off on the congrats to Zhou until he actually delivers the coins. that is a lot to deliver. We are not discontinuing the service. Trading, deposits and withdrawals will all go back to normal in a few hours (once our new Bitcoin server has caught up with the current block). We are honoring every single withdrawal request, large or small. No account had any balance deductions resulted from this incident. glad to hear you reiterate this. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kiba on March 02, 2012, 05:06:16 AM Let just hope you don't store 40K bitcoin of your customer's money on your red hot wallet next time.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: BkkCoins on March 02, 2012, 05:08:31 AM Keeping this many BTC in a "hot" wallet is just nutty. I wonder if MtGox keeps that qty online? If the transfer volume really requires so much instantly available then I'd be looking at ways to use offline wallets and cron based transfers to move money between them as needed. Bitcoin has a lot of flexibility in how transactions are created and posted or batched so I think it would be wise for any business doing high volume transfers to seriously look at ways to keep account depth highly controlled.
Your ability to bounce back despite how hard hit is pretty astounding. Profits must be very worthwhile! Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Clipse on March 02, 2012, 05:09:10 AM This is quite insane, this thief is probably follow these threads thats why he started to dump as quickly as possible now.
I still dont see the current dumping as just a phase, its way to linear. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: zhoutong on March 02, 2012, 05:10:33 AM Let just hope you don't store 40K bitcoin of your customer's money on your red hot wallet next time. We are developing a customized Bitcoin client for sever use, with hard-coded security designed specifically for web apps. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stick_theman on March 02, 2012, 05:13:39 AM We are developing a customized Bitcoin client for sever use, with hard-coded security designed specifically for web apps. That's what I'm talking about! Fighting back like Rockie already. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bbit on March 02, 2012, 05:16:09 AM Zhou, talk to Mark at mtgox. i bet there's something he can do to intercept at least some of these coins as the thief tries to cash out on mtgox. Mt.gox response so far: https://bitcointalk.org/index.php?topic=66986.msg778811#msg778811Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bitcoinBull on March 02, 2012, 05:16:55 AM Let just hope you don't store 40K bitcoin of your customer's money on your red hot wallet next time. It's not customers' money anymore, but his loss. There's plenty of blame to go around (starting with Linode), but I have enough confidence that zhou can eat the loss, and then make it back. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: max in montreal on March 02, 2012, 05:34:55 AM Can we not follow these coins?
If i was the thief, I would deposit onto silk road and just withdraw into another wallet...there is your free coin mixer... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: paraipan on March 02, 2012, 05:40:38 AM This is quite insane, this thief is probably follow these threads thats why he started to dump as quickly as possible now. I still dont see the current dumping as just a phase, its way to linear. +1 Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: max in montreal on March 02, 2012, 05:42:11 AM half on SR the other half on the armoury...
Scarface... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bbit on March 02, 2012, 05:43:42 AM half on SR the other half on the armoury... Scarface... naaassttyyy...... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stochastic on March 02, 2012, 06:36:11 AM We didn't have the opportunity to scan our whole system for suspicious transactions that were not initiated from our customers because we had to shut down the system immediately after we've discovered the huge loss. We did get a rough estimate and we published a press release to warn our users about the deposit address replacement. However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. For transparency, we would like to disclose all the suspicious transaction ids in this incident: I hope you get insurance next time to account for any losses due to theft. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: finway on March 02, 2012, 06:37:48 AM Not much.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: pastory99 on March 02, 2012, 07:00:18 AM This is very sad to hear. I wish you the best of luck with whatever you decide to do now.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 02, 2012, 07:01:11 AM We didn't have the opportunity to scan our whole system for suspicious transactions that were not initiated from our customers because we had to shut down the system immediately after we've discovered the huge loss. We did get a rough estimate and we published a press release to warn our users about the deposit address replacement. However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. For transparency, we would like to disclose all the suspicious transaction ids in this incident: I hope you get insurance next time to account for any losses due to theft. Doesn't exist. You could only have the USD insured. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: viboracecata on March 02, 2012, 07:02:09 AM Good luck to zhoutong.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Bro on March 02, 2012, 07:20:15 AM http://news.ycombinator.com/item?id=2973301
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: roomservice on March 02, 2012, 07:37:42 AM Sorry for your loss zhoutong!
