[Emergency ANN] Bitcoinica site is taken offline for security investigation

[REF]

(...)
Important Disclaimer: I'm not a partner of Bitcoinica LP after the corporate reorganisation. Therefore, I have no financial obligation in this matter as I'm only an employee of Bitcoinica LP responsible for daily operations (no shares, no voting). However, I'll do my best with the team to resolve this problem as quickly as possible and minimize the impact for the community. I appreciate your patience and understanding.

wow did you get out of bitcoinia's ownership position at the perfect time.

[1713625793]

1713625793

[JusticeForYou]

There's a lot of complaining, arguing, and finger pointing going on in this thread and rightfully so. However, I think the first thing we should worry about is %100 reimbursement as fast as possible. Only after that should we worry who's to blame. Many people in this forum, including me, lost a considerable amount of money. Having that money just vanish is terrifying and until we get it all back will we be able to think straight and rationally.

That is the point of Bitcoin. There is no getting it back. If there was, why are people using it over PP, ACH, etc... at a cheaper cost to them.

Even if you physically catch the guy with the wallet.dat(s), unless he tells you his passphrase(s), the coins are gone. And that is assuming it is just one guy with one copy of the wallet.dat(s).

I am sorry for your loss however.

If people are going to be leaving lots of money in others control, you should get some type of assurance from fraud or risk loosing it all.

At least, lets have funds insured up to a certain amount to start.

Isn't it time for the BDIC for businesses wanting to handle lots of coin?

The nice thing about BDIC is that the wallet can remain a 'cold' wallet until funds need to be distributed by direction of ah... 'Community Board of Directors'. Although distribution of funds would take time to distribute considering if one adheres to a good 'Claims' protocol.

There are members already providing their own insurance to funds by setting aside a portion of profits to fund their own self insurance. This is not a bad idea either. I would suggest reputable businesses do this and make the 'cold' address transparent.

[shockD]

There's a lot of complaining, arguing, and finger pointing going on in this thread and rightfully so. However, I think the first thing we should worry about is %100 reimbursement as fast as possible. Only after that should we worry who's to blame. Many people in this forum, including me, lost a considerable amount of money. Having that money just vanish is terrifying and until we get it all back will we be able to think straight and rationally.

You left a considerable amount of money in a service that just recently lost 40K BTC due to running in an insecure environment?

[DiabloD3]

I have repeatedly told people that Bitcoinica is a scam and that Bitcoinica staff should be banned from the forums.

Maybe now people will actually listen.

Bitcoinica is a regulated entity, verifiable by government records. We are one of the most legitimate businesses in Bitcoin community, by any standard.

What is it with all the anonymous/pseudonymous guys on this forum repeatedly attacking every NAMED (and easily verified) individual and company and labelling every project run by those most legitimate operators as a scam?

Insane! Grow a brain or something.

I'm sorry, what? I am not anonymous. I am a forum moderator, an early adopter, and author of the DiabloMiner software. If Bitcoinica was so legitimate, why did they get "hacked"? The facts simply do not seem to add up.

[FairUser]

Another thing I was just thinking since Mt.Gox blacklists "tainted funds"  - they should go ahead and entertain the person to send their coins "to cash" out but never cash them out thus retrieving the coins again ?

What a lot of people don't stop and think about is that when Gox receives stolen coins, then "freezes" them, Gox is still keeping the coins!!  So now Gox has become the thief of the thieves.

Has Gox every stated what they do with stolen coins other than just keeping them?  If not, then Gox is just as bad as the hackers who stole them in the first place.

[muyuu]

(...)
Important Disclaimer: I'm not a partner of Bitcoinica LP after the corporate reorganisation. Therefore, I have no financial obligation in this matter as I'm only an employee of Bitcoinica LP responsible for daily operations (no shares, no voting). However, I'll do my best with the team to resolve this problem as quickly as possible and minimize the impact for the community. I appreciate your patience and understanding.

wow did you get out of bitcoinia's ownership position at the perfect time.

