BIPS Wallet security breach

[troy112]

The thing is that there will be crooks who try to steal money, even if you put all the security measure you can find. You just have to pray that you aren't the one to be crooked...

[Dadio202]

Dave . Be very careful. Not only have they lost my bitcoins but I sent them £.... Via bank transfer to purchase more on the Friday the 15th and have heard nothing from them since. Did they loose all their bank deposits as well?

[Roobotics]

The timing of this is scary, because this nearly caught me as well.

A week  prior a coworker and I were having a conversation and started talking about web-wallets. After reading up online I came to the conclusion I wanted nothing to do with BIPS and scooted my measly 0.03BTC or so away from them. A week later and this happens.

I initially chose BIPS because it was recommended on the "choose your wallet" page and the site seemed reasonable well put together. I feel like it doesn't deserve a spot there anymore..

[okoun]

Seems like with increased BTC value this will keep happening more and more often.

[TookDk]

no that is not good.  what bips does is transfer from your deposit address  to a second address.  since your monies were moved way before the breach you do not know what happened to them in the holding wallet.  my timing was the .4 btc   was put in about 1 hour to 10 hours before the breach and then moved  3 days after the breach was found it is easy to trace the history.

 I need to study the address you gave me.  maybe I can figure the moves made after you put the coins in.

Its a good point.

If you follow the some of the deposits to BIPS on the blockchain, the balance form the wallets are moved to secondary addresses owned by BIPS, together with other deposits, and then moved again and again.

We have heard that some coins are recovered. How are you going to decide who lost coins and who still got a balance?

[allincoin]

I withdrew 3.82761346 BTC from MTGOX to BIPS address 1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb on November 6th.

Then Spent .861 BTC sending it to 1CK8gvdupixuWWsPxo2dZLtXqZkVaYkhwA on the same day it was deposited.

My balance when BIPS went down should have been 2.96661346 (might have included the .001 fee)

https://blockchain.info/address/1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb?sort=1

Can you give me a crash course in understanding tracing the transactions?

[allincoin]

Wow, I'm a Zen Cart ecommerce designer and after looking at all Zen Cart/Bitcoin plugins I chose BIPS - YESTERDAY! I had no issue creating a new account and installing the software on demo site. I can't believe there were no warning or announcements anywhere to be seen, if It wasn't for this post I would not have known of any breach. Luckily I had yet to transfer BTC's to test their plugin - whew!

Sorry to hear the losses on here, I hope you find restitution quickly.

Dave Ward
Kitchener, ON, Canada

I was very surprised there wasn't more posts about this when I created this thread.

[philipma1957]

I withdrew 3.82761346 BTC from MTGOX to BIPS address 1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb on November 6th.

Then Spent .861 BTC sending it to 1CK8gvdupixuWWsPxo2dZLtXqZkVaYkhwA on the same day it was deposited.

My balance when BIPS went down should have been 2.96661346 (might have included the .001 fee)

https://blockchain.info/address/1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb?sort=1

Can you give me a crash course in understanding tracing the transactions?

  hard to do.  but here goes


NOV 7   this id is the deposit

https://blockchain.info/tx/6991b1997f7175e56f3aa242dd2553d2b56936a204c25fb2800ab6718c806a17


https://blockchain.info/address/1PnhVVr2LgPNkbK3vnFepFzVk84mHSNpt9    this appears to be your   2.966xxx


next move is here


https://blockchain.info/tx/98a83e636a86e375abbfb9eddb42bcd2100bc8cced5b4e41d8cc5b0bbc54d89c

and the money sits in this address

https://blockchain.info/address/1MTzsVSe5D2FDDeM9UjqkpKuJTdu5Snegb   notice the .01 fee removed.


that wallet is like a tellers drawer in the bank.  next up this move

https://blockchain.info/tx/87615f9363a17cdfd214b79a03510fab0cbc52f49d7180452402fa37af2b65f6

most money  is here   https://blockchain.info/address/1ANuFn4qjzh1uxVJoRiRGosCyHEueEwnxr   this got a little money most likely a fee.


https://blockchain.info/address/1NGS8XBNpKQV7sCfQo1Fifg1WBicAxdkrV


most money is still here  https://blockchain.info/address/1ANuFn4qjzh1uxVJoRiRGosCyHEueEwnxr   2.8… btc

next move is this




https://blockchain.info/tx/92c24d58ad65548ba57d9d5ea6dfcf79ee892cd9e5882c013d49960060249f91   this is a merge of the 2.8 plus other to here

https://blockchain.info/address/1CuLB5gVR1uS2C3KTNLBiRMrqiizyycF9q

https://blockchain.info/address/1AEXdHBmtcFSG5Qb7Vb6fgG1vpm2JFhjZU   at this point it has been co-mingled   in and out of multiple wallets. 

  you could argue   that there is a trail and that 2.8 of the coin is yours but  we are only up to NOV 9th.

 think that the coins may have  entered a bankers cash drawer.  you really lost the chance to trace them in most cases. 

