If your security is so good, then you should be able to get 3rd party security and account audits, which would then allow you to get insurance on deposits, right?
We have conducted three independent security audits + black-box pen tests and everything considered Severity 3 and above has been addressed by our programmers and administrator. Audits are repeated periodically to discover any new vulnerabilities as they emerge. Results from one of the tests are available on this forum, and a full report was also shared with one of the former-moderators on the forum for peer review. As things stand today, CampBX has the best chance of obtaining insurance but it will take more than security audits to seal the insurance deal. |
|
|
|
One hack after another...
It's getting quite tiresome.
CampBX has been operating securely without incident for over a year now. I am a data-center guy and not very good at marketing on this forum, but I invite you to check out our security best practices here: https://campbx.com/faq.php#security-complianceOn a sidenote, BitFloor lost power to their servers on 8/31 which tells me that it wasn't hosted at a real data center with redundant power. Keyur |
|
|
|
Interesting find! Bruce's mailing list is awfully quiet about this hack. |
|
|
|
I regularly use CampBx and have been mostly satisfied with their service and low bid prices.
I don't think I've ever waited more then a few hours for a dwolla deposit, and short of walking to a bank or CVS with CASH I know of no faster way to convert fiat to BTC with the exception of p2p trades.
I was recently blocked for "Verification" during a trade. I emailed a notarized copy of my passport and electric bill (as I've had to do with almost every other service/exchange when you get to certain levels) and I was back in business in 24 hours.
I've interacted with support for account and api issues and always found them to be prompt and responsive.
Just my 2c
Thank you BCB! On a side note, we caught two bugs in Dwolla code in last couple of months. One of the bugs affected our ability to see deposits activity altogether, which led to several deposits being delayed in July. Hope Dwolla can stabilize their code base fast. |
|
|
|
it was ACH withdraw but I found out that I put the wrong account number. I recently opened the account and in the paperwork it has listed my debit card number not the actual account number. I found this out thanks to another ex-changer I use-fastcash4bitcoins. Thankfully fastcash4bitcoins ALWAYS answers they're emails right away. Now I just got to wait until campbx corrects the problems which who knows when it will happens since they haven't written me since monday
Hi DD, Since your account number was wrong, there is no other option but to wait for the ACH to bounce before we can reattempt it. Please check your ticket reply for more details. Keyur |
|
|
|
Deposited $12xx into campbx. My account only shows $1000 deposited.
Yes, I have KYC, so the $1k a day limit does not apply here.
Contacted campbx since Monday 8/13. Got a generic email saying they are looking into it.
it is now 8/15, and still no word as to what happened to the $2xx missing.
Perhaps they got a huge bug in the system? or system got breached??? Why are they not responding with a real answer?
Hi Chungenhung, This issue should be resolved for you now - please see the ticket reply for details. We aim to resolve all tickets in 1 business day, but sometime the volume spike makes it impossible to do so. Thank you, Keyur |
|
|
|
Does anyone know if CampBX and/or Intersango have received written permission to use Dwolla?
Yes, we have received the formal permission from Dwolla compliance after a review of our policies and performance with Dwolla over past 90 days. |
|
|
|
For a company that tries to position itself as a "Trusted Bitcoin Platform", I find these facts disturbing:
- Anyone can reset anyone else's password by knowing their user name
- The "change password" form only has one field for "New Password" instead of two, allowing for user error.
Hi Bigg, I would like to clarify that this was never a security risk as the password goes to the original registered email address, and not displayed on screen. Worst case scenario is that someone with too much time on their hands can annoy you with repeat password resets. Point noted though - we are reworking the PW reset code to be annoyance-proof and will deploy the update shortly. - Keyur |
|
|
|
I will check the police station to see of they could gave me a certificate for my ID and then get the certificate translated and notarized. The procedure is like this: A) Take you passport and have it notarized, you don't need anything from the police station as it won't help and they are legally capable of issuing such a document under Chinese law. B) Go to the local government and have the document sent for legalization (认证） at the foreign ministry in Beijing. C) EXPRESS ship documents to CampBx as legalization expires after a set period. The above procedure works for papers for processing visas, international marriages being registered in multiple countries, having contracts notarized in multiple countries etc and should be beyond any kind of questioning from anybody. +1 |
|
|
|
Miernik, I think we are both saying the same thing: MtGox did not lock the account - Dwolla did. When the situation came to light, Mark Karpeles brought the hammer down hard and XZ's withdrawals from MtGox were recalled. MtGox reported the issue to Dwolla, and Dwolla shutdown XZ's account.