Betcha he didn't sell it for cheap either.

But I don't think he's responsible of the second fiasco, save for the stubborn, braindead decision to keep sensible data in "the cloud" or anywhere outside of his exclusive control. Because the fatal vector here was "multiple emails with access to admin pass"+VPS hosting structure.

[bulanula]

Another thing I was just thinking since Mt.Gox blacklists "tainted funds"  - they should go ahead and entertain the person to send their coins "to cash" out but never cash them out thus retrieving the coins again ?

What a lot of people don't stop and think about is that when Gox receives stolen coins, then "freezes" them, Gox is still keeping the coins!!  So now Gox has become the thief of the thieves.

Has Gox every stated what they do with stolen coins other than just keeping them?  If not, then Gox is just as bad as the hackers who stole them in the first place.

Better keep the bounty of other hackers than pretend they got "pseudo-hacked" themselves, I would think.

If you read above it says they destroy the coins to /dev/null or something.

[FairUser]

Thanks I respect yours also.  No, I'm just saying for big thefts like the one's that have been happening I think there would be a big consensus in favor of disabling $87,000 worth of bitcoin.  Yes, I don't know all the logistics of how it would play out but I'm pretty sure we are all smart enough to figure it out.

Ok say I buy 20,000 BTC worth of Gold from you.  I pay you, you get the 6 confirms.  I walk away with my ~$100K in gold.  Then I report the coins stolen.  Oops you lose 20K BTC.  Even better I cal you up and threaten to report them stolen.  If you give me back 5K BTC I won't report them stolen. You lose 5K or you lose 20K.  Your choice.

Worse say I did steal 20K BTC.  I then buy some gold form you.  Nobody has reported them stolen ... yet.  I pay you, you get the 6 confirms.  I walk away with $100K in gold and then the original legit owner of the coins reports them stolen.  I stole the coins and lost nothing.  The owner is still out 20K coins and you are out $100K in gold.

Awesome system you got there.  Also there is no central agency in Bitcoin.  Who decides if a coin is disabled or not?  Someone with 51% of hashing power.  Awesome you just gave the govt an auto kill switch.  Gain 51% control of Bitcoin (even temporarily) and disable all 21M coins.  Game Over.

+1

[FairUser]

Better keep the bounty of other hackers than pretend they got "pseudo-hacked" themselves, I would think.

If you read above it says they destroy the coins to /dev/null or something.

Gox doesn't destroy them.

Why in the hell would you EVER want to permanently destroy coins?  It surely doesn't make the value rise any, so what would the point be? If we only have 21 Million coins that will ever be created, making that number smaller doesn't help.

[shockD]

Better keep the bounty of other hackers than pretend they got "pseudo-hacked" themselves, I would think.

If you read above it says they destroy the coins to /dev/null or something.

Gox doesn't destroy them.

Why in the hell would you EVER want to permanently destroy coins?  It surely doesn't make the value rise any, so what would the point be? If we only have 21 Million coins that will ever be created, making that number smaller doesn't help.

Coins are divisible...

[Raoul Duke]

If you read above it says they destroy the coins to /dev/null or something.

Sure they do, sure they do...

[JusticeForYou]

Better keep the bounty of other hackers than pretend they got "pseudo-hacked" themselves, I would think.

If you read above it says they destroy the coins to /dev/null or something.

Gox doesn't destroy them.

Why in the hell would you EVER want to permanently destroy coins?  It surely doesn't make the value rise any, so what would the point be? If we only have 21 Million coins that will ever be created, making that number smaller doesn't help.

Coins are divisible...

100 BTC
21 Milllion BTC

If you lose 10% per year, which one lasts longer?

Coins are divisible, but are you suggesting they are divisible below a Satoshi?

If so, then there is a problem. Even the FED can't print money into ∞.

