bitcoin7.com is really hacked?

[den11111]

Yesterday I withdraws ALL BTC at 12 o'clock (43 BTC). Everything was fine. After few hours site is working. I check my wallet but no money...  Today I go to bitcoin7.com and see this message:

Dear User,
Please read carefully the following critical announcement.

On Oct 5th 2011 Bitcoin7.com became the victim of a number of pre-planned hacker attacks. While our investigation is still going, evidence reveals that the attacks originated from Russia and Eastern Europe.

The attack itself took action not only against the bitcoin7.com server but also against other websites and servers which were part of the same network. Eventually the hackers managed to breach into the network which subsequently lead to a major breach into the bitcoin7.com website.

As a result of the hacking, unknown individuals managed to gain full access to the site's main bitcoin depository/wallet and 2 of the 3 backup wallets.

In addition the hackers gained access to our user database.

Even though our faith in the bitcoin project and community remains as strong as it ever was, it is our responsibility to admit that the scale of the damage is far beyond our financial and physical capabilities.

This is why we have decided to cease the operation of bitcoin7.com and instead of investing in new technology and personnel that could possibly help us overcome this unfortunate situation, we decided that we'd rather gather all possible finances through all possible means and initiate a crisis plan for reimbursing the lost balances of our users.

This is also an open invitation to all interested investors which have interest in taking over the site at the only cost of recovering the stolen bitcoins.

The crisis plan will take action over the next 90 days. On behalf of the management of bitcoin7.com we want to apologize for this extremely stressful situation.

More specific updates will follow within the next 24 hours with detailed instructions about how to withdraw your funds.

I DONT BELIVE THAT IT WAS REALLY HACKED

[SmokeAndMirrors]

They'd probably reached their goal and decided it was time to make their "claim" and walk away with your bitcoins.

[TiagoTiago]

Why does this keep happening?

[Sekioh]

If it's a BACKUP wallet, why the hell was it on the server anyway? Backup is supposed to be offline and only manual transfer when funds in the active pool get lower than 50%ish. That should be the most ever stolen +- a few % from like really recent deposits and such.

Why does this keep happening?

Because it's easy and people are gullible.

No real life information posted on sites, anonymous money, plenty of suckers. Why would anyone not collect and bail? As long as there is no consequences people will continue to cheat/scam/hack their way through anything. It applies to any other place too, people will push the boundries as much as they can.

Same applies to the *coins themselves, one made success, look at all the imitators. Now look at mybitcoin, here's the successors to that story. I don't entirely believe it was hacked either.

[speeder]

There are SEVERAL warnings here on the forum about B7 (lack of) security.

They being hacked is REALLY probably, in fact maybe someone from the forums did it...

If they lied, probably is about other sites being hacked, just to not show how crap their security was (and their security was really crap, they had several known flaws, including some basic ones, like having the site hijacked by another site, I forgot the name of that).

[TiagoTiago]

I mean, why sites handling people's 'coins remain vulnerable after many others before showed the need for an increased effort towards security?

[EhVedadoOAnonimato]

No real life information posted on sites, anonymous money, plenty of suckers.

Bitcoin7 was not anonymous as MyBitcoin, AFAIK. But yeah, not sure it changes anything.

[Jonathan Ryan Owens]

Did people really put their Bitcoins here? Domains By Proxy registration does not inspire confidence, and is a pretty good indicator for any Bitcoin related site that at some point your Bitcoins will disappear.

Do business only with sites that have public company registrations.

[Chucksta]

This sort of thing is really bad for cryptocurrency. Makes you wonder if it's safe to keep money or coins anywhere other than your wallet.

I don't keep coins on a trading site for very long (long enough to sell, only), but I do keep real money (speculating purposes). But I use Mt Gox, and for all the flaming of that exchange, they do have a very stringent security set up now.

[Chucksta]

Did people really put their Bitcoins here? Domains By Proxy registration does not inspire confidence, and is a pretty good indicator for any Bitcoin related site that at some point your Bitcoins will disappear.

Do business only with sites that have public company registrations.

+1

[muad_dib]

If it's a BACKUP wallet, why the hell was it on the server anyway? Backup is supposed to be offline and only manual transfer when funds in the active pool get lower than 50%ish. That should be the most ever stolen +- a few % from like really recent deposits and such.

security is expensive.

It is unfeasible to host the site in house, since it would require a huge capital upfront.


Plugging on and off an hard disk from a hot swap bay in a datacenter roughly takes 30 minutes.

A premium datacenter (rackspace) charge roughly 350$ per hour in sensitive datacenters.

It's much cheaper to do this remotely.

[elggawf]

security is expensive.

It is unfeasible to host the site in house, since it would require a huge capital upfront.


Plugging on and off an hard disk from a hot swap bay in a datacenter roughly takes 30 minutes.

A premium datacenter (rackspace) charge roughly 350$ per hour in sensitive datacenters.

It's much cheaper to do this remotely.

How I would do it? Online wallet with all the keys for people to deposit funds and so on. Figure out what percentage of funds you need to keep "online" in a buffer so that users can hit withdraw and have it go through in a timely fashion, all the rest of it is periodically (maybe in 1~4 hour intervals, so as to avoid too much fees) swept into an offline wallet. This offline wallet sits on a machine that's behind a LAN/firewall, that has it's one sole purpose is to be cold storage.

Whenever the amount of funds is over whatever your threshold is for your buffer, the funds are swept into cold storage. If you notice the buffer is getting a bit empty (lots of withdrawals and little deposits), then you go over the entire balance sheet and make sure all the numbers add up. There should be X amount in the exchange, and that's how much is there. If everything checks out and you're still low, you initiate a transfer from your cold storage wallet to your active wallet.

It's a teeny bit more fees, but it beats the snot out of the exposure of being wiped out if your exchange is hacked. If your threshold is 10% of all funds need to be available for withdrawal (I would imagine if you had a bunch of market makers on your site your threshold is much lower than that), then you're only on the hook for 10% of whatever BTC are in your stewardship. I don't know what the margins are for exchanges, but I would imagine it's not unreasonable to expect if you can go a few months without getting owned that you may even have this in reserves.

But that's just me - I can't understand why anyone would get taken for 50+% of what they're holding if they purport to know what they're doing.

[repentance]

security is expensive.

It is unfeasible to host the site in house, since it would require a huge capital upfront.


Plugging on and off an hard disk from a hot swap bay in a datacenter roughly takes 30 minutes.

A premium datacenter (rackspace) charge roughly 350$ per hour in sensitive datacenters.

It's much cheaper to do this remotely.

Nobody who isn't prepared to invest a huge amount of capital in security upfront should be trusted with other people's funds to begin with.

[Bind]

You were all warned a long time ago about bitcoin7, in multiple threads.

Whatever happened after that is your own fault if you decided to use them after the multiple threads about their dishonesty, lack of ethics, security concerns, and lack of caring about said security concerns.

It simply does not matter why the bitcoins have vanished.

[saykor]

This sort of thing is really bad for cryptocurrency. Makes you wonder if it's safe to keep money or coins anywhere other than your wallet.

I don't keep coins on a trading site for very long (long enough to sell, only), but I do keep real money (speculating purposes). But I use Mt Gox, and for all the flaming of that exchange, they do have a very stringent security set up now.

ooo please... mtgox was hacked 2-3 time to now.