[Emergency ANN] Bitcoinica site is taken offline for security investigation

[ashleyconnor]

From the new site:

For the technically inclined, we salt and encrypt passwords with bcrypt.

Bcrypt hashes passwords it doesn't encrypt them.

[cypherdoc]

From the new site:

For the technically inclined, we salt and encrypt passwords with bcrypt.

Bcrypt hashes passwords it doesn't encrypt them.

lol, perhaps that explains it!

[Crypt_Current]

From the new site:

For the technically inclined, we salt and encrypt passwords with bcrypt.

Bcrypt hashes passwords it doesn't encrypt them.

lol, perhaps that explains it!

arg ... 

[cypherdoc]

From the new site:

For the technically inclined, we salt and encrypt passwords with bcrypt.

Bcrypt hashes passwords it doesn't encrypt them.

lol, perhaps that explains it!

arg ...  

actually i remember this was picked up late last year and pointed out to Zhou.  

[JusticeForYou]

I think that Bitcoinica should join this NZ financial service providers arbitration/dispute resolution service

http://www.fdr.org.nz/

& Zhou I'm waiting to hear back from you on your main Bitcoinica thread where you offered to refund me for the considerable swaps fees when they were first introduced ages ago - thanks

I had our legal department make some queries, and it appears they already did:

http://www.business.govt.nz/fsp/app/ui/fsp/version/searchSummaryCompanyFSP/FSP207625/4.do?noReturn=true

What is interesting though is that their FSP license ONLY allows them to deal with other businesses and NOT retail customers (i.e. individuals) as they are doing now.

Again, as official funding partners, we would very much to know who owns and operates Bitcoinica (as in, for whom are we moving thousands of dollars per week). I do not understand why the secrecy, nor why partners weren't communicated about this "Sell".

If we do not receive further information soon, we will be forced to have our legal department subpoena the NZ registry to obtain such information.

Thank you
Roberto
AurumXchange

One begs to ask: You didn't do this 'before' you started to move large sums of money?

However, thanks for the information.

[guruvan]

I think that Bitcoinica should join this NZ financial service providers arbitration/dispute resolution service

http://www.fdr.org.nz/

& Zhou I'm waiting to hear back from you on your main Bitcoinica thread where you offered to refund me for the considerable swaps fees when they were first introduced ages ago - thanks

I had our legal department make some queries, and it appears they already did:

http://www.business.govt.nz/fsp/app/ui/fsp/version/searchSummaryCompanyFSP/FSP207625/4.do?noReturn=true

What is interesting though is that their FSP license ONLY allows them to deal with other businesses and NOT retail customers (i.e. individuals), which makes their license and operating legal framework dubious at best. As you can see by clicking on the link above, clicking on the "Financial Services" and scrolling all the way down, their dispute resolution scheme is NOT authorized to deal with retail clients:

Code:

Dispute resolution scheme
Financial service providers who provide a financial service to retail clients must belong to an approved consumer dispute resolution scheme. Please provide the details of your membership below.

* Are you providing any financial services to retail clients?
No

Again, as official funding partners, we would very much to know who owns and operates Bitcoinica (as in, for whom are we moving thousands of dollars per week). I do not understand why the secrecy, nor why partners weren't communicated about this "Sell".

If we do not receive further information soon, we will be forced to have our legal department subpoena the NZ registry to obtain such information.

Thank you
Roberto
AurumXchange

Yeah, now it appears that the owners are different than Zhou Tong. And it appears that you've been mislead for MONTHS, Robert. Wow. Just wow.

Yeah. Bitcoinica, Intersango - you guys have some SERIOUS explaining to do. I don't think ANYONE is justified in trusting you guys with so much as an email address after this bullshit.

WHO OWNS THE COMPANY? WHY IS IT SECRET? WHAT ARE YOU HIDING?

Why have Bitcoinica's owners been hiding behind a 17yr old kid?

Seriously, the main reason people refuse to answer questions these days seems to be to avoid incrimination. I'm increasingly convinced that there are more wrongdoings going on here than just violating the terms of their FSP license.

I did seriously lol at "Reopen Bitcoinica" hahaha.

