[Emergency ANN] Bitcoinica site is taken offline for security investigation

[rjk]

Investing in a bucket shop. This is gold.

[kokjo]

Hi all. I'm making my first post here to offer my heartfelt apology to those affected by the security breach at Bitcoinica.

so you are the shady invester?

The investment fund I work with first put money into Bitcoinica because I had identified it as a promising start-up in this exciting space. It is my job to find potential investments and conduct related due diligence. In doing so, I learned a lot about bitcoin trading and Bitcoinica.

Like many early stage companies, Bitcoinica experienced growing pains as its success outgrew the capacity of its initial founder to handle alone. It was I who sought out expanded management to help take Bitcoinica forward.

I chose the Bitcoin Consultancy team due to their early involvement with bitcoin, their experience operating an exchange, and their reputations for expertise in online security. 

Bitcoin Consultancy was first retained to perform a comprehensive security audit on March 27 and they became owners and operators of Bitcoinica LP on April 24. As General Partner, they have exclusive legal authority to manage the company.

Because their time with the company is relatively short, the present situation is especially challenging. Zhou Tong has continued to assist in an unofficial capacity. I've offered what insights I can based on my knowledge of the business. In spite of the challenges, I know the Bitcoin Consultancy team would like to bring about the best possible outcome.

Per standard practice, Bitcoin Consultancy entered into a non-disclosure agreement which extends to Bitcoinica's proprietary systems and processes. They are free to discuss their role and history with the company.

For those who wish to blame someone, blame me. Perhaps if I'd pushed for expanded management sooner or in a different way, the incident might have been avoided.

For avoidance of confusion, I wish to reiterate Bitcoinica Consultancy's prior statement: Mr. Heaslip is an accounting professional who assisted with company formation. He has his own business interests in New Zealand which are otherwise unrelated. I have facilitated investments in dozens of other companies, including some in the bitcoin space. Those companies are also unrelated.

I’m unable to follow most public postings here, but you can reach me through this forum by private message. Questions about processing of funds should be directed to Bitcoin Consultancy as they alone control that process.

bla bla bla... about stuff that we already know. and some little that we did not know. thank you.

I've advised Bitcoin Consultancy to focus their efforts on processing claims rather than public debate. Please extend them your continued patience.

awesome way to stop the clusterfuck that Bitcoinica Consultancy and Zhou Tong had.


do you know when claims are being processed? (and especially my claim!)

[allten]

Wow, what a show.

From what I've read on these forums over some time, I have come to pretty strong conclusion that the biggest problem with Bitcoinica is Zhou.
It reads so clearly I wish more people could see. Zhou has great technical abilities and thrives on accomplishment and glory from his peers.
At the same time, he is in no way a team player.

My speculation and observations:

The investors/owners of this venture did the most logical thing when they contracted with the Consultancy to help out with a business that was growing faster than anyone could handle. They were desperate, needed some help quick, and the Consultancy were the only ones on the block specializing in exactly what they needed. So, for Zhou, who prides in himself extensively for his technical creation, to have this new addition to the team review his work and give corrections was a severe blow to his ego and he's been having a tissy fit ever since.

Zhou is now eager to see the demise of his creation as long as he can maintain a good public image and the illusion of his great accomplishment. At the same time pin Bitcoinica's downfall on someone else to bolster his ego that it just can't succeed with any one else but him alone. Zhou, this is very dishonest and your excellent PR post don't blind everyone. Remember, the best lie is the truth that is twisted. It is no coincidence that after this fiasco Zhou was the only one here doing great PR, but it was more for his personal name sakes and excusing himself from actually making things happen at bitcoinica. Please wake up everyone!

"It's my money and I want it now!". The predicament the Consultancy finds itself in is not pretty. I don't see how anyone that that just showed up to the game would have the ability to execute claims quickly while being precise and accurate. Yes, Zhou would do it faster, but do realize that the crappy situation the Consultancy finds itself in they are doing about as good as anyone could.

Now, here's my big problem with intersango: The best thing about Bitcoin is it offers the opportunity to do business without all the red tape we find in bureaucracies all around the world; Yet, your business model tries too hard to do things right by the state's definition. Give it up please! Bitcoin is a great opportunity to do things different. Your trying to do things "right" but it's just wrong.

