Mybitcoin.com Press Release #2

[kiba]

Well it smells so, but technically it's not a bailout, since a new board would take over (a new company that's 100% on GLBSE). A trusted group of people are still needed to make the transition, hopefully people who plan to buy a bigger portion of the shares and/or plan to be employed by the company. The site probably would need to switch to a different business model to be able to generate enough profit though.

So we're creating a non-governmental chartered corporation which you can't sue in courts?

In all seriousness, I hope this new company will be more secure and more accountable to the wallet holders.

[1713296388]

1713296388

[1713296388]

1713296388

[1713296388]

1713296388

[1713296388]

1713296388

[1713296388]

1713296388

[Astrohacker]

It appears to be human error combined with a misunderstanding of how Bitcoin secures transactions into the next block. Our programmer was under the assumption that one block was good enough to secure a transaction. Two years ago when the software was written, this single confirm myth was a popular belief.
In hindsight we should have credited deposits after one confirmation so they would show up in the transaction history, and held the deposit until it reached at least 3 confirmations. Keeping track of two balances and displaying them in the login area would have been trivial.

Luckily for us, this just told us enough that we could validate his whole story. Wasn't someone working on double-spend detection? Well, we need that ASAP.

True. If they really release their source code, we'll be able to see how their code was fooled with what sounds like a fake block.

[ymgve]

OMG, I love ABE! Turns out that we can read all of the branches pretty easily!

Here's some examples:

Block 137571:
http://abe.john-edwin-tobey.org/block/0000000000000779066b823cc302316ca6cf5550f7b1d28f79a26ebff09503d4
http://abe.john-edwin-tobey.org/block/00000000000001fba6bcf0c15d3fecc4d1f2837e934d6ee5afff3ff28a0888a2

Block 136755:
http://abe.john-edwin-tobey.org/block/00000000000000f48d1225842ed629fce1d1e5ae0fba6ae04d4ae7dbfc9e34af
http://abe.john-edwin-tobey.org/block/0000000000000152fd8df6e551d1d3db507132ed34495cde176eb799057871f3

Anyone want to look for conflicts? If we check every reorg, we'll be able to INDEPENDENTLY verify the amount of funds stolen, and where they went to. Additionally, we might even find out that a pool was behind this. Game = changed.

I did a check of the fake 137571 block, and the only transaction that's there, but not in the real 137571-137573 blocks is the generation one. Which is what you'd expect from a "legit" dupe block. Looking through the other one now.

edit: Same with the 136755 block. Only generation block is missing.

[Maged]

OMG, I love ABE! Turns out that we can read all of the branches pretty easily!

Here's some examples:

Block 137571:
http://abe.john-edwin-tobey.org/block/0000000000000779066b823cc302316ca6cf5550f7b1d28f79a26ebff09503d4
http://abe.john-edwin-tobey.org/block/00000000000001fba6bcf0c15d3fecc4d1f2837e934d6ee5afff3ff28a0888a2

Block 136755:
http://abe.john-edwin-tobey.org/block/00000000000000f48d1225842ed629fce1d1e5ae0fba6ae04d4ae7dbfc9e34af
http://abe.john-edwin-tobey.org/block/0000000000000152fd8df6e551d1d3db507132ed34495cde176eb799057871f3

Anyone want to look for conflicts? If we check every reorg, we'll be able to INDEPENDENTLY verify the amount of funds stolen, and where they went to. Additionally, we might even find out that a pool was behind this. Game = changed.

I did a check of the fake 137571 block, and the only transaction that's there, but not in the real 137571-137573 blocks is the generation one. Which is what you'd expect from a "legit" dupe block. Looking through the other one now.

edit: Same with the 136755 block. Only generation block is missing.

I'm seeing the same you are. We'll have to check the other blocks too, I guess.

Unless ABE is hiding the conflicting transactions that should have been included in those blocks?

[lettucebee]

MyBitcoin is a Limited Liability Company, so the owner(s) is not personally responsible for the company's debts.  This is a very good thing, because it allows entrepreneurs to start risky ventures without putting their entire lives on the line.  If we didn't have limited liability entities, there would be a whole lot less innovation, a lot less wealth, and a lot fewer jobs.

One man's innovation is another man's fraud. “A corporation is a legal person created by state statute that can be used as a fall guy, a servant, a good friend or a decoy,” the company’s website boasts. “A person you control… yet cannot be held accountable for its actions. Imagine the possibilities!”

