Alitin Mint Coin Breach

[RichardForsyth]

My name is Richard Forsyth and I am one of the founders of Alitin Mint. 

I am very sorry to those of you who have had your coins compromised. 

So far, we have received very few reports and we believe that the breach was quite limited, but we urge any of our customers to contact us so that we can work with you on an individual basis to resolve the matter to your satisfaction as soon as possible.  You may reach me at raforsyth@alitin.com, and I will try to get back with you as soon as I can.

I contacted authorities (FBI) first thing this morning and we are cooperating as best we can--we are laying out our pockets, so to speak, and inviting a vigorous investigation in to myself and my brother/partner as soon as possible so we can clear our names and get to work helping anyone who has been cheated to receive whatever recovery we can restore, and to also bring the perpetrators to full justice.  An official report has been filed with the FBI and I am at their disposal, 24/7, in any investigation which may (likely) occur. 

We will also be re-launching our site at AlitinMint.com soon so that anyone who has any concerns can contact us and work with us to resolve the issue as best we can, with an emphasis on full customer satisfaction.  I invite any investigation in to myself or my partner because I know we have nothing to hide and we're eager to earn any kind of trust back in the Bitcoin community, though we are likely out of the physical Bitcoin business for good at this point. It's not easy to come back from such a devastating blow.  Our reputation is dear to us, and we have both dedicated our lives to ethical and generous principles; and we care deeply about our private and business relations.  We're horrified if we have hurt anyone in anyway.  We'll do anything in our power to make it right.

Alitin Mint has been out of business for about 2 years now.  We just didn't sell enough coins and the regulatory environment became more complicated and expensive than we anticipated. Our original plan was to offer high grade numismatic coins with Bitcoin codes attached in order to offer a secure product that at least partially bridged the gap between the less risk averse and tech savvy on one hand, and those who were interested in Bitcoin but balked at buying something entirely virtual--we thought it might help skeptics get in to Bitcoin by offering them something tangible for their purchases; something physical to hold on to, but an entry in to the Bitcoin market.  We started out at the $80 BTC price, but things ballooned way out of control in BTC pricing and this blasted our sales apart because our products were just too expensive too soon for most interested customers.  Plus, compliance became so expensive and time consuming that our business just naturally became insolvent.

We spent years as advocates of cryptocurrency and I myself was a regular on the national speaking circuit as a compliance expert in finance and crypto to banking associations with FIBA and CSMB out of Miami. For a time, I was quite well known as a crypto expert to bankers around the world.  I also worked as a consultant and educator on the subject for several years.  As you can imagine, it would be devastating for someone in my position to be the subject of even one small breach of security of any type or level, because I only aim for perfection in my work. There's really no room for mistakes in what we do, but we are reasonably sure we were burned by an insider to our organization.  This might indicate a somewhat greater tendency towards trust with our people than was warranted and, if that was indeed our mistake, we apologize profusely.  We truly thought we were being paranoid with even the people we trusted, but again, apparently no security system is 100% full-proof. 

We did once have offices but we have since sold them and we've mostly gone our separate ways, but those involved in the company mostly stay in contact.  My personal phone number has since changed as well, but neither our phone or address changes have been in an effort to hide or avoid anyone.  We intend to make good on our promises and to do our best to satisfy anyone who has been aggrieved.  And we will get the bottom of what happened and resolve it. 

I personally understand what it is like to be robbed.  It's infuriating, and I COMPLETELY understand and fully accept the anger.  I urge you to contact me at raforsyth@alitin.com if you think you have had coins stolen from you, and I also hope you will contact me if you have other questions or concerns.

Please feel free to vent at me personally.  Call me names, threaten me, whatever you need to do--you will find me completely contrite and eager to help in any way I can.  I will apologize personally to anyone who is aggrieved in this issue and ask for patience and mercy.  I have personally never been at a lower point in my life, even if it turns out to be only a few coins that were compromised, because again, there was never any room for error here. 