To the Consultancy: I would so take Zhou up on his offer!!!!!! Kiss his butt and let all your pride go. Return all the power back to him and ask him nicely to please fix it. Remember, he got this running in four days (oh yeah, that was a lie) so he can make miracles happen again. Back out of this deal completely! Zhou will continue to be in self destructive mode until you guys are gone so just go!!!!! Once you leave, the investors will realize the big mistake they've made by putting their money behind someone with deep character flaws.

 Edit: Several posts were made since I typed this up basically changing some of my perspective. As I said before, it was just my speculation and observations.
Didn't know The Consultancy was the owner operator even though I had read that before, but couldn't tell if it was just someone's speculation.

Edit2: "For those who wish to blame someone, blame me. Perhaps if I'd pushed for expanded management sooner or in a different way, the incident might have been avoided. " - tseale. In other words, if you didn't piss off the technical genius who doesn't know how to be a team player everything would be fine.

Question to tseale and consultancy: what network privileges does Zhou still have with Bitcoinica?

[allten]

Hi all. I'm making my first post here to offer my heartfelt apology to those affected by the security breach at Bitcoinica.

The investment fund I work with first put money into Bitcoinica because I had identified it as a promising start-up in this exciting space. It is my job to find potential investments and conduct related due diligence. In doing so, I learned a lot about bitcoin trading and Bitcoinica.

Like many early stage companies, Bitcoinica experienced growing pains as its success outgrew the capacity of its initial founder to handle alone. It was I who sought out expanded management to help take Bitcoinica forward.

I chose the Bitcoin Consultancy team due to their early involvement with bitcoin, their experience operating an exchange, and their reputations for expertise in online security. 

Bitcoin Consultancy was first retained to perform a comprehensive security audit on March 27 and they became owners and operators of Bitcoinica LP on April 24. As General Partner, they have exclusive legal authority to manage the company.

Because their time with the company is relatively short, the present situation is especially challenging. Zhou Tong has continued to assist in an unofficial capacity. I've offered what insights I can based on my knowledge of the business. In spite of the challenges, I know the Bitcoin Consultancy team would like to bring about the best possible outcome.

Per standard practice, Bitcoin Consultancy entered into a non-disclosure agreement which extends to Bitcoinica's proprietary systems and processes. They are free to discuss their role and history with the company.

For those who wish to blame someone, blame me. Perhaps if I'd pushed for expanded management sooner or in a different way, the incident might have been avoided.

For avoidance of confusion, I wish to reiterate Bitcoinica Consultancy's prior statement: Mr. Heaslip is an accounting professional who assisted with company formation. He has his own business interests in New Zealand which are otherwise unrelated. I have facilitated investments in dozens of other companies, including some in the bitcoin space. Those companies are also unrelated.

I’m unable to follow most public postings here, but you can reach me through this forum by private message. Questions about processing of funds should be directed to Bitcoin Consultancy as they alone control that process.

I've advised Bitcoin Consultancy to focus their efforts on processing claims rather than public debate. Please extend them your continued patience.

Thank you for coming here and at least let us know that you do understand what is going on. Thank you also for letting us know about the role of the bitcoin consultancy.

~respect~

+1

As I've said before, if they compensate everyone as Zhou promised on their behalf they will earn my respect and business.

[proudhon]

Hi all. I'm making my first post here to offer my heartfelt apology to those affected by the security breach at Bitcoinica.

The investment fund I work with first put money into Bitcoinica because I had identified it as a promising start-up in this exciting space. It is my job to find potential investments and conduct related due diligence. In doing so, I learned a lot about bitcoin trading and Bitcoinica.

Like many early stage companies, Bitcoinica experienced growing pains as its success outgrew the capacity of its initial founder to handle alone. It was I who sought out expanded management to help take Bitcoinica forward.

I chose the Bitcoin Consultancy team due to their early involvement with bitcoin, their experience operating an exchange, and their reputations for expertise in online security.  

Bitcoin Consultancy was first retained to perform a comprehensive security audit on March 27 and they became owners and operators of Bitcoinica LP on April 24. As General Partner, they have exclusive legal authority to manage the company.

