Cryptoine.com HACKED [race condition bug] [exchange closed]

[abyrnes81]

Our hot wallets was drained
...
We had wallets in the ratio 60%/40% (hot/cold).
...
1HF3WND3pG9VEW6Kt7Qj33LoCqVbFpHp2n    0.1             bitcoin       46.98.75.23    2015-03-24 08:20:04.507378
1Dwoam5EXn6g1NuAK8moEd5cpDvUFcqvPi    0.5             bitcoin       46.98.33.104    2015-03-24 04:31:50.770491
1Dwoam5EXn6g1NuAK8moEd5cpDvUFcqvPi    0.5             bitcoin       46.98.33.104    2015-03-24 04:28:40.170138
1Dwoam5EXn6g1NuAK8moEd5cpDvUFcqvPi    1               bitcoin       46.98.33.104    2015-03-24 04:27:57.658323
1Dwoam5EXn6g1NuAK8moEd5cpDvUFcqvPi    1               bitcoin       46.98.33.104    2015-03-24 04:23:13.164357
1Dwoam5EXn6g1NuAK8moEd5cpDvUFcqvPi    1               bitcoin       46.98.33.104    2015-03-24 04:21:27.592489
1Dwoam5EXn6g1NuAK8moEd5cpDvUFcqvPi    1               bitcoin       46.98.33.104    2015-03-24 04:18:45.405848
1Dwoam5EXn6g1NuAK8moEd5cpDvUFcqvPi    0.5             bitcoin       46.98.33.104    2015-03-24 04:16:58.138757

Is that it? 5.6 btc is what they had on hot wallet and that was 60% of everything they had?

its not a popular exchange site, so its not that shocking why they got only few coins in their wallets and the good news is they were drained for a small amount..

5-6 bitcoins is a lot of 'money' for a small - medium exchange like Cryptoine.com ; they should improve their security (I have already lost a couple of bitcoin on bter and I was lucky because I didn't keep btc or others altcoin on cryptoine). Never keep money on an exchange, deposit >> change >> withdraw in less then 10 minutes.

[redsn0w]

Here some interesting articles :

Not even a month has passed since AllCrypt Bitcoin was taken down and another Altcoin exchange has been attacked by hackers. Cryptoine offers numerous markets that are generally absent from larger exchanges. Apparently, it has stopped operating due to a hack attack. Operators of Cryptoine have promised to reveal details but no specific time or date has been declared as of now.


https://www.hackread.com/bitcoin-altcoin-exchange-cryptoine-gets-hacked/

Another altcoin exchange has been hacked, not even a month after AllCrypt went down. Cryptoine, which offers a number of markets not available at larger exchanges, is down as of this morning, claiming a hack. The operators have promised to be forthcoming with details at an unspecified time and date.
....
Multi-Signature Withdrawals More Necessary Than Ever

This attack, along with other recent attacks such as the one on the Chinese exchange Bter, co-incides with wide-ranging calls in the community for broader implementation of multi-signature security. There is a lot of suspicion that exchanges are not implementing such because in most cases these supposed “hacks” are in fact inside jobs not unlike Ponzi schemes where the owners make off with the funds once there is a sufficient amount.

https://www.cryptocoinsnews.com/bitcoin-altcoin-exchange-cryptoine-hacked/

[redsn0w]

Another update :

2015-03-26 08:36 UTC

We apologize everyone, and thank you all for your understanding.

Attacker acted in hours from 3:15 to 10:00 UTC.

Cryptoine database is reversed to 2015-03-24 03:08 UTC and frozen.

In response to many questions...

There was no break-in to the system
There was no leak of data
Wallet private keys are safe and not compromised
The attacker was not able to execute any external code
The bug has been located and fixed. However, the losses are irreversible. We plan to complete the activity of exchange.

We will enable withdrawals in April 2015.

It's sad to say goodbye to all crypto-community. We need to take a few months break. But we will back stronger and more experienced than ever before.

[redsn0w]

Another news on the site (added to the OP):

015-03-27 21:26 UTC

Users will receive a refund in the following amounts:

40% bitcoin,
40% litecoin,
90% urocoin,
65% dogecoin,
40% bitcoinscrypt,
82% magi,
40% darkcoin,
50% dogecoindark,
40% cannabis
100% of other coins (or equivalent in other cryptocurrency)
This applies to balances before attacker activity! (2015-03-24 03:15)


It seems they want to refund all the "customers" with a percentual (40% of bitcoin  ).

[MikeCorleone]

How to make money:

1. Start a Bitcoin / shitcoin exchange

2. Let it run for a bit, pretend to be honest

3. Get "hacked"

Bonus points if only a portion are "stolen" in the hack and you can "return" some of them to make sure nobody tries to hunt you down and give you a proper beating.

[HI-TEC99]

How to make money:

1. Start a Bitcoin / shitcoin exchange

2. Let it run for a bit, pretend to be honest

3. Get "hacked"

Bonus points if only a portion are "stolen" in the hack and you can "return" some of them to make sure nobody tries to hunt you down and give you a proper beating.

I agree if it's a bigger exchange, but cryptoine only had 5-6 bitcoins hacked. It's a nice little payout for someone, but it's not a life changing amount. 100 bitcoins could make a difference to someone's life, but 5-6 bitcoins won't.

[redsn0w]

Another news on their site:


2015-04-04 09:15 UTC
Users will receive 100% XMG refund. Thanks to joelao95 (@coinmagi) 14996 XMG donation.


2015-04-03 16:00 UTC
Please withdraw your coins, you should do it ASAP!

This website and all services will be unavailable after April 30 2015.
Here the coin status: https://cryptoine.com/currency/status

Too many hacks, and I hope now you will never keep your coin on an exchange (it is so risky).

[redsn0w]

The site is closed now, due their previous message:

....
2015-04-03 16:00 UTC
Please withdraw your coins, you should do it ASAP!

This website and all services will be unavailable after April 30 2015.
....