Bitcoin Forum
December 12, 2024, 11:31:51 PM *
News: Latest Bitcoin Core release: 28.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1] 2 »  All
  Print  
Author Topic: bitfloor coin theft details  (Read 22025 times)
shtylman (OP)
Sr. Member
****
Offline Offline

Activity: 243
Merit: 250



View Profile
September 04, 2012, 05:12:00 PM
 #1

This thread is the sister thread to the "bitfloor needs your help" thread here https://bitcointalk.org/index.php?topic=105818.0

It is meant for the tracking and discussion of the stolen coins from BitFloor.com

The attack came from the following IP:
178.176.218.157

And the coins were withdrawn with the following transactions:
83f3c30dc4fa25afe57b85651b9bbc372e8789d81b08d6966ea81f524e0a02be
d5d23a05858236c379d2aa30886b97600506933bc46c6f2aab2e05da85e61ad2
f9d55dc4b8af65e15f856496335a29e2be40f128a7374c75b75529e864579f93
42ea472060118ee5aee801cdedbc4a3403f3708a87340660f766e2669f0afeb0
358c873892016649ace8e9db4c59f98a6ca8165287ac80e80c52e621f5a26e46

Obviously it is high hopes to have the coins returned, but I do feel that the community can always benefit from more knowledge about high profile thefts and the aftermath.
nimda
Hero Member
*****
Offline Offline

Activity: 784
Merit: 1000


0xFB0D8D1534241423


View Profile
September 04, 2012, 05:24:59 PM
 #2

That IP address is almost certainly one of multiple proxies, but it's in Russia. No help there.
1nject0r
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile WWW
September 04, 2012, 05:28:49 PM
 #3

This thread is the sister thread to the "bitfloor needs your help" thread here https://bitcointalk.org/index.php?topic=105818.0

It is meant for the tracking and discussion of the stolen coins from BitFloor.com

The attack came from the following IP:
178.176.218.157

And the coins were withdrawn with the following transactions:
83f3c30dc4fa25afe57b85651b9bbc372e8789d81b08d6966ea81f524e0a02be
d5d23a05858236c379d2aa30886b97600506933bc46c6f2aab2e05da85e61ad2
f9d55dc4b8af65e15f856496335a29e2be40f128a7374c75b75529e864579f93
42ea472060118ee5aee801cdedbc4a3403f3708a87340660f766e2669f0afeb0
358c873892016649ace8e9db4c59f98a6ca8165287ac80e80c52e621f5a26e46

Obviously it is high hopes to have the coins returned, but I do feel that the community can always benefit from more knowledge about high profile thefts and the aftermath.


wait letme trace
1nject0r
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile WWW
September 04, 2012, 05:43:22 PM
 #4

your server were not hacked i didnot see any defacing issue some account were compromised only but your server are not hacked those were not a russian hacker's they were some other countries hacker
epetroel
Sr. Member
****
Offline Offline

Activity: 431
Merit: 251


View Profile
September 04, 2012, 06:01:49 PM
 #5

your server were not hacked i didnot see any defacing issue some account were compromised only but your server are not hacked those were not a russian hacker's they were some other countries hacker

This makes absolutely no sense...
1nject0r
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile WWW
September 04, 2012, 06:07:16 PM
 #6

your server were not hacked i didnot see any defacing issue some account were compromised only but your server are not hacked those were not a russian hacker's they were some other countries hacker

This makes absolutely no sense...

i have the proof that server were not hacked even no hacker did that maybe inside employ did this but

if u know how to check defacing site cache google it Tongue

no hackers record on zone-h.org
coga
Full Member
***
Offline Offline

Activity: 222
Merit: 100


www.btcbuy.info


View Profile WWW
September 04, 2012, 06:43:31 PM
 #7

i have the proof that server were not hacked even no hacker did that maybe inside employ did this but

if u know how to check defacing site cache google it Tongue

no hackers record on zone-h.org

dude, the situation is already irritating enough as-is. May we focus on something constructive here?