To be honest, this incident brought Bitcoinica to my attention for the first time. Really great service, i just registered and made a deposit! Wish you the best and good luck for the future. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: proudhon on March 02, 2012, 07:41:05 AM I'm impressed with the way Z has handled this so far. Sufficiently impressed that I've decided not to withdraw the bitcoin I have in bitcoinica. Hopefully, like MtGox, bitcoinica will emerge from this more secure than ever.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: caveden on March 02, 2012, 08:44:20 AM However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. I'm sincerely impressed by your good behavior here. Congratulations. Can't you try to sue Linode or something? This is mainly their fault. I wouldn't be surprised at all if the attacker is a rogue employee of theirs. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Brian DeLoach on March 02, 2012, 08:54:28 AM http://news.ycombinator.com/item?id=2973301 This comment is oddly prophetic. Quote from: jerf I'm going to pitch a different take than a few others: Yes, great initiative, please keep trying things and building things, but end this project now. There are no probable outcomes where you do not end up having to explain where thousands of dollars of other people's money went to some angry people. I do wonder how an 18 year old is going to come up with $200,000 worth of bitcoins as reimbursement. I don't know how profitable bitcoinica has been, but that much money seems too much to overcome. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 02, 2012, 08:54:48 AM However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. I'm sincerely impressed by your good behavior here. Congratulations. Can't you try to sue Linode or something? This is mainly their fault. I wouldn't be surprised at all if the attacker is a rogue employee of theirs. Unofficially, already working on it. Officially, I'm not working with Bitcoinica and can't comment. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: zby on March 02, 2012, 09:12:06 AM The question now is were user passwords compromised? I would assume an affirmative answer to this, even if they were encrypted - this is only a matter of time. Just like with the historical MtGox hack bitcoinica now should shutdown and go through a round of account claiming.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: racerguy on March 02, 2012, 09:13:11 AM are deposits working? I deposited 0.1btc's from mining a while ago that still aren't showing up, 13confirms so far.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: racerguy on March 02, 2012, 09:14:15 AM The question now is were user passwords compromised? I would assume an affirmative answer to this, even if they were encrypted - this is only a matter of time. Just like with the historical MtGox hack bitcoinica now should shutdown and go through a round of account claiming. The way I understood it only a machine with the hot wallet was hacked, not machines holding user data. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: FlipPro on March 02, 2012, 09:20:11 AM Zhous got the fucking dough WOW! :D
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Koekiemonster on March 02, 2012, 10:14:40 AM Tough hit Zhou! I hope P2SH will leave major hacking incidents behind us, another great lesson learned here.
I actually don't understand why everybody seems to be surprised Zhou is able to cover these losses. If you look at their volume and fees I think they easily covered this, huge hit nonetheless. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: muyuu on March 02, 2012, 10:29:45 AM I'm a bit surprised that this whole turn of events hasn't hit the market more, to be honest.
Just goes to show how successful a short, directed attack can be. 1/4M from a bunch of accounts in a matter of minutes, and the perp is nowhere to be found... At the end of the day, a VPS is an untrusted party and you cannot put your private keys there. They stop being private at all. Single point of failure and all that jazz... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: piuk on March 02, 2012, 10:48:15 AM Sorry to hear about this zhoutong,
This will be a test of whether bitcoin is truly anonymous and un-blockable. Will the hacker be able to successfully launder and exchange this volume of stolen coins? I don't know if it is better if they are successful or not. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Bitcoin Oz on March 02, 2012, 11:10:54 AM My condolences for the theft mate :(
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Technomage on March 02, 2012, 11:32:03 AM People who think the dumps at Mt. Gox is the stolen money, are absolutely clueless about everything. Gox takes money laundering more seriously than any other Bitcoin exchange. The thief would be out of his mind to try selling the coins via Gox, not now or ever.
There are better ways to do it. What we're seeing now at Gox is speculators selling because there has been serious bad news in the Bitcoin world. That's about it. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Mageant on March 02, 2012, 12:11:40 PM Good work, Zhou.
:) Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: muyuu on March 02, 2012, 01:34:32 PM Probably not, but none of us need to know the addresses that go through MtGox. Only MtGox needs to know. All we need to know is what MtGox is going to do about it if they find one, and that is up to them to tell us, since we agree to the user agreement when we make our accounts and we support them as a community by giving them our business. Sure, but if we're going to have some sort of collaborative tracking of coins stolen in big hacks, that kind of information would be very useful. MtGox and other exchanges could also transfer coins to a number of accounts publicly to their name at some point (either to store them or to pass them out) and that would also help. Since MtGox already stated publicly that the coins were not the same ones, it's very clear he's just out to cause trouble. Since I tend to ignore Paraipan's posts I'm not sure what you're talking about here, to be frank. It was just an idea. Probably having a public statistical tracking service would not be a great idea. After all, one would only know if the BTC he just received are significantly tainted AFTER receiving them... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 02, 2012, 01:53:48 PM @Matthew N. Wright i'm only doing this to help the robbed people out for Christ sake You're misguided. We are already helping the 'robbed people' out by asking questions. You are making statements and asking people to break other laws just to make you happy. You're as misguided now as you were when you filed a police report because Zhou Tong didn't answer you quickly enough.Being honest is important. I am completely honest that Zhou Tong dropped the ball by ignoring our advice to be collocated instead of using the magical cloud he loves so much. I support him and believe since he is covering the costs himself, he has learned his lesson and will move on. He's a bright kid who just needs some polishing. I am not advocating secrecy, I am advocating common sense. What your asking for doesn't help anyone. What you think is necessary isn't even necessary. Yet, you're not listening to anyone and you can't give a good reason. Why would anyone support you? Start asking questions and giving reasons instead of making demands and statements against things. putting my reputation in line with people like you calling me names. Your reputation is not in line with me. You do not work with me. I had held on to you against the recommendation of every-single-participating-party in the Bitcoin Magazine because I didn't believe it was fair to judge you on a single instance of irresponsible behavior (regardless of how large and idiotic it was) for filing a worthless police report against Zhou and bragging about it on the forums. Today however, before this thread was started, I removed you from the magazine completely for continuing to be over-the-top, ignoring facts, and just pushing pushing pushing, like a wannabe cop with no jurisdiction.Which side you on Matthew ? Gavin, SLush, Zhoutong and other bitcoiners