[Phinnaeus Gage]

I think that Bitcoinica should join this NZ financial service providers arbitration/dispute resolution service

http://www.fdr.org.nz/

& Zhou I'm waiting to hear back from you on your main Bitcoinica thread where you offered to refund me for the considerable swaps fees when they were first introduced ages ago - thanks

I had our legal department make some queries, and it appears they already did:

http://www.business.govt.nz/fsp/app/ui/fsp/version/searchSummaryCompanyFSP/FSP207625/4.do?noReturn=true

What is interesting though is that their FSP license ONLY allows them to deal with other businesses and NOT retail customers (i.e. individuals), which makes their license and operating legal framework dubious at best. As you can see by clicking on the link above, clicking on the "Financial Services" and scrolling all the way down, their dispute resolution scheme is NOT authorized to deal with retail clients:

Code:

Dispute resolution scheme
Financial service providers who provide a financial service to retail clients must belong to an approved consumer dispute resolution scheme. Please provide the details of your membership below.

* Are you providing any financial services to retail clients?
No

Again, as official funding partners, we would very much to know who owns and operates Bitcoinica (as in, for whom are we moving thousands of dollars per week). I do not understand why the secrecy, nor why partners weren't communicated about this "Sell".

If we do not receive further information soon, we will be forced to have our legal department subpoena the NZ registry to obtain such information.

Thank you
Roberto
AurumXchange

Yeah, now it appears that the owners are different than Zhou Tong. And it appears that you've been mislead for MONTHS, Robert. Wow. Just wow.

Yeah. Bitcoinica, Intersango - you guys have some SERIOUS explaining to do. I don't think ANYONE is justified in trusting you guys with so much as an email address after this bullshit.

WHO OWNS THE COMPANY? WHY IS IT SECRET? WHAT ARE YOU HIDING?

Why have Bitcoinica's owners been hiding behind a 17yr old kid?

Seriously, the main reason people refuse to answer questions these days seems to be to avoid incrimination. I'm increasingly convinced that there are more wrongdoings going on here than just violating the terms of their FSP license.

I did seriously lol at "Reopen Bitcoinica" hahaha.

Perhaps, re-watching this interview may explain a lot: http://www.youtube.com/watch?v=CeddzoQsgLY

[stochastic]

Who are these so-called "owners" ?

Zhoutong claims it is not him => you claim it is not you => then who is it

Just a hint from a another lurker here in the forum

Zhoutong pointed out that the owner requested not to be publickly known.

This started a rather lengthy discussion right here in this thread about business and ownership in generall, but like it or not, such things are very common in the current world of business. I might be wrong, but just from the answers available here in the forum, I would be surprised to get any further disclosure on that topic.

Personally I'm glad that Team Intersango spoke up and clarified their position and the technical details.

--Ichthyo

Doing some digging I find on the Bitconica FSP registration page that it was updated by a Chris HEASLIP.  Doing another search I found a Chris HEASLIP on LinkedIN that states he is in New Zealand and founder of Pushpay.

Some more investigating and the registration page shows the address to be:

Code:

Name
Bitcoinica Lp
Incorporation / Registration number
2558460
Type
Limited Partnerships (NZ)
Registered office
Auckland Chartered Accountants Level 1, 10 Manukau Road Newmarket Auckland 1023
Status
REGISTERED

Now where do you think Pushpay Limited is registered at?

Code:

ACCOUNTING BRANDS LIMITED, Level 1, 10 Manukau Road, Newmarket, Auckland, 1023 , New Zealand
  Address for service 
ACCOUNTING BRANDS LIMITED, Level 1, 10 Manukau Road, Newmarket, Auckland, 1023 , New Zealand

Code:

Directors
Eliot Barry CROWTHER
Flat 2, 166 Blockhouse Bay Road, Avondale, Auckland, 0600 , New Zealand

Christopher HEASLIP
Flat 3, 10 Dorchester Street, Meadowbank, Auckland, 1072 , New Zealand

There is the 10 Manukau Road, Newmarket, Auckland address again.

Just a coincidence that a Chris Heaslip is updating the Bitcoinica LP information, is founder and managing director of an online payment company, and registers his information with the same address?

[FreeMoney]

How could someone not reopen bitcoinica? It's like if your golden eggs get stolen are you going to kill the golden egg layer?

[datafish]

So the "solution" to leaving server vulnerable to remote password reset was to do a tedious line by line analysis of the codebase (which has never exploited) and meanwhile install the code on a new server which had (almost) the same vulnerability as the prior server.

Doesn't instill a lot of confidence, does it?  I find Intersango's response wholly lacking.  To many people, Intersango/Bitcoin Consultancy/Amir Taaki is THE public face of Bitcoin.  There should have been an immediate public statement from Intersango, even if it was just "we're looking into it and Zhou will be our spokesman for the time being."  I personally don't care if the owner wants to remain anonymous, but the people who are supposed to be in charge should act the part.

