Hi, For all those willing to sue Mt.Gox because we will be making trades void, please remember that criminality usually falls under "force majeure" by its externality (not like we would have ever wanted that), unpredictability and irresistibility (we resisted most hack attempts, this one was "strong" enough to go through). Force majeure (French for "superior force"), also known as cas fortuit (French) or casus fortuitus (Latin),[1] is a common clause in contracts that essentially frees both parties from liability or obligation when an extraordinary event or circumstance beyond the control of the parties, such as a war, strike, riot, crime, or an event described by the legal term "act of God" (such as flooding, earthquake, or volcanic eruption), prevents one or both parties from fulfilling their obligations under the contract. In this very specific case, any "trade contract" (if you see that as such) is void due to force majeure. Subsequent trades directly or indirectly resulting from the hacking fall under the same rule. Now don't be so selfish and stop trying to claim benefits you generated from nothing by abusing an extraordinary situation. I appreciate all the attention and all the mail about lawsuits, threats and more, but I'd prefer being working on "Stuff that Matters®". |
|
|
|
This is potentially a 5-10m heist. No one knows what's going on.
This should open up lawsuits and criminal proceedings. We don't know if MtGox stole it or what his intentions were. We don't know ANYTHING.
You guys are blind religious fanatics for trusting this idiot. I hope he contacts the FBI. He's at least negligent and worst, a criminal.
We already have criminal proceedings in process against whoever did the hack. |
|
|
|
MT posts some random selective login (why?) logs, and you immediately believe him? hmm.
I posted all the logins on Kevin's and the hacked account for May 19th. |
|
|
|
Kevin, after what Mt Gox did in the "their side" thread to try and CONNECT YOU with the hacker, I sure as hell hope you file that injunction.
I sure hope too, will make it easier for us. |
|
|
|
Let me show you the login logs for our hacker guy on his account full of bitcoins, and Kevin: [2011/06/19 05:00:02] Hacker login
[2011/06/19 05:12:10] Kevin login
[2011/06/19 05:15:10] Hacker login
[2011/06/19 05:22:35] Hacker login
[2011/06/19 05:45:39] Hacker login
[2011/06/19 06:08:18] Hacker login I don't understand. Which account? Kevin and the hacker used the same account? Yeah Please Explain this Jargon, And what is it that you're implying by it? He is saying that Kevin logged in 12 minutes after the attacker logged in to start the attack. Not damning by itself, and almost certainly a coincidence, but still a connection that needs to be followed up, particularly in light of how it all played out. And placed a buy order at 0.01 USD per btc. its quite odd that Kevin could login when the rest of us couldn't. i watched the whole thing unfold and i certainly couldn't get in. the other thing MT might be implying is that Kevin logged into the hacked acct? now that would be damning. please clarify? He logged in 3 minutes before the whole thing unfold. |
|
|
|
Let me show you the login logs for our hacker guy on his account full of bitcoins, and Kevin: [2011/06/19 05:00:02] Hacker login
[2011/06/19 05:12:10] Kevin login
[2011/06/19 05:15:10] Hacker login
[2011/06/19 05:22:35] Hacker login
[2011/06/19 05:45:39] Hacker login
[2011/06/19 06:08:18] Hacker login I don't understand. Which account? Kevin and the hacker used the same account? Yeah Please Explain this Jargon, And what is it that you're implying by it? He is saying that Kevin logged in 12 minutes after the attacker logged in to start the attack. Not damning by itself, and almost certainly a coincidence, but still a connection that needs to be followed up, particularly in light of how it all played out. And placed a buy order at 0.01 USD per btc. |
|
|
|
We don't give a shit.
You were stupid and ill equipped, and you should admit defeat.
