Inputs.io | Instant Payments, Offchain API, Secure Wallet, 235k+ BTC transferred

[niktitan132]

Just got an e-mail back, quote :
"Because the hack occurred neraly 2 weeks ago and the public announcement was only made now?"

This makes no sense, why did TF let people use a COMPROMISED wallet for two more weeks?

Why its now public and not before 2 weeks?  

[Korbman]

If 4100 BTC were stolen, which address were they sent to?

Publish the blockchain info for the stolen coins, otherwise it's safe to assume there were no stolen coins.

Here you go.

http://blockchain.info/tx/9536feebe3a50b94f85ca27d56e669a7209bd4188385d55c5b97227c95cf7f74

The stolen coins are still unspent in https://blockchain.info/address/1EMztWbGCBBrUAHquVeNjWpJKcB8gBzAFx

Oohh no. no no no. Please tell me this isn't the right link...because otherwise this is very damning information.

It's one thing to have a security breach occur, draining BTC4,000 from the site. To continually allow the site to run normally for over 14 days with users unaware of the gravity of the situation is not just irresponsible, but borderlines criminal negligence. You were aware of the situation, yet you allowed deposits to continue.
I'm having a very difficult time fathoming the reasoning behind keeping the breach under wraps for so long (hell, I used Inputs within the past two weeks), so any explanation here would be helpful.

 

[Anduck]

So who believes a anonymous person makes a service, keeps most of the funds in hot wallet and then claims it was hacked?

Also for the newbies and others: TradeFortress is NOT a trustful person as we've witnessed several times in the past. You can search for "Ripple social experiment" where newbies lost a lot real bitcoins when they did what TradeFortress told them to do inside Ripple trust network to get a free bitcoin (which they never got, obviously.) You can also search for stuff about some websites he has programmed for clients, unauthorized pentesting (hacking attempting) on them etc... And he's on the default trust list of this forums, I still don't know why.

He's anonymous, is he?

Ohh and TF remember when you came to #bitcoin-otc and asked for peoples' passwords and so?

Why people trust in these anonymous scammers?

Please do some research before praising the scammer. I yet can't believe how much people there are who are unaware of his actions earlier.

[wtfvanity]

If 4100 BTC were stolen, which address were they sent to?

Publish the blockchain info for the stolen coins, otherwise it's safe to assume there were no stolen coins.

Here you go.

http://blockchain.info/tx/9536feebe3a50b94f85ca27d56e669a7209bd4188385d55c5b97227c95cf7f74

The stolen coins are still unspent in https://blockchain.info/address/1EMztWbGCBBrUAHquVeNjWpJKcB8gBzAFx

Oohh no. no no no. Please tell me this isn't the right link...because otherwise this is very damning information.

It's one thing to have a security breach occur, draining BTC4,000 from the site. To continually allow the site to run normally for over 14 days with users unaware of the gravity of the situation is not just irresponsible, but borderlines criminal negligence. You were aware of the situation, yet you allowed deposits to continue.
I'm having a very difficult time fathoming the reasoning behind keeping the breach under wraps for so long (hell, I used Inputs within the past two weeks), so any explanation here would be helpful.

 

No one noticed for 14 days that their coins were vanishing?

[js1985]

It was working quite fine until yesterday

[TheQuin]

No one noticed for 14 days that their coins were vanishing?

Nothing to notice, it was run like a bank, your balance was still shown but the bank no longer had the funds to pay out. All Ok unless everyone tries to withdraw, a bank run.

When the hacker came back and hit the API, then customers saw their balance disappear, causing the said bank run that led to him having to admit what happened.

[🏰 TradeFortress 🏰]

Just got an e-mail back, quote :
"Because the hack occurred neraly 2 weeks ago and the public announcement was only made now?"

This makes no sense, why did TF let people use a COMPROMISED wallet for two more weeks?

Why its now public and not before 2 weeks?  

Since Boelens have decided to only selectively pick responses, after the 4K btc compromise I cloned the disk image as soon as I could (after disbelieving and in horrendous shock), investigated the scope of the breach, regenerated all credentials, and have been exploring any options that allows Inputs users to not lose any money.

[Anduck]

Could TradeFortress explain how the loss of bitcoins happened exactly?

[Boelens]

Just got an e-mail back, quote :
"Because the hack occurred neraly 2 weeks ago and the public announcement was only made now?"

This makes no sense, why did TF let people use a COMPROMISED wallet for two more weeks?

Why its now public and not before 2 weeks?  

