Bitcoin Forum
June 18, 2019, 02:00:20 AM *
News: Latest Bitcoin Core release: 0.18.0 [Torrent] (New!)
 
   Home   Help Search Login Register More  
Pages: [1] 2 »  All
  Print  
Author Topic: Strongcoin.com owner stole user money - are my Bitcoins safe online?  (Read 5579 times)
Lotuss
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
April 23, 2013, 11:04:36 AM
Last edit: April 23, 2013, 11:36:51 AM by Lotuss
 #1

Hello!

I first wanted to take this post in the Ozcoin thread, but maybe its best to give it an own thread. Not that I have a choice since I am newly registered Wink



So I have been following the latest weeks post in Ozcoin thread, where owner Graet got hacked and lost 923 BitCoins. It was posted to me by a friend that wanted to point out to me how there is much unsafty with bitcoins.
I told him that the problem was not with BitCoins as a system, but Graets lack in security and drew a parallel to people getting their cards skimmed or computers infected with a virus.
Since then People have "chased" the money, and debated about a system to catch stolen money.



Graets money seems to have ended up in a Strongcoin online Wallet according to this post https://bitcointalk.org/index.php?topic=14085.msg1910151#msg1910151 .

As I understand it owner of Strongcoin dogisland then stole this money from the alligated thief and returned it to Graet.

To be honest, I think this is a bigger issue then Graets first loss of money.

I am sorry for your loss Graet but as you said it was your own fault, leaving your system open to such a exploit.
But here dogisland, a "Bank" of bitcoins, took the matter in his own hand as #1 world police and hijacked one of his customers money and gave them to his friend (?) Graet.

What if dogisland one day decides to hijack all his customers money?


First I quote strongcoin.com's firstpage:
Quote
What is a hybrid wallet ?
A hybrid wallet allows you to send and receive Bitcoins just like any other wallet. However, the Bitcoin private key which is required to send money is encrypted in your browser before it reaches our servers.

Therefore our servers only hold encrypted private keys and neither we nor anyone else can spend your Bitcoins. Only you.

Only you. OR, well, dogisland also. And who know who else...?

I hope I have missed something essential here, does anyone care to explain..?


Edit: As a newbie I am not allowed to send messages. I hope someone that can would send them a PM asking them to answer here.
Edit2: Nametypo.

Best of wishes,
Lotus
1560823220
Hero Member
*
Offline Offline

Posts: 1560823220

View Profile Personal Message (Offline)

Ignore
1560823220
Reply with quote  #2

1560823220
Report to moderator
1560823220
Hero Member
*
Offline Offline

Posts: 1560823220

View Profile Personal Message (Offline)

Ignore
1560823220
Reply with quote  #2

1560823220
Report to moderator
1560823220
Hero Member
*
Offline Offline

Posts: 1560823220

View Profile Personal Message (Offline)

Ignore
1560823220
Reply with quote  #2

1560823220
Report to moderator
The block chain is the main innovation of Bitcoin. It is the first distributed timestamping system.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
simonk83
Hero Member
*****
Offline Offline

Activity: 798
Merit: 1000


View Profile
April 23, 2013, 11:09:11 AM
 #2


I hope I have missed something essential here


Graet, not Garet Wink
John (John K.)
Global Troll-buster and
Legendary
*
Offline Offline

Activity: 1260
Merit: 1089


Will read PM's. Have more time lately


View Profile
April 23, 2013, 11:13:38 AM
 #3

Well, you got a point there actually. What happened to this? :

Quote
What is a hybrid wallet ?
A hybrid wallet allows you to send and receive Bitcoins just like any other wallet. However, the Bitcoin private key which is required to send money is encrypted in your browser before it reaches our servers.

Therefore our servers only hold encrypted private keys and neither we nor anyone else can spend your Bitcoins. Only you.

Please do not use any online wallets if you value your coins. If strong coin.com was rooted, funds would be stolen easily from users despite that statement above.

My BTC Tip Jar: 1Pgvfy19uwtYe5o9dg3zZsAjgCPt3XZqz9 , GPG ID: B3AAEEB0 ,OTC ID: johnthedong
Escrow service is available on a case by case basis! (PM Me to verify I'm the escrow!)

Lotuss
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
April 23, 2013, 11:37:03 AM
 #4


I hope I have missed something essential here


Graet, not Garet Wink

heh Wink Fixed! Sorry Graet!
Lotuss
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
April 23, 2013, 12:47:35 PM
 #5

Quote
"but Graets lack in security and drew a parallel to people getting their cards skimmed or computers infected with a virus."
I'm sorry, but WHAT? What does this have anything to do with card skimming and viruses?
I drew the parallel between real life where people lose real money to skimming and viruses.
and that tts not the bitcoins faults that graet got hacked. its due to careless, its not the goverment or the bitcoins fault.