[btcgoldsilver]

I appreciate the messages from Zhoutong and Intersango but will feel a lot happier when I have my bitcoins back. The original estimate was Monday, its nearly Tuesday evening here in New Zealand now. I think we need an update on the timeline!

Zhoutong / Intersango / mysterious owner ... Any updates on the timeline for a refund please ?

I have a feeling it will take bitcoinica a while to regain trust on this, its not just the security questions surrounding a second hack but also the other questions emerging about the secretive ownership.

Still can't see anything on the bitcoinica site myself, just getting a page timeout.

[Phinnaeus Gage]

Who are these so-called "owners" ?

Zhoutong claims it is not him => you claim it is not you => then who is it

Just a hint from a another lurker here in the forum

Zhoutong pointed out that the owner requested not to be publickly known.

This started a rather lengthy discussion right here in this thread about business and ownership in generall, but like it or not, such things are very common in the current world of business. I might be wrong, but just from the answers available here in the forum, I would be surprised to get any further disclosure on that topic.

Personally I'm glad that Team Intersango spoke up and clarified their position and the technical details.

--Ichthyo

Doing some digging I find on the Bitconica FSP registration page that it was updated by a Chris HEASLIP.  Doing another search I found a Chris HEASLIP on LinkedIN that states he is in New Zealand and founder of Pushpay.

Some more investigating and the registration page shows the address to be:

Code:

Name
Bitcoinica Lp
Incorporation / Registration number
2558460
Type
Limited Partnerships (NZ)
Registered office
Auckland Chartered Accountants Level 1, 10 Manukau Road Newmarket Auckland 1023
Status
REGISTERED

Now where do you think Pushpay Limited is registered at?

Code:

ACCOUNTING BRANDS LIMITED, Level 1, 10 Manukau Road, Newmarket, Auckland, 1023 , New Zealand
  Address for service 
ACCOUNTING BRANDS LIMITED, Level 1, 10 Manukau Road, Newmarket, Auckland, 1023 , New Zealand

Code:

Directors
Eliot Barry CROWTHER
Flat 2, 166 Blockhouse Bay Road, Avondale, Auckland, 0600 , New Zealand

Christopher HEASLIP
Flat 3, 10 Dorchester Street, Meadowbank, Auckland, 1072 , New Zealand

There is the 10 Manukau Road, Newmarket, Auckland address again.

Just a coincidence that a Chris Heaslip is updating the Bitcoinica LP information, is founder and managing director of an online payment company, and registers his information with the same address?

Which leads to this guy: http://angel.co/tseale who also invested in this: http://angel.co/coinlab

[terrytibbs]

Which leads to this guy: http://angel.co/tseale who also invested in this: http://angel.co/coinlab

Yep, that's the guy.

/zhoutong

[Phinnaeus Gage]

Which leads to this guy: http://angel.co/tseale who also invested in this: http://angel.co/coinlab

Yep, that's the guy.

/zhoutong

http://www.gridding.com/G/Search.aspx?ContentDisplayMode=inline&FreeTextSearch=KOSS%20or

Based in Seattle, CoinLab is an emerging umbrella group for cultivating and launching innovative bitcoin projects. Until now, they have been relatively quiet regarding their initiatives but they are credited with releasing a comprehensive Bitcoin Primer in January 2012. The founders are startup entrepreneurs Peter Vessenes, Mike Koss, and Tihan Seale, each with a strong passion for the broad advancements enabled by a decentralized currency.

[stochastic]

Which leads to this guy: http://angel.co/tseale who also invested in this: http://angel.co/coinlab

Yep, that's the guy.

/zhoutong

http://www.gridding.com/G/Search.aspx?ContentDisplayMode=inline&FreeTextSearch=KOSS%20or

Based in Seattle, CoinLab is an emerging umbrella group for cultivating and launching innovative bitcoin projects. Until now, they have been relatively quiet regarding their initiatives but they are credited with releasing a comprehensive Bitcoin Primer in January 2012. The founders are startup entrepreneurs Peter Vessenes, Mike Koss, and Tihan Seale, each with a strong passion for the broad advancements enabled by a decentralized currency.

I wonder what is so important that they have to hide their identity.

[M4v3R]

Um, now it's even more confusing.

