Mtgox's official story could be wrong. The BTC of many accounts was sold.

[BitcoinBonus]

Did anyone get e-mails with trade notifications?   I didn't. I guess you could turn this off first but that would be hard.

Special edition of The Bitcoin Show tonight:

9-10pm Eastern TradeHill interview
10-11pm Eastern Mt. Gox interview.

[1713557235]

1713557235

[1713557235]

1713557235

[dinzy]

with multiple accounts he could withdraw tons of money. 

I am annoyed because someone used the damn list to fuck with my gmail account. 

[TurboK]

with multiple accounts he could withdraw tons of money. 

I am annoyed because someone used the damn list to fuck with my gmail account. 

Have you checked the logon history for unknown IPs? Gmail automatically gives a password change option on logon for everyone whose email was in the leaked database, that's Googles doing in case you encountered it.

[deathnetworks]

i only joined mt gox to have a look to see if they did instant buy glad i never used it >.> but can't remember what password i put on the bloody thing...

anyway i suggest virwox.com for trading has been good to me and love the paypal payout option and still around $16 dollar trade rate atm

Android app for it here

[Sebz4n]

Wait, did Google download this list, and then "force" people on it to change password?
My Gmail account had been "compromised" (I don't use the same password, so I don't see how), but perhaps this was just a reaction of the Mt Gox leak?

If so, then this is exactly why I am using Gmail, excellent service!

[dinzy]

with multiple accounts he could withdraw tons of money. 

I am annoyed because someone used the damn list to fuck with my gmail account. 

Have you checked the logon history for unknown IPs? Gmail automatically gives a password change option on logon for everyone whose email was in the leaked database, that's Googles doing in case you encountered it.

Ah.  Google is so quick.  Now I just wish Android wasn't so difficult to figure out how to change my password on it without deleting my account/adding it again.

[TurboK]

Wait, did Google download this list, and then "force" people on it to change password?
My Gmail account had been "compromised" (I don't use the same password, so I don't see how), but perhaps this was just a reaction of the Mt Gox leak?

If so, then this is exactly why I am using Gmail, excellent service!

Yeah, pretty much.

[jme621]

nvm hehe

[ahtremblay]

op looks like a screen cap from that youtube vid floating around

Did you read the post sherlock. I say right there where its from.

[jme621]

op looks like a screen cap from that youtube vid floating around

Did you read the post sherlock. I say right there where its from.

nope it was tl;dr 

[dayfall]

with multiple accounts he could withdraw tons of money. 

I am annoyed because someone used the damn list to fuck with my gmail account. 

Same thing with me.  However, I was able to quickly update ally my important passwords.  I think that my gmail password was simply reset.

[Cluster2k]

I don't want to be guy carrying the bad news. Don't shoot me! I'm just the messenger! But I also believe MtGox's coins had been depleted.
MtGox has a 1000 USD limit or equivalent BTC, at 0.01 this means 100,000 btc can be withdraw at once.
By seeing the users file, I come to a conclusion that the attackers could use any number of those accounts, if not all, to trade and withdraw.

This is a snap of bitcoinmonitor during the attack, notice the last transactions leading to the 500K. Looks like the robber getting away with his heist.

That graph is pretty damning.  Can anyone think of another plausible scenario for transfering 500k bitcoins?  I don't think there is.  The BTCs were probably bulk transfered out to another account and then distributed out to other accounts soon after.  Unlike with a fiat currency system that people love to deride, there is no compensation here.  No chargebacks.  The BTCs are gone and not coming back.  Worse, whoever has them is sitting on a fortune when markets reopen and can crash the market at any moment they wish.  I fear this hack is the end of bitcoin as a potentially viable commodity/currency.  The confidence in the market is gone.  Why Mt Gox didn't have any protection against this is amazing, as it's a completely foreseeable scenario.

[ahtremblay]

That graph is pretty damning.  Can anyone think of another plausible scenario for transfering 500k bitcoins?  I don't think there is.  The BTCs were probably bulk transfered out to another account and then distributed out to other accounts soon after.  Unlike with a fiat currency system that people love to deride, there is no compensation here.  No chargebacks.  The BTCs are gone and not coming back.  Worse, whoever has them is sitting on a fortune when markets reopen and can crash the market at any moment they wish.  I fear this hack is the end of bitcoin as a potentially viable commodity/currency.  The confidence in the market is gone.  Why Mt Gox didn't have any protection against this is amazing, as it's a completely foreseeable scenario.