Because their time with the company is relatively short, the present situation is especially challenging. Zhou Tong has continued to assist in an unofficial capacity. I've offered what insights I can based on my knowledge of the business. In spite of the challenges, I know the Bitcoin Consultancy team would like to bring about the best possible outcome.

Per standard practice, Bitcoin Consultancy entered into a non-disclosure agreement which extends to Bitcoinica's proprietary systems and processes. They are free to discuss their role and history with the company.

For those who wish to blame someone, blame me. Perhaps if I'd pushed for expanded management sooner or in a different way, the incident might have been avoided.

For avoidance of confusion, I wish to reiterate Bitcoinica Consultancy's prior statement: Mr. Heaslip is an accounting professional who assisted with company formation. He has his own business interests in New Zealand which are otherwise unrelated. I have facilitated investments in dozens of other companies, including some in the bitcoin space. Those companies are also unrelated.

I’m unable to follow most public postings here, but you can reach me through this forum by private message. Questions about processing of funds should be directed to Bitcoin Consultancy as they alone control that process.

I've advised Bitcoin Consultancy to focus their efforts on processing claims rather than public debate. Please extend them your continued patience.

Mr. Tihan Seale,

Thank you for coming here and at least let us know that you do understand what is going on. Thank you also for letting us know about the role of the bitcoin consultancy. It is very good to hear that there is a captain on this ship:)

Respectfully Jared

Seriously people.  Just chill out and wait.  There's nothing else we can do.

[zhoutong]

Wow, what a show.

From what I've read on these forums over some time, I have come to pretty strong conclusion that the biggest problem with Bitcoinica is Zhou.
It reads so clearly I wish more people could see. Zhou has great technical abilities and thrives on accomplishment and glory from his peers.
At the same time, he is in no way a team player.

My speculation and observations:

The investors/owners of this venture did the most logical thing when they contracted with the Consultancy to help out with a business that was growing faster than anyone could handle. They were desperate, needed some help quick, and the Consultancy were the only ones on the block specializing in exactly what they needed. So, for Zhou, who prides in himself extensively for his technical creation, to have this new addition to the team review his work and give corrections was a severe blow to his ego and he's been having a tissy fit ever since.

We have a code repository at Github, and here's my activity:



22,750 lines of codes written/modified in six months.

Bitcoinica Consultancy? Zero commits.

They pointed out some security vulnerabilities, and I have acknowledged that. There were some customers pointed out other bugs and vulnerabilities too, and we have sent out some fair amount of bounties. I don't think there's any pride for technical creation - I'm just a Rails developer, what's the big deal?

I have my full respect for Mr Seale for his generous investment and kindness. Without his support, Bitcoinica would have to be shut down long before today. But giving up an significant amount of equity to exchange for a technical team whose transition period lasts two months with zero LOC written can't be a good decision.

[Crypt_Current]

Could this whole thing be a huge round-robin?

Did anyone actually watch that episode of the Good Wife??

[JusticeForYou]

Hi all. I'm making my first post here to offer my heartfelt apology to those affected by the security breach at Bitcoinica.

The investment fund I work with first put money into Bitcoinica because I had identified it as a promising start-up in this exciting space. It is my job to find potential investments and conduct related due diligence. In doing so, I learned a lot about bitcoin trading and Bitcoinica.

Like many early stage companies, Bitcoinica experienced growing pains as its success outgrew the capacity of its initial founder to handle alone. It was I who sought out expanded management to help take Bitcoinica forward.

I chose the Bitcoin Consultancy team due to their early involvement with bitcoin, their experience operating an exchange, and their reputations for expertise in online security. 

Bitcoin Consultancy was first retained to perform a comprehensive security audit on March 27 and they became owners and operators of Bitcoinica LP on April 24. As General Partner, they have exclusive legal authority to manage the company.

Because their time with the company is relatively short, the present situation is especially challenging. Zhou Tong has continued to assist in an unofficial capacity. I've offered what insights I can based on my knowledge of the business. In spite of the challenges, I know the Bitcoin Consultancy team would like to bring about the best possible outcome.

