Inputs.io | Instant Payments, Offchain API, Secure Wallet, 235k+ BTC transferred

[jonitas]

This doesn't look good, https://inputs.io shows this message.

404 BTC not found

Two hacks have left Inputs unable to pay

Woah, this admittedly IS looking bad now TradeFortress, please give us an update?

Update please, why this message, what is the timeframe for processing withdrawals again?

[giantdragon]

This doesn't look good, https://inputs.io shows this message.

404 BTC not found

Two hacks have left Inputs unable to pay

Woah, this admittedly IS looking bad now TradeFortress, please give us an update?

I have some feelings that you won't see any updates from Inputs.io! 

[BadBear]

Full message on his website.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Two hacks totalling about 4100 BTC have left Inputs.io unable to pay all user balances. The attacker compromised the hosting account through compromising email accounts (some very old, and without phone numbers attached, so it was easy to reset). The attacker was able to bypass 2FA due to a flaw on the server host side.

Database access was also obtained, however passwords are securely stored and are hashed on the client. Bitcoin backend code were transferred to 10;15Hd@mastersearching.com:mercedes49@69.85.88.31 (most likely another compromised server).

What about my coins there? If you stored more than 1 BTC, send an email to support@inputs.io with a Bitcoin address (preferably, an offline, open source light/SPV wallet like Multibit or Electrum). Use the same email you're using on Inputs. Please don't store Bitcoins on an internet connected device, regardless of it is your own or a service's.

I know this doesn't mean much, but I'm sorry, and saying that I'm very sad that this happened is an understatement.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJSeuZ9AAoJEB7FawRj3T8Th5QH/iapt2DUuyy1j7t51y1N1LOk
+Gu5fdIAV8molXnv+InMQvxtfxWfc7zKiROSP6Zv1cXdvMrCyzKP+SnTEFshIa+0
j2FYOgLeMNmsPSw8yeR1O8vJieYlK+7imEZL4nRKA+O+mjqCT1nTCtBUAVcYQ8Uu
O6BoNLkgT8z/1ZTfw+OK4t2kw9KcC317JOv3yVugfA3xCn4HbKPRP2yFIKR49C7L
w7C2h3L1jHqLerQNjbowcyKH83BFJ2IB0cFZFFCLBI+8NQcUIcIFymxrxUV73Rqa
xlMPX2rPFcIj6yz0ABl1t2rwY2DGOvc33MYCzX82CumLx/qAXCd2uF/jG6fzQ5M=
=Ip/9
-----END PGP SIGNATURE-----

[BadBear]

That's just over a million at current exchange rates. Gotta say I'm finding it a little hard to believe he was actually hacked and this isn't just another long con, though I'd like to believe that isn't the case.

[🏰 TradeFortress 🏰]

This doesn't look good, https://inputs.io shows this message.

404 BTC not found

Two hacks have left Inputs unable to pay

Woah, this admittedly IS looking bad now TradeFortress, please give us an update?

I have some feelings that you won't see any updates from Inputs.io! 

I just replied to your email, asking for your Bitcoin address.

[Mooshire]

Hello, chiming in here. The GPG signed message on the website doesn't check out. I saved the key that he had on glados.cc, and the key ID is 2E67C3DF, but when I checked this message, the key is 63DD3F13. What's the reason behind this TF?

[giantdragon]

I just replied to your email, asking for your Bitcoin address.

I have sent you an address.

BTW, I think storing 4100 BTC (!) on hot wallet is somewhat an insanity and hope other service operators will not repeat this mistake!

[Mooshire]

The GPG signed message on inputs.io and the GPG key that TF has previously used are DIFFERENT

Do not trust anything signed that is not signed with key ID 2048D/2E67C3DF. This is the key TF always used and we have no reason to believe he would use a different key now

[Injust]

The GPG signed message on inputs.io and the GPG key that TF has previously used are DIFFERENT

Do not trust anything signed that is not signed with key ID 2048D/2E67C3DF. This is the key TF always used and we have no reason to believe he would use a different key now

Archived version of glados.cc from http://web.archive.org/web/20130606204001/http://glados.cc/ says that his GPG key is 2E67C3DF. See for yourself.

[Mooshire]

The GPG signed message on inputs.io and the GPG key that TF has previously used are DIFFERENT

Do not trust anything signed that is not signed with key ID 2048D/2E67C3DF. This is the key TF always used and we have no reason to believe he would use a different key now

Archived version of glados.cc from http://web.archive.org/web/20130606204001/http://glados.cc/ says that his GPG key is 2E67C3DF. See for yourself.

