Was Paymium really hacked? Or are they running a scam? Latter appearing likely.

[pyedpyper]

Two weeks ago Paymium (who run Instawallet, Bitcoin-Central and Paytunia) claimed they were hacked, and that coins were stolen.

They also said they had filed a police report in that regard.

Forum member Boussac (who is Pierre Noizat, Chief Operations Officer for Payium) has been actively communicating on the forums about this alleged "hack" and the Instalwallet "claims process", which will no doubt net Paymium a huge chunk of unclaimed and "un-paid out" coin.

On the various threads on which he has been active (https://bitcointalk.org/index.php?topic=167215.0 / https://bitcointalk.org/index.php?topic=164143.0 / https://bitcointalk.org/index.php?topic=173902.0) he has been asked repeatedly, by many different forum members, to kindly supply the police report file number, or other verifiable evidence, that a police report has actually been filed. Perhaps 50 requests so far!

He has ignored this ever single time. Not answered the question, not responded to the question, and not once even acknowledged it.

At first it was a simple, natural and rather innocent question seeking further clarification. As he continues to directly avoid this repeated request, the questions have become more insistent and demanding.

And still it is ignored. The question of course is WHY?

It certainly points to the fact that a police report was not filed, and this suggests that there was in fact no hack at all, and that Paymium have created an opportunity to profit from the demise of Instawallet.

I really hope that this is not so, as we would then have in our midst, a bunch of lying dodgy fraudsters, who continue to be active in the Bitcoin community via Paytunia and Bitcoin-Central.

Ironically all it would take to refute this "heinous slanderous accusation" of mine would be for Boussac to just simply provide it here. Such an easy thing for him to do. And so, in order to be transparent and fair, I invite it again:

Boussac, would you kindly supply the police report file number, or other verifiable evidence that a police report has been filed, as you claim it has.

I would be very interested to hear comments and suggestion from anyone in the Bitcoin community about this.

In my opinion, the greatest threat to Bitcoin, and its acceptance in the world, are the ongoing scams (or even just rampant unprofessionalism) being perpetrated by various "insiders" and corporate entities within the Bitcoin economy.

Paymium has a responsibility to be accountable to their customers and in fact to all in the Bitcoin community, and they should be held to that IMHO.

[caffeinewriter]

I have no coin in Instawallet, but I agree, it is a bit suspicious that he has ignored every question in regards to the police report. And note to pyedpiper, it would be the latter appearing likely.

[BubbleBoy]

This could have been a "from the desk of Tom Williams" classic stunt: sell the coins on the bubble and buy them back later during the claims process. There's zero liability since they will eventually return the coins, they were indeed 'hacked' (the Google link disclosure) and they don't need to raid more than 1% top worth wallets to make millions. It's almost dumb not to seize such an opportunity.

[tvbcof]

Watching (on the reply feed.)

[tvbcof]

...
In my opinion, the greatest threat to Bitcoin, and its acceptance in the world, are the ongoing scams (or even just rampant unprofessionalism) being perpetrated by various "insiders" and corporate entities within the Bitcoin economy.

Payium has a responsibility to be accountable to their customers and in fact to all in the Bitcoin community, and they should be held to that IMHO.

Busy right now, but I got to thinking on a long drive yesterday,

 - "Where is the Bitcoin Foundation?"

 - "Do they have any resources to help here?"

The Bitcoin Foundation has, for better or worse, made no bones about wishing to embrace and be embraced by the mainstream political bodies of our societies.  This would be a good opportunity to demonstrate this willingness in my opinion.

[Herodes]

Good point from OP.

I can't see any reason to reject giving the police report number apart from it being non-existent. That also leads me to believe that the operators of Instawallet are dishonest,and as such also all other businesses they're associated with will suffer from the same kind of dishonesty. This alone is enough for me not to give them any business.

Therefore, nobody should give them any business at this point. Of course this will not happen, as not everybody do research or care about such things.

What would be possible would be to send a formal letter to the french police in Paris (sent it on paper, snail mail) inquiring about whether they have any cases related to the Instawallet incident (all names and company names should be listed), and perhaps sending it directly to the nearest police department of Pierre Noizat would be a good idea. I am sure someone with good google fu skills can find the nearest police station.

