Hey Kevin, thanks for mk IV

Sincerely,

Pitchforkmedia smackdown

I came into Information Security Consulting about 9 years ago, and was hired by a New York based consulting company in 1999.

I actually think Kevin's story makes some sense.  I still think he should return the BTC he withdrew (or forfeit the $3000 and all remaining BTC in account to cover the loss, which, as he claims, is probably worth close to $10,000 at market prices).

Kevin says (1) he has a higher withdraw limit than $1000 and (2) he withdrew around 600 BTC.  It is true that his post implies that his limit was at $1000 when he withdrew, but I don't think that's actually the case and I don't think that he meant to imply that.  Many on the forums have claimed that the BTC withdrawal is based on a 24-hr rolling average (people who claim to have hit this limit themselves, presumably when trying to withdraw during recent volatile periods) and not on the current market price.  At that point the 24-hr rolling average was apparently around $4.5, which would have allowed a maximum withdrawal of around 200 BTC per $1000 allowed.  600 BTC withdrawal, then, aligns with a roughly $3000 withdrawal limit.  I think perhaps he assumed that the limit was based on $0.01, but was in fact wrong about that.

But, like I said, I still think he has no claim to profit on the buy-side of a fraudulent sell order.

Hi,

To increase your bitcoin withdraw limit, there is no need for any document, just let me know your mtgox account user name, and the daily limit you wish for.

To increase your withdraw limit (by default $1000 per 24 hours and $10000 per 30 days), please provide your account name, the copy of an official ID document (such as passport, driver's license, etc...) and the copy of an utility bill at your name and address.

We will review your document and increase your withdraw limit based on your risk profile.

Please note that you can also send a notarized color copy of your ID document to this address (remember to include your mtgox account name) via registered mail (fedex, etc) :

Kevin, regardless of whether you were the original hacker (I don't think you were), a large part of the consensus here is that you did pretty much admit to possessing stolen property. Considering your real name and info is out now (thanks to you yourself), it would probably be in your best interest to wait until things calm down a bit, get in touch with MtGox people, and then PUBLICLY return the funds. Otherwise you'll likely get blacklisted and trolled for years to come. Not saying MtGox people are right, either, but at present only two entities are getting attacked. If I were you, I'd do everything I can to not be one of those any more.
Unless, of course, $12,000 is worth it to have your name remembered and dragged through the mud for the next few years.

But this IS YOU, correct?


http://www.freshports.org/mail/elm/

elm 2.5.8_2 mail on this many watch lists=8 search for ports that depend on this port An older version of this port was marked as vulnerable.
    Is Interactive IS INTERACTIVE: yes
    A once-popular mail user agent, version 2.5.x
    Maintained by: toasty@dragondata.com search for ports maintained by this maintainer
    Port Added: unknown
    License: not specified in port


I'm looking for a bit of assistance from a undernet IRC node operator please. I would like a cloaked hostname. Seems I'm attracting a bit of attention.
Elm is an interactive screen-oriented mailer program  that
supersedes mail and mailx.  This is the 2.5.x distribution.

---

http://www.securityfocus.com/archive/75
Re: Unusual entry in Apache logs 2008-05-30
Kevin Day (toasty dragondata com)

From all the posts in this thread and all the info gathered by other users not to mention your own words, it is pretty obvious you are the hacker that had caused all this and tried to profit from it. Now that you have been caught and your name is out there you are making up this pitty party story to try and keep your stolen profits. Trying to con all the users of this message board into beleiving you are the victim and big bad mtgox is the bad guy. I think you should be locked up and hope the authorities are looking into this as we speak. I got to hand it to you though, hacking into MtGox, emptying out someones account and buying them back up for .01, then coming on the forum and telling everyone you are the one who tried to buy them, and then asking for pity!?

Not going to make an ethical judgment here on the course of action for MtGox, so right to the point:


We were discussing your story in #bitcoin, but weren't able to track down said transfer in the block chain. Could you point it out?

You say you should keep them for the good of the community but if you've got half of the freely traded bitcoins then the market really is gone. Tough luck.

@toasty:
So, you are Kevin, the guy who bought 259684 of stolen BTC for under $3000. And with your essay you are here to complain that MtGox says you can't keep the stolen value but will get your money back? Tell that face to face to person who got robbed.

And btw, how do we know you are not related to the hacker? Maybe you just wanted to launder the stolen BTC that he(or yourself) sold on MtGox.

Given this, would you agree to a panel of senior community members (chosen at large by the community as a whole) to become a panel for arbitration between yourself and MtGox?  Lets call it 5 senior well-respected members, who both MtGox, yourself, and the community can all trust.

Kevin will submit his story, which he pretty much already did it seems.  MtGox will tell their side, and provide confidential information needed to verify it to these 5 panel members.

These 5 members will decide the best course of action in relation to your specific situation with the following guidelines given to them:
* The primary consideration is what is best for the community as a whole
* Any solution will not bankrupt or otherwise substantially impact MtGox's operational capabilities

This would accomplish the following, based on your +/- system:
+ Gives the community some semblance of transparency for a MAJOR issue with the bitcoin market as a whole (as it exists today, at least)
+ Allows both sides to tell their story in relative confidence, thus protecting any major run on markets or mtgox due to new info being released that may be damaging.
+ Keeps this situation out of the court system, where it really has no business belonging and everyone is a loser
+ Quick resolution if MtGox agrees to this, I can't imagine it taking more than a few hours?
- Random panel of 5 "Internet Dudes" are deciding your fate
- You have a very substantial chance of being ordered to give back the BTC you withdrew, should the community members deem it appropriate

I believe this solution, with of course some tweaks to make both parties feel comfortable can accomplish everyone's *stated* goals here.  It will allow Kevin to know what happened, so he knows he's not being completely taken advantage of, it will allow the community to gain transparency and show to outsiders we can resolve problems in an expediant and reasonable manner.  Additionally MtGox will be able to end the rampant speculation as to their activities, and at least for me personally I'd regain a lot of confidence in their exchange.

Does someone have anything better?  Kevin, do you agree in principle to this?  MtGox?  Community feedback?

My personal goal is the longevity of Bitcoin.  Discussions with Kevin lead me to believe this is also his goal as well.  Is it MtGox's goal?  They have stated it is!  If so, step up!  If they do not, then I will have lost faith in their motives myself.  Others will make their own decisions.

okay, so if someone goes to 7-11, runs in for a second to buy something and leaves their car running it's no longer a theft if someone else takes it...? obviously the car is now theirs to sell, right...? they "allowed" their car to get stolen due to their own stupidity, so that's where the situation ends, right...?

The person whose account was hacked (if it was one person) is entitled to their Bitcoins and it's MtGox's responsibility to provide that to him. Kevin did nothing wrong making a large purchase of bitcoins, but now that he KNOWs the bitcoins were stolen, he's possessing stolen property, which can be a felony. The fact that MtGox's account was hacked makes all the difference here, as it makes the bitcoins which were traded stolen property.

I don't wanna argue the case with you.
all I'm saying: public statements when you MIGHT get sued are never a good idea, especially when you have nothing to gain.

I wouldn't rule out that you'll get sued for the 643.
it's just a matter of their "professionalism", if they have the means to pull off a lawsuit in another country or just 3 people in a basement.

if I was in your shoes I'd just shut up.

Have no doubt...   MtGox will use the full weight of civil and criminal law to retrieve what it believes it is owed.  Cutting off communication with you is the first legal step.

Robber steals from a bank.



Robber loses his loot on a chase.



You pick up loot.



You're tracked down.



Loot is not yours to keep.



Simple fucking logic.