Captcha is better than nothing. Do the ad ones and make a few pennies off the hackers.

Store a column on the table for failed attempts. If the count > 5 then require a captcha with the password. On a successful login, reset the count.

If the count say, gets over 50, lock the account for verification, or run a cron to reset it on a daily basis.

Another flag inside the account when they first login could show these hack attempts, something along the lines of "57 attempts to login to your account were done prior to this login from IP: " etc... TOR IP's of course won't be very helpful.

Last log in from IP can also be helpful if people pay attention to it and normally login from a similar address.

None of that makes it bullet proof, but it certainly makes it easier to quickly spot an issue. Needless to say, your password shouldn't be password for something that stores money in it.

hi all,

i accept bitcoins for zimbabwe dollar notes
http://thatuselessguy.com/btc.html

the banknotes are 100 trilion zim $ (that's 14 zeros)

and my starting offer is at 8 BTC (1 banknote) for 100 trilion zim $

PM me if interested; I i'm irc passive (once a week)

I'd be interested in a journal style thread where you write about your day, how you ended up where you are now, etc, with a donation address at the bottom. You seem to be a good writer and whether you're lying or not is irrelevant if you're producing something interesting to read 

Probably would be a good idea make a new thread if you were to do something like that, this one is cluttered.

Have you not told me that when you gambled, you lost some money?