BitMarket.Eu has closed down

[huayra.agera]

Oh well, I'll just have to wait then, it's 0.7 BTC by the way. I mentioned in my e-mail to the other party that either way, I can still push through unless the admin completely cancels my request.

[M4v3R]

@huayra.agera: We have a policy of at least 24 hours before taking any steps toward cancellation. You have to take into account that a person you're trading with can live in a different timezone and, for example, asleep at the moment of trade.

[yossarian]

I also use bitmarket for trading and have made only positive experiences so far. Most of the times, a buyer doesn't reply to the first automated message at all but simply sends you the money. Even with paypal, this sometimes takes a few hours. I guess some people have a real life, too. It is wise just too wait a little bit, I'd say 24 hours for paypal and 72 hours for bank transfer.

After this, I usually write the buyer another message, sending him the payment info again. On rare occasions, the buyer didn't get the intial message sent by bitmarket. If the buyer doesn't reply within 24h, I hand over the matter to bitmarket, which tries to contact the buyer again. If he doesn't answer (within 24 hours, I believe), they'll cancel the transaction manually. In my experiences, this seldomly happens. In fact, out of a couple dozen trades, this only happened once to me so far.

Bottom line: Be a little patient and try to communicate. The hand-picked bitmarket crowd is a very pleasant one, so you shouldn't be too concerned. People are not always in front of the computers, sometimes they eat, sleep, go to school and simply can't react at once. Especially, if you've just been waiting for 5 hours and the amount in question is only 0.7 BTC.

[huayra.agera]

Sorry about looking a bit impatient (I was aware of the 24-policy), it was my initial reaction that with exchanges, things are a little close to instant when it comes to transactions. I just wondered so far why the first one paid instantly and the other didn't. Wherein my offer was bought/sold to 2 parties (shared). Anyways, I'm quite happy that I have an alternative now for trading.

[M4v3R]

Today an incident took place on BitMarket.eu, that deserves a few words of explanation.

It seems that the Mt. Gox hack that yielded in revealing the users' logins, emails and passwords has yet to haunt us. As (nearly) everyone knows, the messages about how important it was to change your password that you used on Mt. Gox were all over the place. Yet, some people didn't manage (or didn't give a damn) to change their passwords on BitMarket.

What we have done to avoid problems:

- we have alerted all users having the same login or email address as on Mt. Gox that they should reset the passwords as soon as possible straight after it was clear that Mt. Gox got hacked
- we have enforced a password change on some users (we should have done this with all of them, it seems now)
- we have made it impossible to change the Bitcoin withdrawal address without e-mail confirmation, so that even in case someone hacked an account they would not be able to steal coins

Here's what most likely happened:

One of our users failed to change his password on BitMarket. That woulnd't be a big problem, but this person apparently had exactly the same password on his email account (otherwise the attacker would not be able to change their withdrawal address).
Thus, an attacker was able to take over his account despite of our efforts to avoid this. On top of that, some of our other users kept the same password as on Mt. Gox - which allowed that same person to log in onto their accounts, perform transactions
with the person to whose email address the attacker had access already, and thus he was able to withdraw the coins. We found out about it this morning and immediately blocked all compromised accounts.

The total amount of Bitcoins that were withdrawn this way is 63.78 BTC onto this address:

1B3CtSJCncLGqRcyMG1AFujUFKjFqnJC39

We are thinking on how should we approach this problem, because it hardly is our fault that someone was negligent enough
to keep his now publicly available password not just on BitMarket, but also his email.

Right now we have ~21 BTC from donations, so that wouldn't even be able to cover the losses.

-------

TL;DR: Few members of our site lost their BTCs because they used same passwords on both Mt. Gox and BitMarket.

[tschaboo]

Well, what you should do: being transparent about incidents, informing the public as soon as possible, help investigating the issue. Looks like you did that.

What you shouldn't do: replace the lost BTC. Especially if you informed all your members right after the Mt. Gox incident to do the obvious: don't use the same passwords everywhere. Probably that loss is a good motivation for the affected people to "invest" into good passwords and that might prevent them to loose much more in the future.

What you absolutely shouldn't do: Give out your donations. They are meant to support you and the site.

[sonba]

I completely agree with tschaboo. If you let yourself hack - that's something which might be discussable. If users are too lazy to change their passwords or to use different passwords on different accounts / mailadresses - that is their problem, not yours.

It might be a good idea to put sth. like that on your website, though, to avoid trouble. (We are not responsible for...) I like the way britcoin did it: "This site is strictly in alpha state. [..] The software is new. Use at your own risk. We will do our best to prevent problems, but mistakes can happen. Only deposit amounts you feel comfortable with in regards to the aforementioned information."

However, I think it is a great sign of integrity that you are considering using your donations to refund. But as said: you paid a hell of work to build up the site and maintain it - you shouldn't spend your donations for this. (Obvisouyl it's your choice in the end - I wouldn't do it, though)

[digimag]

You provide a free service (supported by donations), it is not your fault (even if what you did is certainly perfectible), you're clearly not to blame here.