or the robbers side ? Slush and ZhouTong are both in the DCAO with me. Gavin might be too. Other Bitcoiners do business with me. The robber might too (who knows!). I am not on anyones side. I am on the side of common sense, as always. You are not making any sense. Your demands, even if provided, would help no one and hurt people in the process. Your continued denial of this shows your ignorance, your continued lack of self explanation and clarification shows your stubbornness and your continued self important vagaries about how you're going to help when people who are actually helping right now don't even need what you're asking for shows me that you're so out of the loop you should just be ignored.Why am I responding to you then? Because it's in my nature to care, as obnoxious and vicious as I come across, it is in my nature to never ignore people who need a good punch in the face. I would do it to you, I would do it to my own father. Humans are humans and we all need a good check once in a while. This is your check. That isn't much info at all and already public, you wouldn't know who deposited which coins only MtGox, but they already know that, right ? Trust the powers that be or stop supporting them. You are not a shareholder of MtGox. You are not a recognized legal official. You are not representing anyone right now. If you are curious and want to "do your part", then start asking questions and stop asking people to do things for you like you are an all-knowing investigator, ready to file your weekly police reports!Help me out dude, damn it. Trust me, I am. You just don't realize it yet.Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: glitch003 on March 02, 2012, 02:29:25 PM http://news.ycombinator.com/item?id=2973301 This comment is oddly prophetic. Quote from: jerf I'm going to pitch a different take than a few others: Yes, great initiative, please keep trying things and building things, but end this project now. There are no probable outcomes where you do not end up having to explain where thousands of dollars of other people's money went to some angry people. I do wonder how an 18 year old is going to come up with $200,000 worth of bitcoins as reimbursement. I don't know how profitable bitcoinica has been, but that much money seems too much to overcome. He said it's not a problem as the companies historical profits are high enough to cover it. Zhou is a smart guy, smarter than leaving all his profit in bitcoins on a internet-accessible server. If anything, it's a testament to Bitcoinica's success. (This is assuming that Zhou does in fact stick to his word) Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Etlase2 on March 02, 2012, 02:49:13 PM He said it's not a problem as the companies historical profits are high enough to cover it. Zhou is a smart guy, smarter than leaving all his profit in bitcoins on a internet-accessible server. If anything, it's a testament to Bitcoinica's success. (This is assuming that Zhou does in fact stick to his word) If he has made enough to cover it, it would certainly seem to be in his best interest to stick to his word. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: sgbett on March 02, 2012, 02:59:55 PM @Matthew N. Wright i'm only doing this to help the robbed people out for Christ sake You're misguided. We are already helping the 'robbed people' out by asking questions. You are making statements and asking people to break other laws just to make you happy. You're as misguided now as you were when you filed a police report because Zhou Tong didn't answer you quickly enough.Being honest is important. I am completely honest that Zhou Tong dropped the ball by ignoring our advice to be collocated instead of using the magical cloud he loves so much. I support him and believe since he is covering the costs himself, he has learned his lesson and will move on. He's a bright kid who just needs some polishing. I am not advocating secrecy, I am advocating common sense. What your asking for doesn't help anyone. What you think is necessary isn't even necessary. Yet, you're not listening to anyone and you can't give a good reason. Why would anyone support you? Start asking questions and giving reasons instead of making demands and statements against things. putting my reputation in line with people like you calling me names. Your reputation is not in line with me. You do not work with me. I had held on to you against the recommendation of every-single-participating-party in the Bitcoin Magazine because I didn't believe it was fair to judge you on a single instance of irresponsible behavior (regardless of how large and idiotic it was) for filing a worthless police report against Zhou and bragging about it on the forums. Today however, before this thread was started, I removed you from the magazine completely for continuing to be over-the-top, ignoring facts, and just pushing pushing pushing, like a wannabe cop with no jurisdiction.Which side you on Matthew ? Gavin, SLush, Zhoutong and other bitcoiners or the robbers side ? Slush and ZhouTong are both in the DCAO with me. Gavin might be too. Other Bitcoiners do business with me. The robber might too (who knows!). I am not on anyones side. I am on the side of common sense, as always. You are not making any sense. Your demands, even if provided, would help no one and hurt people in the process. Your continued denial of this shows your ignorance, your continued lack of self explanation and clarification shows your stubbornness and your continued self important vagaries about how you're going to help when people who are actually helping right now don't even need what you're asking for shows me that you're so out of the loop you should just be ignored.Why am I responding to you then? Because it's in my nature to care, as obnoxious and vicious as I come across, it is in my nature to never ignore people who need a good punch in the face. I would do it to you, I would do it to my own father. Humans are humans and we all need a good check once in a while. This is your check. That isn't much info at all and already public, you wouldn't know who deposited which coins only MtGox, but they already know that, right ? Trust the powers that be or stop supporting them. You are not a shareholder of MtGox. You are not a recognized legal official. You are not representing anyone right now. If you are curious and want to "do your part", then start asking questions and stop asking people to do things for you like you are an all-knowing investigator, ready to file your weekly police reports!Help me out dude, damn it. Trust me, I am. You just don't realize it yet.well said. it's cliched but "keep calm and carry on" seems to be sage advice right now. bad stuff happens all the time. its how you deal with it that counts, looks like bitcoinica/zhou is showing exactly what it/he's made of. good work. keep it up, I'm not withdrawing anything. I don't thank anything has fundamentally changed, and if anything this is a good thing because this can only lead to more security. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: runeks on March 02, 2012, 03:14:10 PM I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there. Exactly how have you made the assessment of the security of the Mt. Gox platform that allows you to make this claim?Tough hit Zhou! I hope P2SH will leave major hacking incidents behind us, another great lesson learned here. I doubt it will. It will make it harder, no doubt about that, but theft will never be prevented. All we can hope for is a reduction in these occurrences, a lower profit to work ratio (how much work the thief has to put in for a certain amount of profit). But as soon as the price of Bitcoins double, the profit to reward ratio will double as well.Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Rassah on March 02, 2012, 04:14:45 PM I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there. Exactly how have you made the assessment of the security of the Mt. Gox platform that allows you to make this claim?Their word that they rewrote the code for it from scratch, closed down all access they could, and are now storing most coins in offline storage. Also them putting limits on all withdrawals, requiring some type of ID for anyone wishing to withdraw substantial funds, and being the first to use two factor authentication. Plus the part about them still being the top exchange by volume by far, and yet not being hacked since that last incident almost 9 months ago. Also, I wouldn't be surprised if a lot of the common sense ideas everyone uses now (cold storage, withdrawal limits, two factor option) were things people didn't care about until MtGox incident, and which they got from MtGox since then. I wouldn't be surprised if Bitcoinica came up with new security procedures that everyone else six months from now would look back on as a no-brainer, and at the very least this would emphasize the urgency of implementing multi-sig security, whereas without it people would have greeted the change with a "meh." In fact, I'd go as far as to say we were about due for another major security breach to get people to learn more about or invent better security measures. The more that happens during Bitcoin's development stage the better. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: muyuu on March 02, 2012, 04:17:05 PM I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there. Exactly how have you made the assessment of the security of the Mt. Gox platform that allows you to make this claim?Their word that they rewrote the code for it from scratch, closed down all access they could, and are now storing most coins in offline storage. Also them putting limits on all withdrawals, requiring some type of ID for anyone wishing to withdraw substantial funds, and being the first to use two factor authentication. Plus the part about them still being the top exchange by volume by far, and yet not being hacked since that last incident almost 9 months ago. Also, I wouldn't be surprised if a lot of the common sense ideas everyone uses now (cold storage, withdrawal limits, two factor option) were things people didn't care about until MtGox incident, and which they got from MtGox since then. I wouldn't be surprised if Bitcoinica came up with new security procedures that everyone else six months from now would look back on as a no-brainer, and at the very least this would emphasize the urgency of implementing multi-sig security, whereas without it people would have greeted the change with a "meh." In fact, I'd go as far as to say we were about due for another major security breach to get people to learn more about or invent better security measures. The more that happens during Bitcoin's development stage the better. In reality we have one true measure regarding to security and its perception in the Bitcoin community: time passed since last big fuck-up. It was just reset to zero yesterday. In the particular case of MtGox, we have it running at under a year still. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cypherdoc on March 02, 2012, 04:18:10 PM I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there. Exactly how have you made the assessment of the security of the Mt. Gox platform that allows you to make this claim?Their word that they rewrote the code for it from scratch, closed down all access they could, and are now storing most coins in offline storage. Also them putting limits on all withdrawals, requiring some type of ID for anyone wishing to withdraw substantial funds, and being the first to use two factor authentication. Plus the part about them still being the top exchange by volume by far, and yet not being hacked since that last incident almost 9 months ago. Also, I wouldn't be surprised if a lot of the common sense ideas everyone uses now (cold storage, withdrawal limits, two factor option) were things people didn't care about until MtGox incident, and which they got from MtGox since then. I wouldn't be surprised if Bitcoinica came up with new security procedures that everyone else six months from now would look back on as a no-brainer, and at the very least this would emphasize the urgency of implementing multi-sig security, whereas without it people would have greeted the change with a "meh." In fact, I'd go as far as to say we were about due for another major security breach to get people to learn more about or invent better security measures. The more that happens during Bitcoin's development stage the better. i agree with this. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: grue on March 02, 2012, 05:06:49 PM In reality we have one true measure regarding to security and its perception in the Bitcoin community: time passed since last big fuck-up. It's not really a "fuck-up" if the server provider is compromised. the mtgox breach was caused by a employee that had access to the db, which is totally different.It was just reset to zero yesterday. In the particular case of MtGox, we have it running at under a year still. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Rassah on March 02, 2012, 05:09:00 PM Rassah, you are a bastion of common sense. Common sense is just common, not sensical. What MtGox and Bitcoinica were doing before they got hacked was common sense 8) Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: muyuu on March 02, 2012, 05:16:54 PM In reality we have one true measure regarding to security and its perception in the Bitcoin community: time passed since last big fuck-up. It's not really a "fuck-up" if the server provider is compromised. the mtgox breach was caused by a employee that had access to the db, which is totally different.It was just reset to zero yesterday. In the particular case of MtGox, we have it running at under a year still. It doesn't matter who fucked up. It's a combination of things. Criminals have stashed a big amount of coins from important figureheads in the community. For the layman this translates as "BTC are insecure, even their gurus get stolen." Notice I was talking about security and its perception. Personally I think one should never store his private keys anywhere it can be seen in any form they can possibly be seen, so the responsibility would be shared. True enough, VPS's are nice and cheap. I use them. But I don't put any private keys in them, or anything that can be directly stolen. Hopefully this is a learnt lesson now. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Elwar on March 02, 2012, 05:19:53 PM Bitcoin is definitely not yet ready for prime time when it comes to large companies where several people have access to the money with no paper trail if it goes missing.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: goodlord666 on March 02, 2012, 05:21:03 PM Again, we would like to reassure that trading will not be in any way affected and we are already in the process of contacting Linode regarding this incident. The Bitcoinica system has not been compromised and our reserves are more than sufficient for regular trading activities. Your writing style has improved exceptionally since the beginning! Keep it up! Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: MPOE-PR on March 02, 2012, 05:30:56 PM Quote Yes, our historical profit is fairly sufficient to cover the loss from this incident From bitcoinica right now: Quote 73,661.62 traded (56% hedged) 1.152% equivalent fees (indicative) 73661.62 BTC * 1.152 / 100 = 848.581862400 BTC From Thursday, 1 September 2011 to Friday, 2 March 2012: 183 days. If bitcoinica grew linearly (unlikely, but for the sake of argument) 848.581862400 * 183 / 2 = 77645.240409600 BTC, or less than twice the 43k lost. Basically Zhou is putting most of this revenue to cover for this loss, which shows real mettle. To all the people going "o, he's a 17 yo kid": no. He's a 17 yo man. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: BadBear on March 02, 2012, 05:37:40 PM He has a nice little business going, eventually he can hire staff to run it while he focuses on other things, using the profits as capital. So he's definitely gonna wanna keep it going.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: LoupGaroux on March 02, 2012, 05:42:51 PM As the business owner he set the volume of his hot wallet based on what he believed to be his transactional needs. Hard to fault a businessman for trying to handle his customers needs well. He got ripped off and is standing behind his reputation and his service with his own money. Hard to fault a guy for being honest and showing some backbone in adversity.
