BREAKING: Atlanta based Bitcoin giant BitPay hacked for nearly $2,000,000!

[VitoH]

In the grand scheme of things, this had little to do with bitcoin itself. Just another case of cyber and social security breached by combining social engineering with hacking. This could have just as easily been some wall street firm, or perhaps some precious metal company. It's a classic security breach. Bitpay is at fault for being hacked. Someone dealing with millions of dollars in cryptocurrency should have a little sense when visiting opening random documents/pages, even if from a trusted source. Quite a foolish move on bitpay's part.

[johnyj]

In the grand scheme of things, this had little to do with bitcoin itself. Just another case of cyber and social security breached by combining social engineering with hacking. This could have just as easily been some wall street firm, or perhaps some precious metal company. It's a classic security breach. Bitpay is at fault for being hacked. Someone dealing with millions of dollars in cryptocurrency should have a little sense when visiting opening random documents/pages, even if from a trusted source. Quite a foolish move on bitpay's part.

This has something to do with bitcoin too. This kind of theft would never happen in legacy financial system where each account have a clear ownership registration by the banks, and supervised by regulators. So the fraudulent payment will always be reversed by the banks. However bitcoin is like cash, once bitcoin moved to another address, it is like cash being stolen, there is almost no way to trace it back

That's also the reason large banks are refusing to do bitcoin related business. If it really works like cash, then all those regulations around cash might apply to bitcoin: Daily withdraw limit, maximum number of cash allowed in one transaction etc...

[Gleb Gamow]

So these people have no telephones to confirm these types of transactions? Everyone know email is the easiest platform to hack. How can they simply trust a email to transfer $2 000 0000 worth of Bitcoin? I hope a full investigation will be launched and some people will get fired for this.

Every time something like this happens, people lose faith in the technology. I will never trust a 3rd party to keep any large amount of my coins. A central organization have many weak links! and they become a easy target for hackers.

The fraudster got access to Krohn's email, allowing the fraudster to review Krohn's communications "to learn specific details about how Bitpay transacted business," according to the lawsuit. The fraudster then sent emails to Bitpay CEO Stephen Pair purporting to be from Krohn, asking Pair to transfer 1,000 bitcoins to a Bitpay customer's "wallet," which he did.

So, exactly who should Stephen Pair, one of BitPay's co-founders doing grunt work on that day, fire for not doin' their job properly?

[Gleb Gamow]

inside job.   do u really think that anyone is thatstupid     ........   or R they?  looks like the owners are that stoopid.

any exchange not utilizing a blockchain as their exchange mechanism is begging for it. as an exchange owner u might not be setting up a long con, but your poor employees cannot be blamed for giving into the temptation of taking $millions from you and blaming it on a bad hair day.

 openledger. ccedk. rendering news clips like this obsolete

Remember 1QAHVyRzkmD4j1pU5W89htZ3c6D6E7iWDs ?

BFL: Hello, BitPay, we will be using 1QAHVyRzkmD4j1pU5W89htZ3c6D6E7iWDs as one of our bitcoin wallet address.
BitPay: Roger Wilco!

<millions travel into 1QAHVyRzkmD4j1pU5W89htZ3c6D6E7iWDs via sales and on-site mining>

Press Release: BitPay would like to announce that it has just processed the first $1M transaction via Bitcoin. HashTrade is using BitPay to remit to BFL the first million dollars of a down payment for all them Monarchs they ordered, thus has moved in front of BFL's strict queue position thingy. Here's HashTrade's address used for the purchase as proof: 1QAHVyRzkmD4j1pU5W89htZ3c6D6E7iWDs : https://blockchain.info/tx/1b6ea350c094071412df1f801651263fd65ffa0b89ad6c8626ceeca8755f50bc

http://ww1.prweb.com/prfiles/2013/10/29/11283333/gI_81188_1mm-BTC-Transfer.jpg



BFL: Hello, BitPay. Sonny, here. I'll be liquidating some bitcoins via our 1QAHVyRzkmD4j1pU5W89htZ3c6D6E7iWDs bitcoin wallet address using you guys as an unlicensed exchange. Don't worry 'bout where any of them bitcoins came from, for we's legit. Honest Abe! BTW, I'll be movin' millions. Can you dudes handle that much?
BitPay: No prob! Start a sendin'.