Also calling such a police station and asking could be a good idea, but I think a letter could be the best thing. It could be weeks to get an answer though, if there ever will be an answer.

Since Pierre Noizat aka Boussac doesn't address giving out the police report number, although he stated such an investigation exists, and he also stated there are independent investigators looking into the case, and he even stated that bitcoin-central is being audited by a professional security company. I think all of it is just a bunch of bullshit. A legit company would have no problem saying that a certain company is doing the audits, and then giving them permission to confirm this if asked by a customer.

In essence this is what he's doing:


Unless somebody seek him out in person and ask him some hard questions, we will never have the answers. He had repeatedly proven that he is not a professional businessman. A professional businessman would've ignored the personal attacks and the less civilized attacks, and adressed all issues that he could in a professional manner, and if there was some issues that he could not address he would've explained calmly that unfortunately he can not adress these issues in public because [insert reason].

We don't know who or how much was stored at instawallet, but if there was some sharks storing a lot of money there, I for one would not sleep well at night knowing that my name is out there in the wild and I owe a lot of people money.

The most serious part is the fact that nobody knows how many coins were stolen, if any. He has not made a concise statement in regards to this, and currently all coins are in limbo.

Things that should've been answered are:

1. How many coins were stolen, and how much of the total percentage is this ?
2. Who is managing the reclaim process, is this the same person(s) that are evading and lying on this forum. How can we be sure that this process is just. For example, knowingly wiping out 40% of all funded wallets from the reclaim process, would still give coins back to 60% of the holders, and when complaints from the remaining 40% surface, Instawallet reps could just say they're lying or making up fake wallets. As long as the reclaim process is not done by a trusted party, we have no idea how this is going to end, or if it will be just at all.
3. Pierre Noizat seems to be a person of 40+ of age ? He doesn't handle the whole mess as a professional businessman, and I have no reason to believe this will change at any point soon. He takes stuff very personal, and his response to anyone he deem to do a personal attack is to stop communicating with that person. For instance when I said bitcoin-central should do a security audit by a professional firm, he called me out as condecending, instead of adressing the issue at hand. Personally I would thank anyone for their interest in the company and pointing to the fact that such matters are attended to, and give the details that I saw necessary.

Sure we could all sugar coat our words every time we communicate with someone, but the business world is not a candy store.

[Herodes]

It's almost dumb not to seize such an opportunity.

No - it's not. Doing so is criminal in each and every jurisdiction.

[Herodes]

The Bitcoin Foundation has, for better or worse, made no bones about wishing to embrace and be embraced by the mainstream political bodies of our societies.  This would be a good opportunity to demonstrate this willingness in my opinion.

To the best of my knowledge, the leader of the foundation is the same individual that is running Coinlab, Peter Vessenes. I haven't checked the foundation's webpages for a while, but they certainly doesn't seem to be very active around here, so frankly I don't have much of an idea what they're up to, or how active they are.

Personally I don't understand how Peter Vessenes can be both a leader of the Foundation and Coinlab. Common sense tells me that he can't be dedicated enough to play a good role in both enterprises, one or both of them will suffer.

[pyedpyper]

Just for fun : suppose Boussac provides you a number such as "2013-0123" for the "police report number". What will you do with that information ?

I am not kidding. I filed a complaint (with no relation to bitcoin) last year (end of 2012) and my record number is something like it (2013-0XXX). No other reference, nothing.

It is merely the beginning of the further process of verification that what Paymium are saying is actually true.

If he actually makes up a fake police report number then he's even deeper in, and the consequences will be upped.

And if he does supply it (and thereby simply be professional and responsive) it will be the beginning of confidence being restored in Paymium.

Of course there is the question of whether the rest of the board of Paymium is aware that he is single-handedly trashing the company's reputation with his refusal to answer. Or whether this is Paymium's policy in the moment.

Either way they are not to be trusted as it stands now.