At this time, we're still not entirely sure what happened but we have some running theories and we hope to resolve any investigation that we anticipate will begin shortly.  Again, we urge you to contact us so that we can get as much information as possible for the authorities to work with.  I will monitor my email account to be prompt to your questions and request; and again, if you just want to rant at me.  I considered many of those I met to be wonderful people and hoped for a chance to meet at future conferences to strike up long-lasting friendships.  I've been so impressed by the kindness, the energy, and the intelligence of the Bitcoin community.  I admire so many of you.  I am still a believer in the crypto concept and not just for personal gain.  I still believe it will change the world for the better, and I still hope to be a part of that in some way, however limited.  And as a consequence, I am deeply wounded to be in a position where I have wounded or undermined trust with anyone. 

I met many of you personally in the sale of these coins and I was sincere in my promises and belief in our product.  I have never stolen anything in my life, but I am certainly guilty of personal mistakes from time to time.  I offer no exculpation other than my vigorous assertion that neither I nor my brother had anything willing to do with any security compromises of our products.  Our security was vigorous but nothing can be 100% secure.  Again, we are still intensely surprised and disappointed by this breathtaking news that even a few coins have been compromised. You will find on my part only a willingness to satisfy anyone who has been injured and to do my best to make things right. 

Thank you for any patience you are willing to extend to us in this issue, and please contact us if we can help you personally.

Sincerely,

Richard A Forsyth
Former CEO of Alitin Mint

 

[1713888702]

1713888702

[Dogedigital]

Who all had access and/or exposure to the private keys?

You, your brother, and who else?

[hybridsole]

So far, we have received very few reports and we believe that the breach was quite limited, but we urge any of our customers to contact us so that we can work with you on an individual basis to resolve the matter to your satisfaction as soon as possible. 
 

There were approximately 56 coins which may have been breached according to this post by bitenvy: https://bitcointalk.org/index.php?topic=1814828.msg18079926#msg18079926

So far, that's roughly $140k in lost bitcoins.

1. Will you provide a list of all of the public keys associated with the coins you've sold?  From that we could check to see how many were redeemed last month and get the entire total.

2. Please provide the list of people who were involved from key generation, to engraving, to assembling into the final slab. 

3. At which point in the process do you believe the breach occurred? And why was it only a subset of the coins?

[BurtW]

Crap. I have two of these coins for a total of 3 BTC.  I guess I will have to check and see if they still have their BTC...  Crap.

Was the theft limited to certain series, or were all of them compromised?

[CanaryInTheMine]

So far, we have received very few reports and we believe that the breach was quite limited, but we urge any of our customers to contact us so that we can work with you on an individual basis to resolve the matter to your satisfaction as soon as possible. 
 

There were approximately 56 coins which may have been breached according to this post by bitenvy: https://bitcointalk.org/index.php?topic=1814828.msg18079926#msg18079926

So far, that's roughly $140k in lost bitcoins.

1. Will you provide a list of all of the public keys associated with the coins you've sold?  From that we could check to see how many were redeemed last month and get the entire total.

2. Please provide the list of people who were involved from key generation, to engraving, to assembling into the final slab. 

3. At which point in the process do you believe the breach occurred? And why was it only a subset of the coins?

Were they all breached? Or is it ppl peeling and redeeming majority of coins after alarms went off?

[BurtW]

I think we can tell the difference by looking at the claiming transactions.  However, Alitin has a real problem here going forward.  They will need to try to differentiate between the people that got ripped off by having their BTC swept by the thief and the people trying to rip them off by reclaiming the BTC themselves and then filing a claim.

[Fortify]

So, it's nice of you to come by and introduce yourself, but nothing you've written describes the technical aspect of how it could be stolen? It'd be nice if you actually shared your theories, instead of just alluding to them. Were the keys created on an isolated system? Were they deleted immediately after the coins were created, and if not, why would you keep them? It's all very well saying you've contacted the FBI, but plenty of people thought they were smart enough to outwit the authorities and it means little.

[HabBear]

I think we can tell the difference by looking at the claiming transactions.  However, Alitin has a real problem here going forward.  They will need to try to differentiate between the people that got ripped off by having their BTC swept by the thief and the people trying to rip them off by reclaiming the BTC themselves and them filing a claim.

You're presuming that Alitin is planning to reimburse owners for the theft, I've not seen or read any such intention. The statement provided by the Alitin guys here is a deep, sincere apology and an admission that they've initiated an investigation on the matter and themselves.