Knock, knock.
Who's there?
FTC. Let us in or we're breakin' down the door with this dance pole we found in the parking lot that some dude riddled with moles was doin' cartwheels over.

FTC: Okay, boys, looks like we got everything, including BFL's main bitcoin wallet address, 1QAHVyRzkmD4j1pU5W89htZ3c6D6E7iWDs. Leave the dance pole by the desk of that old shaggy-breast grey-haired chick. Chances are it's hers, hence the crusty cum stains at the top with chicken feathers stuck to it.

[VitoH]

This has something to do with bitcoin too. This kind of theft would never happen in legacy financial system where each account have a clear ownership registration by the banks, and supervised by regulators. So the fraudulent payment will always be reversed by the banks. However bitcoin is like cash, once bitcoin moved to another address, it is like cash being stolen, there is almost no way to trace it back

That's also the reason large banks are refusing to do bitcoin related business. If it really works like cash, then all those regulations around cash might apply to bitcoin: Daily withdraw limit, maximum number of cash allowed in one transaction etc...

You would think so, but that's not how the world works. What you are basically suggesting is that no fraud whatsoever can occur in the banking system because of how regulated it is because regulatory agencies can just reverse transactions. Take a look at history. It is ripe with thousands of cases of banking scams and fraud that were never recovered from. Especially when you are involving foreign banks, with foreign laws and regulations. There is so much red tape involved in getting such large wires reversed. Once the money is sent overseas, it's basically gone. Foreign banks will always put their account holders first, instead of taking orders from another banking institution outside of their country.

The only way such foreign banks would reverse transactions would be through a court order, from their country of residence. Wire Transfers may be traceable to account holders, but when you start involving multiple foreign countries and multiple unassociated accounts, the money is as good as gone. It can take YEARS to get effective court to get any kind of action, and by then the money is long gone, and likely is any evidence. Not to mention building a case and presenting evidence to the notion that there was fraud/scam involved, IN (possible multiple) foreign countries.

After you exceed more than 2 or 3 bank transfers beyond the initial fraud, that money will likely never be recovered. You'd be dealing with multiple parties/shell bank accounts. The party that is at the end, has nothing to do with the past 2 owners of the money. Can you imagine if someone spent a couple millions of dollars to your company, you gave them the product, they disappear with it, and then agencies try to take your money saying the 3rd to last owner stole it? There's no way on earth in any court system would get behind that.

[Gleb Gamow]

I once spoke of Bryan here: https://bitcointalk.org/index.php?topic=150803.msg10258238#msg10258238

http://www.csbs.org/regulatory/ep/Documents/EPTF%20Hearing%20Panel%203.pdf

Bryan Krohn: Thank you, Commissioner Cotney, the distinguished members of the task force, and the state banking commissioners for the opportunity to speak with you today. My name is Bryan Krohn, I am the CEO of BitPay. I appreciate all of your interest in the commercial and international trade uses of virtual currencies, and for reaching out to the community to better understand opportunities and risks that virtual currencies represent.

BitPay was formed in May of 2011, so that has been operating for three years, which makes us pretty old in this space today. During this time we've acquired over 30,000 merchants to accept bitcoin with our service. Our merchants include small, medium, and large sized businesses in every state who accept bitcoin side-by-side with credit cards as a form of payment. At BitPay, our role in the bitcoin ecosystem is very close to that of a traditional merchant-acquirer in the credit card space. Our software helps merchants clear and settle payments, transactions rather, over the bitcoin network.

