Alitin Mint Adam Smith Coins compromised!

[digicoinuser]

It looks like the coins had the private key physically engraved on the side of them, was that engraving done in house or by an external engraver?

[1714009716]

1714009716

[1714009716]

1714009716

[1714009716]

1714009716

[1714009716]

1714009716

[1714009716]

1714009716

[1714009716]

1714009716

[Bemerand]

I hope you guys who still have your btc on the coins move the btc asap. Something is a rye here.

[msin]

In regards to key generation, and disposal, there is zero room for error in this market. This is a real shame and it saddens me to see this. I also don't feel that businesses in the physical crypto space should operate if there is more than a single person to cast blame on if any problems should arise. I make an effort to build relationships with my customers to help establish trust, but I also leave my customers with the option of leaving their Kialaras unfunded.

The last thing myself and other honest, responsible makers want is the community questioning our own trust because of the actions and irresponsibility of others.

Sincerely feeling for those affected.

Max-

Yes, I trust you and guys like Mike, who (most of the time) worked alone. Alitin had really nice coins, they most likely had to outsource several steps along the way. Too many people involved

[chronicsky]

This is kind of scary and makes me think about many other funded coins that people own.

I can only hope this is a mistake and not on their end but some other problem and it gets fixed soon.
Good luck guys! Though if you haven't ,  redeem them already

[Quickseller]

It looks like the coins had the private key physically engraved on the side of them, was that engraving done in house or by an external engraver?

On the side? What would stop someone from taking a picture of the coin, reselling it and then redeeming the BTC in the coin?

If the private key was not protected by some kind of halo then the theft was the result of negligence on the part of the manufacturer, and any number of people involved throughout the process could be the actual thief. 

[cryptodechange]

On the side? What would stop someone from taking a picture of the coin, reselling it and then redeeming the BTC in the coin?

There is foam inside the casing which is/was permanently sealed:


In order to redeem the coins, the owner was supposed to break apart the case to reveal the engraving. So either either the private key generation or engraving process was compromised, or the private keys were actually stored to be illegally redeemed at a later date.

[Quickseller]

On the side? What would stop someone from taking a picture of the coin, reselling it and then redeeming the BTC in the coin?

There is foam inside the casing which is/was permanently sealed:


In order to redeem the coins, the owner was supposed to break apart the case to reveal the engraving. So either either the private key generation or engraving process was compromised, or the private keys were actually stored to be illegally redeemed at a later date.

It is also possible that someone took a picture of the coins after they were engraved but prior to when they were put in the case.

I think it is most likely that the manufacturer stored the private keys to the coins. Otherwise the manufacturer could have discovered the malware (or other compromise) and warned his customers to redeem the btc in the coins, so the thief would have redeemed the btc right away as opposed to when btc is at ATH

[bitenvy]

I have repeatedly asked for a list of public addresses, but those requests have been ignored thus far. 

My guess is there has been some sort of internal "breach" or compromised email, etc.  I have been told by JR that they have contacted law enforcement authorities and they will have a public/formal statement tomorrow. 

[TheNewAnon135246]

I have repeatedly asked for a list of public addresses, but those requests have been ignored thus far. 

My guess is there has been some sort of internal "breach" or compromised email, etc.  I have been told by JR that they have contacted law enforcement authorities and they will have a public/formal statement tomorrow. 

I'm getting the feeling they're just buying time. Why haven't they posted by now at least to let people know they're investigating the leak? That only takes a few minutes time and shows that they're actively trying to find who did this.

[bitenvy]

I know what you mean...  If they don't tomorrow, then I'll start barking more!  I truly believe they don't know how this happened based on the conversation via email and phone.  Maybe I'm being played...   

[TheNewAnon135246]

I know what you mean...  If they don't tomorrow, then I'll start barking more!  I truly believe they don't know how this happened based on the conversation via email and phone.  Maybe I'm being played...  

Did you ask if they outsourced the engraving?

[bitenvy]

No.  I guessed they wouldn't answer that question either since they are focused on how it happened.

BTW, I have tracked my coin funds down to two addresses:

[Redacted]
[Redacted]

EDIT:
I think I jumped the gun.  These are the endpoint (likely exchanges), so likely not accurate.  Sorry.