The company is out of business, what claim is to be made?

The best way for those that got robbed to recoup their loss is to file a claim with their insurance company (i.e, homeowner's, renter's). These coins are collectible and have value as currency and art does...they would be covered by any basic insurance policy for personal possessions.

So sorry to hear of everyone's loss. We all lose in this situation, if not by monetary means by the mark down on the reputation that bitcoin and physical cryptocurrency has been working hard to build. A crime against one is a crime against us all!

[bitenvy]

So far, we have received very few reports and we believe that the breach was quite limited, but we urge any of our customers to contact us so that we can work with you on an individual basis to resolve the matter to your satisfaction as soon as possible.  
  

There were approximately 56 coins which may have been breached according to this post by bitenvy: https://bitcointalk.org/index.php?topic=1814828.msg18079926#msg18079926

So far, that's roughly $140k in lost bitcoins.

1. Will you provide a list of all of the public keys associated with the coins you've sold?  From that we could check to see how many were redeemed last month and get the entire total.

2. Please provide the list of people who were involved from key generation, to engraving, to assembling into the final slab.  

3. At which point in the process do you believe the breach occurred? And why was it only a subset of the coins?

Were they all breached? Or is it ppl peeling and redeeming majority of coins after alarms went off?

I think we can tell the difference by looking at the claiming transactions.  However, Alitin has a real problem here going forward.  They will need to try to differentiate between the people that got ripped off by having their BTC swept by the thief and the people trying to rip them off by reclaiming the BTC themselves and them filing a claim.

For the transactions I found.  All were swept and stolen on the same day.  That doesn't mean there aren't more.  But, any transactions in my list are likely valid as stolen because they were all taken the same day (2/26).  Hopefully there are not more than the 50+ I've found.  

I would like to ask again for a list of all public keys for both your Adam Smith 2BTC coin as well as your Jeanne D'Arc 1BTC coin (even if in PM), and we can confirm how many and which ones are compromised.  Public would be better. 

[BurtW]

I think we can tell the difference by looking at the claiming transactions.  However, Alitin has a real problem here going forward.  They will need to try to differentiate between the people that got ripped off by having their BTC swept by the thief and the people trying to rip them off by reclaiming the BTC themselves and them filing a claim.

You're presuming that Alitin is planning to reimburse owners for the theft, I've not seen or read any such intention. The statement provided by the Alitin guys here is a deep, sincere apology and an admission that they've initiated an investigation on the matter and themselves.

The company is out of business, what claim is to be made?

The best way for those that got robbed to recoup their loss is to file a claim with their insurance company (i.e, homeowner's, renter's). These coins are collectible and have value as currency and art does...they would be covered by any basic insurance policy for personal possessions.

So sorry to hear of everyone's loss. We all lose in this situation, if not by monetary means by the mark down on the reputation that bitcoin and physical cryptocurrency has been working hard to build. A crime against one is a crime against us all!

I will call my insurance company but I expect there is no claim unless they were listed on a special rider.  I have artwork (paintings) and had to insure them separately.  I did not do that with these coins, but it does not hurt to try the insurance path.

[BurtW]

So far, we have received very few reports and we believe that the breach was quite limited, but we urge any of our customers to contact us so that we can work with you on an individual basis to resolve the matter to your satisfaction as soon as possible.  
  

There were approximately 56 coins which may have been breached according to this post by bitenvy: https://bitcointalk.org/index.php?topic=1814828.msg18079926#msg18079926

So far, that's roughly $140k in lost bitcoins.

1. Will you provide a list of all of the public keys associated with the coins you've sold?  From that we could check to see how many were redeemed last month and get the entire total.

2. Please provide the list of people who were involved from key generation, to engraving, to assembling into the final slab.  

3. At which point in the process do you believe the breach occurred? And why was it only a subset of the coins?

Were they all breached? Or is it ppl peeling and redeeming majority of coins after alarms went off?

I think we can tell the difference by looking at the claiming transactions.  However, Alitin has a real problem here going forward.  They will need to try to differentiate between the people that got ripped off by having their BTC swept by the thief and the people trying to rip them off by reclaiming the BTC themselves and them filing a claim.

