CEX.IO "hacked"........?

[IYFTech]

Thought I'd copy this over from the cex.io official thread so everyone could read it, seeing as nobody looks at their thread anyway - especially cex.io......

CEX.IO Hacked. User loses 7,000 USD
http://mentaso.com/bitcoin-news/cex-io-hacked-user-loses-7-btc.html

[PatMan]

****GONE****

EDIT: More on it here.......

http://narrock.com/threads/my-cex-io-just-got-hacked.130/#post-790

Apparently cex allow multiple logins........how wonderfully secure 

[empoweoqwj]

Apart from the volatility of bitcoin, I see "hacking" as the number thing that could cause it to fail.

Barely a week goes by without another "several thousand" bitcoins going missing because a site has been "hacked".

I put "hacked" in quotes because in 90% of these "hacking" cases, I don't believe for a minute the site has really been hacked. Its just a convenient excuse for the site owner to run off with the coins.

Tip: never leave any more bitcoins that you have to on *any* bitcoin website. There are too many greedy people about. Keep your bitcoins offline.

[HellDiverUK]

Huh, glad I emptied out my BTC from there yesterday.  Still have a tiny amount of cloud hashing going on there (mostly to keep the referral freebies running).

[helmax]

i am new in this pool
where is thread official for doughts ?

how i can put my address wallet in pool for withdrawn

[Mitchell]

Apart from the volatility of bitcoin, I see "hacking" as the number thing that could cause it to fail.

It's the same with every other online banking account. It takes a while to build up good security and people just have to be careful with their stuff.

[PatMan]

Cex aren't happy about the posting - but have neither confirmed or denied it happened. I've asked them to clarify the situation on their official thread so as to assure their users that their system is safe, here:

https://bitcointalk.org/index.php?topic=318010.msg3905148#msg3905148

[empoweoqwj]

Apart from the volatility of bitcoin, I see "hacking" as the number thing that could cause it to fail.

It's the same with every other online banking account. It takes a while to build up good security and people just have to be careful with their stuff.

Umm ..... how many stories have we heard from banks recently saying "oh sorry, we've got hacked, and all your money has gone".

No, I'm not defending banks for a minute, just pointing out that you can have all the "good security" in the world but if the website owner decides to steal the coins, he can do so in 5 mins.

Greed does funny things to people. Inputs.io claimed the most amazing levels of security, yet they claim they were hacked and had all their coins stolen. Make your own mind up 

[bkpduke]

If the user had setup two-factor authentication, this would not have happened.

I put more blame on the user here than CEX.  Sorry, you just don't leave large sums of BTC unprotected.

[siameze]

"Jeffrey Smith" who replies to all cex.io correspondance is aparently a TradeFortress clone: http://mentaso.com/bitcoin-news/cex-part-2-the-hacked-account-and-children-playing-grownups.html

This sort of thing is becoming far too commonplace. While I like the premise of cex.io, I wish there was a more stable and secure platform like it and not the constant dodgy behavior Mr. Smith seems to exhibit.

[IYFTech]

 http://mentaso.com/bitcoin-news/cex-part-2-the-hacked-account-and-children-playing-grownups.html

+100!

Gotta love those 3 questions.....

TBH, cex.io are dodgy full stop. They've even accused me of getting paid to criticize them.....

It's all gonna end in tears.

[siameze]

http://mentaso.com/bitcoin-news/cex-part-2-the-hacked-account-and-children-playing-grownups.html

+100!

Gotta love those 3 questions.....

TBH, cex.io are dodgy full stop. They've even accused me of getting paid to criticize them.....

It's all gonna end in tears.

My criticism is free lol.

[empoweoqwj]

"Jeffrey Smith" who replies to all cex.io correspondance is aparently a TradeFortress clone: http://mentaso.com/bitcoin-news/cex-part-2-the-hacked-account-and-children-playing-grownups.html

This sort of thing is becoming far too commonplace. While I like the premise of cex.io, I wish there was a more stable and secure platform like it and not the constant dodgy behavior Mr. Smith seems to exhibit.

Seriously? That explains all then .............

Nobody going to investigate him, the police I mean.

This is giving a bad name to the .io domain space 

Re: 2 factor authentication "solving all", it didn't stop all the coins disappearing from inputs.io, owned by "Mr" TradeFortress. he was unfortunately (cough cough) "hacked", even though he claimed the best security of any online wallet. Make your own mind up.

[johningreece]

Earlier today my cex.io account was hacked and also my email. The hacker sold the GHS I had and withdrew the funds. I had deposited 10 btc into my cex account. My cex account is now frozen by cex and they are investigating - whatever that means. Does not cex have the obligation to make this right??

[Mitchell]

Earlier today my cex.io account was hacked and also my email. The hacker sold the GHS I had and withdrew the funds. I had deposited 10 btc into my cex account. My cex account is now frozen by cex and they are investigating - whatever that means. Does not cex have the obligation to make this right??

If it was their fault, they should. If you fucked up, they don't have to.

[empoweoqwj]

Earlier today my cex.io account was hacked and also my email. The hacker sold the GHS I had and withdrew the funds. I had deposited 10 btc into my cex account. My cex account is now frozen by cex and they are investigating - whatever that means. Does not cex have the obligation to make this right??

If it was their fault, they should. If you fucked up, they don't have to.

Several reports of lost funds from cex.io these last few days. Hope its not another .io site getting "hacked".

[johningreece]

Cex.io said "sorry for your loss"

[rammy2k2]

i doubt cex.io is hacked ... i bet users have fallen for phising sites or keyloggers

[empoweoqwj]

i doubt cex.io is hacked ... i bet users have fallen for phising sites or keyloggers

You can't possibly know that. I haven't heard of of any cex.io phishing emails going around, but I have heard of several cex.io accounts being emptied recently .........

[streetlogics]

Was just logged in to cex.io chat and got 2 javascript alerts minutes apart with simply the text "1".

I logged back in a few minutes later to investigate, and discovered this in the "russian" tab of their chat window:

Code:

z66 : 20:25
“><img src="#" onerror="alert(1)"
Ramirez : 20:26
><img src="#" onerror="alert(1)"
Ramirez : 20:26
doesnt work
kickbit : 20:27
xe2x80x9c><img src="#" onerror="alert(1)"
Ramirez : 20:28
-->
Ramirez : 20:29
->

They have been alerted via twitter by others that noticed the problem too:
https://twitter.com/chrisfarms/status/423913046512128001
https://twitter.com/vvedma/status/423920180750610432

As a professional web developer, this is deeply concerning.

I am not sure that this is necessarily related to people having their accounts cleaned out, but it is certainly something to consider regardless as a "possibility".  Anyone who has studied computer information security knows how serious the potential for an XSS attack is, and it certainly should not be taken lightly.

You are free to draw your own conclusions, but personally I withdrew all my BTC from there a while ago.