Quote
It's well known that online wallets are always vulnerable to hackings, and can be used to steal your bitcoins. Just because the Private key is encrypted in your browser means nothing. You can add one line of code to log the Private key. A sort of.. phisher, per-se.
To do this, the hacker would have to have enough time to gain knowledge on how the system works, which usually takes a while.

The statement "However, the Bitcoin private key which is required to send money is encrypted in your browser before it reaches our servers." means it's encrypted through HTTPS(SSL), so that anybody snooping on your network cannot steal your money.

Ok, its' only https?

Then the quote "neither we nor anyone else can spend your Bitcoins. Only you." from the homepage is a complete lie.

Badabing
Member
**
Offline Offline

Activity: 75
Merit: 10



View Profile
April 23, 2013, 12:57:56 PM
 #6

I am sorry for your loss Graet but as you said it was your own fault, leaving your system open to such a exploit.
But here dogisland, a "Bank" of bitcoins, took the matter in his own hand as #1 world police and hijacked one of his customers money and gave them to his friend (?) Graet.

What if dogisland one day decides to hijack all his customers money?

You raise a valid question with regards to how the funds were transferred from your account, however, the lack of empathy and holier-than-thou tone of your post makes it sound more like "I hacked a website and stole funds. Then, someone sole them back and gave them to their original owner."

I'd be interested to see how external law enforcement would react to this sort of claim - especially considering the lack of recognition of BTC as currency, as far as I am aware. This is of course assuming that you are going to contact someone regarding this 'theft'; I assume you will, considering you lost close to USD$60K?

Let us know how you go.
QuiveringGibbage
Hero Member
*****
Offline Offline

Activity: 597
Merit: 515


http://idontALT.com


View Profile WWW
April 23, 2013, 02:35:38 PM
 #7

I just signed up for an account with StrongCoin.com. It's pretty neat.

1aQGjTHindCLvophoeu4kNsZMm7XzHgca

QG

Bitcoin is at the tippity top of the mountain...but it's really only half way up.. Wink
Lotuss
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
April 23, 2013, 02:43:08 PM
 #8

I am sorry for your loss Graet but as you said it was your own fault, leaving your system open to such a exploit.
But here dogisland, a "Bank" of bitcoins, took the matter in his own hand as #1 world police and hijacked one of his customers money and gave them to his friend (?) Graet.

What if dogisland one day decides to hijack all his customers money?

You raise a valid question with regards to how the funds were transferred from your account, however, the lack of empathy and holier-than-thou tone of your post makes it sound more like "I hacked a website and stole funds. Then, someone sole them back and gave them to their original owner."

I'd be interested to see how external law enforcement would react to this sort of claim - especially considering the lack of recognition of BTC as currency, as far as I am aware. This is of course assuming that you are going to contact someone regarding this 'theft'; I assume you will, considering you lost close to USD$60K?

Let us know how you go.

I am sorry to say I am only a observer, taking interest in BTCs lately, that tries to shine light on this situation from another perspective.

Probably since I am new to the scene I saw strongcoin.com with its professional website as a serious player, and I did not think such serious players would take law in their own hand and compromise its customers integrity and money so easily, without publishing any real proof.

I hope you can see how this endanger the reputation of bitcoin as a serious currency.
knedle
Member
**
Offline Offline

Activity: 99
Merit: 10


View Profile
April 23, 2013, 04:55:46 PM
 #9

But what is the problem?

You were contacted by owner of StrongCoin and asked where did you get that money and to explain on the forums your involvement, which you didn't do. I think that right now best option is to contact Graet and talk with him, even meet somewhere IRL and show him the proof you are telling truth. That is of course if you have proof.
itsgoldbaby
Full Member
***
Offline Offline

Activity: 157
Merit: 100


Hello!


View Profile
April 23, 2013, 05:07:23 PM
 #10

If he just started stealing coins then I would think differently, but in this scenario he just saved a percentage of a fairly popular pools bitcoins. So I guess if you are going to steal bitcoins from people, don't trust sending them to this service after you do it. He will stop you from profiting from being a piece of shit.
Arvicco
Hero Member
*****
Offline Offline

Activity: 574
Merit: 501


Please bear with me


View Profile WWW
April 23, 2013, 05:17:04 PM
 #11

I am sorry to say I am only a observer, taking interest in BTCs lately, that tries to shine light on this situation from another perspective.

