RarityCheck VIBGYOR gilded #12 swept yesterday.

[polymerbit]

A solicitor could argue that under UK law you've displayed negligence.

This generator was known to be compromised, which you failed to disclose to your customers.

Simply put, this has opened you up to potential litigation. Regardless of the fact that you refunded the loaded amounts.

Without an Ltd., this liability is practically unlimited to you personally.

---

Both other key makers, and clients may have a claim against you and your project now.

You really should not be making keys if the results suggest you have no idea what you are doing.

[seavodin]

Raghavsood previously reported, that the system you used to generate keys was connected to a network (the internet in this case).
This was information he received from your team:

Based on a discussion I had with the team separately earlier today, they opened the website on the computer, before removing the internet connection and generating the keys.

And yet you state:

Ofcourse, We always have used airgapped laptop/printer that we wipe after.

An air gapped system, by definition, should never be connected to an external network.
If you hadn't connected it to the internet, more than likely you wouldnt have used the walletgenerator website directly.
You would have downloaded the source code from github (which isnt malicious), loaded it onto a flash drive, then transferred it to the air gapped system.

It seems like you might have a different definition to what an air gapped system is?
It does not protect from all threats, but it limits the possible attack vectors when the system has never had direct contact with external networks.
It also means that all data transfers to and from the system are very intentional and should be scrutinized.


Edit:
I see here that you mention that the system was never connected to the internet:

It's true. The only reason keys were compromised because the key-generator itself is compromised(we weren't aware of that).
But the process of key generation was secure as we never connected any of the devices to internet.

But in earlier posts (and from raghavsood), you stated that it was:

Hi Raghav

We know you are trying to help and we will answer your questions.
But please note that most of the team are software engineers in their day job and the only mistake in this whole process is that we truly blindly trusted a compromised software.

We think the wallet generator either has a back door or someone has done an RNG attack

How we created the keys were we connected the computer via lab cable to the internet to download the client side side site from walletgenerator and the disconnected the cable
No hardware (printer) was connected to wifi.

All hardware is wiped (windows uninstalled and hard disk  wiped) after usage.

About dates that is the main reason why we took sometime. After i reached home after my day job I started looking at my personal device to check historically  when was the first time i was researching on key gen software and looking at all sales thread and when exactly it could be that we created the keys.
But unfortunately as we have no back up of any kind it is impossible to tel exactly. But we feel it might be between July and November  2022.  

[raritycheck]

A solicitor could argue that under UK law you've displayed negligence.

This generator was known to be compromised, which you failed to disclose to your customers.

Simply put, this has opened you up to potential litigation. Regardless of the fact that you refunded the loaded amounts.
 

We didn’t know it was compromised until the whole thing happened.
If we knew we wouldn’t even sell the coins and contact the customers immediately (which we did as soon we got to know)

[polymerbit]

You're focusing on the wrong thing here. There's still a duty of due care. This is others peoples money you ended up affecting.

Your conduct is the issue. I find it particularly abhorrent that you tried to get your project into the gallery in Sicily.

This can be argued to be predatory. You have a project on your hands that you tried to PR wash to people who may not be aware of your multiple failures.

The damage you did is inexcusable. People are already weary of key makers, and for good reason. You proved them right.

[raritycheck]

You're focusing on the wrong thing here. There's still a duty of due care. This is others peoples money you ended up affecting.

Your conduct is the issue. I find it particularly abhorrent that you tried to get your project into the gallery in Sicily.

This can be argued to be predatory. You have a project on your hands that you tried to PR wash to people who may not be aware of your multiple failures.

The damage you did is inexcusable. People are already weary of key makers, and for good reason. You proved them right.

What gallery in Sicily?
Edit: Are you talking about the bitbolo post (above this post on main thread)
That was a post in collectibles.
We thought it’s cryptoonly  coin related event  and we wanted to bring new hole coin v2.
And meet fellow makers and discuss. And  generally since the whole situation been feeling very low and chat to people. So asked bibollo about more details of the event.
We don’t want to PR wash(no idea what that means). But we messaged now to bibollo about this post.
But we really wanted to bring the new v2 coins and show to fellow makers.

Ofcourse, in general we don’t want to hide, we want people to know that this can happen.
Also  we want to ensure that this doesn’t happen again. We want to in general make the whole thing  safer.
Hence created the mini-key generator with better entropy and asking for feedback.
And hence we are continuing this discussion to make people aware.
And also updated on the site https://crypto.raritycheck.com/vibgyor that these coins are compromised.

Edit2:
Inevitably, new makers will come in this space and we are also getting messages from other makers about what we find in our research.

About ‘multiple failures’. That’s not factually correct. In this post itself there are multiple accusations against multiple creators of bad printed key. Then the whole Yogg thing that happened last year. (Mind you in that we actually donated everyone impacted). We think buyers should know that there is a risk.

One thing interesting about the this whole situation for VIBGYOR coins is that Even now if you look at the list of coins
https://crypto.raritycheck.com/vibgyor
Not all coins are actually redeemed and some of the redeemed coins are manually redeemed by buyers.
How could that be ?

Anyways, all we are hoping is that going forward what happened with us doesn’t happen with others
And we can help some trust back into the hobby.

[Edits]

Vouched, mine are gone.

Such is the world of physicals and trusting people within a system designed for us to not need trust.

Oh well.

You know what, we can all get burned. These were 0.001 coins so does it really matter?
The hardest burn is their reputation. I had high hopes for them as their coins were fantastic.
Make shit right, refund the stolen BTC and learn the lesson to create your own keys.

Im not sure if I will buy RC coins again, but thats where we are.

[YodasRedRocket]

Collectible money app just alerted that the remaining 30 VIBGYOR were swept today. I would have thought maker would have reached out to all buyers to tell them to peel their coins but they’ve all been rugged now 

[Steeley]

Collectible money app just alerted that the remaining 30 VIBGYOR were swept today. I would have thought maker would have reached out to all buyers to tell them to peel their coins but they’ve all been rugged now 

oof

[MoparMiningLLC]

and I thought this guy (rarity check) said they were safe...

[seavodin]

One thing interesting about the this whole situation for VIBGYOR coins is that Even now if you look at the list of coins
https://crypto.raritycheck.com/vibgyor
Not all coins are actually redeemed and some of the redeemed coins are manually redeemed by buyers.
How could that be ?

Collectible money app just alerted that the remaining 30 VIBGYOR were swept today. I would have thought maker would have reached out to all buyers to tell them to peel their coins but they’ve all been rugged now  

I guess this answers RC's question. He wasnt convinced that all coins were compromised in that series.
Did anyone get the new holos for the VIBGYOR coins? Mine still have the compromised keys.

[2stout]

and I thought this guy (rarity check) said they were safe...

I believe they said the other series were safe and not this one. 

[MoparMiningLLC]

and I thought this guy (rarity check) said they were safe...

I believe they said the other series were safe and not this one. 

I also believe they said the rest that didnt get swept the first time were safe - didnt they? If not, why on earth would anyone have left them funded?

[LoyceV]

why on earth would anyone have left them funded?

Why did the attacker leave them funded for this long?