Sounds like he may be getting some valuable advice about who should be the responsible party here... absolutely inexcusable that Linode permitted this vulnerability, and the responsibility is theirs to make good on all losses, irrespective of whatever exclusionary language they might have pasted into their service agreements. It is called fiduciary responsibility, and they failed. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Aggro on March 02, 2012, 06:32:44 PM I cant help but know some Linode employee wont be at work tomorrow. This all is way way way to convenient, seems like an inside job planned overtime with the knowledge of who runs worthwhile bitcoin services and on which VPS accounts. This is alot of money, please for all of us make its your top priority to get compensation out of Linode otherwise any future losses less than this would be seen acceptable by these crappy hosting companies or other services. Indeed. It seems rather odd that a random hacker would systematically probe linode for security flaws, and then magically find 8 customers related to bitcoin, and methodically empty their wallets. This is clearly somebody from the inside. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 02, 2012, 06:44:06 PM I cant help but know some Linode employee wont be at work tomorrow. This all is way way way to convenient, seems like an inside job planned overtime with the knowledge of who runs worthwhile bitcoin services and on which VPS accounts. This is alot of money, please for all of us make its your top priority to get compensation out of Linode otherwise any future losses less than this would be seen acceptable by these crappy hosting companies or other services. Indeed. It seems rather odd that a random hacker would systematically probe linode for security flaws, and then magically find 8 customers related to bitcoin, and methodically empty their wallets. This is clearly somebody from the inside. I don't know, I hacked VizVideo's phone banks and the St. Joseph county library network both using the method you just described --stumbling upon it. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stochastic on March 02, 2012, 07:18:29 PM We didn't have the opportunity to scan our whole system for suspicious transactions that were not initiated from our customers because we had to shut down the system immediately after we've discovered the huge loss. We did get a rough estimate and we published a press release to warn our users about the deposit address replacement. However, now we have concluded that we lost 43,554 BTC from this incident and we will reimburse our customers for the full amount. For transparency, we would like to disclose all the suspicious transaction ids in this incident: I hope you get insurance next time to account for any losses due to theft. Doesn't exist. You could only have the USD insured. Any insurance can exist. It is just a contract. Of course if these thefts keeps happening then the premiums are going to be expensive. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 02, 2012, 07:21:29 PM Any insurance can exist. It is just a contract. Of course if these thefts keeps happening then the premiums are going to be expensive. I didn't say it won't ever exist, I said it doesn't exist. Now provide your link to the only service in the world that will insure bitcoins (because I've checked to London and back and there isn't one) or stop daydreaming outloud. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stochastic on March 02, 2012, 07:32:48 PM Any insurance can exist. It is just a contract. Of course if these thefts keeps happening then the premiums are going to be expensive. I didn't say it won't ever exist, I said it doesn't exist. Now provide your link to the only service in the world that will insure bitcoins (because I've checked to London and back and there isn't one) or stop daydreaming outloud. What I am saying is a person needs to call a specialist insurance company and they will figure it out. Did you call Lloyd's (http://www.lloyds.com/)? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Phinnaeus Gage on March 02, 2012, 07:43:47 PM Again, we would like to reassure that trading will not be in any way affected and we are already in the process of contacting Linode regarding this incident. The Bitcoinica system has not been compromised and our reserves are more than sufficient for regular trading activities. Your writing style has improved exceptionally since the beginning! Keep it up! Ironically, I was going to pen a similar sentiment, but you, goodlord666, beat me to it. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 02, 2012, 07:44:19 PM Any insurance can exist. It is just a contract. Of course if these thefts keeps happening then the premiums are going to be expensive. I didn't say it won't ever exist, I said it doesn't exist. Now provide your link to the only service in the world that will insure bitcoins (because I've checked to London and back and there isn't one) or stop daydreaming outloud. What I am saying is a person needs to call a specialist insurance company and they will figure it out. Did you call Lloyd's (http://www.lloyds.com/)? Are you kidding? They're the first I thought of! Given the lack of assurance to the location of the bitcoins, the fact that the keys can be copied and moved, the volatility of the market value, and the inability to hold the only physical copies in any medium, they won't insure. If it had a fixed price, I'd imagine they would insure it for more than it's spot value in fees, but what's the point of that? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: ball4thegame on March 02, 2012, 07:45:42 PM Just a thought to share with Zhou and others trying to locate the thief...