I think Mtgox could file bankruptcy in a few days or weeks.

[BCEmporium]

And I think people is taking damage of their own stupidity. Everybody ran to the same spot, like lambs to the slaughter, instead of diversify their options.
Created a bitcoin centralization, now here's the price...

[jaybny]

sorry OP your clueless. 

a single big sell order WILL result in thousands of trades. Each trade is a buy limit order that was sitting in the order book.

also, the reason for the big sell order was to drive prices down in order to withdraw BTCs from mtgox, since there is a $1000 a day limit.

[SgtSpike]

Guys, MtGox isn't going anywhere.  They aren't bankrupt, they have plenty of coins to cover the loss, and there's no reason to think that they don't.  You're all just flying around with rumors.

The attacker didn't withdraw 100k BTC.  They first sold everything, bought up a bunch, and THEN withdrew $1000 worth of BTC.

[Quantumplation]

I believe a hacker got hold of everyone's account at mtgox. This hacker then executed a looping script that logged into a number of accounts one by one and issued a sales order for the full BTC balance in these select accounts. After 2 minutes, the loop was completed and all BTC held of the mtgox's clients accounts were offered for sale on the mtgox market.

This drove the price of BTC down to almost nothing. mtgox as a withdrawal limit of 1000$ equivalent BTC per 24 hour period. With the price to almost nothing, the hacker could withdraw almost any amount of BTC he wished from different accounts. I think in a few days or weeks some people will learn they have lost a fortune in this attack.

We must face the reality that mtgox is short on BTC. They do not have the BTC they claim they have.

The official story by mtgox states that a single large account was compromised and someone sold everything. This story does not make sense for a number of reasons. First, every account was compromised so why would the hacker limit himself only to one account.

If you were watching the sales order book in real time during this event, you would notice that there were a sequence of hundreds of small sales ranging from 0.1BTC to 2BTC. This is inconsistent with the one big sellout story. The picture below indicates some of those sales. Please refer to this youtube to see how it happened live. http://www.youtube.com/watch?v=T1X6qQt9ONg



Again this is inconsistent with the one big account sold off story. Many mtgox accounts have small amount of BTC coins left hanging in them (because of a withdraw bug for small amounts). We are seeing these small sellouts in the order book.


TL:DR; If you look at the sales manifest, There are hundreds of 0.1BTC to 0.5BTC sales orders placed one after the other. This indicates that a script is looping trought the accounts and issuing a sales order. If it was just 1 big account, there would be 1 sale for 250k BTC. This fact, combined with the release of all mtgox accounts / password moments later makes it impossible for me to believe in the official story.

The thousands of trades was not from thousands of small sell orders, but from thousands of small buy orders.  "I want to sell 1000 bitcoins for 0.01 btc" ends up being (if there is not one large buy order out), "I've been waiting to buy 10 bitcoins at 17.5, gimme" "I've been waiting to sell 5.4 bitcoins at 17.4, gimme", etc.  All trades happened within a single second, because it was simply the mtgox software looping through buy orders and fulfilling them.

[diven]

For everyone thinking there is a 1000USD / BTC withdraw limit, I was informed by mtgox that this can be "easily lifted".  I had over a thousand BTC withdrawn within a few minutes by an attacker.

[relmeas]

ok let's look at the official story...

1. selling lots of BTC for 0.01, price lowers to 0.01 but all BTC are sold.

2. for gained $$ buying from available sell orders to spend all gained $$. this drives price back into $17+

3. moving obtained BTC out with $1000 limit which is around 50 BTC now since he bought from really expensive sell orders.

so anyway, what was the point in this? I don't see why would anyone do that .. why not instead sell SOME BTC and when the price is sufficiently low, withdraw remaining BTC.

so either hacker is pretty dumb or some info is missing here.

[Clipse]

Well I suspect its an amateur heist gone seriously wrong.

He obviously planned to get alot more out of it as quickly as possible, alternatively he could have hoped to destroy the bitcoin economy.