The whole situation with mybitcoin smells fishy. My instincts tell me that "Tom Williams" is a pirate. Captain Tom!

[SgtSpike]

If he's not incorporated, he can be sued for his personal assets and cash by anyone and everyone who lost bitcoins from this.  I encourage people to take this route once more of his information is revealed, and if he does not fully reimburse every single person who used the service.

MyBitcoin is Limited Liability Company, i.e. owners don't take any liability for company's debts. In this case maximum you can get suing them is corporation's assets.

Hence the reason I started with "If he's not incorporated..."    I wasn't sure what the registration of the business was.

[jago25_98]

First I lost money with ice save when the Icelandic economy went tits up. So I switched to an unregulated US hedge fund. They got shut down by the FSA. So I switched to some gold. Some of that went missing in transit. I claimed on insurance but decided to check out Bitcoin. I saved some with mtgox and mybitcoin and my own client. First mtgox got lost (couldn't remember my balance), then mybitcoin had this problem. Terrible!

This is just a reminder that this is nothing new.

In this case I feel I blame myself for using mybitcoin as a store rather than just for spending. I've lost a lot in one way but... When I signed up it wasn't worth what it is now! Oops!

I stay forever hopeful with bit coin because I've experienced first hand greater losses. It could be a lot worse - I'm glad I'm not starving this time and take it as a lesson - spread those eggs into different baskets!

[repentance]

If he's not incorporated, he can be sued for his personal assets and cash by anyone and everyone who lost bitcoins from this.  I encourage people to take this route once more of his information is revealed, and if he does not fully reimburse every single person who used the service.

MyBitcoin is Limited Liability Company, i.e. owners don't take any liability for company's debts. In this case maximum you can get suing them is corporation's assets.

Their website says they're an LLC, but has anyone seen the paperwork?  I'm guessing no, since if they had there would probably be a way to track down the owner(s).

Nevis doesn't require the names of the actual owners or beneficiaries to be listed anywhere in the paperwork.  Given just how many companies are registered to that same PO box and street address and the fact that Meridian Trust (which acts as agents for shell companies) appears in the whois information for Mybitcoin, I doubt that information about the true owners appears anywhere in the LLC records.

I've done a bit of research over the last few days and there are any number of company agents who'll set up LLCs in Nevis complete with a company agent and an off-shore bank account (which can be in Panama, Belize, Nevis or other safe havens) for under $2000.  One of their big selling points is that Nevis courts don't enforce judgements from foreign courts, and that Nevis law prohibits the disclosure of information about the owners/beneficiaries of certain types of legal entities.  A Nevis court can probably force a company agent to disclose that information, but I'm guessing that the company agents would fight very hard against any such action in order to keep their reputation as being IRS-proof intact.

[Nefario]

mybitcoin is stalling for time.

They have no contact information available and are not communicating (although they are watching these forums).

They have said there will be a claims process but they've not done anything.

From the information provided, on the technical side their story doesn't add up.

I vote for continuing to attempt to uncover the real identity of Tom Williams. It seems this is the only reason he made a statement at all.

Nefario.

[BioMike]

(although they are watching these forums).

Are they? How are you so sure about that?

[Nefario]

(although they are watching these forums).

Are they? How are you so sure about that?

Why wouldn't they?

[Maged]

(although they are watching these forums).

Are they? How are you so sure about that?

The second press release here confirms it. With no way for us to contact them, there is nowhere else they could have received the community feedback used in #2.

[repentance]

mybitcoin is stalling for time.

They have no contact information available and are not communicating (although they are watching these forums).

They have said there will be a claims process but they've not done anything.

From the information provided, on the technical side their story doesn't add up.

I vote for continuing to attempt to uncover the real identity of Tom Williams. It seems this is the only reason he made a statement at all.

Nefario.

There's some updated information here.

http://bitcoin.crimeunit.net/wiki/index.php/MyBitcoin_Summary

[Vladimir]

If he's not incorporated, he can be sued for his personal assets and cash by anyone and everyone who lost bitcoins from this.  I encourage people to take this route once more of his information is revealed, and if he does not fully reimburse every single person who used the service.

MyBitcoin is Limited Liability Company, i.e. owners don't take any liability for company's debts. In this case maximum you can get suing them is corporation's assets.