[philipma1957]

https://twitter.com/bips


 the twitter account is pretty dead.  more then a day since they spoke on it.

[blockgenesis]

Why are they still shown on bitcoin.org as a 'recommended' web wallet?

When something like that happens and you think an action is required, please report it! There's an "About bitcoin.org" page for this purpose
http://bitcoin.org/en/about-us

BIPS is now removed from the wallets listed on bitcoin.org .

I initially chose BIPS because it was recommended on the "choose your wallet" page..

This kind of comment concerns me. There is a red warning on each web wallet on bitcoin.org and users are forced to read them before looking at them. This was mainly designed to educate users about the risk of using these services, assuming that it was better than nothing given that people would be using them anyway. But a comment like this one seems to suggest this wasn't enough in some cases and can confuse some people into thinking these wallets are recommended despite the disclaimer.

Should we keep trying to educate users using disclaimers and by listing only web wallets with a "clean history", or should we stop listing them completely to make sure they don't appear like they are recommended (and leave users not informed about their risks or which one have some established reputation).

[assortmentofsorts]

https://twitter.com/bips


 the twitter account is pretty dead.  more then a day since they spoke on it.

Kris is coming online every day atleast twice but choosing not to reply to messages or helpdesk ticket. I'll keep messaging him every day from now on until he replies. If he doesn't, i'll bump it up to every hour I hate it when people don't show the simple courtesy to even reply.

[allincoin]

Why are they still shown on bitcoin.org as a 'recommended' web wallet?

When something like that happens and you think an action is required, please report it! There's an "About bitcoin.org" page for this purpose
http://bitcoin.org/en/about-us

BIPS is now removed from the wallets listed on bitcoin.org .

I initially chose BIPS because it was recommended on the "choose your wallet" page..

This kind of comment concerns me. There is a red warning on each web wallet on bitcoin.org and users are forced to read them before looking at them. This was mainly designed to educate users about the risk of using these services, assuming that it was better than nothing given that people would be using them anyway. But a comment like this one seems to suggest this wasn't enough in some cases and can confuse some people into thinking these wallets are recommended despite the disclaimer.

Should we keep trying to educate users using disclaimers and by listing only web wallets with a "clean history", or should we stop listing them completely to make sure they don't appear like they are recommended (and leave users not informed about their risks or which one have some established reputation).

I came across bips by chance personally. The vendor I made my first purchased from was using them so I set up my first wallet there also.  Prior to bips I kept them on the exchange purchased.   I think it would be a great idea to sticky a warning in the Newbie and general bitcoin discussion forum to educate users about the risks of web based wallets.

I didn't even know I could download a software based wallet prior to losing my coins or I would have done that. FYI.. I joined the started with bitcoin in march of this year.

[Roobotics]

I initially chose BIPS because it was recommended on the "choose your wallet" page..

This kind of comment concerns me. There is a red warning on each web wallet on bitcoin.org and users are forced to read them before looking at them. This was mainly designed to educate users about the risk of using these services, assuming that it was better than nothing given that people would be using them anyway. But a comment like this one seems to suggest this wasn't enough in some cases and can confuse some people into thinking these wallets are recommended despite the disclaimer.

I came across bips by chance personally. The vendor I made my first purchased from was using them so I set up my first wallet there also.  Prior to bips I kept them on the exchange purchased.   I think it would be a great idea to sticky a warning in the Newbie and general bitcoin discussion forum to educate users about the risks of web based wallets.

I didn't even know I could download a software based wallet prior to losing my coins or I would have done that. FYI.. I joined the started with bitcoin in march of this year.

As it should I suppose, I did read the warning but I suppose it's easy to brush those off as an "Oh pfft that will probably never happen, it's just a disclaimer" But in bitcoin it's just not. It should be plainly stated that because of the price demand BTC has worked up to and it's inherent decentralization and control that these attacks/scams/robberies happen at an alarming frequency to those who don't know how to protect their coin. I had a discussion over on reddit about the wallet system and I'll copy it in here, it's basically a recap of what happened when I tried to install bitcoin-QT before going to a web wallet and some improvements I think we can make to help introduce newer users as I was shortly ago:

I completely agree with your ideas here. I'm quite tech savy so for my first btc wallet I chose armory... Oh okay it requires QT..no big deal.. Oh it needs to sync first? Alright I'll let it do that..

