BTC Stolen from Poloniex

[SpiryGolden]

  Simply are gone ...by Magic !  Damn man that sucks i hope it will be fine . Add more coins i also recommend you too add Franko & Magic Internet Money , Maza & Auroracoin make some volume bro . That would be awesome !

[supervine]

So, the users will pay for that flaw again (with rised fees). It were some understandable with XCP, where the flaw was on protocols side, but here? Great idea busoni. Why not take the amount you was stolen of from all the users?

[The One]

The major problem here is that the auditing and security features were not explicitly looking for negative balances. They add deposits and withdrawals and check that accounts are in balance. If you have 2 BTC, withdraw 10 BTC, and are left with -8 BTC, the software would see that you deposited 2, withdrew 10, and have exactly what you should: -8.


This is pathetic. Any programmers would not have allowed this to happen in the first place. It's basic programming level. If you have 2 BTC, withdraw 10 BTC, then "withdrawal rejected due to lack of funds."

Secondly, one by one the exchanges are going pear shaped. One by one suspicious of scams are raised.

Is there any honest people on the Bitcointalk forum apart from myself?

Any rises in fees, especially up to 1.5% is suicide. Users will simply move to another exchange. All businesses should have insurance policies in place and funds held in reserve.

Poloniex a fast growing site and revenues are going up, therefore as more coins are added, the revenues will increase further. So no need for an increase in fees but the owner need to trust that the revenues will grow. Any fees increase will compound the problem, thus lowering revenues.

Fixed the basic programming error and continue as best you can. Users will then be able to continue as normal and the revenues will grow.

I would support a small .20% withdrawal fee as a temporary measure.

[supervine]

Address of the thief https://blockchain.info/address/1Ktq7TE3J5vZ3c99M5weqKfFcNkHQdqPrq
Total loss is around $50,000

If that's indeed him, Googling the address brings up a russian forum with his address... If the site cooperates we can find the guy:
http://2ch-b.ru/2014/03/03/privet-anon-hochu-besplatno-gb-na-drpbx-libo-posovetuj-drugoj-63603242.html

More on this?

It some faucet. Giveaway 0.1LTC for anyone registering on dropbox... So no additional info from here, beside the fact what the thief speaking russian.

[MaddestScientist]

How about issuing fee share to all affected accounts?

For example, issue 200,000 shares @ 1 mBTC each (for a total of 200 BTC)

For each 1 mBTC loss, issue 1 share to the account.

Rising fee to 1.5% is like committing suicide, I'm quite sure that many people (including myself) will leave.

[cloverleaf]

What about BTC deposits after the announcement? Will they be affected?

[mannie]

Does anyone know when exactly the market froze? I started a BTC withdrawal +5 hours ago but it's stuck in PENDING.

[The One]

How many bitcoins is 12.3%?

This keeps getting posted in the trollbox, but I have no idea about the veracity of it:

https://blockchain.info/address/1Ktq7TE3J5vZ3c99M5weqKfFcNkHQdqPrq

Is there a way of stopping and taking those BTC back?

[Jam0r]

Everything pretty much ends up in this account if you follow the chain

https://blockchain.info/address/1N2f642sbgCMbNtXFajz9XDACDFnFzdXzV

and now he's taking everything out of that one too..

[DavidT]

Everything pretty much ends up in this account if you follow the chain

https://blockchain.info/address/1N2f642sbgCMbNtXFajz9XDACDFnFzdXzV

and now he's taking everything out of that one too..

45000 BTC!!!!!!!!!!! Ouch!!!!!!!!!!!!!

[breakbeater]

Does anyone know when exactly the market froze? I started a BTC withdrawal +5 hours ago but it's stuck in PENDING.

I am also interested in THIS...

[The One]

Everything pretty much ends up in this account if you follow the chain

https://blockchain.info/address/1N2f642sbgCMbNtXFajz9XDACDFnFzdXzV

and now he's taking everything out of that one too..

Looks like a serial scammer, possibly the one who brought down MxGox.

[Jam0r]

That's a lot of coins right there.

Following it you see withdrawals to different accounts but he splits them, so 50 coins sent, 49.9999 to the one address and 0.00001 to a different one.

Very cunning tbh

https://blockchain.info/tx/729d325dc1edb750d2bfb838dc61d2fcca315a3c676a7d5a8d399cc4b07bd650

[Kn_os]

Are you sure it is not one of exchange? 45k btc is a real big amount.

[Seedeer]

Damn thief stole my 4 mBTC. Are the XCP withdrawals also frozen?

[jmclarty]

Why not take the amount you was stolen of from all the users?

+1.  Or, if it's easier for you, just the liquid coins.  Not fair that "just" BTC holders hit.  If you happened to have had a position on, you're okay? That's not right. Likely 99% of people were "using" BTC as a conduit to get into and out of the exchange. So, those people need to pony up.

Also, don't raise fees Busconi.  Pay us back slower if you have to.

IDEA: TAKE 12.6% from all withdrawals until funds are recovered.  Revenue will be higher, cause people will be trading with larger BTC sums. And, people will leave funds with you, and likely trade more.  You also eliminate the risk of a run on the exchange completely.

Whatever, I support Busconi, and I'll trust the exchange more now.

[Spiff637]

Great way of handling it..  My question is what is being done to find and stop these people from knocking over the next exchange?

[HeadsOrTails]

So can we see proof of the remaining BTC 517.75
(if 12.8% ~= BTC 77, 87.2% = 517.75)

That'd go a long way in this MtGox BTC hacking clusterfuck of a trading environment.

[mr7950]

So sad to hear this has happened I have had a great time trading on your exchange so far and don't think raising trade fees is a good idea either. 
Hopefully you will learn from this and the exchange will be better of in the long run. 

[discobean]

my few c

1. select for update to lock selects, then update the btc value, in a transaction.
2. trigger on db owned by privileged user on update for the btc value field, that throws an error to rollback transaction if negative.
3. audit sum() of values vs expected nett btc balance, which I'd expect was done already
4. triggers that log changes of btc values into log fields, sql injection can be logged

There are many others like hashing and triggers to validate data, and to ensure sql injection if happens can be discovered easily.