Approximately a week ago on the SR forums, there was someone who put out a $30,000 offer to anyone who would submit ID info and such to Mt Gox to enable him/her to withdraw from a large account without giving up his/her real information. Perhaps this was the hacker trying to cover his identity for his future 'endeavor'. Figured I would let people know. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 02, 2012, 07:46:26 PM Just a thought to share with Zhou and others trying to locate the thief... Approximately a week ago on the SR forums, there was someone who put out a $30,000 offer to anyone who would submit ID info and such to Mt Gox to enable him/her to withdraw from a large account without giving up his/her real information. Perhaps this was the hacker trying to cover his identity for his future 'endeavor'. Figured I would let people know. Link? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Rassah on March 02, 2012, 07:47:50 PM Insure for a certain amount of USD/Fiat based on business risks, instead of a specific BTC value. To be safe, the Bitcoin business operator can insure for more than they actually have in case they get more. It's doable. Just stupid expensive.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: ball4thegame on March 02, 2012, 07:50:54 PM Just a thought to share with Zhou and others trying to locate the thief... Approximately a week ago on the SR forums, there was someone who put out a $30,000 offer to anyone who would submit ID info and such to Mt Gox to enable him/her to withdraw from a large account without giving up his/her real information. Perhaps this was the hacker trying to cover his identity for his future 'endeavor'. Figured I would let people know. Link? Can't access from work, will try to post it later if nobody else does. It was in the discussion section on the SR forums. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: runeks on March 02, 2012, 07:51:40 PM I think insurance companies would get a lot of cases on their hands if they started insuring bitcoins. I mean, how can you insure something that can be stolen without leaving any trace?
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: mc_lovin on March 02, 2012, 07:55:12 PM i pretty much saw this coming.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: neo_rage on March 02, 2012, 07:55:57 PM Awesome. Hope that you guys solve this problem with a little troubles.
Thanks god I'm not mining at Bitcoinica, but i'm with you. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Clipse on March 02, 2012, 08:10:41 PM Awesome. Hope that you guys solve this problem with a little troubles. Thanks god I'm not mining at Bitcoinica, but i'm with you. Bitcoinica is far from a mining pool ;) Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: bitcoinBull on March 02, 2012, 09:30:19 PM I cant help but know some Linode employee wont be at work tomorrow. This all is way way way to convenient, seems like an inside job planned overtime with the knowledge of who runs worthwhile bitcoin services and on which VPS accounts. This is alot of money, please for all of us make its your top priority to get compensation out of Linode otherwise any future losses less than this would be seen acceptable by these crappy hosting companies or other services. Indeed. It seems rather odd that a random hacker would systematically probe linode for security flaws, and then magically find 8 customers related to bitcoin, and methodically empty their wallets. This is clearly somebody from the inside. They could have been observing bitcoin node ip addresses and found that 8 of them belonged to linode. Could have observed that the transaction broadcasts of bitcoinica withdrawals were originating from one of those 8. Then concluded that bitcoinica's hot wallet was on a linode VPS. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Herodes on March 03, 2012, 12:17:16 PM I cant help but know some Linode employee wont be at work tomorrow. This all is way way way to convenient, seems like an inside job planned overtime with the knowledge of who runs worthwhile bitcoin services and on which VPS accounts. This is alot of money, please for all of us make its your top priority to get compensation out of Linode otherwise any future losses less than this would be seen acceptable by these crappy hosting companies or other services. Indeed. It seems rather odd that a random hacker would systematically probe linode for security flaws, and then magically find 8 customers related to bitcoin, and methodically empty their wallets. This is clearly somebody from the inside. They could have been observing bitcoin node ip addresses and found that 8 of them belonged to linode. Could have observed that the transaction broadcasts of bitcoinica withdrawals were originating from one of those 8. Then concluded that bitcoinica's hot wallet was on a linode VPS. Yes, but would it not be likely that he/they would need intimiate knowledge of the linode systems, meaning they would need to be a customer or already a sysadmin at Linode ? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: BkkCoins on March 03, 2012, 12:46:08 PM I cant help but know some Linode employee wont be at work tomorrow. This all is way way way to convenient, seems like an inside job planned overtime with the knowledge of who runs worthwhile bitcoin services and on which VPS accounts. This is alot of money, please for all of us make its your top priority to get compensation out of Linode otherwise any future losses less than this would be seen acceptable by these crappy hosting companies or other services. Indeed. It seems rather odd that a random hacker would systematically probe linode for security flaws, and then magically find 8 customers related to bitcoin, and methodically empty their wallets. This is clearly somebody from the inside. They could have been observing bitcoin node ip addresses and found that 8 of them belonged to linode. Could have observed that the transaction broadcasts of bitcoinica withdrawals were originating from one of those 8. Then concluded that bitcoinica's hot wallet was on a linode VPS. Yes, but would it not be likely that he/they would need intimiate knowledge of the linode systems, meaning they would need to be a customer or already a sysadmin at Linode ? Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: muyuu on March 03, 2012, 12:52:33 PM Bitcoinica was also in Rackspace, right?
