BTC Stolen from Poloniex

[noobinscrypt]

Noticed after logging in I lost .1 btcs in the theft, and .006x has been paid back already... love the way this exchange delt with the problem. Thanks OP!

[1715651679]

1715651679

[flipNstack]

loss/theft was due to the exchanges incompetence,  this is not the customers fault.  If the theft was only 50k and this guy running an exchange cant pay 50k back, then he is a liar and has no business running this company.

I mean when the exchange is doing good,  he is not sharing those profits with his customers.  By the same token if his exchange is having problems then he shouldn't make the customers pay for it in any way.  

People should show a little more anger, instead of thanking the guy for his incompetence

When you have a bit of experience in this business, you might show a little humility.

You are a whingeing negative force.. that is more annoying IMO. Better to pull together and trust people's motives until really proven otherwise.

and you Nancy are a Fairy boy living in a Fairy world...

[flipNstack]

Its been confirmed that the vulnerability in their system existed a result of incompetence on their part...
this exchange allowed you to send money in when they know they are being robbed or were just robbed...  How can you allow money to come in if you are not sure that money wont be stolen as well, this indicates maliciousness on their part.  They allow it because they know you would much sooner bow down then state the obvious and maybe show some anger. 

[Biomech]

loss/theft was due to the exchanges incompetence,  this is not the customers fault.  If the theft was only 50k and this guy running an exchange cant pay 50k back, then he is a liar and has no business running this company.

I mean when the exchange is doing good,  he is not sharing those profits with his customers.  By the same token if his exchange is having problems then he shouldn't make the customers pay for it in any way.  

People should show a little more anger, instead of thanking the guy for his incompetence

When you have a bit of experience in this business, you might show a little humility.

You are a whingeing negative force.. that is more annoying IMO. Better to pull together and trust people's motives until really proven otherwise.

and you Nancy are a Fairy boy living in a Fairy world...

...and this solves what?

When D&T lambasts Tristan, it's with respect and detail. Not to start a fight amongst other users.

I'm somewhat neutral here. I see the point of the PROGRAMMERS who say that Tristan should shut it down pending a rewrite and audit. I see the point of the customers who want it to stay up. And I see the point of Tristan trying to keep his business afloat after a major fuckup. It seems that the majority of his customers are ok with how he's handling it, despite the flaws, because he's been up front and honest about it.

That goes a long way in my book, too. But I must defer to the programmers and experts as well, because I am not one and do want a secure exchange. But yelling at each other isn't going to change or help anything, nor does it add to the conversation.

I think he should compromise. Give everyone a couple of days to withdraw, after suspending trading and deposits, and recode the thing. Then issue shares to help defray the costs of the rewrite, pay back everyone who was harmed in the hack and his solution, and reopen with a new and more secure platform. That way everybody wins in the medium to long term. Oh, and mount an external audit or two, just to be sure. He seems to have the good will of the community, so I do not think the above would harm his long term business prospects. On the contrary, it just might secure them.

[Majormax]

I'm somewhat neutral here. I see the point of the PROGRAMMERS who say that Tristan should shut it down pending a rewrite and audit. I see the point of the customers who want it to stay up. And I see the point of Tristan trying to keep his business afloat after a major fuckup. It seems that the majority of his customers are ok with how he's handling it, despite the flaws, because he's been up front and honest about it.

That goes a long way in my book, too. But I must defer to the programmers and experts as well, because I am not one and do want a secure exchange. But yelling at each other isn't going to change or help anything, nor does it add to the conversation.

I think he should compromise. Give everyone a couple of days to withdraw, after suspending trading and deposits, and recode the thing. Then issue shares to help defray the costs of the rewrite, pay back everyone who was harmed in the hack and his solution, and reopen with a new and more secure platform. That way everybody wins in the medium to long term. Oh, and mount an external audit or two, just to be sure. He seems to have the good will of the community, so I do not think the above would harm his long term business prospects. On the contrary, it just might secure them.

+1
Simple and obvious really. Majority of users are OK with that, it seems.

[JakeThePanda]

So many people in this topic dying to resume sending coins here despite the shockingly poor level of understanding displayed by the operator.

I wonder if these same people will be crying, "don't be mean, how were we meant to know Poloniex was bad, it was mostly okay for ages!" at some point in the near future.

Anyone planning to use this service needs to list off the unique selling features—things that no other exchange can offer today—and weigh those up against the incredibly high risk of placing your funds in the care of someone that demonstrably does not know what they are doing.

I personally cannot imagine what it is that Poloniex offers that could make it worth the risk but I'll assume all those clamouring to throw their money at it do and have done their own risk assessment.

Because there will be no saying that they weren't warned, later on.

I sent BTC yesterday and my balance didn't get reduced by 12%.  I use Poloniex because it's the only exchange that trades NRS.  I buy NRS and immediately withdraw to my wallet.  That's it.

[schiavonxv]

I sent 102000USDe to Poloniex, but so fat not confirmed.

TXid: http://cryptexplorer.com/tx/e9eaf49c605e7dfbec8ec65c1d1ea63146e2e2f10a6121fc90671124ee84a18d#o1

[allcrypt]

A little late to the party but I wanted to post something. When this happened, although poloniex.com is a direct competitor and I've never spoken to him, I gained a massive amount of respect for the owner for:
A) Owning up to what happened and more importantly:
B) Doing something I have NEVER seen an exchange do - actually give pertinent details as to what happened. We got hacked, and this is exactly how it happened. And how you can #LFMF

Immediately after reading that I went into our code to make sure the same thing couldn't happen to us. For that, busoni, you are the man.

Monday morning - we lost some BTC. And had a huge revelation, that had poloniex.com done what we do (and we didn't even know it was added security until I had a panic attack at 6:40am yesterday morning) they wouldn't have lost a single satoshi.

