[ANN][QB] Malicious Quarkbar altcoins tracked down and eliminated

[Jonesd]

Official statement here

Malicious Quarkbar altcoins tracked down and eliminated

Scam prevented and scammer assets frozen


On May 20, The Cryptocoin Revival Foundation (CRF) detected a large amount of scam coins in the blockchain of Quarkbar created by the original developer. Luckily, these coins were held in a small amount of wallets and only 2.3% reached exchanges. Within two days of discovery, CRF created a fork that disabled the malicious wallets. This forgery of coins is comparable to the recent scam at Asiacoin and Beecoin, but the Cryptocoin Revival Foundation was able to disable 97,7% of the fake coins. The exchange account of the scammer has been frozen, resulting in a loss of 0.4BTC for the perpetrator. CRF is proud they were able to disable these coins and hurt the scammer in his wallet.

Timeline of events
May20:
- Block explorer was finished and CRF found out total amount of Quarkbar far higher than expected
- CRF found a premine of 15,482,256 Quarkbar in block 1
- CRF was able the transactions and managed to find 97.7% in five separate wallets
May 21:
- CRF changed the code to cut the wallets off from the blockchain from block 262,500
- The addresses were shared with Quarkbar exchanges and could be linked to one account with 7,000 QB and about 0.4 BTC in other coins. The account could not be traced to a person
May 23:
- Block 262,500 got passed so wallets are successfully cut off.

Revival of Quarkbar
On April 18, The Cryptocoin Revival Foundation (CRF) decided to take over the responsibility of Quarkbar. As it happens quite often, the developer was missing so CRF decided to take control and help the community out. CRF patched up the source, released new wallets and took over communications. Some security issues got fixed and the coin started to flourish again.

Scam detected
It took the team at CRF a while to create a block explorer, but on May 20 they finally managed to do so. The total coin amount seemed to be 15.5 million coins higher than expected so they started an investigation. It turned out the original developer scammed the mining and investing community of Quarkbar. A separate batch of coins was created in block 1, equal to the total amount of coins to be mined, with the purpose to sell them off in an elaborate scam. CRF acted quickly to nip it in the bud.
Luckily, the scam did not do much harm, since the coin amount was simply way too high to sell (100% of intended amount of coins). The scammer moved around the coins a lot in an attempt to hide the coins and took his explorer offline. We managed to track down about 97,7% of the coins to five wallets and decided to change the code to simply block those wallets.

Taste of his own medicine
The scammer did manage to send about 300,000 Quarkbar to an exchange. In cooperation with this exchange we managed to track the scammer down and freeze his account. This contains coins with a combined value of about 0.4 BTC.
The Cryptocoin Revival Foundation team also decided to give the perpetrator a taste of his own medicine by adding a message to his new wallet. We put a scam into his scam to scam him out of his fake coins!


 

SCAM FREE!
In this graph you can follow the money trail and see which wallets we could block. This can also be seen when you use our abe explorer and follow the transactions that start with the creation of the scam coins in block 1. In the abe explorer we have subtracted the blocked wallets from the total amount of coins to give a clear representation of the coins in circulation.
The Cryptocoin Revival Foundation is happy about stopping this scammer and froze his assets making his coins useless. Quarkbar is now stronger than ever and officially SCAMFREE!

Information about source code change
We made and addition to the file “base58.h” in which we added the code to exclude the malicious addresses. These addresses are described from line 393 as “LUCKY_WINNERS”. His price? A wallet full of useless Quarkbar!

Code fragment:

Code:

static const CBitcoinAddress LUCKY_WINNERS[5] = {
 CBitcoinAddress("QUwKPLAGxAYQtkTeD5opwD2Q4fvLWwXesb"), //14M
 CBitcoinAddress("QN4cdcaVJtbk6SuLQbDY1u4G2ZGyxEfbcg"), //800k
 CBitcoinAddress("QWjTNd1d47zNi6VdkTGx4ZQYtBodJfHiiQ"), //50k
 CBitcoinAddress("QeDoawWtLN32hJC6jpHs1k3RDiDU3kv2Zw"), //11.8k
 CBitcoinAddress("QaRKRXjiRWVDjQCNNWtQYCMrkSH4sJxfCH")  //999
};

About Quarkbar
Quarkbar is a super secure quark-based altcoin (CPU/GPU mining) that is fast, very rare and with no premine, very fair! It was taken over by the community! More information can be found on www.quarkbar.net.