Sure, sure, this is totally believable. Someone just signs up out of nowhere, and their very first post on Bitcointalk is regarding this situation which in no way concerns them personally. No, it does not look like a disgruntled thief created a sock puppet account to vent their frustration about the lost spoils. Not at all.

binaryFate
Legendary
*
Offline Offline

Activity: 1372
Merit: 1001


Still wild and free


View Profile
April 23, 2013, 05:38:54 PM
 #12

Maybe it would be more valuable to forget wondering who is he and focus on what he says?
Even if he is the thief, I've never heard of this story before and I'm concerned about the
home-made justice made to this case, so somehow, I don't care from whom is the story
coming from.


Monero's privacy and therefore fungibility are MUCH stronger than Bitcoin's. 
This makes Monero a better candidate to deserve the term "digital cash".
JohnsonX
Member
**
Offline Offline

Activity: 91
Merit: 10



View Profile
April 23, 2013, 05:46:20 PM
 #13

900 bitcoins is a fortune Shocked

I would never trust the online wallets.

muggerbee
Newbie
*
Offline Offline

Activity: 1
Merit: 0


View Profile
April 23, 2013, 06:21:14 PM
 #14

I am sorry to say I am only a observer, taking interest in BTCs lately, that tries to shine light on this situation from another perspective.

Sure, sure, this is totally believable. Someone just signs up out of nowhere, and their very first post on Bitcointalk is regarding this situation which in no way concerns them personally. No, it does not look like a disgruntled thief created a sock puppet account to vent their frustration about the lost spoils. Not at all.

I just started mining a week ago with Oz and so i've followed this very closely and all I can say is Lotuss P@wned Smiley  lmao
SgtSpike
Legendary
*
Offline Offline

Activity: 1372
Merit: 1001



View Profile
April 23, 2013, 06:26:11 PM
 #15

Well, you got a point there actually. What happened to this? :

Quote
What is a hybrid wallet ?
A hybrid wallet allows you to send and receive Bitcoins just like any other wallet. However, the Bitcoin private key which is required to send money is encrypted in your browser before it reaches our servers.

Therefore our servers only hold encrypted private keys and neither we nor anyone else can spend your Bitcoins. Only you.

Please do not use any online wallets if you value your coins. If strong coin.com was rooted, funds would be stolen easily from users despite that statement above.
That's a blatant lie from Strongcoin then, unless not all of their wallets are hybrid wallets.
haveagr8day
Member
**
Offline Offline

Activity: 112
Merit: 10


View Profile
April 23, 2013, 06:49:38 PM
 #16

They could have done all of that with a JS change even without knowing the private keys.

░▒▓█ Coinroll.it - 1% House Edge Dice Game █▓▒░ • Coinroll Thread • *FREE* 100 BTC Raffle
Tips: 14pw9gn35ueAWHvdkesQV298QLPWGBESjs
FireBlazzer
Member
**
Offline Offline

Activity: 70
Merit: 10


View Profile
April 23, 2013, 07:37:58 PM
 #17


I hope I have missed something essential here


Graet, not Garet Wink

o.0 did you say garet???

(hides valuables)

Smiley
Rampion
Legendary
*
Offline Offline

Activity: 1120
Merit: 1000


View Profile
April 28, 2013, 10:32:37 PM
 #18

Well, what happened to this?

Quote
What is a hybrid wallet ?
A hybrid wallet allows you to send and receive Bitcoins just like any other wallet. However, the Bitcoin private key which is required to send money is encrypted in your browser before it reaches our servers.

Therefore our servers only hold encrypted private keys and neither we nor anyone else can spend your Bitcoins. Only you.

How was dogisland able to "seize" those funds to return them back to Graet? Maybe he modified the site, so all the transaction originated by the thief went to an address controlled by him?

IMO this confirms again that shared wallet/third party services are insecure by nature and thus should be avoided, regardless of super strong passwords, encryption, 2 factor authorization, etc. etc. etc.

It's a pity because really secure third party services are need for BTC (for example for trading)

Rampion
Legendary
*
Offline Offline

Activity: 1120
Merit: 1000


View Profile
May 07, 2013, 06:14:42 PM
 #19

So, no answer on this. Admin was able to "intercept" the funds as easily as stealing a candy to a baby. I really don't know how they can then write things like this:

Therefore our servers only hold encrypted private keys and neither we nor anyone else can spend your Bitcoins. Only you.

Utter bullshit. They can do whatever they want with your funds Sad

cp1
Hero Member
*****
Offline Offline

Activity: 616
Merit: 500


Stop using branwallets


View Profile
May 07, 2013, 06:17:55 PM
 #20

It's pretty close to true.  The hacker did spend them -- he was just tricked into sending them to the strongcoin operator.

No online wallet is 100% safe.

Guide to armory offline install on USB key:  https://bitcointalk.org/index.php?topic=241730.0
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!