Bitcoin Forum

We sadly need to announce that our wallet has been compromised thus DO NOT send any further funds to any of the coin wallets, BTC, DVC, LTC, etc. We will setup a new wallet and reset all the addresses. This will most likely take the whole weekend.

Posted an announcement regarding this at Important Announcements subforum.

Sorry to hear that. How bad is the loss? Will users be out of pocket, or can vircurex cover it?

Further update:  The system was not breached, no passwords were compromised (they are salted and multiple times hashed anyways). The attacker used a RubyOnRails vulnerability that was released yesterday (http://www.exploit-db.com/exploits/24019/) to withdraw the funds therefore.

Sorry for your lose.

Amm ... the RoR volnurability was posted to multiple large forums, including Slashdot.

Did the attacker see the announcement before you were able to realize it affects you and shut off your systems? How come you missed it for so long that you didn't shut your stuff off / upgrade in time?

Exploit released yesterday, eh? How convenient...

Before the wild speculations beginn, the service will be recovered and we pay the losses out of our own pockets.

That's just scheduled maintenance (https://bitcointalk.org/index.php?topic=135731.0) :)
We deployed the fixes within five minutes after receiving the notification from the Rails security mailing list.

It's the truth.

Bit slow of the attacker. I was actually half-expecting someone to start hacking Bitcoin sites before any exploit was even publicly released.

Service restored: deposits, trading and withdrawals are working again

For the time being, some restrictions apply until we have sorted out the account details and validated data integrity.

	Trading	Deposits	Withdrawals
BTC	Active	Active	On hold
NMC	Active	Active	On hold
LTC	Active	Active	On hold
DVC	Active	Active	Active
SC	Active	Active	On hold
IXC	Active	Active	Active
PPC	Active	Active	Active
USD	Active	Active	Active
EUR	Active	Active	Active

It's good to see you are recovering so quickly, especially with the severe downtime or outright collapse most exchanges seem to go through.

Did you switch servers ?

It's been a couple of stressful hours here.

No we did not switch servers, we:
 - applied the Ruby Rails patch
 - backed up all log files for further analysis
 - log files show the XML code injection, we validated all triggered commands to ensure nothing other than withdrawing funds (e.g. backdoor) was done.
 
2AM here, will need to catch some sleep,  mistakes are easily made when being too tired.

Total value lost in the heist?

Sorry for your loss indeed.  Sucks that the vulnerability was in rails and not in your app. 

DId you hold ALL your money in cold wallets?

I'm not sure if I feel worse for bitcoin, vicurex, the people with funds there, or ruby on rails.

This seems like a terrible plan of action. Your server could still be compromised, but site actions have been restored? Why is your wallet easily accessible by your web server?

looks like btc withdrawl is allowed now...shall I test it?

nope. the page has button greyed out

BTC, NMC and LTC service back online again.

We hope to fix Soldcoin in the coming hours too.

confirmed withdrawl seemed to work for BTC

If you don't mind me asking, how much did you lose?

We'll post all the infos after we have done our investigation, the TRX IDs, IPs, Bitcoin address, etc. May it be of help to the other service providers out there.

See if anyone notices if you don't.

Lol werd.

I had hundreds of satoshis there I think.

Also Solidcoin is up and running again.

Kumala, hope you do everything fine.

Any clue how this happened?

Read the beginning of the thread ?

Every major scientific database provider.

Ltc withdrawels are 5 Ltc per withdrawel now, really? I have 10 Ltc on the site, and will have to pay 50% of it as a fee? You will lose a lot of business if this is for real.

Also, while you are at it, please take a look at other exchanges and improve your exchange. It's very confusing, you allow way too many scammy alt coins to be exchanged, which had premining going on like Solid Coin for example. Next, apart from the terrible page design, trading isn't convenient at all, I have to calculate and type dozens of digits whenever I want to change dvc or ixc to btc, then back to ltc. Why do I have to change for ltc, you might ask, other than the fact that I like ltc? Because the withdraw fee for Btc is at a ridiculous 0.1 btc per withdrawel. What a rip-off.

So, while I only use vicurex to profit from some merge mined fractions of coins (way too little volume for actual trading) some real competition for btc, nmc, ltc markets would be very muchly needed. It would be desirable if vircurex presented a a real alternative to btc-e. However, unfortunately you are lightyears away from it.

While I agree the 5 coin fee for LTC (and NMC) is ridiculous, the inclusion of many altcoins is what gives Vircurex its market niche.  So, please put the fee back to what it was, but leave the alt coins.  An easier way to spend "all funds" at once (on a buy) would be nice as well.