Per standard practice, Bitcoin Consultancy entered into a non-disclosure agreement which extends to Bitcoinica's proprietary systems and processes. They are free to discuss their role and history with the company.

For those who wish to blame someone, blame me. Perhaps if I'd pushed for expanded management sooner or in a different way, the incident might have been avoided.

For avoidance of confusion, I wish to reiterate Bitcoinica Consultancy's prior statement: Mr. Heaslip is an accounting professional who assisted with company formation. He has his own business interests in New Zealand which are otherwise unrelated. I have facilitated investments in dozens of other companies, including some in the bitcoin space. Those companies are also unrelated.

I’m unable to follow most public postings here, but you can reach me through this forum by private message. Questions about processing of funds should be directed to Bitcoin Consultancy as they alone control that process.

I've advised Bitcoin Consultancy to focus their efforts on processing claims rather than public debate. Please extend them your continued patience.

So I take this as, you or you and others you represent are Venture Capitalists that put Bitcoin Consultancy in charge of your investment. e.g. Cisco but the team you put in charge flubbed up somewhere.

Which, if I read right, Bitcoin Consultancy is the Executive Management (CEO's, CFO's, CSO etc...) and you and/or you and others are the investment group with any rights that you maintained in the agreement.

NDA agreements for proprietary material are normal and used often. There are, from what I am aware of, some limits on them when a crime is committed.

So I have only one two part question: Has this been reported to the respective locality authorities as a crime being committed in theft of peoples money (or belongings)? and if so, where and what is the report number?


Zhou, another noted here, please maintain discretion in you talking (typing) about business matters. Businesses value discretion over many other attributes. No one will include you in meetings or decision making positions if they believe you will go around spouting off. That doesn't mean you can't view your opinions but cut all ties and don't use any inside knowledge in those opinions. In your future, you can be a complete asshole but if you maintain DISCRETION people will tend to trust you.

Bitcoin Consultancy, if someone breaks with expected discretion, it doesn't pay to publicly point it out and/or try to shame or embarrass them. It is better to let it go quietly into the night otherwise you will cause a division and create a possible enemy for a long time.

Much better is: Zhou has been a innovator, has shown an entrepreneurial spirit that has expanded the knowledge, and has given more outlets for the use of bitcoins. It is unfortunate that we have grown apart and have had some disagreements of direction of management decisions. We respect all that he has done with the community and wish him well in his future projects.

Remember: Someone will be writing things about you so it might behoove you to use the BCB method of criticism.

 

[genjix]

I have a huge level of respect for Tihan because he has several times shown his honest and forth-right character. While it was unfortunate that we were muted for so long, it was needed I guess so that everyone could come to terms with what happened and make a solid action plan to move forwards rather than acting on impulse and emotion.

After the Linode problem, Tihan refunded everything from his own pocket. Again after this problem, he is again putting up the money to fund Bitcoinica. To me that commands great respect. I'm really happy we are collaborating with someone that trustworthy. Now he offers to take the blame too. If that's the case, then I should equally share in the blame what with being director for Intersango.

I could care less right now if everything we've worked on is in vain. The most important thing I feel is that everyone gets refunded. As a believer in transparency, honesty and openness, it feels good to have everything public now. Part of the problem was that the handover process was meant to be very gradual (it is very disruptive if you made sudden huge changes to a production system) but that there was some communication problems that allowed Bitcoinica to get compromised (things were assumed from both sides about its setup).

I trust the people involved with this. I would only surround myself with trustworthy dependable people. They are going to resolve this in the best manner they can with the crappy situation that exists. It's unfortunate but must be fixed.

[zhoutong]

IMO Zhou and Mr Seale are pretty awesome. Did the bitcoin consultancy do anything other than get hacked? What did they add to this that was productive?

Thanks.

They did an intensive code review and dig out a Nginx vulnerability that someone notified me earlier but I forgot to address. (This was really my fault! Luckily no one exploited it.)

Patrick is a good guy and I believe in his security expertise. It's just that none of the new team has prior experience with Ruby on Rails.

Donald, however, is a non-technical CEO. The vastly different value judgement (between a technical entrepreneur and a non-technical one) resulted in the mass debate earlier today. He has never communicated with me before the hack, so I'm not sure about his job.