Well, this just in http://www.rackspace.com/knowledge_center/content/slicehost-forum-archive-migration-and-conversion Rackspace's slicehost forum user DB compromised. They are a bit unclear on how and what exactly was compromised, and why do they know it. This shouldn't in theory affect rackspace users but is a fair warning on not reusing passwords and also not having your passwords anywhere near "the cloud"... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: gamer4156 on March 03, 2012, 06:20:13 PM I remember seeing that post on SR as well.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: btcash on March 03, 2012, 06:32:49 PM How can you reimburse that much? Have you really made that much profit? Yes, our historical profit is fairly sufficient to cover the loss from this incident, and we believe that it's the best interest for the community to keep running the business. We will take appropriate strategies and implement more security features to prevent this from happening ever again, even with the presence of dishonest partners or employees. I am wondering why somemany bitcoin people used that hoster. There are thousands of hoster. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stick_theman on March 03, 2012, 08:55:35 PM How can you reimburse that much? Have you really made that much profit? Yes, our historical profit is fairly sufficient to cover the loss from this incident, and we believe that it's the best interest for the community to keep running the business. We will take appropriate strategies and implement more security features to prevent this from happening ever again, even with the presence of dishonest partners or employees. I am wondering why somemany bitcoin people used that hoster. There are thousands of hoster. Bitcoinica is leveraged as compared to MtGox. I have a lot of respect for you, ZT. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: kurtosis on March 04, 2012, 09:23:09 AM I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there. I was wondering about that, being one of the people whose account was hacked. How do you know this?Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: runeks on March 04, 2012, 02:18:00 PM How can you reimburse that much? Have you really made that much profit? Yes, our historical profit is fairly sufficient to cover the loss from this incident, and we believe that it's the best interest for the community to keep running the business. We will take appropriate strategies and implement more security features to prevent this from happening ever again, even with the presence of dishonest partners or employees. in fees (https://www.bitcoinica.com/ bottom page) and allows leveraged trading (buying/selling more bitcoins/dollars than you actually have). So when a guy like this (https://bitcointalk.org/index.php?topic=59969.0;all) short sells for $130,000 worth of bitcoins, Bitcoinica makes around $1500 in, quite literally, no time. I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there. I was wondering about that, being one of the people whose account was hacked. How do you know this?I'm not saying Mt. Gox isn't secure though, please don't misunderstand me. I'm just saying we have no way of knowing - with absolute certainty - if they are. I think this is a relevant point. Many people thought the Titanic was unable to sink. Until it sank. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: zhoutong on March 04, 2012, 06:14:19 PM How can you reimburse that much? Have you really made that much profit? Yes, our historical profit is fairly sufficient to cover the loss from this incident, and we believe that it's the best interest for the community to keep running the business. We will take appropriate strategies and implement more security features to prevent this from happening ever again, even with the presence of dishonest partners or employees. in fees (https://www.bitcoinica.com/ bottom page) and allows leveraged trading (buying/selling more bitcoins/dollars than you actually have). So when a guy like this (https://bitcointalk.org/index.php?topic=59969.0;all) short sells for $130,000 worth of bitcoins, Bitcoinica makes around $1500 in, quite literally, no time. Bitcoinica spreads take the market depth into account. We don't charge fees directly. Most of the time, trading on Bitcoinica is just slightly more expensive than Mt. Gox for heavy traders (who pay 0.3% at Mt. Gox), and usually cheaper for infrequent traders. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Seal on March 06, 2012, 01:36:35 AM +1 to zhoutong. Respect.
Given the community collectively has a massive amount of skilled IT resource available. Why not put up some kind of community raised bounty for those 'skilled enough' to expose the thief. I wonder if any of the 'anonymous' crowd would like some work... Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: ctoon6 on March 06, 2012, 03:21:40 AM Here is my question. Why was it ever a good idea to be running a site like this where someone else has access to your machine? These types of operations should be run from locked up racks.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: LightRider on March 06, 2012, 04:41:38 AM http://blockchain.info/tx-index/3059769/de3177f4e929d4deb1984889aa7ad79fd2e78075e41babbda23315bb5135e71f Edit: It looks like someone is sending out small amounts of bitcoin to a large number of public addresses in alphabetical order...I think I just got tainted... Nevermind, I am unduely paranoid. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: dooglus on March 06, 2012, 07:53:52 AM Edit: It looks like someone is sending out small amounts of bitcoin to a large number of public addresses in alphabetical order...I think I just got tainted... But those coins aren't tainted. At least not from the linode theft. 'Only' these 1062 addresses contain coins from the linode theft: http://privatepaste.com/ce5905880d My guess would be that this transaction was made by http://dailybitcoins.org/ - do you use them? dailybitcoins.org: * sends out their payments around 3am (your transaction was at 2012-03-06 03:55:43) * mostly sends out 0.001 bitcoins, almost never less, with a few bigger (yours has 55 of 0.001, 24 of 0.005, 1 of 0.015 and some change) * puts the addresses in alphabetical order * usually has 81 outputs in their transactions (your transaction in blockexplorer: http://blockexplorer.com/tx/de3177f4e929d4deb1984889aa7ad79fd2e78075e41babbda23315bb5135e71f - has 81 outputs) I think it's a pretty good guess that it's them. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Polvos on March 06, 2012, 08:12:22 AM The more layers of complexity, the less people will use Bitcoins. And remember that the average Joe's Bitcoin client doesn't allow you to select the addresses you are sending from.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: LightRider on March 06, 2012, 09:18:52 AM Edit: It looks like someone is sending out small amounts of bitcoin to a large number of public addresses in alphabetical order...I think I just got tainted... But those coins aren't tainted. At least not from the linode theft. 'Only' these 1062 addresses contain coins from the linode theft: http://privatepaste.com/ce5905880d My guess would be that this transaction was made by http://dailybitcoins.org/ - do you use them? dailybitcoins.org: * sends out their payments around 3am (your transaction was at 2012-03-06 03:55:43) * mostly sends out 0.001 bitcoins, almost never less, with a few bigger (yours has 55 of 0.001, 24 of 0.005, 1 of 0.015 and some change) * puts the addresses in alphabetical order * usually has 81 outputs in their transactions (your transaction in blockexplorer: http://blockexplorer.com/tx/de3177f4e929d4deb1984889aa7ad79fd2e78075e41babbda23315bb5135e71f - has 81 outputs) I think it's a pretty good guess that it's them. Yes, that is it, thanks! Totally forgot that I tried that site. Apologies for the undue paranoia. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: dooglus on March 06, 2012, 09:23:01 AM Yes, that is it, thanks! Totally forgot that I tried that site. Apologies for the undue paranoia. I use a different receiving address for every site I use. Then when coins arrive in my wallet I can instantly tell who sent them. For example, only sealswithclubs.org knows the address I use when I'm withdrawing from sealswithclubs.org, and it's labelled in my wallet as "sealswithclubs.org". The address in my signature here is only ever in my signature, and is labelled "bitcointalk forum donation". Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: ram1 on March 07, 2012, 05:37:20 AM Out of curiosity, I analyzed some of the transactions on the blockchain following the theft. It's my opinion that a small amount of tainted coins (100) were moved to the Virwox exchange shortly after the theft. Being a Virwox customer, I deduced this through knowledge of typical Virwox transactions, and not with any actual confirmation, so I could be mistaken.
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: JoelKatz on March 07, 2012, 05:44:23 AM Here is my question. Why was it ever a good idea to be running a site like this where someone else has access to your machine? These types of operations should be run from locked up racks. This is what I first thought when I heard about the Linode hack. It stunned me that people would run these kinds of things from low-end virtual servers. But it just happened that I always worked for companies that were ISPs, had ISP businesses, or had server infrastructure that pre-dated easy virtualization. I was quite surprised to find that use of virtual servers for business-critical infrastructure and highly-sensitive information is now quite common. I'm still not sure how I feel about it.Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: muyuu on March 07, 2012, 12:40:17 PM Here is my question. Why was it ever a good idea to be running a site like this where someone else has access to your machine? These types of operations should be run from locked up racks. This is what I first thought when I heard about the Linode hack. It stunned me that people would run these kinds of things from low-end virtual servers. But it just happened that I always worked for companies that were ISPs, had ISP businesses, or had server infrastructure that pre-dated easy virtualization. I was quite surprised to find that use of virtual servers for business-critical infrastructure and highly-sensitive information is now quite common. I'm still not sure how I feel about it.It's not just low-end or high-end VPS. The cloud is just as susceptible to a crime like this, no matter how expensive your instance is. People seem to have forgotten that some info is private beyond stamping an EULA and saying "you cannot copy this." Let's not get started about the cloud and social networks... the stupidity of the mass is just astonishing. You just have to make something look normal on the surface and they will stop questioning it. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: pent on March 08, 2012, 03:28:35 AM I wrote how to avoid such sutuations:
https://bitcointalk.org/index.php?topic=67787.0 Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: Matthew N. Wright on March 08, 2012, 03:37:12 AM I wrote how to avoid such sutuations: https://bitcointalk.org/index.php?topic=67787.0 Your hindsight is remarkable sir! Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: stick_theman on March 08, 2012, 04:20:25 AM Hahahahaha. Thanks for the tips. Should be bookmarked and stickied!
Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: CIYAM on May 28, 2015, 03:40:28 PM Sorry to necro a topic but I have had to block Off Topic due to all the rubbish so just wanted to find a topic that mentioned Linode as it is not specific otherwise to this post.
I have recently moved ciyam.org to Linode and have found in doing so that if I attempt Google searches from ciyam.org that they are being blocked by Google. This is apparently because Linode is blanket banned by Google due to web-scrapers using them, yet Linode denies this (despite many links you can find showing this) and Linode instead blames their customers for any problems that they have trying to use Google (so it should be believable that one is blocked making one single query via Google through a Linode for "some reason" when one is able to do the identical query through other VPS services without being blocked?). Personally it is not surprising to now see why so much BTC was lost to Linode as this is a company that fails to take *any responsibility* itself but tries to push that all onto its clients. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: cryptopaths on May 29, 2015, 12:53:27 AM I just want to note that after MtGox got severely hacked, it became one of the most secure Bitcoin exchanges out there. Lol the irony. Title: Re: Bitcoinica lost 43,554 BTC from Linode compromise, suspicious TXIDs publicized Post by: jeannemadrigal2 on May 29, 2015, 04:29:10 AM Isn't it a little early for Halloween boys?
|