We'll start with something more simple, the "security question" on password reset. This should help a lot.

Just a note, be REALLY careful when accepting wire transfers and/or sepa transfers, as many of those are fraudulent (that's our main issue with banks in Europe right now, especially in France where banks are f****** r******* and have no clue to what kind of fraud exist in this world).

Right now we are using the fact that legally we cannot have no bank account in France as a company (the French laws says we are allowed to have a bank account, the French "central bank" - Banque de France - assigned us a bank, but that bank refused to create the account, so we are assigning it in front of a judge. We have filed on August 8th, had a reply on August 9th, and ruling will happen on August 11th, most likely forcing the bank to follow the law).

In the meantime for Europe we are opening a bank account with a bank which is a bit better at handling large volume of international wires/SEPA in Switzerland. They do however check a lot of details on their customers, which adds some delay in having the bank account opened. Things there are progressing smoothly. We started the procedure on July 1st, and got approval on August 8th. We did the initial deposit on August 9th and it should take no more than 2 weeks from that for us to receive the required elements to access this bank account online.


At the same time we have also progressed with HSBC in Hong Kong. I went there directly to meet HSBC and talk about possibilities of us being able to accept funds from anywhere in the world through the HSBC network. The discussion will take some time, as they want to see how we handle things. We'll have a new bank account in Hong Kong (we already do, in fact, I'm just waiting for the online access token which should be delievered soon via DHL) which will allow us to waive all fees on incoming international wires, and make free outgoing international wires.

Hi, I checked the account history quickly, and saw the hack had nothing to do with your account email. The attacker used the reset password function and got the right reset key right after, which he used to change your password. Therefore here are my questions for you:

• Was your email password strong too?
• Are you sure you NEVER logged into your email from any other place than your home, on a safe computer (ie. never used that email from a mobile device, for example)

We are talking with them, and they are interested, now. We'll be doing something real soon (and MtGox will likely handle this for them, thru making this $4096 a quite nice investment indeed)

Would make sense as botnets gets exploited to mine bitcoins ~

Unfortunately I cannot provide this kind of information without creating useless risks for the stored coins. As we grow we will create more ways of ensuring continuity on which we will be able to communicate openly.

That would be a pain, both to explain to users, and to implement. Plus actually, we can say that about 98% of all funds deposited by users are put offline. We have a handful of very big depositors who know they cannot withdraw their full balance in one go as we don't keep that much online.

Anyway we always keep only 2% of the balance online, which means that even in the case something happens to the online coins we could still guarantee 98% of users funds (we intend to write our ToS with this in mind, however it's not easy to put together). Of course we are doing everything possible to avoid this to ever happen.

Well, I guess it's obvious enough, but yes, we do already keep a large part of the bitcoins in offline wallets, and also have fake offline wallets stored in various places which I would not disclose (each one is encrypted too, of course, but let's avoid useless troubles).

The good thing is we can add bitcoins to those wallets without accessing them, we just keep a list of addresses (signed) and send only when needed.

We would have come (MtGox) if someone told us about this with a bit more advance notice (it falls right on japanese holidays of obon, which means planes are expensive and mostly overbooked)~

We do not cancel trades, unless there is really a need to.

Where did you get such an answer? There was no problem during the weekend.

As for the price, no, bitcoin did not go up to 14.80, only one old order which was placed at that price and which didn't get executed got executed when we rebuilt the orderbook, that's all.

Let me know if you need anything from our api - admin@mtgox.com

It's always within 15 minutes, except dwolla was down a few days ago for a few hours, and since we do not get response from dwolla we do not retry automatically.

Contact info@mtgox.com if your withdraw is not on your account, our staff will be able to tell the system to retry the transfer.

Ok, sorry, I shouldn't have posted too fast. We do not even have proof this post was indeed made by Tom Williams.

Still, if this is truth I would very much like to know how this could happen, especially after they claimed to be secure (see quote in 2nd post) so everyone in the community can learn from this, including ourselves.

We have never said we had 30 years of experience and made fun of other people who got hacked. People around here do not understand the kind of "bad" people who are around here and just go "oh look, mtgox got hacked, but we won't, we are too good for that"... now look at that. I know I shouldn't answer, but I'm tired of being made fun of by people who claim to be better, but end not being better I'd like to know HOW this happened. We need to know how this could happen.

If I quote https://bitcointalk.org/index.php?topic=22221.0 ...


Against


That leaves a large difference.

We won't lock the account, as nothing was lost. It is an interesting way of showing things. We did a fuck up with this update that didn't go right (we did a dozen during the past month and it's the first update causing a major problem, we have found why and modified the procedures to make sure it won't happen again).

Anyway in this case Xiong Zhuang told us exactly how to get the funds back (cancelling the LR withdraw, thru crediting $2000 to his account, solving the negative balance and setting everything right). There is nothing else for us to do here.

We are auditing any account which got a negative balance following that bug. Yes, Dwolla can be reversed, and yes, we will ask for reversal if someone shows an intent to be evil. AML limits on withdraws prevent us from losing any significant amount, anyway.

Paxum gère aussi les comptes en euro.

Ah et aussi, on va bientôt réavoir 2 comptes en europe. L'un en France (dès que la Banque de France se bouge) et un autre en Suisse (dans les semaines à venir).

De plus nous discutons avec notre nouvelle banque HSBC (je suis allé à HK parler directement avec les gens importants de bitcoin) pour pouvoir accepter des dépôts et émettre des fonds de façon locale dans n'importe quel pays où HSBC est présent.

Bruce Wagner: ~25k ( http://forum.bitcoin.org/index.php?topic=33020.msg416038#msg416038 )

Yep, timing can be tricky, we'll add some explanations.