GPG key: 6F8E305690A05365B58C50A
Vladimir
Hero Member
*****
Offline Offline

Activity: 812
Merit: 1001


-


View Profile
September 04, 2012, 06:53:14 PM
 #8

I somehow lack compassion today and for that I do apologize.

Having said the above I must say that you kids with all those fat wallet.dat's sitting on your laughable amateurish servers do deserve to be hacked and will continue to be hacked. Right until you come up with some money to pay pros to help you out with information security.

Once you have some money to spend on security conscious hosting and consulting do let me know. A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.




-
ribuck
Donator
Hero Member
*
Offline Offline

Activity: 826
Merit: 1060


View Profile
September 04, 2012, 07:00:50 PM
 #9

A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.

What kind of security guarantee does one get for a few kBTC/year?
vampire
Hero Member
*****
Offline Offline

Activity: 574
Merit: 500



View Profile
September 04, 2012, 07:01:28 PM
 #10

A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.

What kind of security guarantee does one get for a few kBTC/year?

Zero
Vladimir
Hero Member
*****
Offline Offline

Activity: 812
Merit: 1001


-


View Profile
September 04, 2012, 07:02:53 PM
 #11

A few kBTC/year on proper hosting/security is by far better than 30k loss per year on top of all the reputational problems and likely biz failure.

What kind of security guarantee does one get for a few kBTC/year?

Zero

true

but most risks would be reduced dramatically.

Silensec Labs Ltd. (a joint venture of myself and Silensec http://silensec.com/ ) would be happy to discuss what a few kBTC can do for one's information security. But we are going offtopic here, 2 posts full of shameless plugs is too much already.

-
iron77
Member
**
Offline Offline

Activity: 112
Merit: 22


View Profile
September 04, 2012, 07:12:55 PM
 #12

What would now happen with USD balances?
DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218
Merit: 1079


Gerald Davis


View Profile
September 04, 2012, 07:15:21 PM
 #13

What would now happen with USD balances?

They should be returned as even if bitfloor opens it obviously will be at some point in the future.  Client funds should be escrowed from company funds.  Clients shouldn't be turned into unwilling "investors" simply because they had funds on the wrong site at the wrong time.

I am still confident that shtylman will do the right thing.
shtylman (OP)
Sr. Member
****
Offline Offline

Activity: 243
Merit: 250



View Profile
September 04, 2012, 07:21:11 PM
 #14

What would now happen with USD balances?
I am still confident that shtylman will do the right thing.

I am working on that right now. I will post to the other thread (https://bitcointalk.org/index.php?topic=105818.0) in a few minutes.
notme
Legendary
*
Offline Offline

Activity: 1904
Merit: 1002


View Profile
September 04, 2012, 07:41:10 PM
 #15

What would now happen with USD balances?

They should be returned as even if bitfloor opens it obviously will be at some point in the future.  Client funds should be escrowed from company funds.  Clients shouldn't be turned into unwilling "investors" simply because they had funds on the wrong site at the wrong time.

I am still confident that shtylman will do the right thing.

You mean like what is happening to those of us who had mostly bitcoin in their accounts?

https://www.bitcoin.org/bitcoin.pdf
While no idea is perfect, some ideas are useful.
casascius
Mike Caldwell
VIP
Legendary
*
Offline Offline

Activity: 1386
Merit: 1140


The Casascius 1oz 10BTC Silver Round (w/ Gold B)


View Profile WWW
September 04, 2012, 08:01:25 PM
 #16

With all due respect to the victims in this hacking, whoever they'll end up being, I am suspicious of hacking claims where the announcement of the hack includes a factual assertion of how the hack took place, e.g. "we used encryption but they found our forgotten unencrypted backup".  How does one come to know with certainty that this is actually what happened?  Seriously, I'd expect to see "we don't know how they got our funds, but clearly they did, we can think of n possible ways they did it so far, including this forgotten backup, and we'll let you know more when we find out".