You can spend all of whatever currency you are trading by clicking that balance and and then clicking a low enough sell price to cover all of those coins. If you mean out all of every currency into one buy, I'm not sure they can do that.

I'd just like to throw out some serious props to Kumala for how quickly and thoroughly he took care of this. I started trading again on Vircurex soon after they re-enabled deposits, and everything has been incredibly smooth.

Don't even think about changing the site... if people find it confusing, it says more about their own intelligence than it does about the site.

All the info I would need without a bunch of eye candy prettying up a pig like a few other sites I could name.

(reversible USD and EUR pairs would be nice tho :) )

Also, do we have to get new deposit addresses? The welcome messages (announcements) when we log in didn't say that at all. It wasn't until someone pointed me at this thread that I knew what was going on and what the announcements were referring to. (I'm not concerned about the few deposits I made to my old addys... total, they only amounted to a few IXC, so, no big deal)

-- Smoov

Fees reduced down to 1 NMC / 1 LTC respectively.

I had raised the fees due to the considerable amount of extra efforts required to repeatedly maintain those NMC and LTC wallets. People are depositing tons of little amounts (often smaller than 0.0001 LTC or NMC). This leads to the problem that the wallet often needs manual follow up because the wallet is too defragmented and cannot generate the withdrawal.

All your old addresses still work. Thus those "auto" deposits you might have running are all credited correctly.

The initial thought was to put in a new wallet due to the security breach, but looking through the system files/logs we believe the wallets have not been touched, that unfortunately only become after we had reset the addresses. I'll be uploading the "old" addresses to those of you who haven't regenerated them yet  in the coming days.

I very much appreciate users feedback/wishes or recommendation on how further to improve the website. Feel free to send me ideas.

Thnxy... and I just got a deposit notification of one of the IXC deposits in question, so I can confirm that much is working.

-- Smoov

In this case, I seriously suggest you to impose a deposit fee of 0.0001LTC/NMC

A fee of $0.00006?  So it takes 166 transactions to make a penny?  That would be worth it... how, exactly?

I agree with a deposit AND withdrawal fee (perhaps 0.5 both ways), but 0.0001 would just be pointless.

Since Kumala is complaining about sub-0.0001LTC deposit, a deposit fee of 0.0001LTC should be enough to stop these spam activities without affecting "honest" users.

The problem with that is generally exchanges don't charge deposit fees.

Registration fees? Sometimes.
Withdrawal fees? Pretty standard.
Transaction fees? Also rather standard.
Deposit fees? OMGWTFBBQ

Deposit fees tend to chase money away from an exchange, they present a barrier to entry. A withdrawal fee though encourages continued trading, you want to get the most out of the withdrawal fee you can, so you keep trading.

Yeah, I wouldn't ever use an exchange with a deposit fee, as I might as well use one of the competitors for free!

Make a minimum deposit, then.  That would fix your problem.  Maybe .001 or .01 ltc?

Wow,

I noticed the wallet announcements, but didn't even notice a disruption in my service.  Perhaps I should be more careful, haha.

Keep up the awesome Kumuala!

why down?

+1

There is one improvement I'd like to see to the way the site operates.

When BTC gets withdrawn and I pay the 0.01 fee to do so, could you pretty please put 1/10th or 1/20th of that towards the optional transaction fee when the transaction should already be high priority.

This has only been a problem for me a few times, but it always seems to pop up when I would like to use the coins I'm withdrawing right away. Then I see new block after new block pass by with the transaction still unconfirmed. It's painful because all of those Satoshi Dice transactions I see flying by on Blockchain.info are probably getting confirmed, because even though they don't meet the network requirements to be high priority they do include fees.

whats the high priority network requirements?

Aged coins and size of inputs and outputs. A day old value of 1BTC or more is generally golden, the technical section of this page covers the formula for determining priority: https://en.bitcoin.it/wiki/Transaction_fees (https://en.bitcoin.it/wiki/Transaction_fees)

Lately I've noticed though that less mining pools are taking these free transactions though, and it matters very little what the reference bitcoin client says when pools are strongly preferring transactions which include "optional" fees.

What's the current status?  Is it safe to use again now?

Vircurex is fully functional, you can check the trading volume on the home page of https://vircurex.com

what's going on now? the site's getting ddos'd?

All discussion are going on in this thread:
https://bitcointalk.org/index.php?topic=49383.100

hello..

what is about vircurex and BCC and the frocen amount of BTC?
Will this speed up the refund.



i know i don't get an answer but maybe somebody also interested

and now, this exchange is down completely now?
with all frozen founds ..

and nobody cares.

I'm getting a 502 on vircurex.com now. I think it's gone.