[pyedpyper]

I have no coin in Instawallet, but I agree, it is a bit suspicious that he has ignored every question in regards to the police report. And note to pyedpiper, it would be the latter appearing likely.

Corrected - thanks

[pyedpyper]

...
In my opinion, the greatest threat to Bitcoin, and its acceptance in the world, are the ongoing scams (or even just rampant unprofessionalism) being perpetrated by various "insiders" and corporate entities within the Bitcoin economy.

Payium has a responsibility to be accountable to their customers and in fact to all in the Bitcoin community, and they should be held to that IMHO.

Busy right now, but I got to thinking on a long drive yesterday,

 - "Where is the Bitcoin Foundation?"

 - "Do they have any resources to help here?"

The Bitcoin Foundation has, for better or worse, made no bones about wishing to embrace and be embraced by the mainstream political bodies of our societies.  This would be a good opportunity to demonstrate this willingness in my opinion.

Might be worth looking into... As Paymium is not a member of the Foundation, they probably don't have any leverage over them though...

[pyedpyper]

Of course there is the question of whether the rest of the board of Paymium is aware that he is single-handedly trashing the company's reputation with his refusal to answer. Or whether this is Paymium's policy in the moment.

Either way they are not to be trusted as it stands now.

I think that today's priority of Paymium is Bitcoin-Central. Which is running fine now.

Instawallet is another thing. As they have no way to be actually sure of anyone's claim they do it the right way (I think) :
- first reimburse the "low" accounts with a few controls (single claimed served no question asked, multiple claims on first order basis),
- then manually check all accounts over $5000 before doing anything.

Anyhow Paymium is still a "solvable" company. We know they had something like 40,000 BTC assets at the time of breach. Even by today's price it is still more than $3,000,000 so they should have no problem giving back everything to their customers.

But of course anyone not trusting them is free to fill its own police report. France is still a somehow democratic country and even a foreign customer is allowed to fill a complaint against any french company, which will be processed by the police, even if it takes one year or more ...

Thanks for your comments

A company can only be trusted to the degree that its board members and senior officers can be trusted. If their COO can not be trusted to be honest or professional then what does that say about the company altogether? And what does it suggest may happen in the future to someone who does entrust their money to any of their services?

I want to believe that they are being straight, but in the face of the ongoing refusal to provide confirmation as requested, I simply can not.

[BubbleBoy]

It's almost dumb not to seize such an opportunity.

No - it's not. Doing so is criminal in each and every jurisdiction.

Yeah, but it's the perfect crime. If they manage to buy back at lower prices, there's not even any basis for a criminal complaint, you have your coins back. If questioned they will tell the police they covered the coins "that the hackers stole" out of their own pocket. Maybe some civil liability for not being able to access your coins for an extended period of time is it's not already covered in the TOS.

[Phinnaeus Gage]

http://betabeat.com/2012/12/bitcoin-central-becomes-first-bitcoin-exchange-to-operate-as-a-bank/

In addition to protections provided by the Garantie des dépôts (France’s FDIC), user funds will also be held at Credit Mutuel under their name instead of an online Bitcoin wallet, ostensibly providing accounts with more stringent security. This may be attractive to users worried about theft, considering some Bitcoin exchanges have been the target of heists in recent months.

Update:

A commenter writes in to clarify:

The insurance on deposits is only for euro-denominated deposits, and funds in euros are stored at the bank. Bitcoin balances are not stored at the bank, and are not insured.

[pyedpyper]

http://betabeat.com/2012/12/bitcoin-central-becomes-first-bitcoin-exchange-to-operate-as-a-bank/

In addition to protections provided by the Garantie des dépôts (France’s FDIC), user funds will also be held at Credit Mutuel under their name instead of an online Bitcoin wallet, ostensibly providing accounts with more stringent security. This may be attractive to users worried about theft, considering some Bitcoin exchanges have been the target of heists in recent months.

Update:

A commenter writes in to clarify:

The insurance on deposits is only for euro-denominated deposits, and funds in euros are stored at the bank. Bitcoin balances are not stored at the bank, and are not insured.

Rather ironic then that this company is appearing to be one of the more sketchy around...