About Cryptocoin Revival Foundation
The Cryptocoin Revival Foundation is an initiative that started on Bitcointalk. A group of users was dissatisfied about altcoin developers disappearing and decided to work together to provide stability and technical help to altcoins that show great promise, but have been deserted by their developers. This way, the mining was not wasted, people will not have worthless coins and altcoins in general will become more reliable. The foundation has no profit motivation and relies on donations from members.

Contact
cryptocoinrevival@gmail.com  - www.cryptocoinrevival.com - https://bitcointalk.org/index.php?topic=576714.0
END
###

[1715108755]

1715108755

[1715108755]

1715108755

[derrend]

YOU BOYS ARE F*****G LEGENDS, NO OTHER WORD FOR IT, LEGENDS, CRYPTO HEROES IN FACT, CONGRATULATIONS LADS YOU NEVER FAIL TO SURPRISE  EPIC.

[Jonesd]

scary stuff

[platorin]

Thank you for the news!

[Jonesd]

Thank you for the news!

IT is now updated

[wxh]

we should more information about the coin, please update it in time..

thanks so much//.

[Jonesd]

Forexminute wrote an article about our coin: http://www.forexminute.com/cryptocurrency-news/breaking-news-crf-eliminates-scam-quarkbar-coins-32833

[derrend]

This is a great achievement fellas, congrts again. Your credibility will go through the roof from this and any coin you announce adoption will spike in value.

[Jonesd]

This is a great achievement fellas, congrts again. Your credibility will go through the roof from this and any coin you announce adoption will spike in value.

Thanks

[CunzhangInCHN]

what's in the logo? a person?

[SaintFrantic]

So how many coins exist at this point?

[Jonesd]

what's in the logo? a person?

It's abstract YOu can vote for a new logo here: https://bitcointalk.org/index.php?topic=611221.msg6761101#msg6761101

So how many coins exist at this point?

Good question

Effectively this raises the total amount of coins with 369,201 Quarkbar.

As an overview:
Forged Quarkbar:  15,482,256
Quarkbar Eliminated: 15,113,055 (97.7%%)
Forged Quarkbar in circulation: 369,201 (2.3%)
Mined quarkbar: 10,572,597
Total Quarkbar at the moment: 10,941,798
Total Quarkbar to be mined: 15,852,081

[tom14cat14]

Great jobs guys.

[Jonesd]

Great jobs guys.

Thanks man! We had to pass block 262,500 without him finding out, so we had to do it covertly

[tom14cat14]

Great jobs guys.

Thanks man! We had to pass block 262,500 without him finding out, so we had to do it covertly

I figured you guys where doing something like this. Just didnt think it was this massive.

[Jonesd]

Great jobs guys.

Thanks man! We had to pass block 262,500 without him finding out, so we had to do it covertly

I figured you guys where doing something like this. Just didnt think it was this massive.

We were horrified when we found out, but once we saw we could contain it we immediately took action.

[shursight]

 :)Omg! Great job guys! This is a great day for quarkbar and CRF! both are stonger than ever now. 

[Jonesd]

:)Omg! Great job guys! This is a great day for quarkbar and CRF! both are stonger than ever now. 

Thanks:-)

[zro]

Great news!!
CRF is really here for you guys

[Jonesd]

Great news!!
CRF is really here for you guys

:-)

[derrend]

rogue dev must be gutted he woke up 120btc poorer this morning

[Jonesd]

rogue dev must be gutted he woke up 120btc poorer this morning

opening his wallet to this picture:

[derrend]

here is the url link to block 1 for anybody who may be interested
http://explorer.cryptocoinrevival.com/b/5UZeBvVRE

[derrend]

opening his wallet to this picture:

Shame we couldn't find his ID, an IP address or anything would have been good. This guy is prob responsible for the Asia coin fraud plus who knows how many others , Imagine if quarkbar had the rogue dev arrested, now that would also be news worthy

[BitcoinNational]

YOU BOYS ARE F*****G LEGENDS, NO OTHER WORD FOR IT, LEGENDS, CRYPTO HEROES IN FACT, CONGRATULATIONS LADS YOU NEVER FAIL TO SURPRISE  EPIC.

  agree

[YarkoL]

Epic stuff!