This is my take as well. The fact is that you were compromised. We've all seen absolute proof. When you decided you were going to move into real commodities of significant value, along with seeing dollar signs, you should have made SURE you were secure. This is on you. Most people will cut you a break, but you were lax on your security. YOu saw $ signs, got greedy, and didnt take necessary precautions. If you think installing new securities and recoding everything can be done instantly. Mt.Gox had a growth far too fast to give us enough time for this, and we did our best to fix every found problem. In the end however the accounts were leaked because of something completely different... |
|
|
|
Hi, Since lots of people have been posting on http://forum.bitcoin.org/index.php?topic=20207.0 let me give you some infos too. The cat is out, so let's just as well put as much infos as I can. Kevin asked publicly me to reply, so here is my reply response. Kevin has no buy order as of the day preceding the attack. Now, he bought 258k bitcoins at 0.01 USD per bitcoin (0.0101 if you include our 0.65% fee). Let me show you the login logs for our hacker guy on his account full of bitcoins, and Kevin: [2011/06/19 05:00:02] Hacker login on hacked account
[2011/06/19 05:12:10] Kevin login on his account
[2011/06/19 05:15:10] Hacker login on hacked account
[2011/06/19 05:15:36] Hacker starts selling
[2011/06/19 05:22:35] Hacker login on hacked account
[2011/06/19 05:45:39] Hacker login on hacked account
[2011/06/19 06:08:18] Hacker login on hacked account Kevin had only one chance that day to place his 0.01 buy order. So either he had a lot of luck, and somehow knew it was the right time to place a 0.01 buy order, or something smells fishy in there. It's not up to me to decide, but I will report this as it has become a public matter. Therefore I choose option 4: Option 4: Mt Gox signals this to the competent authorities + We are safe + We may even have a chance of catching our hacker if Kevin knows him + We can rollback without having to worry - Having to deal with FBI, provide logs and proof |
|
|
|
The coins stolen from Mt.Gox were not stolen using any CSRF exploit.
So they were stolen from Mt.Gox using another exploit...? No, they logged in on users account using the correct login and password. We have logs showing the loggin succeed on first try. |
|
|
|
So the owner of the site says no coins lost, and customer support says your coins are lost  ?Whom do I believe ?? I wouldn't worry about this at all. Mark Karpeles and MagicalTux often contradict themselves. For example, Mark has just confirmed to us that a few accounts were hacked into. However, MagicalTux reassured us yesterday that the CSRF exploits "were never used," even though there was an obvious corresponding increase in reports of coins being stolen via Mt. Gox. The coins stolen from Mt.Gox were not stolen using any CSRF exploit. |
|
|
|
|
Ok so:
#1407: Confirmed hacked on june 16th, investigation in progress
#1836: Investigation in progress, no lost coins
#1862: Investigation in progress, no lost coins
|
|
|
|
You know about my case very well MARK - I`m still waiting for my stolen 13.4 BTC...
As I already replied you, your funds were stolen by someone logging in onto your account with your password. Your funds are right now on a bitcoin address and have not moved since then. As a reminder we assume no responsibility should your funds be stolen by someone using your own password. |
|
|
|
Password are encrypted one way (+salt). Someone cannot be selling "user + pass" unless he has some way to revert this. In one expression: FUD |
|
|
|
Trust me, if we had a problem in Mt.Gox and it was actively exploited, we'd have way more than a dozen compromised accounts. are you saying that no changes were made to the site in the past 24 hours to protect against a csrf? if it wasn't broken, would you have any explanation for this claim that a hole had been fixed? http://forum.bitcoin.org/index.php?topic=18709.msg235994#msg235994There was indeed a CSRF vulnerability in the "change email" and "send funds" features, however we verified the logs of the webserver and could confirm neither were ever exploited, except by the people who discovered it. Both are now fixed. |
|
|
|
Ok, we've been seeing a "lot" of cases recently. So far I have 10 known cases of people whose coins were stolen (someone logged in on the account using their password, traded USD for BTC, withdrew all the BTC). Considering we have now over 60000 accounts (2 months ago we had 10 times less), this seems to be a problem coming mainly from users. Problem is many have been posting in various places (forums, reddit, twitter, irc, etc) causing a lot of fear among users when the problem is still fairly limited. Trust me, if we had a problem in Mt.Gox and it was actively exploited, we'd have way more than a dozen compromised accounts. By the way we are working on adding an extra feature: a withdraw password. If you define one (on the settings screen) you will have to enter this password too. Should be available by monday. Now, we cannot recover the funds, however we can try to track those and locate to which account they were sent. I guess that if your account was compromised you first sent an email to info@mtgox.com asking for your account to be blocked until investigation, providing as much information as you can as for the problem. Please post here your ticket number that was assigned to you when you created this if you want priority handling. Please read the following FAQ before. FAQMy history disappears along all my coins and moniesYou have not logged in with your usual login. Please make sure you are using the right account. My coins were traded for USD, or my USD were traded for coins, I never entered any orderYou had an open order that couldn't be filled because you didn't have enough funds. When you added funds (or coins) your order could be filled, and was filled. |
|
|
|
They can fix database vulns for one, and they could make password cracking a little harder.... Even dictionary attacks are easy on this site. If Someone had the balls to do it, they could steal almost a million dollars from this site easy.