First, Zhoutong said that Bitcoinica will be shut down and their working on the claim page, with all positions forcefully liquidated (which, as Instated before, is not only plain wrong, but looks even illegal, considering Bitcoinica was a legal money processor).

Then, Team Intersango shows up and tells us that Bitcoinica will be back up, more secure than before. Nothing about currently open positions in this statement.

So... Which is it?!

[DiabloD3]

For those who are stuck because of the Bitcoinica hack:

I am willing to pay for shares/bonds of major GLBSE mining operations with Diablo Mining Company shares to help offset the losses of Bitcoinica users.

https://bitcointalk.org/index.php?topic=77469.msg901042#msg901042

[muyuu]

Um, now it's even more confusing.

First, Zhoutong said that Bitcoinica will be shut down and their working on the claim page, with all positions forcefully liquidated (which, as Instated before, is not only plain wrong, but looks even illegal, considering Bitcoinica was a legal money processor).

Then, Team Intersango shows up and tells us that Bitcoinica will be back up, more secure than before. Nothing about currently open positions in this statement.

So... Which is it?!

Stop hoping you will have your positions respected.

Nothing about Bitcoinica being back up "more secure than before" contradicts the previous statement. ZT also said as much, which was part of the reason he needs to clean shop now: it will take time to do significant changes to the code base/rebuild.

The longer the process takes the more untenable is to keep positions frozen. Liquidating positions is definitely one of the most, if not the most sensible things to do if you cannot bring the site back securely VERY soon.

[stochastic]

Um, now it's even more confusing.

First, Zhoutong said that Bitcoinica will be shut down and their working on the claim page, with all positions forcefully liquidated (which, as Instated before, is not only plain wrong, but looks even illegal, considering Bitcoinica was a legal money processor).

Then, Team Intersango shows up and tells us that Bitcoinica will be back up, more secure than before. Nothing about currently open positions in this statement.

So... Which is it?!

Stop hoping you will have your positions respected.

Nothing about Bitcoinica being back up "more secure than before" contradicts the previous statement. ZT also said as much, which was part of the reason he needs to clean shop now: it will take time to do significant changes to the code base/rebuild.

The longer the process takes the more untenable is to keep positions frozen. Liquidating positions is definitely one of the most, if not the most sensible things to do if you cannot bring the site back securely VERY soon.

If Bitcoinica was a registered company interested in doing everything according to the law, then why do they need to hide their identities?  Where is the police report detailing the first theft of 40,000 bitcoins and this second one of over 10,000?  Whether the police do anything or not to recover the stolen items or investigate the alleged hacking incident, Bitcoinica should report this incident.  Most thefts occur by people within a company.

[muyuu]

Um, now it's even more confusing.

First, Zhoutong said that Bitcoinica will be shut down and their working on the claim page, with all positions forcefully liquidated (which, as Instated before, is not only plain wrong, but looks even illegal, considering Bitcoinica was a legal money processor).

Then, Team Intersango shows up and tells us that Bitcoinica will be back up, more secure than before. Nothing about currently open positions in this statement.

So... Which is it?!

Stop hoping you will have your positions respected.

Nothing about Bitcoinica being back up "more secure than before" contradicts the previous statement. ZT also said as much, which was part of the reason he needs to clean shop now: it will take time to do significant changes to the code base/rebuild.

The longer the process takes the more untenable is to keep positions frozen. Liquidating positions is definitely one of the most, if not the most sensible things to do if you cannot bring the site back securely VERY soon.

If Bitcoinica was a registered company interested in doing everything according to the law, then why do they need to hide their identities?  Where is the police report detailing the first theft of 40,000 bitcoins and this second one of over 10,000?  Whether the police do anything or not to recover the stolen items or investigate the alleged hacking incident, Bitcoinica should report this incident.  Most thefts occur by people within a company.

It is a registered company and their identity is not hidden. Companies don't generally disclose the identity of their main investors - only companies traded in the stock market have this obligation. This is Bitcoinica's identity: http://www.business.govt.nz/fsp/app/ui/fsp/instance/viewChangesCompanyFSP/677086.do

AFAIK Bitcoinica is a Limited company not traded in any stock market. Their identity is the company (look up "juridical person" or "juridical personality"). All that is strictly in accordance to law. The liability lies within this juridical personality, and how it carries over to the people behind it depends largely - through not exclusively - on their jurisdiction (applies to the jurisdiction where an allegedly wronged user may be, as well, but good luck with opening an international prosecution). Welcome to the financial world.