I'd like to know more about how the scam was accomplished.
From what I understand the batch of coins were not granted as block
reward, so then they were in transaction output?

It worries me how many other altcoins have similar scam
in them.

[Jonesd]

Epic stuff!

I'd like to know more about how the scam was accomplished.
From what I understand the batch of coins were not granted as block
reward, so then they were in transaction output?

It worries me how many other altcoins have similar scam
in them. It looks like all coins should be passed thru an independently
built block explorer check to find out..

We noticed a premine when we finally finished the explorer. Seems to be connected to beecoin and shacoin at the least.

[Jonesd]

ANNOUNCEMENT

We have another announcement this Monday that is very positive.  :-)

[YarkoL]

We noticed a premine when we finally finished the explorer. Seems to be connected to beecoin and shacoin at the least.

They shared a snippet of suspicious code in the form of seemingly innocent but
unncecessary function. Shacoin used that function in concealing the true
money supply when requested thru RPC, but QuarkBar did not as far as I could see.

But since the premine was found via block explorer and not in source code, it
would be interesting to know how could it have been concealed so that it passed the standard
checking procedures in the client.

[micryon]

fyi i posted about the analysis of the code a few weeks ago.. you can look for the signature in other coins just doing a github search.. unfortunately the thread got lost in the sea of other stuff: https://bitcointalk.org/index.php?topic=595056.0

[Jonesd]

We noticed a premine when we finally finished the explorer. Seems to be connected to beecoin and shacoin at the least.

They shared a snippet of suspicious code in the form of seemingly innocent but
unncecessary function. Shacoin used that function in concealing the true
money supply when requested thru RPC, but QuarkBar did not as far as I could see.

But since the premine was found via block explorer and not in source code, it
would be interesting to know how could it have been concealed so that it passed the standard
checking procedures in the client.

We already got rid of the code, but we had no way to see the true coin count, because there was no explorer. Once we had it, we could see there were way too many coins. The current coin count of 10.9 million represents the total amount - frozen wallets.

[sylwt]

what???

[Jonesd]

what???

what what?

[YarkoL]

If the 15,482,256 Quarkbar were in block 1, I have hard
time understanding how could that block could be included
in the chain, since in the code the block reward is defined as 256 coins.

Consequently blocks that have different rewards
would have been rejected (by wallets and clients
built from the code at Github).

Maybe the hidden premine could be in the
genesis block (block 0) and then one could fork the
source but hardcode the block in the new version as well.

[dukektm]

Great news!!!!

[Jonesd]

Update

Frozen scammer assets handed over to Quarkbar, Beecoin and Shacoin communities

When the Quarkbar developers managed to track down the malicious premine coins, they were also able to track the coins back to a trading account of Allcoin.com. Together with this exchange it was decided to freeze this account. Allcoin noticed the account was also used for selling Shacoin and Beecoin, so there is reason to believe the scam is also related to those coins.

Allcoin decided to hand over the frozen coins to the three communities. Each community will receive about 0.15 BTC that they can use to strengthen themselves.

The Cryptocoin Revival Foundation and Allcoin are very proud of getting the funds away from the scammer and give it backto where it belongs, the community.

The official statement can be found here.

[Stinky_Pete]

Awesome stuff! Thank you from a SHACoin miner.

[Jonesd]

Awesome stuff! Thank you from a SHACoin miner.

You're welcome

[shursight]

Very good for all three communities. 

[popolite11]

good work , these coin are now no good.

[hanzuohan]

rogue dev must be gutted he woke up 120btc poorer this morning

Did we got exchange?

[tom14cat14]

rogue dev must be gutted he woke up 120btc poorer this morning

Did we got exchange?

Go to the main quarkbar thread there are a few exchanges.  https://bitcointalk.org/index.php?topic=587457.560

[Hippie Tech]

Just a heads up..

The link to your website seen on your tweeter is showing up like this..

h t t p : / / t.co/ngaIDgL9B3

https://www.virustotal.com/en/url/3be48f0a299163a66696b4f11cc4f6dc41c88a010dd89733386158a147a96eda/analysis/1401121428/

[Jonesd]

Just a heads up..