[EhVedadoOAnonimato]

I'm not going to participate in your delusion. The owner(s) is(are) the company and the company is(are) the owner(s) even if they change through time. You can't transfer your liability to a legal fiction and be taken seriously, what we have today is only possible because a monopoly on violence says so.

I'm still going through all the posts on this thread but I wanted to comment on this "company liability" thing. I'm also against every monopoly, as you hazek, but I don't agree with all you've said about this subject.

Some points:

• You may do a contract with an "organization", "entity" or "legal fiction" if you prefer, and that's different from making a contract to actual people. If you owe me and you die, the debt dies with you. If your company owes me and you die, those who inherit the company inherit its remaining contracts/debts etc.
• You don't really need to know who owns a company to have a contract with it. Only the enforcer of the said contract would probably need to know. But not even that is an absolute "must".
• I would expect a liberty-oriented person like you to value privacy a little more. There are pretty good reasons for the owners of a company not want to disclose their identity. You know, it's not very wise to go screaming to all winds that you own this and that and that... Privacy is a security matter to some.

[eleuthria]

100 BTC
21 Milllion BTC

If you lose 10% per year, which one lasts longer?

Coins are divisible, but are you suggesting they are divisible below a Satoshi?

If so, then there is a problem. Even the FED can't print money into ∞.

Actually, there is no problem if bitcoin was modified (I don't believe its currently possible) to extend the decimals out another digit.  It wouldn't be the same as printing money, because that simply increases the aggregate supply of money, but only goes into the hands of a few.  If Bitcoin were to extend the decimal out further, it would mean nobody's supply in comparison to the total supply has changed.  It simply gives the ability to have higher precision pricing, like if the US were to re-introduce half-pennies.

[bulanula]

Can we at least have some IPs or country of attacker so we can begin the witch hunting

Was it that guy "meelba" who paid some Russian hackers because he was crayzy ? Maybe ...

[Phinnaeus Gage]

How you reached the conclusion that address is a vanity address? Seems pretty random to me with the exception of the EML part

Not sure if serious...

So, you think that's a vanity address also? Explain why, please...

Also, is the following address also a vanity address? 1AKNNX3uptocrisMbW7amrLYAbF3TggYdN
Or this one with no numbers whatsoever besides the intial 1: 1AhAzstfNZGwmNKVNbHJoKPWJYEUgodoBk

Granted, your argument is sound, psy, but if the entire chain was hashed after inputting the 1EML part (via VanityGen, e.g.), then it's a vanity address, albeit it may still be a fluke.

Now to catch up on the next 20+ new posts since steppin' in the office.

~Bruno~

[cypherdoc]

I assume you meant to quote me. Well, start 'disabling' coins if you can. BTC is a fiat currency. Its sole value is what people believe they are worth. If they can be 'disabled', they are pretty worthless. Imagine going to a store and handing a dollar to a clerk who tells you: "Sorry your dollar has been disabled." Do you have another? Oh, that one is disabled too.

But meh... go ahead and disable them. Oh, damn wait, I can't short at Bitcoinica.

yes, it was for you.  I believe more people would be willing to get into if you were to tell them that hackers and thiefs don't bother with bitcoin because if you "steal" them they become worthless . This mindset has value and I would be more willing to put more money into bitcoins knowing that its worthless for a hackers to even bother with bitcoin ? just my 2 cents.

Ok, I'll respect your position. Although I completely disagree with it.

So you would put more money into BTC if 'Someone?' could disable them if they are 'stolen'.

Who determines if they are to be disabled? What are the standards to determine if they are stolen?

It would become one big cluster @#*$ really soon with false claims of coins being stolen. And then people not trusting the people that can 'disable' the coins.

I understand your fear. Fear the fear tho...

