To the person above, here's what happened:
- Bitcoinica has an internet mailing list called info@bitcoinica.com
- It was the email for the website and all sensitive accounts.
- You could request a password for that email. In a production system, that should never be possible.
- Several people had access to this mailing list (non-admins and business people included).
- Patrick got added.
- His personal email was compromised. Normally this shouldn't be a big deal; I use my personal email at internet cafes and public computers.
- Attacker was able to request a new password and login to rackspace.

The assumption here was that info@bitcoinica.com did not have access to critical infrastructure.

Lastly, it was my fault Patrick's email server got compromised. I had a VPS for programming and development which many people had access to - randoms from #c++ IRC, people from this forum, beginners I was teaching .etc It's a public VPS for development. The SSH key on there was added to Patrick's server because we were developing the bitcoinconsultancy.com website on there (that's why it's now down). My SSH key was stolen and he ssh'ed into the box. Then had access to his emails.

yesterday I received this reply from ZT by PM which I'm sure he won't mind me quoting here:


OK, now I need to think about this & how to proceed, I don't actually really even understand it, any helpful input would be welcome, many thanks ZT for responding, so it seems though that Bitcoin Consultancy which I now guess is called Bitcoinica Consultancy were not the owners & operators until after Zhou Tong's promise of the 22nd March 2012 to refund for swaps, but that he had already secretly sold Bitcoinica = Bitcoinica LP to T. Seale's investment group & was at that time effectively an employee of them

"Bitcoin Consultancy was first retained to perform a comprehensive security audit on March 27 and they became owners and operators of Bitcoinica LP on April 24. As General Partner, they have exclusive legal authority to manage the company." - Quoted from tseale speaking for the investment group that took over from ZT

Full Disclosure: I AM (or is it I'm?) NOT A WORDSMITH!

But I know grammatical errors when I see/read them and I'm seeing/reading a hell of a lot them in all these official/nonofficial posts. It's like I'm reading shit written by young adults who don't have a rudimentary command of the English language but keep trying their damndest to come across as educated blokes. Now, I'm not necessarily speaking of Zhou, for obvious reasons, but I feel (not sure) that his writting style has changed, as if somebody else is posting in his name. Reason I say this is because I've read words of which he's spelled correctly in the past, coupled with his current delivery seems odd (to me).

Forgive me if this has already been address, but I'm now only catching up, about nine pages out.

Back to reading this CF.

~Bruno~

Yes. Mr. Tihan is the hero here. I am glad he is now getting the recognition and the respect he should. He has invested heavily into the bitcoin community and without people like him we would die on the vine.

 

Heh. A lot of people here assumed it was Zhoutong who ponied up out of his pocket and nobody ever denied that.

Interesting.

I was thinking that it would be paid from Bitcoinica's reserves, but that isn't the case, right?

IMO Zhou and Mr Seale are pretty awesome. Did the bitcoin consultancy do anything other than get hacked? What did they add to this that was productive?

Thanks.

Wow, what a show.

From what I've read on these forums over some time, I have come to pretty strong conclusion that the biggest problem with Bitcoinica is Zhou.
It reads so clearly I wish more people could see. Zhou has great technical abilities and thrives on accomplishment and glory from his peers.
At the same time, he is in no way a team player.

My speculation and observations:

The investors/owners of this venture did the most logical thing when they contracted with the Consultancy to help out with a business that was growing faster than anyone could handle. They were desperate, needed some help quick, and the Consultancy were the only ones on the block specializing in exactly what they needed. So, for Zhou, who prides in himself extensively for his technical creation, to have this new addition to the team review his work and give corrections was a severe blow to his ego and he's been having a tissy fit ever since.

We will take what Zhou has proposed into consideration and discuss it with relevant parties. The issues of misrepresentation were not amenable despite numerous talks. Our silence was called into question the same time we were being misrepresented. Despite our best efforts this was unavoidable. We apologise but we are happy that Zhou has stated many things which, if there is full disclosure, will be shown to be lies and misrepresentations.

With full disclosure I believe our actions will be understood. Without full disclosure, our reputation may remain damaged. If that is the case at least we can say we spoke up.