Warning: Low disk space

Oh FFS how big is this file.. 11GB?! (Running a 128GB SSD, so kind of a big deal)

These sites need to have a warning that states if you use _______ wallet program the entire blockchain will be downloaded, and tell you roughly how much space that is. This will keep newbies from needlessly draining the bandwidth of peers for something they're possibly not going to use.

Then there needs to be an explanation why you would want to download the QT version, how you're helping the network thrive by leaving it on, etc.
Without making these distinctions to end users you are indirectly slowing the ease of adoption for BTC and clogging up the network.

Also please add a link to the official "bootstrap.dat" torrent and explain where to place it to significantly increase the syncronization speed(and that you can delete/move it once QT renames it to a *.old file)

[nullfrog]

I had 1.1335 coins at bips.me, bought them less than a year ago and kind of forgot about the whole account. I got the mail about the security breach, logged back in and can no longer see any coins or activity logs on the account.

What's odd is that I went to my mail to see if I can find the transaction details for my purchase and found the link to my wallet activity https://blockchain.info/address/14zpn5EGTBKLZGRroBZn7uzTBUWFqJo4cs

It seems like all the coins would have been taken out of the account just hours after they were put there, over half a year ago. I guess the blockchain reports etc. can't be tinkered with, so it must be the case?

I started thinking that did I transfer the coins over to mtgox account so I could sell them more easily, but my mtgox account is also claiming no transaction history.

Is there any hope to recover my coins, or are they gone forever? Paid only ~80$ for them, so it's not a massive loss, but at current rates it still stings. I guess that's what I get for wanting a convenient online wallet.

[dantes]

does anyone have a physical address for BIPS? or a physical address for Kris where he might be visited? 

We are getting together a group of people who have lost money as a result of this scheme.  Please get in touch if you have lost bitcoins in this scam.  Curiously we have a number of US holders - can't think it would be ideal for Kris if it were reported to the US authorities that he had breached US law by for example offering securities to US persons without being registered with the SEC.  Orange jumpsuit, perp walk and dungeon time for him. 

I don't see how there can be any future for Kris or BIPS in the bitcoin community.    There should be a blacklist on which we list people who take people's bitcoins and fail to show their face afterwards.  Shall we leave it to private enterprise to organise such a blacklist?  Or would the bitcoin.org guys like to add a page on which we list these sorts of people so people can check it?

[howzar]

To think I moved them only days prior from MTGox...  Is there a recommended wallet service to use?  I know large amounts should be kept in cold storage.  Is the wallet service from blockchain a good one to store a small amount of coin?

Why would you even put your money in any online wallet and risk it to be hacked?
 Blockchain.info looks to be the best online wallet currently and they claim they don't have access to your wallet and pass (and mostly this is correct), but what's wrong with paper wallets? it just takes 10 mins to upload the key from a paper.

[Missim]

Use of  bitcoin does require the use of an online wallet. This is the case if  Bitcoin is  going to be accepted mainstream.

I too lost  here - but I blame the hacker - not the victim. From what I read the file system was wiped.  Curious as to why a hacker would do that. Usually get in - get the info  - get out.  Wiping the server clean ensures there is no trace of  how.

I believe some thought needs to be put into the who - as well as the how.

I do also note  a  number of online wallets  have had problems. A number of  the leading wallets in various countries  have been taken down recently.   Denmark, Poland, Czechoslovakia.

Rather than thinking all about me,  let's think all about we.  The BTC  community  has been targeted (and probably always will be) by those who seek to  devalue it.

They seek to destroy the work of hours spent  working out systems that are for the improvement of all.

Why is that?  If the hacker is successful then the value  drops.  And  who profits from that?  The  established systems  would seem to have the most to gain.  Food for thought.

It helps to read the terms.  I think the security was ok -  obviously not enough - hindsight is  20/20.  But one can lock the doors and the thief still breaks the window - or  burns the house down.

I hope Kris - and Bips -  continue.  I hope they focus on the merchant services.  I hope they prosper.

And -  I do hope they find  a  way to  recompense.  But  hey  I'm human. 

If they don't - then I will still use their merchant services. 

[moneymaking1]

 Well, this kind of shit could happen to any of the merchants out there.

I have always founds BIPS to be a good service but unfortunately bad things happens...hackers should be blamed and not them.

[PenAndPaper]

There should be a blacklist on which we list people who take people's bitcoins and fail to show their face afterwards.

Those people are burned anyway and it seems unlikely to continue doing business with bitcoins. The real issue here is that the community should be proactive and i don't know about bips but some other incidents wasn't so unexpected...

[btcranger]

from where i see, there is no better option than being patient wait and observe the progress they are doing
give them time to clean the mess on their own way and allow them to come with the best possible solution for both them and us.

or we can just continue vent our despair here purposeless...