[tvbcof]

...
But of course anyone not trusting them is free to fill its own police report. France is still a somehow democratic country and even a foreign customer is allowed to fill a complaint against any french company, which will be processed by the police, even if it takes one year or more ...

You, ~ghdp, are my best hope yet for getting police reports filed.

If you are willing to either:

 - locate a suitable legal person to do the next bullet item, or

 - formulate a suitable report for international victims to use as a template and publish it on this thread for public comment and utilization,

I will promise at least 2 BTC for this task from my own funds.

----

If anyone else who has experience in the corporate world wishes to formulate some documentation to present first to the marketing departments of the 'mainstream' banks that 'Paymium' claimed to be working with, and thence (possibly) on to mainstream media outlets, that is another task.  And also one which I will be inclined to personally commission if necessary.

The goal would be to enlist the legal bodies of said corporations if they feel like it would be in their interest that their names not be sullied in association with 'Paymium' who, by all appearances, seems at this point to be a criminal organization.

Thanks,

 - Tom

[crazy_rabbit]

It would be insane to suggest they caused this crash, right? Take all the coins and sell them all at once- cause mass panic and buy them back now?

[steelboy]

As most people following this know I have a lot of coins tied up in this problem. (Stupid I know, but I genuinely believed that if I kept my URL safe no one could acces my money)

I am hoping that Boussac and paymium are honest but there are reasons to be suspicious.

I am meeting with a lawyer on Wednesday to discuss options. I believe that i should be doing something towards registering a crime regardless of if they are guilty or innocent. I am hoping to claim skmething through my insurance xompany if possible. He is a finance lawyer who worked in Paris for 10 years so hopefully will have contacts in all the right places.

I am hoping to arrange some kind of fee based on money back with him as nearly all my coins were held by instawallet.

I will keep you all updated.

[repentance]

Just for fun : suppose Boussac provides you a number such as "2013-0123" for the "police report number". What will you do with that information ?

I am not kidding. I filed a complaint (with no relation to bitcoin) last year (end of 2012) and my record number is something like it (2013-0XXX). No other reference, nothing.

It just allows you to confirm that a report has been made.  There are many reasons why it might be undesirable for the actual information in the complaint to be made public but those who've been affected by this incident need a way to reassure themselves that appropriate action has been taken.

I know you all think I'm something of a dinosaur when it comes to management styles, but this is the kind of situation in which management needs to come out very publicly and allow themselves to be subjected to scrutiny.  I've previously suggested that a public letter from the auditors investigating this incident would be appropriate.  Users essentially want some kind of confirmation that this incident is being investigated from a third party who is unlikely to lie and it's within Paymium's power, and certainly in their best interests, to provide that.

[tvbcof]

As most people following this know I have a lot of coins tied up in this problem. (Stupid I know, but I genuinely believed that if I kept my URL safe no one could acces my money)

I am hoping that Boussac and paymium are honest but there are reasons to be suspicious.

I am meeting with a lawyer on Wednesday to discuss options. I believe that i should be doing something towards registering a crime regardless of if they are guilty or innocent. I am hoping to claim skmething through my insurance xompany if possible. He is a finance lawyer who worked in Paris for 10 years so hopefully will have contacts in all the right places.

I am hoping to arrange some kind of fee based on money back with him as nearly all my coins were held by instawallet.

I will keep you all updated.

I'll appreciate your updates.

I feel that it would be in the best interest of those who've lost high values to operate as individuals in the system.  It strikes me as more likely that Paymium will 'pay off' those who are willing to take these actions.

It makes sense to me, though, that those who lost smaller amounts of value can form an effective cooperative pool to push this thing forward and try our best to make sure that this thing does not become forgotten about.

In your discussions with your attorney(s), if the opportunity comes up, please mention that at least one person is interested in seeing a multi-pronged attack as described, and feel free to e-mail me if anything comes of it.

One more thing to note is that especially for this possible 'small fry' cooperative adventure, I highly value as much public visibility as possible.  Hopefully there would be enough information freely available that effected users could easily just pick up the ball and file their own complaints without needing a high level of communication or whatever.

Thanks,

 - Tom