Bitcoin, BitPay is not an exchange. BitPay is not a bitcoin bank. We do not have any consumer facing services. Consumers have no risk of loss from our service. BitPay is committed to being a good corporate citizen. We employ a strict KYC policy to protect against money laundering. Our KYC policy follows the best practices of traditional merchant acquirers.

We need to know who our merchants are and what they're selling. We only want the good actors on our platform.

Bitcoin does have risks as other forms of payments do. Criminals use cellphones, email US dollars, and banks. BitPay shares the tasks force policy goals to protect consumers from fraud and money launderers, keeping money launderers away from our business.

We implement a risk-based approach for merchant acquisition as recommended by FinCen BSA, and the Patriot Act. This approach provides increased CIP in KYC due diligence as the merchant's daily sales volumes increase.

All BitPay merchants must provide identification and contact information and are verified for the types of businesses they're engaged in, and that the business is compliant under US laws. Personal interviews by BitPay are required at the highest tiers. We also conduct ongoing monitoring of merchants transactions to ensure visibility into potential money laundering and CFT activities.

In summary, BitPay's policies and procedures are guided by regulations that have served the financial community well. We will continue to track and comply with all existing and future regulations and recommendations.

Guidance from the IRS, the Treasury, the Department of Justice, and SEC have all established that those dealing with virtual currency must simply follow existing tax laws and anti-money laundering regulations.

Bitcoin is still in its infancy. It's much like the Internet of '90s. We look five or 10 years in the future, we're going to see many companies built on bitcoin-related technologies. We want those companies to be based in America, creating jobs in America, and building a revenue and
tax-base in America. I commend the task force for realizing the real and practical uses of virtual currencies, and the potential future applications of the technology.

Thank you again for the time to speak today.

[Gleb Gamow]

http://www.businesswire.com/news/home/20130514006754/en/BitPay-Hires-Bitcoin-Core-Developer-Jeff-Garzik#.VfuNMN9Viko

BitPay has also hired Bryan Krohn as Chief Financial Officer. Bryan has previously worked as VP of Finance and Director of Finance for several Atlanta-based companies in the IT and Healthcare spaces. Bryan’s experience with international banking and treasury management will greatly help BitPay’s service meet the needs of larger clients. Bryan will report to Tony Gallippi, CEO of BitPay.

Looks like the dude with all that there background changed who he was reporting to - Tony, then Stephen. Given a few months more, Bryan would've been reporting to the janitor if Stephen is a step down from reporting to Tony. The change must've happened after the hearing I linked to in the post above.

Exactly what does a Chief Financial Officer do if he has to pass the duties of allocating funds to those he reports to? Isn't that suppose to be his job? Sure, if bigger moneys are involved, you first get the nods (notice the plural), then when approved, do the grunt work, i.e., click, click, click, DONE!

What'll be funny is if Bryan is making less that that chick in Kentucky earning $80K/yr to deny marriage licenses to folks she deems unworthy.

[smoothie]

C'mon, this doesn't even resemble to MtGox. There's no exchange involved, and nobody's money is being held hostage. It's expensive corporate fuckup, but it's small enough to be covered from current income.

MtGox looked legit too, compare these companies without retrospective.

Really?

MtGox looked legit?
At what point in time are you referencing they looked legit? And by whom did they look legit to?

[smoothie]

C'mon, this doesn't even resemble to MtGox. There's no exchange involved, and nobody's money is being held hostage. It's expensive corporate fuckup, but it's small enough to be covered from current income.

MtGox looked legit too, compare these companies without retrospective.

The question now becomes:  Is everyone jumping the gun with these btc startups?  Are the people running these completely incompetent?

or

Is btc too weak and too prone to hacks that its completely unsafe to use online?  Yeah I know everyone says "just use a paper wallet!" but that can only help so much.  Sad story, and shows you cant trust insurance companies!

Trust the insurance companies?