It's a long post, but worth the read. If you just want the technical details and none of the entertainment value, scroll down to about the bottom third.

http://www.allcrypt.com/blog/2014/03/small-bug-leads-to-lost-btc-and-a-huge-revelation-why-arent-all-exchanges-doing-this/

[DeathAndTaxes]

Small bug leads to lost BTC, and a huge revelation. Why aren’t all exchanges doing this?

Because bitcoind "accounts" system doesn't scale beyond a couple hundred users.  If your system relies on it, well that will be an exciting day when you realize you have a complete recode in front of you.  You will notice performance issues at around a thousand accounts or ten thousand transactions.  RPC calls involving accounts will start to takes hundreds and then thousands of milliseconds. 

[Billyboy402]

sorry . but your business was hack , so it should be Ur business that take the lost . Image if paypal lost money from a bad employee. We wouldn't stand for our account to be lock or our balance to be touch. Surly Poloniex has made 10% in profit.

Poloniex should declare bankrupt of they cant afford the lost , It time for competent people to start running these type of business.


Your happy when your making huge profits with fees , Making us trust you with our money , then cry when you cant manage your affair.

This is getting really old. Do you even read what you write?

Instead of him paying us all back, you think he should declare bankruptcy and pay us nothing?

He obviously hasn't been making huge profits, or he'd have paid back the money already. He hasn't "made" anyone trust him with their money; they all chose to do so of their own accord by using his exchange. Also, he hasn't "cried" about it in the slightest; you're the one apparently "crying".

lol  not crying , i dont even have account with them . They should go bankrupt - I will make the next exchange better and stronger

[Billyboy402]

loss/theft was due to the exchanges incompetence,  this is not the customers fault.  If the theft was only 50k and this guy running an exchange cant pay 50k back, then he is a liar and has no business running this company.

I mean when the exchange is doing good,  he is not sharing those profits with his customers.  By the same token if his exchange is having problems then he shouldn't make the customers pay for it in any way.   

People should show a little more anger, instead of thanking the guy for his incompetence

Same View I have ,

[Franky2010]

Poloniex has great customer service. That is all, what I can say. They'll take the trade business seriously.

[allcrypt]

Poloniex has great customer service. That is all, what I can say. They'll take the trade business seriously.

It shows integrity - for the first time since any of these things started happening.

I honestly don't know the details of the repayment - so I cannot comment. *IF* they hiked fees to pay people back thats pretty crappy, but again, I'm only commenting on posts I read that may have been uninformed.

But the fact he owned up, made public the details, and was honest? It shows a hell of a lot more promise than any other snafu thats happened.

[allcrypt]

Small bug leads to lost BTC, and a huge revelation. Why aren’t all exchanges doing this?

Because bitcoind "accounts" system doesn't scale beyond a couple hundred users.  If your system relies on it, well that will be an exciting day when you realize you have a complete recode in front of you.  You will notice performance issues at around a thousand accounts or ten thousand transactions.  RPC calls involving accounts will start to takes hundreds and then thousands of milliseconds.  

We'll see. I just did some testing based on your post. Took baseline transaction time checks for getinfo, listaccounts, and a sendtoaddress. Then added 4000 accounts. Sent a small transaction to about half of them. Ran the time checks on those 3 functions again. Getinfo was the same, listaccounts obviously took a little longer (24ms), and sendtoaddress was actually faster by about 100 miliseconds.

Memory usage didn't change.

Obviously it's not a real world test case, but I dont believe the RPC server will crap out anytime soon. But we'll know to watch for it. Thanks for the info.

I did wind up with a 23gig db.log file though

[Ckyman]

I love the ownership and your ability to let your users know on the open forums whats going on ASAP. Sucks that much was taken though :/

[DannyTom]

Eventually someone will start a BTC insurance policy to cover losses upto 80 BTC for 0.005 BTC a month.

At least Polniex is open, honest, and working out a way to pay back users harmed by the theft.

[smoothie]

MTGOX GETS HACKED in 2011

MTGOX RECOVERS AND RUNS OK UNTIL MID 2013

MTGOX SHUTS DOWN DUE TO ANOTHER HACK/THEFT 2014 (FEB)




POLONIEX GETS HACKED in 2014

POLONIEX RECOVERS AND RUNS OKAY UNTIL 20XX

POLONIEX SHUTS DOWN DUE TO ANOTHER HACK/THEFT in 20XX.


See a pattern? BEWARE

[stereotype]

MTGOX GETS HACKED in 2011

MTGOX RECOVERS AND RUNS OK UNTIL MID 2013

MTGOX SHUTS DOWN DUE TO ANOTHER HACK/THEFT 2014 (FEB)




POLONIEX GETS HACKED in 2014

POLONIEX RECOVERS AND RUNS OKAY UNTIL 20XX

POLONIEX SHUTS DOWN DUE TO ANOTHER HACK/THEFT in 20XX.


See a pattern? BEWARE

You seem to be putting alot of effort in here Smoothie. Whats the agenda?

[bbeagle]

You seem to be putting alot of effort in here Smoothie. Whats the agenda?

Someone who states the facts, and predicts what is more likely to happen in the future.
Someone who ignores everything that happened in the past, and dreams of rainbows and fairies in the future.

Who is more likely to have an agenda?

[Majormax]

You seem to be putting alot of effort in here Smoothie. Whats the agenda?

Someone who states the facts, and predicts what is more likely to happen in the future.
Someone who ignores everything that happened in the past, and dreams of rainbows and fairies in the future.

Who is more likely to have an agenda?

The opposite may be true.   

The owner of Poloniex is trying to do the right thing. Anyone who can afford it should give him support.