Is this directed towards me or others? Because that's what I just posted

[dexX7]

Check this thread:

https://bitcointalk.org/index.php?topic=290860.0

Code:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: SKS 1.1.0

mQENBFIYPJcBCAClVCDiS+/iiP/UBS8RrPAWHaxmTMvIuLMemplvel21248W87qCsbRLOyN7
HLjPCxWgFz1phKLZA0vzeVT7RKM9wyGTvAdRnrP72JWQsFRJs0MI72aiseO2z9n+SK9Mjwlj
Vjpy7vodL+6aczDOoE12pD2bjxFSAvROsn+czjIYS7KnR8g0AM0ztLYBiGrkrT0B0/fOPx4P
nwg+p17Y9p0rNWaYhfTo8UvEU3ctg2bkyhoAeeKLQFPQVfrvdj9d31Bsd0FpMjZQOpTvxnAK
Rfzr33m3Dh60b9JQKZ/IfRXI3Y3zKb39WLy6qne1+YeZ9CL4WGUKzeG+/5nXw9YvHcXfABEB
AAG0GmdsYWRvc2NjIDxhZG1pbkBnbGFkb3MuY2M+iQE4BBMBAgAiBQJSGDyXAhsDBgsJCAcD
AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAexWsEY90/E3guCACW9bWFx2WgddmkDuoIBns0KaWc
GObpgFXwmrURVBsIIqnEZgN9ZvHZXy7FUg73E3UaRgTRHADTdcO4LX0dQjAG03HYMyTS9Ci8
JntYwnQte9hpj7dygyx9ieYb7I2t1nG70VA4NC7I5rOJHn9A/SL1VJxbYX5PbqkaUBFpuaok
QxGDVKJGdHhKp/SZNVZDGDi5DTZXnRfdV+BxKQmO46FoUZggzfsWKIS+xmVezDNJxVmifL6y
1LgHuhsDxHbl70aQGG5YACm7DRj5TEka6uC3z085FC/bMptzBdTeRxn3lK9YYNRUhj2NJg6o
QFQRmtlHtWiuOONe+iO0wAkQqi72uQENBFIYPJcBCACfjPqREfaOeiwYMoNc2KFadZ/BwW2S
L+G2K7wN2wZ5Ey/WqlOEgJbc/h0sD/idrR7QME5jB0ursMRrcRui+4H/7o95Cax59+GyOHjw
ekziE/zGMfN5iBkeCGApilj0+FFec+3AxK/CxuMC2VLuHTNK3vIVoQ+cuJphtmOR2srVWAqy
DZyrgc7DFtDgyxrzSS90i0A7ONfs49tR7low0IWBYbm+epppuOeLHd8Y/5HrnjqPHjpFN70K
SkUIoys3OND8gtfBotFI/JXJssHTb3BVBvWxn8lOlrV6X9jBJlzoHfNaZMoo4pOY6RhZRT2+
UvZbBFrKdtQViLyqAjhYuANhABEBAAGJAR8EGAECAAkFAlIYPJcCGwwACgkQHsVrBGPdPxOU
gQf9GmKUC5V228ij8UP7JZwCIKJXiLCnNMpNlOXaDl5RSQLFI1bfDQ/nfYT5ztPRp+a/BQXk
VrWFi3tGidhE/8awMCQH1ILl973bFbSvx4OylIo8qHxInjPq3GKVjBmcwJjGfvkukTKel7X8
G4Ik5nShoF+UNnBEF4jSlQ2vrHCnIU39aad49n1x4qL+nrJrfJ75hzNGd5N+My3iPMSfNGCI
XaeQ4RG1X9jzeiEZu7MbnpnYdPM9nctl83OqVxgsmdQn0icAnztSFBjB0nzYVoFKx1RVFvYd
LldcuUPHMsfeOFb360y1rnbwzjnZTK/i8AVOco/427RaKYYXHIe5TGeOsQ==
=do56
-----END PGP PUBLIC KEY BLOCK-----

The signature is valid for this one.

[windywinter]

This doesn't look good, https://inputs.io shows this message.

404 BTC not found

Two hacks have left Inputs unable to pay

Woah, this admittedly IS looking bad now TradeFortress, please give us an update?

I have some feelings that you won't see any updates from Inputs.io! 