Thanks I respect yours also.  No, I'm just saying for big thefts like the one's that have been happening I think there would be a big consensus in favor of disabling $87,000 worth of bitcoin.  Yes, I don't know all the logistics of how it would play out but I'm pretty sure we are all smart enough to figure it out.

edit: keep in mind if we had this mindset early on we wouldn't even be talking about $87,000 worth of bitcoin being stolen they most likely would be where they were before being stolen if we made it clear bitcoins couldn't be stolen and sold for their value to the would-be-thief. Also, the way it now its a big #@#@ .  I'd rather have the would-be-thief get burned then to enjoy his or her bitcoins.

But then where would be the incentive for bitcoinica to beef up security if they knew they'd be bailed out?

[hazek]

I'm not going to participate in your delusion. The owner(s) is(are) the company and the company is(are) the owner(s) even if they change through time. You can't transfer your liability to a legal fiction and be taken seriously, what we have today is only possible because a monopoly on violence says so.

I'm still going through all the posts on this thread but I wanted to comment on this "company liability" thing. I'm also against every monopoly, as you hazek, but I don't agree with all you've said about this subject.

Some points:

• You may do a contract with an "organization", "entity" or "legal fiction" if you prefer, and that's different from making a contract to actual people. If you owe me and you die, the debt dies with you. If your company owes me and you die, those who inherit the company inherit its remaining contracts/debts etc.
• You don't really need to know who owns a company to have a contract with it. Only the enforcer of the said contract would probably need to know. But not even that is an absolute "must".
• I would expect a liberty-oriented person like you to value privacy a little more. There are pretty good reasons for the owners of a company not want to disclose their identity. You know, it's not very wise to go screaming to all winds that you own this and that and that... Privacy is a security matter to some.

Great points, you gave me something to think about.

[Phinnaeus Gage]

(...)
Important Disclaimer: I'm not a partner of Bitcoinica LP after the corporate reorganisation. Therefore, I have no financial obligation in this matter as I'm only an employee of Bitcoinica LP responsible for daily operations (no shares, no voting). However, I'll do my best with the team to resolve this problem as quickly as possible and minimize the impact for the community. I appreciate your patience and understanding.

wow did you get out of bitcoinia's ownership position at the perfect time.

I'm only an employee at Acme Coins (acmecoins.com) and when I woke this morning and logged on, I noticed some strange transactions. Since everybody else was still sleeping, I called Rackspace and had the website shut down. Then I went to AcmeCoinTalk, the forum for said company, and posted what I did. I have yet to post on my official blog or put up a page on the official website because...

[JusticeForYou]

100 BTC
21 Milllion BTC

If you lose 10% per year, which one lasts longer?

Coins are divisible, but are you suggesting they are divisible below a Satoshi?

If so, then there is a problem. Even the FED can't print money into ∞.

Actually, there is no problem if bitcoin was modified (I don't believe its currently possible) to extend the decimals out another digit.  It wouldn't be the same as printing money, because that simply increases the aggregate supply of money, but only goes into the hands of a few.  If Bitcoin were to extend the decimal out further, it would mean nobody's supply in comparison to the total supply has changed.  It simply gives the ability to have higher precision pricing, like if the US were to re-introduce half-pennies.

Yes, it would be exactly like if the US were to re-introduce half-pennies. Trillions of them. Without taking money out of the supply, introducing money into it, is quantitative easing.

Edit: I know technically they are not new coins however. Just the ability to divide ones that already exist. The ideal is to maintain the precise amount of coins, i.e. 21 Million.  Buy allowing ∞ division, it is possible to tweak the value.

For argument sake:

A person holding 1 Satoshi after the split would be holding 10 Satoshis. So if 1 Satoshi was equal to $1 before the split, what is it after the split? Still $1 is what most will say because the base unit was moved lower. I however look at it like a stock split. Assuming all things equal, the former will be true. But, things are never equal in this matter. The value of the Satoshi will change from the $1 range.

However, the basic math of the division is true but in practice, at least in my opinion, it will not work.

Why not just do it now and Give everyone a Billion Satoshis each? Cause changing the base unit changes the psychology of its value. It is a fiat currency. Plus if you can go one way, you can go the other way. A reverse split?