And on another side note, about pointing fingers, shit happens some times, and you really can not avoid this all the time.

WHMCS.com was hacked for example using the same method it seems:


I do not believe that guy is not professional, or lacks technical skills.

let me make a point clear in case you dont get this

I dont give a f**k about your blame game, I want my money back and if you feel the need to throw s**t at each other make a f**king thread about that

+1

Waiting for Zhou to start returning the money, as he previously stated.

On a side note, I have a feeling Zhou was not really happy that Team Intersango took over, but its nice to watch such nice promises, you people start to sound like Obama, and Romney.

Maybe add on bitcoinica.com a status update, or maybe a list on how much you returned until now, etc, the wait is really annoying for people.

You mean evidence that we can currently now share?

The fact that you lied was a public admission of yours.

Yes you do not have to answer and you can say "we have no evidence"

The issue is clear. We would like full disclosure. It will resolve all these issues. Are you willing to publicly state that you support full disclosure?

You mean evidence that we can currently now share?

The fact that you lied was a public admission of yours.

Yes you do not have to answer and you can say "we have no evidence"

The issue is clear. We would like full disclosure. It will resolve all these issues. Are you willing to publicly state that you support full disclosure?

Please!

Guys can someone please pull public information from NZ companies house (even if it costs to get some by paying 10 dollars or so) and post it here.

I'm Zhou cannot even keep his word for a matter of hours. Anyone who continues to take him for his word should really consider the situation.


I do not need to give you permission!? You need consent from whomever you've singed non disclosure agreements with in 2012 or before obviously. The private chat is extensive and covers a ton of ground.

Thank you for your long list of 15 items.

3. I apologised and gave a self-criticism publicly (about my incompetency in security system).
- because continued misrepresentation would lead to what has happened today.


5. Bitcoinica Consultancy's compromised system (which was already in production before Bitcoinica's transition period) is the direct cause (i.e. if the transition didn't start the problem wouldn't have happened, and the transition didn't cause the initial compromise on the email server).
-Unrepresentative

7. I was prohibited from expressing anything that may damage Bitcoinica Consultancy's reputation (this is from your long post recently [1]).
-You agreed not to post anymore about us. The agreement came out of a conversation based on the fact that there were many cases of cherry picking and misrepresentations. Only hours later you broke your word and even now you continue to misrepresent.

9. I have not signed any NDA with any one in 2012.
- point?

12. I assume that I obtained the permission from the person who may grant you the transparency (I'm not sure) to post the apology.
-You are responsible for what you post.

13. I have been asked to co-author an apology in my name. (And my own one doesn't sound sincere enough. [2])
-After you had misrepresented the situation so many times and lied, you offer to make an apology was assumed to be simply as a means to be political. We wanted to avoid further problems and misrepresentations (as seen in that thread). We wanted to avoid what is happening right now and reach an agreement with a public statement to clarify the situation.


If full disclosure comes out all these details will all be addressed.

Misrepresentations.

So the only person can shed some light on this all and is not bound by some NDA and has/had access to all the information is the very hacker. IIRC he has/had access to Patrick computer or at least his emails. Maybe we can convince him to publish Patricks email database. I am pretty sure he copied all of them, hackers usually do this.

BTW, am I the only one that feels a little strange that apparently Patrick does the claim thing alone? The very person that shared this computer with the hacker. Now I should send him all of private data?

Indeed! If he does not have non-competition agreement. Zhou could develop a new Bitcoinica in the next 4 days and many people would transfer deposits from old Bitcoinica to new one at the first opportunity.

Yep, security experts are being compromised all the time. They are on forefront so they get hit more often. The fact of compromise is not that important as how they prepare for it, assess the risks and mitigate them on ongoing basis.

I dread the moment any of my servers get compromised some day, for the first time.

While the account is speaking for the group as a whole, it is the other two members which after many days of unrest thought it was best to break this silence. Patrick is working on the claims and right now we have to wait on Patrick before we can continue.

We agree that the statements we have had to release are not the ones we would have liked to, it was the only option at our disposal. It has come after over a week of silence where we were trying to resolve the misinformation issues in a more appropriate manner.