The whole thing is, I didn't realize soon enough that I no longer had any control over Bitcoinica, while everyone still assumed me to be the owner.

Again, I don't blame them for being hacked. If I have done my job better such things wouldn't happen either. In security world any problem is everyone's problem. I was just angry about the "misrepresentation" claims that don't actually mean anything.

[muyuu]

After the Linode problem, Tihan refunded everything from his own pocket. Again after this problem, he is again putting up the money to fund Bitcoinica. To me that commands great respect. I'm really happy we are collaborating with someone that trustworthy. Now he offers to take the blame too. If that's the case, then I should equally share in the blame what with being director for Intersango.

Heh. A lot of people here assumed it was Zhoutong who ponied up out of his pocket and nobody ever denied that.

Interesting.

I was thinking that it would be paid from Bitcoinica's reserves, but that isn't the case, right?

[zhoutong]

After the Linode problem, Tihan refunded everything from his own pocket. Again after this problem, he is again putting up the money to fund Bitcoinica. To me that commands great respect. I'm really happy we are collaborating with someone that trustworthy. Now he offers to take the blame too. If that's the case, then I should equally share in the blame what with being director for Intersango.

Heh. A lot of people here assumed it was Zhoutong who ponied up out of his pocket and nobody ever denied that.

Interesting.

I was thinking that it would be paid from Bitcoinica's reserves, but that isn't the case, right?

I didn't mention anything about this because Tihan requested to be anonymous at that moment. Yes, I shouldn't take the compliment from the community for something that I didn't do, but there's no way to make things transparent either.

Also, I had no equity in Bitcoinica at that time and I was just the sole operator of the website under Tihan's advise.

At least now we all know the whole story behind the compensation of Linode hack.

[John (John K.)]

I have a huge level of respect for Tihan because he has several times shown his honest and forth-right character. While it was unfortunate that we were muted for so long, it was needed I guess so that everyone could come to terms with what happened and make a solid action plan to move forwards rather than acting on impulse and emotion.

After the Linode problem, Tihan refunded everything from his own pocket. Again after this problem, he is again putting up the money to fund Bitcoinica. To me that commands great respect. I'm really happy we are collaborating with someone that trustworthy. Now he offers to take the blame too. If that's the case, then I should equally share in the blame what with being director for Intersango.

I could care less right now if everything we've worked on is in vain. The most important thing I feel is that everyone gets refunded. As a believer in transparency, honesty and openness, it feels good to have everything public now. Part of the problem was that the handover process was meant to be very gradual (it is very disruptive if you made sudden huge changes to a production system) but that there was some communication problems that allowed Bitcoinica to get compromised (things were assumed from both sides about its setup).

I trust the people involved with this. I would only surround myself with trustworthy dependable people. They are going to resolve this in the best manner they can with the crappy situation that exists. It's unfortunate but must be fixed.

Yes. Mr. Tihan is the hero here. I am glad he is now getting the recognition and the respect he should. He has invested heavily into the bitcoin community and without people like him we would die on the vine.

 

+1 to this!

[Mushoz]

Since people are allowed to speak now, and it seems like customer funds will be repaid (Thank god!), there's one more question left:

-Are there any backups left?: Is the database intact?

[zhoutong]

I have a huge level of respect for Tihan because he has several times shown his honest and forth-right character. While it was unfortunate that we were muted for so long, it was needed I guess so that everyone could come to terms with what happened and make a solid action plan to move forwards rather than acting on impulse and emotion.

After the Linode problem, Tihan refunded everything from his own pocket. Again after this problem, he is again putting up the money to fund Bitcoinica. To me that commands great respect. I'm really happy we are collaborating with someone that trustworthy. Now he offers to take the blame too. If that's the case, then I should equally share in the blame what with being director for Intersango.

I could care less right now if everything we've worked on is in vain. The most important thing I feel is that everyone gets refunded. As a believer in transparency, honesty and openness, it feels good to have everything public now. Part of the problem was that the handover process was meant to be very gradual (it is very disruptive if you made sudden huge changes to a production system) but that there was some communication problems that allowed Bitcoinica to get compromised (things were assumed from both sides about its setup).