These are more accurate (from my groupings):

19A5uTjZzip9gmNUVjSifeAeUwMdyYQ4zQ - 35 BTC
19ts4csSw2X1gzwsuc3AFQkJk3a1ZG5wtZ - 30.35725 BTC
1M9XcA6kQAoxih2T6ymcr2ShxHZ3uR5dKt - 6.0079869 BTC
173nKDVsFv121rYydJxW7Z13tH2vmyzvrv - 25 BTC
16x5RqEDuDRRKh7muDJ37xReurxWmLj5kh - 13.9967648 BTC
1FjkhxNtTGdNBgqaEKKM6vT1vfWP6sJnHM - 22.74030177 BTC
35o4y29BXAtTXrartEgbbux76ek6XGb4q1 - 7.98259439 BTC

[Gatorelf]

No.  I guessed they wouldn't answer that question either since they are focused on how it happened.

BTW, I have tracked my coin funds down to two addresses:

1tUcP5FxpPTJhkS3bEpKXj1qbCgUK913U which has 256BTC (hasn't changed since 2/27)

1ERenyvfEepDjFsCgJmB1hwLqRCGEC4Jo6 which has 364BTC and has been very active (last transaction was today)

nice detective work my man ! 

[msin]

No.  I guessed they wouldn't answer that question either since they are focused on how it happened.

BTW, I have tracked my coin funds down to two addresses:

1tUcP5FxpPTJhkS3bEpKXj1qbCgUK913U which has 256BTC (hasn't changed since 2/27)

1ERenyvfEepDjFsCgJmB1hwLqRCGEC4Jo6 which has 364BTC and has been very active (last transaction was today)

Wow, large sums of BTC, wondering if all is from Alitin coins or part of personal stash, if the latter I would guess that this is an inside job from one of the founders.

[Lincoln6Echo]

Ouch, that's horrible! Hope there is a Chance to get btc back.

[zanzibar]

This has me worried about the physical coin market in general. I know Casascius is known to be trusted here, I'm wondering did Mike mainly work alone and did he personally address what was done with private keys, assuming he destroyed them. I've never heard of issues with Casascius.

[bithalo]

J.R. replied back to my email today saying they would repay the BTC value.   

[hybridsole]

This has me worried about the physical coin market in general. I know Casascius is known to be trusted here, I'm wondering did Mike mainly work alone and did he personally address what was done with private keys, assuming he destroyed them. I've never heard of issues with Casascius.

Honestly, I am surprised this hasn't happened more often.  Other than Alitin, the only other maker is Coinographic who performed a mass sweep of private keys, and in the case of Coinographic it was only Litecoin, so the damages were not as severe.  This case with Alitin is by far the biggest incident I'm aware of.  

The fact it hasn't happened very much leads me to believe the community has done a decent job vetting and/or only buying funded coins from people who they trust.  The biggest deterrent to doing something like this would be knowing exactly who is making the coins and where they are located.  It's unlikely someone is willing to ruin their name and go "on the run" if they have spent years building up a reputation in the community.  

In the case of Alitin, I have no idea whether these Forsyth guys are real people, or assumed identities.  If they are real, my hope is that it was all a result of negligence and there's a valid explanation for how this happened and a plan to pay the victims back.  If they aren't real, then it's even more important that we perform due diligence on any future makers who want to offer funded coins.  

[zanzibar]

This has me worried about the physical coin market in general. I know Casascius is known to be trusted here, I'm wondering did Mike mainly work alone and did he personally address what was done with private keys, assuming he destroyed them. I've never heard of issues with Casascius.

Honestly, I am surprised this hasn't happened more often.  Other than Alitin, the only other maker is Coinographic who performed a mass sweep of private keys, and in the case of Coinographic it was only Litecoin, so the damages were not as severe.  This case with Alitin is by far the biggest incident I'm aware of.  

The fact it hasn't happened very much leads me to believe the community has done a decent job vetting and/or only buying funded coins from people who they trust.  The biggest deterrent to doing something like this would be knowing exactly who is making the coins and where they are located.  It's unlikely someone is willing to ruin their name and go "on the run" if they have spent years building up a reputation in the community.  

In the case of Alitin, I have no idea whether these Forsyth guys are real people, or assumed identities.  If they are real, my hope is that it was all a result of negligence and there's a valid explanation for how this happened and a plan to pay the victims back.  If they aren't real, then it's even more important that we perform due diligence on any future makers who want to offer funded coins.  

Agreed, although I don't believe there are really that many BTC physical coin producers, if there were hundreds, I would expect to see this happen more often. Luckily for us, guys like Mike are as honest as they come. If Casascius had been compromised early on, it would have been the end of any physical BTC market.

[BitcoinNewsMagazine]

SilverWallets has the right idea. Sell the coin unfunded with hologram provided and let the buyer generate the key pair and assemble the coin themselves. Likewise Polymerbit.