The link to your website seen on your tweeter is showing up like this..

h t t p : / / t.co/ngaIDgL9B3

https://www.virustotal.com/en/url/3be48f0a299163a66696b4f11cc4f6dc41c88a010dd89733386158a147a96eda/analysis/1401121428/

It was shortened by hootsuite, so should be fine. The site is legit.

https://www.virustotal.com/en/url/b823bc382cb9ebaca5c597ad4e081d70448820b4cc2329da753fa3a11f1d803b/analysis/1401123470/

[djslick]

amazing work guys

[Jonesd]

amazing work guys

Thanks:-)

[Biomech]

SHA bagholder here. I applaud your efforts!

What I'm wondering is how you're handling the distribution. Where are the coins now, and where are they going? If they are going to a development fund, or being intentionally destroyed, I would back that. Otherwise, I'm not sure of a way to fairly distribute them.. maybe everyone who traded SHA (or the affected coins in general) on the exchange gets a piece? Even though that would probably get me some coins, I'm not sure it's all that great of an idea.

Frankly, I think the best idea would be to burn them. Make the coins that much more valuable.

[tom14cat14]

SHA bagholder here. I applaud your efforts!

What I'm wondering is how you're handling the distribution. Where are the coins now, and where are they going? If they are going to a development fund, or being intentionally destroyed, I would back that. Otherwise, I'm not sure of a way to fairly distribute them.. maybe everyone who traded SHA (or the affected coins in general) on the exchange gets a piece? Even though that would probably get me some coins, I'm not sure it's all that great of an idea.

Frankly, I think the best idea would be to burn them. Make the coins that much more valuable.

They were cut out of the block chain from my understanding. They posted it somewhere they have blocked around 97% of those coins from ever being apart of QB now.

[Jonesd]

SHA bagholder here. I applaud your efforts!

What I'm wondering is how you're handling the distribution. Where are the coins now, and where are they going? If they are going to a development fund, or being intentionally destroyed, I would back that. Otherwise, I'm not sure of a way to fairly distribute them.. maybe everyone who traded SHA (or the affected coins in general) on the exchange gets a piece? Even though that would probably get me some coins, I'm not sure it's all that great of an idea.

Frankly, I think the best idea would be to burn them. Make the coins that much more valuable.

They were cut out of the block chain from my understanding. They posted it somewhere they have blocked around 97% of those coins from ever being apart of QB now.

We only had access to quarkbar source so could prevent those coins from entering circulation. Is there a representative of the shacoin comnunity?

[derrend]

Frankly, I think the best idea would be to burn them. Make the coins that much more valuable.

I agree with the cowboy, destroy them and make the remaining coins rarer. They never should have existed in the first place.

[Biomech]

SHA bagholder here. I applaud your efforts!

What I'm wondering is how you're handling the distribution. Where are the coins now, and where are they going? If they are going to a development fund, or being intentionally destroyed, I would back that. Otherwise, I'm not sure of a way to fairly distribute them.. maybe everyone who traded SHA (or the affected coins in general) on the exchange gets a piece? Even though that would probably get me some coins, I'm not sure it's all that great of an idea.

Frankly, I think the best idea would be to burn them. Make the coins that much more valuable.

They were cut out of the block chain from my understanding. They posted it somewhere they have blocked around 97% of those coins from ever being apart of QB now.

We only had access to quarkbar source so could prevent those coins from entering circulation. Is there a representative of the shacoin comnunity?

Well, I mined a hell of a lot, sold some, bought some, and lived through the whole debacle. I'm on good terms with the final dev, CryptoGir. I got no official standing, don't know that anyone does at this point, but if you tell me what you need, I can get it to the right ears.


EDIT: frank123m seems to be the most active or at least the most visible in trying to fix things.

[frank123m]

We only had access to quarkbar source so could prevent those coins from entering circulation. Is there a representative of the shacoin comnunity?

hello, here is the SHACoin source:

original version(2014.03.29):
https://github.com/SHACoinProject/SHACoin

CryptoGir version(2014.04.24):
https://mega.co.nz/#!wUhCXSDT!TPBn2NF6uUDz2ebGM70eDnnYGqdUl0cQpuCd2cXKP1E