When Bitcoinica announced "funds got stolen, they broke into our MtGox by getting our password from LastPass" I questioned this much the same way - this seems unknowable if you're not the hacker.  If I ever get hacked, I'll probably the first to say "I don't know how they got in, but I'm reformatting things as I speak!  (And your coin balances are safe, because I didn't forget anything anywhere that would put them at risk!)"

Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable.  I never believe them.  If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins.  I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion.  Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice.  Don't keep coins online. Use paper or hardware wallets instead.
shtylman (OP)
Sr. Member
****
Offline Offline

Activity: 243
Merit: 250



View Profile
September 04, 2012, 08:04:11 PM
 #17

With all due respect to the victims in this hacking, whoever they'll end up being, I am suspicious of hacking claims where the announcement of the hack includes a factual assertion of how the hack took place, e.g. "we used encryption but they found our forgotten unencrypted backup".  How does one come to know with certainty that this is actually what happened?  Seriously, I'd expect to see "we don't know how they got our funds, but clearly they did, we can think of n possible ways they did it so far, including this forgotten backup, and we'll let you know more when we find out".

This is the most information I have at the moment. There are only a number of places/files on the disk that would have provided the attacker the keys so narrowing this down to a few possibilities was not impractical.
ErebusBat
Hero Member
*****
Offline Offline

Activity: 560
Merit: 500

I am the one who knocks


View Profile
September 04, 2012, 08:25:32 PM
 #18

With all due respect to the victims in this hacking, whoever they'll end up being, I am suspicious of hacking claims where the announcement of the hack includes a factual assertion of how the hack took place, e.g. "we used encryption but they found our forgotten unencrypted backup".  How does one come to know with certainty that this is actually what happened?  Seriously, I'd expect to see "we don't know how they got our funds, but clearly they did, we can think of n possible ways they did it so far, including this forgotten backup, and we'll let you know more when we find out".

This is the most information I have at the moment. There are only a number of places/files on the disk that would have provided the attacker the keys so narrowing this down to a few possibilities was not impractical.
Not knowing your current security procedures how can you rule out a compromise of your personal PCs? 

░▒▓█ Coinroll.it - 1% House Edge Dice Game █▓▒░ • Coinroll Thread • *FREE* 100 BTC Raffle

Signup for CEX.io BitFury exchange and get GHS Instantly!  Don't wait for shipping, mine NOW!
deus-ex-machina
Full Member
***
Offline Offline

Activity: 166
Merit: 100



View Profile
September 04, 2012, 08:33:21 PM
 #19

I'm going to try looking into the transaction details. I'll see what I can find. The sooner we get this solved, the better. Even if I find nothing, the least I can do is try to help everyone.
foo
Sr. Member
****
Offline Offline

Activity: 409
Merit: 250



View Profile
September 04, 2012, 09:13:58 PM
 #20

Here are clickable links to the transactions, to save everyone a lot of cutting and pasting...

http://blockchain.info/tx/83f3c30dc4fa25afe57b85651b9bbc372e8789d81b08d6966ea81f524e0a02be - 16,120 BTC
http://blockchain.info/tx/d5d23a05858236c379d2aa30886b97600506933bc46c6f2aab2e05da85e61ad2 - 1,000 BTC
http://blockchain.info/tx/f9d55dc4b8af65e15f856496335a29e2be40f128a7374c75b75529e864579f93 - 6,400 BTC
http://blockchain.info/tx/42ea472060118ee5aee801cdedbc4a3403f3708a87340660f766e2669f0afeb0 - 60 BTC
http://blockchain.info/tx/358c873892016649ace8e9db4c59f98a6ca8165287ac80e80c52e621f5a26e46 - 498.39 BTC

EDIT: Added the amounts.

I know this because Tyler knows this.
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!