My point is that MtGox support guys may not be aware of what Mark said on the forum, because they stopped replying to XZ. It took months of collective effort including PM to Mark to obtain a written clarification about the ownership of money from both MtGox and Dwolla. Xiong, Our lawyer is exploring options of what to do with the money. Most likely we will end up turning it over to a GA state or Fulton county agency and you can follow the due to process to claim it from them. I will send you an email when we complete this hand-off. Thank you, Keyur |
|
|
|
Xiong, We use a professional service to perform KYC / Compliance check and customer ID verification. This service provider is used by many banks and large corporations as well, and they have deemed the documents you submitted as forgeries. I have seen the analysis, but not going to share details here because it can be misused as a tutorial on how to make better fake IDs. Everyone else reading this thread, here is some context that may be helpful: 1) MtGox had a bug last year in their multi-currency code, and Bitcoins showed up as $1 million per coin for a brief period of time. XZ exploited this bug and managed to sell 0.008 Bitcoin for $11,000. The drama is on this thread: https://bitcointalk.org/index.php?topic=33197.0;all2) The proceeds of the sale were withdrawn to XZ's Dwolla, even though Dwolla's TOS does not permit non-USA accounts. 3) XZ created multiple accounts on CampBX and funneled money in to those accounts. This is against our TOS. When the situation came to light, Mark Karpeles brought the hammer down hard and XZ's withdrawals from MtGox were recalled. MtGox reported the issue to Dwolla, and Dwolla shutdown XZ's account. Both companies stopped replying to XZ's messages completely. CampBX also shutdown XZ's accounts, but we understand that perhaps he got a little too excited about the Million-dollar Bitcoins and made a bad judgement call. So we gave him benefit of the doubt and helped him track and recover the money. Now when we requested verification documents from XZ to transmit this money to China, he submitted ID documents bearing a completely different name. The bank account details were also for a different person. His communications came from multiple aliases including XZ, CM, and Pierre. Surprised by these irregularities, we ran a check on his documents from our KYC provider and it came back as a fail. Submitting a fake ID has pushed us on to AML minefield, and we cannot help him anymore with this issue. Thank you, Keyur PS: Edited for clarity. |
|
|
|
|
Hi Splatter,
I have pinged the treasurer about your issue, and will get it resolved shortly. We are sorting through the backlog of tickets due to Dwolla and Bill Pay changes.
Thank you,
Keyur
|
|
|
|
|
Subscribing - will reply as soon as possible.
|
|
|
|
A friend of mine's wife just had her bank account hit with a "BillPay" request that then transferred the money into CampBX. Is this a variation on what you guys are mentioning here? I'd like to try and track the money to find out where it goes.
Raize, Yes - banks were fooled by the fake IDs too. We didn't deposit the flood of BillPay deposits that followed, and have put in new restrictions for BillPay deposits. Keyur |
|
|
|
They've officially sucked since they made unauthorized withdrawals from Tradehill's account and then erased old transactions from already issued account statements to try to hide it. Don't give your business to thieves.
I know, I know..."thieves" is being polite. Hopefully Intersango and CampBX will offer other withdrawal methods, but it seems they're all partners in statism. CA, We support several withdrawal methods besides Dwolla, including my personal favorite USPS Money Orders. We will also add couple of more methods soon. Keyur |
|
|
|
Dwolla has stepped up their procedures to counter the latest attack. Here is a summary of new steps:
--------------------------------------
Starting today, users sending money to your account will need to meet and/or maintain:
1) Connect a social network
2) Have a bank deposit 30 days old
3) Enable a DWOLLA hub page
4) Have a verified account
(i.e. Social Security and/or Photo Verified)
We are working hard to make sure this policy does not affect your most frequent, loyal, and responsible customers.
Thanks for being a part of Dwolla. We hope our new changes will protect customers and merchants alike. Please let us know if you have any questions.
All the best,
Dwolla
--------------------------------------
Discussion at this thread by Charlie: https://bitcointalk.org/index.php?topic=76866.0 |
|
|
|
If you individually deal with someone, most probably a new member of this board, and sell them BTC for Dwolla you could get screwed as well. While we already knew this, the message again is Dwolla is not cash and can be charged back.
LS, Not just Dwolla - One exchange that accepts Chase QuickPay also seems to be affected. Keyur |
|
|
|
do u mean they're transferring stolen USD's to exchanges to buy Bitcoin?
CD, Yes - I didn't make that clear in a rush to get the message out. Just in last couple of hours we received several thousand dollars more from what seems like compromised accounts. InterSango and BitInstant are okay, but seems like one other exchange is going to take a big loss on this one. Keyur |
|
|
|
|
PS: All this info is from the bank investigator. Dwolla so far is reacting like a deer in headlights.
|
|
|
|
|
Hi everyone,
A couple of days ago we noticed some suspicious transfers to CampBX, and reported those to our bank as well as Dwolla. After talking to bank fraud investigators today, seems like there is a well orchestrated, large-scale bank fraud underway. This includes very convincing fake passports and utility bills used to open bank accounts and Dwolla accounts, and transferring money to Bitcoin companies. Bank customers who have been hacked are spread all over geographically: MA, CA, TN, NYC, and WI.
The old-fashioned practice of processing bank+Dwolla transactions manually mostly saved CampBX: We have lost $2.6K and prevented a loss of $9.8K so far. I don't have email IDs for newer exchanges so sending out this open heads-up on the forum. I believe BitInstant does manual processing, so their damage may be limited, but exchanges like Mt.Gox that do automatic processing of Dwolla may be at higher risk. (Unless the fraudsters are selling their coins on Mt.Gox - in that case they will make a nice profit).
Keyur
|
|
|
|
|
Show Posts