Since Boelens have decided to only selectively pick responses, after the 4K btc compromise I cloned the disk image as soon as I could (after disbelieving and in horrendous shock), investigated the scope of the breach, regenerated all credentials, and have been exploring any options that allows Inputs users to not lose any money.

You never told me this. All you said was that it was re secured and thus you announced it now.

[posormo]

Just got an e-mail back, quote :
"Because the hack occurred neraly 2 weeks ago and the public announcement was only made now?"

This makes no sense, why did TF let people use a COMPROMISED wallet for two more weeks?

Why its now public and not before 2 weeks?  

Since Boelens have decided to only selectively pick responses, after the 4K btc compromise I cloned the disk image as soon as I could (after disbelieving and in horrendous shock), investigated the scope of the breach, regenerated all credentials, and have been exploring any options that allows Inputs users to not lose any money.

You let users send good money after bad.   You continued to take deposits and didn't come clean.   You should of shut the site down while you "investigated".    Anyone who has deposited ANYTHING for the past 2 weeks should be 100 percent refunded.  

[christmas]

Just got an e-mail back, quote :
"Because the hack occurred neraly 2 weeks ago and the public announcement was only made now?"

This makes no sense, why did TF let people use a COMPROMISED wallet for two more weeks?

Why its now public and not before 2 weeks?  

Since Boelens have decided to only selectively pick responses, after the 4K btc compromise I cloned the disk image as soon as I could (after disbelieving and in horrendous shock), investigated the scope of the breach, regenerated all credentials, and have been exploring any options that allows Inputs users to not lose any money.

You let users send good money after bad.   You continued to take deposits and didn't come clean.   You should of shut the site down while you "investigated".    Anyone who has deposited ANYTHING for the past 2 weeks should be 100 percent refunded.  

I think so !

[snuff]

I got back .23, but I had .28XX from a deposit made on Tuesday of this week. So the coins I deposited were not stolen and I expect the rest of my money back. There was a small balance there before that and I dont care about it but I do want back what I deposited this week.

Also my partial refund is still unconfirmed since last night.

[allyouracid]

Also, unless being a computer forensic expert, "investigating" on one's own on a compromised server is totally irresponsible!

RAM traces are likely gone now, as well as other traces which could lead to the hackers (whether they exist or not).

[Magazine]

I got back .23, but I had .28XX from a deposit made on Tuesday of this week. So the coins I deposited were not stolen and I expect the rest of my money back. There was a small balance there before that and I dont care about it but I do want back what I deposited this week.

Also my partial refund is still unconfirmed since last night.

Consider yourself lucky, and a pretty cheap lesson not to trust web wallets.

Some people lost loads!

[snuff]

Has anyone who got a refund had problems with them not confirming?

[BTChap]

For a start, has anyone received a confirmed refund? I got my unconfirmed refund today and am waiting for it to process. TF is likely sending 1000's of transaction. I have an ETA of 40hrs. I'll come around to update when this time is up.

[js1985]

Has anyone who got a refund had problems with them not confirming?

no miners are fees are paid so they take forever confirm

[simple-dice]

For a start, has anyone received a confirmed refund? I got my unconfirmed refund today and am waiting for it to process. TF is likely sending 1000's of transaction. I have an ETA of 40hrs. I'll come around to update when this time is up.

I got mine 10 hours ago and it's still unconfirmed, but it's expected.

He's probably going to be sending 1,000+ transactions, meaning that if he paid the 0.0005 fee it would be 0.5 in fees which is 0.5 someone could be getting refunded.

Unfortunately no miner fee was paid, so we will have to be patient.

I am one of the few that got refunded last night and am still waiting for it to confirm.

[haightst]

Just got an e-mail back, quote :
"Because the hack occurred neraly 2 weeks ago and the public announcement was only made now?"

This makes no sense, why did TF let people use a COMPROMISED wallet for two more weeks?

Why its now public and not before 2 weeks?  

So he could file a police report, hahaha just kidding

LOL !!!   i'm sorry i had to laugh

[Kyune]

It's one thing to have a security breach occur, draining BTC4,000 from the site. To continually allow the site to run normally for over 14 days with users unaware of the gravity of the situation is not just irresponsible, but borderlines criminal negligence. You were aware of the situation, yet you allowed deposits to continue.

Yep.  TF has some serious legal exposure if he lives in a western nation (did I read somewhere that he resides in Australia?) and his identity can be ascertained.  Completely separate from the question of whether this was a hack or a scam, TF's actions after the "hack" -- deceptively allowing his customers to put further deposits into an insolvent "bank" when he knew he could not repay them in full -- are likely a violation of the criminal laws wherever he resides and almost certainly exposes him to civil liability.