If you fail at entering your password more than 10 times, your IP is blocked. Even using proxies you'd probably run out of proxies before running a basic dictionary. I believe this makes this kind of attacks non practical. (as for hashing, we use standard unix md5+salt, will switch to $2a$ or $5$ eventually) |
|
|
|
Hi everyone,
I've transferred some funds from my bank using Dwolla to Mt.Gox. I did this on 6/11, which was a Saturday. I think it's supposed to take three business days, so it was supposed to get there yesterday, but even now it's still not confirmed. My Dwolla transaction says it's still pending, and the "expected clearing date" was yesterday...How much longer do I have to wait?
Hi, Please mail your dwolla account id and the message to info@mtgox.com and we'll look into it. Mark |
|
|
|
I think ONLY under legal and required circumstances (court orders), all bitcoin business should cooperate with the law. Not to appease an outraged and out of control legislator, general public, or governments, and certainly not make bitcoins appear more legitimate.
That is we intend to do. I do not want however to see US politicians go all over the place claiming incorrect things about Bitcoin, just because they are ignorant. They will cause global misinformation as whatever they say is echoed broadly. We will comply to court orders valid under our jurisdiction after our lawyers confirm there is no other recourse available. |
|
|
|
June 16th, 2011 - Tokyo (JP) MT.GOX RESPONDS TO REUTERS “WE WANT BITCOIN TO BE UNDERSTOOD” ARTICLELast week Brett Wolf sent us an email hoping we would respond to some of the recent controversies surrounding the Silk Road website. At the time we were unable to respond (they are subject to email response delays, just like everyone else), but after seeing his article about it and reading the mention that “Mt.Gox could not be contacted” we decided to reach out. Like any good reporter, he poked and prodded us a bit about our stance on Silk Road and we advised we have no opinion on the matter, but cummunicated that we did send a letter to the DEA to assert our position in the bitcoin economy, and to shed some light on bitcoin itself to try and put to rest any misconceptions. We believe this initial contact with the DEA is of the utmost importance for the immediate future of bitcoin. The letter ended by saying that we will comply with any court sanctioned investigations and that they are invited to contact us to better understand not only what we do but what bitcoin is. We don’t really think this should be shocking to the bitcoin community as we will be legally obligated to regardless. Also, I think it is safe to say that we do not intend to enable illegal activities or have blood on our hands by association, so to speak. A realization must be made, and that is due to nature of exchanges we are forced to deal with banks and therefor need to stay within the boundaries the regulatory bodies have set. What we intend to do in the future is to stifle and hopefully stop those boarders from closing in on us. We are not here to flip the economic system on it’s head, nor do we believe it is necessary for that to happen in order for bitcoin to be a player in world markets. We have to exist and exercise our right to do business from within the confines of the system. Going forward, we are going to be walking a very thin line with how to proceed with promoting and backing bitcoin. It will not do Mt.Gox or the bitcoin community any good if we are not willing to comply with the laws we are subject to and are consequently shut down. In fact, doing so would only work to taint bitcoins public image and negate any public recourse we might otherwise garner (the media is llouder than the bitcoin community, unfortunately). That being said, bitcoin will be successful in it’s own way and is not intrinsically tied to the future of Mt.Gox. Likely as time goes on bitcoin will become less and less reliant on our exchange, which in many ways is a good thing as it diversifies the communities portfolio, so to speak and would result in less heat being put on us too. However, the reality is that with Mt.Gox being the current mainstay in the bitcoin economy the immediate future of bitcoin is heavily reliant on the public and political perceptions of what we do, and how we do it. So we will continue to keep an open door policy with any and all agencies and governments so long as they are willing to understand bitcoin and work within the law. We understand many people in the community won’t agree, and will look at our exchange (and others) as needing to have a mutually exclusive relationship with bitcoin. We see that on an ideological front, this is likely true, however to have bitcoin take on critical mass we believe exchanges are very necessary entities and are likely the only way politicians, banks and governments will let bitcoin continue on to legitimacy. We invite the community to vet our position intelligently on the public forums, and we will chime in from time to time. -The Mt.Gox Team Download as PDF |
|
|
|
|
Show Posts