I see based on the claim that bitpay fucked up without any recourse.

Pretty sure insurance companies don't insure when you accidentally set your house on fire.

[smoothie]

This is crazy and not good news, BitPay is what enabled a lot of companies to accept bitcoin and we can't lose them.

So what?

Mtgox went into a blackhole and other enhances picked up the customer base.

[Kakmakr]

So these people have no telephones to confirm these types of transactions? Everyone know email is the easiest platform to hack. How can they simply trust a email to transfer $2 000 0000 worth of Bitcoin? I hope a full investigation will be launched and some people will get fired for this.

Every time something like this happens, people lose faith in the technology. I will never trust a 3rd party to keep any large amount of my coins. A central organization have many weak links! and they become a easy target for hackers.

The fraudster got access to Krohn's email, allowing the fraudster to review Krohn's communications "to learn specific details about how Bitpay transacted business," according to the lawsuit. The fraudster then sent emails to Bitpay CEO Stephen Pair purporting to be from Krohn, asking Pair to transfer 1,000 bitcoins to a Bitpay customer's "wallet," which he did.

So, exactly who should Stephen Pair, one of BitPay's co-founders doing grunt work on that day, fire for not doin' their job properly?

Ok, Lets toss a coin... Stephen or his security team? If the insurance is not going to cover the damage, who will? His team or the customers? Someone will have to be held accountable for that. $2 000 000 does not fall out of thin air these days.

They should have had better systems in place. Period!

[coinpr0n]

By not disclosing this earlier I also wonder what else the company could be hiding. I've just lost a lot of faith in Bitpay. As for this happening in legacy bank systems - they could probably just reverse the mistaked transaction. Fungibility is not such a big deal for them.

[Herbert2020]

this sorts of news are the things that will prevent bitcoin from becoming famous. every now and then something like this pops out, and the numbers are always big. no wonder there is not any mass adoption yet!

[nextgencoin]

Instead of trusting third parities for payment we need to start using vanilla coin, sub zero transactions that can't be double spent....BINGO.

[neochiny]

ohhh..... wow oh wow!!!
this kind of new in here having a great impact to newbies and bitcoin users.
its so sad that something always like this happen when bitcoin is holding.
but ofcourse inside job is not questionable.
but whatever it is. almost 2 miillion is really not a joke.
for now i think bitcoin will go down again.
well goodluck to us.

[n2004al]

What kind of people are those which lead such important companies who can be stolen so easy? Which kind of security they implement that can be damaged and breaked in this simple way? Seems that those are kids and not important people...

[NorrisK]

Maybe we should start sending e-mails to these types of companies asking for 1 000 btc and just mentioning in the mail that the CEO is ok with it?

[n2004al]

Maybe we should start sending e-mails to these types of companies asking for 1 000 btc and just mentioning in the mail that the CEO is ok with it?

Sure. The most hard work we must face is to find the email of CEO. One day found this email everything is done. We must go at the end of the online page of the business and see there. For sure will be showed. It was enough to copy this address email and the money are ours.

[S4VV4S]

C'mon, this doesn't even resemble to MtGox. There's no exchange involved, and nobody's money is being held hostage. It's expensive corporate fuckup, but it's small enough to be covered from current income.

MtGox looked legit too, compare these companies without retrospective.

The question now becomes:  Is everyone jumping the gun with these btc startups?  Are the people running these completely incompetent?

or

Is btc too weak and too prone to hacks that its completely unsafe to use online?  Yeah I know everyone says "just use a paper wallet!" but that can only help so much.  Sad story, and shows you cant trust insurance companies!

Trust the insurance companies?

I see based on the claim that bitpay fucked up without any recourse.

Pretty sure insurance companies don't insure when you accidentally incidentally set your house on fire.

FTFY 
If it's an accident they do cover the losses.

[wearehatetherules]

They didn't even confirm before sending that much amount at twice or thrice.