Not really true in all cases. Limited liability does not protect in cases when some kind of crime is proven. Whether it is fraud, operating a depositary institution without appropriate license or something else. By hiding identity, operator of mybitcoin does not help himself much in this regard too.

[FlipPro]

If he's not incorporated, he can be sued for his personal assets and cash by anyone and everyone who lost bitcoins from this.  I encourage people to take this route once more of his information is revealed, and if he does not fully reimburse every single person who used the service.

MyBitcoin is Limited Liability Company, i.e. owners don't take any liability for company's debts. In this case maximum you can get suing them is corporation's assets.

Not really true in all cases. Limited liability does not protect in cases when some kind of crime is proven. Whether it is fraud, operating a depositary institution without appropriate license or something else. By hiding identity, operator of mybitcoin does not help himself much in this regard too.

+1 There have been many cases where the operator of the LLC goes to jail/bankrupt because of the obvious misuse of their company name...

[Nefario]

If he's not incorporated, he can be sued for his personal assets and cash by anyone and everyone who lost bitcoins from this.  I encourage people to take this route once more of his information is revealed, and if he does not fully reimburse every single person who used the service.

MyBitcoin is Limited Liability Company, i.e. owners don't take any liability for company's debts. In this case maximum you can get suing them is corporation's assets.

Not really true in all cases. Limited liability does not protect in cases when some kind of crime is proven. Whether it is fraud, operating a depositary institution without appropriate license or something else. By hiding identity, operator of mybitcoin does not help himself much in this regard too.

His anonymity is the strongest protection for him to avoid criminal prosecution, enough funds are at stake with mybitcoin.com to warrant the harmed parties to chase him to wherever he happens to be. Once we discover who he is he has no protection, having a disclaimer on the bottom of your site doesn't protect you from criminal charges if you're guilty.

[Vladimir]

Anonymity might help him to avoid criminal prosecution (if anonymity is breached and if there were indeed any crimes commited), however it does not help at all with keeping Limited Liability protection. That's what I mean.

BTW. Most people do not have any clue on how difficult it is to stay anonymous on the net, particularly when there are allegations of crime thrown around.

[Nefario]

Anonymity might help him to avoid criminal prosecution (if anonymity is breached and if there were indeed any crimes commited), however it does not help at all with keeping Limited Liability protection. That's what I mean.

BTW. Most people do not have any clue on how difficult it is to stay anonymous on the net, particularly when there are allegations of crime thrown around.

I suspect that this is the reason for his very minimal contact with the community. The more he talks and communicates with the community the higher the risk of his ID being discovered.

There is also how he has paid for his hosting, unless he is paying for his hosting with bitcoin (which is very possible) and he has not bought  the coins off an exchange then the credit card can be traced back to him if it's a personal one. There is no such thing as anonymous banking in this world, so that if the credit card is registered with his company he will still have to provide an identity.

It may be difficult and even costly to track him down but it can be done...unless he's a government agent in which case all bets are off as the state (whichever one) would provide protection.

A court order can be obtained in to reveal his identity in the region that his LLC is incorporated.

Nefario.

[Ulysses]

I think you misunderstood the Mybitcoin's statement about the cause of the hack.

It appears to be human error combined with a misunderstanding of how Bitcoin secures transactions into the next block. Our programmer was under the assumption that one block was good enough to secure a transaction.

[...]

In hindsight we should have credited deposits after one confirmation so they would show up in the transaction history

If i correctly interpret this statements, then Mybitcoin accepted transaction as verified after the block number was incremented, not after that transaction was included in the block. This opens an easy way to drain their coins without block chain fork, especially if you know their bitcoind IP address.

[Nicksasa]

I think you misunderstood the Mybitcoin's statement about the cause of the hack.

It appears to be human error combined with a misunderstanding of how Bitcoin secures transactions into the next block. Our programmer was under the assumption that one block was good enough to secure a transaction.

[...]

In hindsight we should have credited deposits after one confirmation so they would show up in the transaction history

If if correctly interpret this statements, then Mybitcoin accepted transaction as verified after the block number was incremented, not after that transaction was included in the block. This opens an easy way to drain their coins without block chain fork, especially if you know their bitcoind IP address.

Bitcoind doesn't accept remote connections unless their ip is specified in the config file.