I trust the people involved with this. I would only surround myself with trustworthy dependable people. They are going to resolve this in the best manner they can with the crappy situation that exists. It's unfortunate but must be fixed.

Yes. Mr. Tihan is the hero here. I am glad he is now getting the recognition and the respect he should. He has invested heavily into the bitcoin community and without people like him we would die on the vine.

 

Agree. He had put a lot of respectful things he had done under my name and chose to remain secret. Without his integrity and kindness I could have already been in serious trouble.

I was really lucky to have the chance to meet him in person in Guangzhou, China. And I think he's the most supportive person in my business career ever.

[Mushoz]

Since people are allowed to speak now, and it seems like customer funds will be repaid (Thank god!), there's one more question left:

-Are there any backups left?: Is the database intact?

I'll quote this here, as people might miss it on the previous page.

[jimbobway]

The critical mistake here is to hand over a Ruby on Rails project to a team unfamiliar with the language.  It's like handing over a Java project to a group of .NET developers.

Some may even argue it is a mistake to even code a site like Bitcoinica on RoR.

[naima53]

Hi all. I'm making my first post here to offer my heartfelt apology to those affected by the security breach at Bitcoinica.

The investment fund I work with first put money into Bitcoinica because I had identified it as a promising start-up in this exciting space. It is my job to find potential investments and conduct related due diligence. In doing so, I learned a lot about bitcoin trading and Bitcoinica.

Like many early stage companies, Bitcoinica experienced growing pains as its success outgrew the capacity of its initial founder to handle alone. It was I who sought out expanded management to help take Bitcoinica forward.

I chose the Bitcoin Consultancy team due to their early involvement with bitcoin, their experience operating an exchange, and their reputations for expertise in online security. 

Bitcoin Consultancy was first retained to perform a comprehensive security audit on March 27 and they became owners and operators of Bitcoinica LP on April 24. As General Partner, they have exclusive legal authority to manage the company.

Because their time with the company is relatively short, the present situation is especially challenging. Zhou Tong has continued to assist in an unofficial capacity. I've offered what insights I can based on my knowledge of the business. In spite of the challenges, I know the Bitcoin Consultancy team would like to bring about the best possible outcome.

Per standard practice, Bitcoin Consultancy entered into a non-disclosure agreement which extends to Bitcoinica's proprietary systems and processes. They are free to discuss their role and history with the company.

For those who wish to blame someone, blame me. Perhaps if I'd pushed for expanded management sooner or in a different way, the incident might have been avoided.

For avoidance of confusion, I wish to reiterate Bitcoinica Consultancy's prior statement: Mr. Heaslip is an accounting professional who assisted with company formation. He has his own business interests in New Zealand which are otherwise unrelated. I have facilitated investments in dozens of other companies, including some in the bitcoin space. Those companies are also unrelated.

I’m unable to follow most public postings here, but you can reach me through this forum by private message. Questions about processing of funds should be directed to Bitcoin Consultancy as they alone control that process.

I've advised Bitcoin Consultancy to focus their efforts on processing claims rather than public debate. Please extend them your continued patience.

Thank you! This is what I wanted to hear. I still hope that our money is in safe hands. This is a community of good and honest people, we will patiently wait for solutions to problems.

[muyuu]

The critical mistake here is to hand over a Ruby on Rails project to a team unfamiliar with the language.  It's like handing over a Java project to a group of .NET developers.

Some may even argue it is a mistake to even code a site like Bitcoinica on RoR.

The problem being that there is nobody in the community with the required knowledge of RoR AND security to financial services standard AND bitcoin and its protocol and security concerns.

So the best they had is 2 out of 3, they just needed time for transitioning. Ruby on Rails is not hard, given a couple of months of focused work they get to a very good standard.

It could have probably been approached as a joint project but Bitcoin is insular, and trust requirements are very high, with reliable people meeting all the tick-boxes being very, very scarce.

In any case the previous project ownership was even in a more precarious situation, with a guy who was definitely not ready to run a money market of that size and who actually didn't have neither the motivation nor the intention to do so. So I honestly don't think there was a mistake there.

[rjk]

This is a community of good and honest people, we will patiently wait for solutions to problems.

LOL what?