For the transactions I found.  All were swept and stolen on the same day.  That doesn't mean there aren't more.  But, any transactions in my list are likely valid as stolen because they were all taken the same day (2/26).  Hopefully there are not more than the 50+ I've found.  

I would like to ask again for a list of all public keys for both your Adam Smith 2BTC coin as well as your Jeanne D'Arc 1BTC coin (even if in PM), and we can confirm how many and which ones are compromised.  Public would be better. 

OK, we can hope that they swept all the private keys they had, they did not have them all, and so the rest of the coins are safe.  Hope.

[bitenvy]

You're presuming that Alitin is planning to reimburse owners for the theft, I've not seen or read any such intention. The statement provided by the Alitin guys here is a deep, sincere apology and an admission that they've initiated an investigation on the matter and themselves.

JR has told me personally, that I would be refunded the "value of the coin" in bitcoin.  bithalo has also been told the same.  

[msin]

You're presuming that Alitin is planning to reimburse owners for the theft, I've not seen or read any such intention. The statement provided by the Alitin guys here is a deep, sincere apology and an admission that they've initiated an investigation on the matter and themselves.

JR has told me personally, that I would be refunded the "value of the coin" in bitcoin.  bithalo has also been told the same.  

I've been told the same as well. I also provided photo proof of coins held.

[Fortify]

You're presuming that Alitin is planning to reimburse owners for the theft, I've not seen or read any such intention. The statement provided by the Alitin guys here is a deep, sincere apology and an admission that they've initiated an investigation on the matter and themselves.

JR has told me personally, that I would be refunded the "value of the coin" in bitcoin.  bithalo has also been told the same.  

I've been told the same as well. I also provided photo proof of coins held.

There's no judgement to who did it, but a coin manufacturer out of the game for two years has little incentive to protect their reputation with the amount of money to be made. It could be a gamble: Redeem 50 coins, expect 20 people to actively notice and complain, then pocket the rest.

[msin]

OK, we can hope that they swept all the private keys they had, they did not have them all, and so the rest of the coins are safe.  Hope.

I don't think it really matters, people are cracking the cases, the market for Alitin coins is pretty much dead at this point.

[FFrankie]

OK, we can hope that they swept all the private keys they had, they did not have them all, and so the rest of the coins are safe.  Hope.

I don't think it really matters, people are cracking the cases, the market for Alitin coins is pretty much dead at this point.

I really like the design of them, I will buy a cracked/unfunded coin. Please PM me

[Quickseller]

When will coin holders receive reimbursement?

[BurtW]

OK, we can hope that they swept all the private keys they had, they did not have them all, and so the rest of the coins are safe.  Hope.

I don't think it really matters, people are cracking the cases, the market for Alitin coins is pretty much dead at this point.

I really like the design of them, I will buy a cracked/unfunded coin. Please PM me

I may have two for sale at some point (I am at work and cannot check my coins but from what I hear they are probably both empty).

[bonefix]

I have 2 Adam Smiths and 2 Jean D'Arcs purchased in August 2015.

One of the Adam Smiths has been compromised.

18maxv3kVNNKUE9NZhcYcfHhcRrtSXC8eE

The others remain funded.  This implies that the perpetrator has either not raided all the coins or else had limited access to the private keys to a batch of Adam Smiths.  I have sent Richard the batch number of the breached and intact coins which may help in identifying the timeline of when / who was involved.

The affected coin number is 113/600 but my 118/600 was not affected in the 26/2/17 theft.

[msin]

I have 2 Adam Smiths and 2 Jean D'Arcs purchased in August 2015.

One of the Adam Smiths has been compromised.

18maxv3kVNNKUE9NZhcYcfHhcRrtSXC8eE

The others remain funded.  This implies that the perpetrator has either not raided all the coins or else had limited access to the private keys to a batch of Adam Smiths.  I have sent Richard the batch number of the breached and intact coins which may help in identifying the timeline of when / who was involved.

The affected coin number is 113/600 but my 118/600 was not affected in the 26/2/17 theft.

You may want to consider cracking it and redeeming. Or wait, but if there is a major sweep of coins then you probably won't be reimbursed. I'd guess the market for these is pretty much done.