Users are responsible for keeping their passwords safe.

Thanks for your service and don't get upset because of this small incident.

[M4v3R]

Thank you guys for your kind words, we really appreciate that.

As a side note, I'd like to add that when we learned what happened we have put the site down, so no further account would get compromised, scanned the published user/password list and resetted passwords of every user that was found on this list and on our exchange. So I believe there is no user with the same password as on Mt. Gox on our site now.

[imanikin]

@Bitmarket, would you be open to considering adding Dwolla as an option? It may speed things up and the fee is distributed to both parties (25 cents per transaction on each end, which is often better than any percentage).

+1 Dwolla would be an extremely useful option for those of us trading USD, even though in my experiences Dwolla has a long way to go before it's as fast as Paypal... 

Bitmarket.EU is still the best exchange, imho! Keep up the great work! 

[cjp]

I tried to verify my account some weeks ago, but it never got verified, and I did not even receive an e-mail. E-mails to the support e-mail address were not answered either.

It's fine to me if you don't accept the verification methods suggested by me, but please tell me. At this moment I don't even know whether you received my verification attempts.

If you lack the manpower to process all verification attempts in time, then please give me the option for faster verification by paying you. I'm sure you can get more manpower if you have financial resources  .

Edit: As indicated below, my account is now verified. Thanks!

[Waldschrat]

Bitmarket.EU is still the best exchange, imho! Keep up the great work! 

I agree! Thanks for building the site, thanks for maintaining it, thanks for keeping the public informed about these incidents. *thumbs up*
Just one small question by the way: Any news concerning the rating system?

[M4v3R]

I tried to verify my account some weeks ago, but it never got verified, and I did not even receive an e-mail. E-mails to the support e-mail address were not answered either.

It's fine to me if you don't accept the verification methods suggested by me, but please tell me. At this moment I don't even know whether you received my verification attempts.

If you lack the manpower to process all verification attempts in time, then please give me the option for faster verification by paying you. I'm sure you can get more manpower if you have financial resources  .

"Standard" verifications (eBay, OTC) get handled really quick, but the ones like you have sent take time, because they require one of admins to look at. There is a possibility that we can miss one of these, and that was in your case. Nevertheless you are now verified. Enjoy your stay .

[M4v3R]

Two new payment options added

We now support two new payment processors:
- Dwolla
- Moneybookers

Everyone is encouraged to use these instead of Paypal when possible.

[M4v3R]

https://forum.bitcoin.org/index.php?topic=26231.0 here they talk about a bug in bitmarket
seemingly after adding dwolla patch the matching of orders is fucke* up
orders to sell at 12.5 clear at 9

Investigating this now, will report as I find the cause.

[M4v3R]

Should be fixed now. Thanks everyone who notified us about this. Lesson learned - don't leave home immediately after making some changes on the site... Sorry to everyone affected, we will revert erronous transactions.

EDIT: It took more than expected, please bear with us a few moments more...

[M4v3R]

It's after midnight from where I write, but I'll try my best to explain the whole situation that took place today.

Today in the afternoon we were working to introduce two seemingly simple features - Dwolla and Moneybookers support. With code for that we accidently put some new code for that resulted in change of our sorting algorithm - it was comparing the price values as strings, not as numbers. This resulted in very odd (and wrong) behavior: for example in market section a sell offer for 9 USD would be HIGHER on the list than an offer for 11 USD. Thanks to few loyal users we have spotted this issue quickly, but we wasn't fast enough, because some transactions already were mismatched. So we decided to take the site down and correct everything.

For the record - not all trades were affected by this bug. First of all, it started happening around 2:00 pm UTC and affected trades that matched following criteria:
- had price of 10 or more
- had other offers with 9 or less price and matching other criteria (payment types, country, etc.)

Now the site is reopened, the bug is fixed and we finished scanning through trades and cancelling the mismatched ones. This was done by hand and we could miss something in the process, so if you have an offer that was mismatched and want to cancel it, please write to us at admin@ bitmarket.eu and we will cancel it asap.

We know this all caused confusion to some of our users and even potential loss, and we are very sorry that this happened. We have learned our lessons - never release code when you have to leave or sleep. We hope and are doing everything so this kind of thing will not happen again.

To make us look better in all this I would like to add that we are working on some very cool stuff that will not only not break anything, but will give you far more power in trading on BitMarket.eu. Stay tuned!

[Bitcoinreminder.com]

The confirmed transactions on the funds side doensnt show up correctly - there is no yes, when the transaction was confirmed.

[Miner-TE]

When changing payment types, selecting Dwolla and saving but it won't stick.

[M4v3R]

The confirmed transactions on the funds side doensnt show up correctly - there is no yes, when the transaction was confirmed.

When changing payment types, selecting Dwolla and saving but it won't stick.

We have left a small bug in our language parsing function, fixed this as soon as I woke up .