I just replied to your email, asking for your Bitcoin address.

Will we be able to retrieve the coins in CoinLenders too?

[JohnHarmer]

This doesn't look good, https://inputs.io shows this message.

404 BTC not found

Two hacks have left Inputs unable to pay

Woah, this admittedly IS looking bad now TradeFortress, please give us an update?

I have some feelings that you won't see any updates from Inputs.io! 

I just replied to your email, asking for your Bitcoin address.

Will we be able to retrieve the coins in CoinLenders too?

coins in coinlenders is still ok, right?

[darkaxis05]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Two hacks totalling about 4100 BTC have left Inputs.io unable to pay all user balances. The attacker compromised the hosting account through compromising email accounts (some very old, and without phone numbers attached, so it was easy to reset). The attacker was able to bypass 2FA due to a flaw on the server host side.

Database access was also obtained, however passwords are securely stored and are hashed on the client. Bitcoin backend code were transferred to 10;15Hd@mastersearching.com:mercedes49@69.85.88.31 (most likely another compromised server).

What about my coins there? If you stored more than 1 BTC, send an email to support@inputs.io with a Bitcoin address (preferably, an offline, open source light/SPV wallet like Multibit or Electrum). Use the same email you're using on Inputs. Please don't store Bitcoins on an internet connected device, regardless of it is your own or a service's.

I know this doesn't mean much, but I'm sorry, and saying that I'm very sad that this happened is an understatement.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJSeuZ9AAoJEB7FawRj3T8Th5QH/iapt2DUuyy1j7t51y1N1LOk
+Gu5fdIAV8molXnv+InMQvxtfxWfc7zKiROSP6Zv1cXdvMrCyzKP+SnTEFshIa+0
j2FYOgLeMNmsPSw8yeR1O8vJieYlK+7imEZL4nRKA+O+mjqCT1nTCtBUAVcYQ8Uu
O6BoNLkgT8z/1ZTfw+OK4t2kw9KcC317JOv3yVugfA3xCn4HbKPRP2yFIKR49C7L
w7C2h3L1jHqLerQNjbowcyKH83BFJ2IB0cFZFFCLBI+8NQcUIcIFymxrxUV73Rqa
xlMPX2rPFcIj6yz0ABl1t2rwY2DGOvc33MYCzX82CumLx/qAXCd2uF/jG6fzQ5M=
=Ip/9
-----END PGP SIGNATURE-----


Inputs.ip has been hacked

[windywinter]

This doesn't look good, https://inputs.io shows this message.

404 BTC not found

Two hacks have left Inputs unable to pay

Woah, this admittedly IS looking bad now TradeFortress, please give us an update?

I have some feelings that you won't see any updates from Inputs.io! 

I just replied to your email, asking for your Bitcoin address.

Will we be able to retrieve the coins in CoinLenders too?

coins in coinlenders is still ok, right?

Since it's also operated by TF, I cannot assume so. CoinLenders has stopped withdrawing two days ago.

[christmas]

how about the CoinLenders ?

[MPOE-PR]

I. Social engineering is the #1 threat you face. Appallingly coded pieces of crap made by mentally feeble dorks (such as Tor or Bitdaytrade) are defeated through technical means all the time, sure. Nevertheless, if you’re not mentally feeble and you’re not coding a piece of crap the possibility of technical breach shall be and should be the least of your concerns. Mind that BitInstant lost a few hundred BTC in a social engineering attack last year, mind that Lavabit ended up closed through a social engineering attack last monthⁱ, mind that even the NSA, for all its lavish expenditure out of ill gotten proceeds and all its advertised (if false) abundance of young bright minds and qualified engineer hands has pretty much abandoned technical attacks and is concentrating primarily on social engineering tactics.

Social engineering is your enemy, social engineering will stay your enemy. Permanently, your biggest enemy. If you don’t have plans to fight this beast in all its multifacetious forms you don’t have plans to survive, and that’s how it is.

---

i. Yes, the fiat courts and their orders are no different from the famished Ghanaian and his friends in this context : thieves, the lot of them.

Full text, from Trilema.

[Gatekeeper]

lol 2 hacks, yeah right.

more like Trade Fortress just scammed everyone.

[Magazine]

Trade fortress off to buy a island and rub his titties with peoples coins.....


lol damn bitcoins allowing stupid kids to control large amounts of money.

[Magazine]

the ultimate build up a trust account to scam?!?!?! lol