Ripple/XRP/Stellar Coin Hack, theft at exchange

[Anotheranonlol]

Analysis: https://medium.com/@abrkn/partial-payments-ripple-stellar-vulnerability-in-the-wild-29aaefd8a7ac

A network-wide weakness in how both Ripple and Stellar communicated transactions was exploited by an unknown third-party to to deposit false IOUs through Ripple/Stellar to Justcoin. These were consequently withdrawn to their own payment networks as native currencies. The result was that our hotwallets were emptied. Most of our customers' funds is in cold storage but the amounts were still significant. Justcoin will not operate as a fractional reserve and therefore we decided to lock down all services affected until we had a solution ready.

Justcoin cannot and will not accept taking the responsibility for this weakness in the network. It is caused by a feature that is poorly documented and has been present in both Ripple and Stellar for a long time. Other gateways, exchanges and native transaction explorers have also been affected. There is also documented that the security vulnerability has been known by the network developers for at least 2 months without any kind of explicit and direct warning to affected gateways and other services.

[arieq]

I heard millions of STR/XRP have been stolen from justcoin, that's a big loss. All STR/XRP gateways should aware of this issue, they must check their code and apply a fix in the cases where it was needed.

Stellar Devs have taken an action by removing this affected feature (partial payments):
https://www.stellar.org/blog/removal-of-partial-payments/

[megamore]

I heard too about that at twiiter
Evetyone talk about STR or XRP was hacked and can't withdraw from justcoin

[ILoveBigBlackCocks]

Hope everyone starts seeing this shitty protocol for what it really is.  One of the central tenets of crypto-currency is that it is trustless, yet XRP and Stellar rely on trusted nodes.  The whole thing was broken from the get go.  Let this crap die.

[ahbritto]

Ripple Labs response:

• https://forum.ripple.com/viewtopic.php?f=1&t=8135&start=10#p57536

[muddafudda]

Yes. Nakamoto would roll in his grave with this centralised bullshit known as ripple

[bibbit]

In order to lose their funds, it was necessary for Justcoin to suffer multiple failures. If even one of the following practices had been in effect, this theft would either not have happened or been limited to a reasonably small percentage of funds:

• Justcoin failed to properly implement code to process deposits setting the tfPartialPayment flag, which was already documented on the Ripple wiki before Justcoin existed. The payment transaction type only supports three flags. Even if the documentation did not include a screaming warning, one would think a gateway developer would test the limited payment flag options to see what happens. The Justcoin deposit code could have also succeeded by using or double checking against the transaction metadata containing the before and after balances.
• Justcoin failed to only keep a small portion of the exchange's funds in their hot wallet. In a June interview, Justcoin described how over 90% of funds were in cold storage, yet they are freezing 23.27% percent of XRP deposits. That's a 13.27% discrepancy.
• Justcoin failed to ensure that the balance of user deposits credited in their exchange's database matched the funds actually held in their Ripple and Stellar accounts. The nice thing about open ledgers is that you can query them to perform an instant audit and reconciliation with your exchange's database. Disabling deposits when the two values are in disagreement prevents these kinds of problems.
• Justcoin failed to either impose withdrawal limits on accounts or to flag unusually large transactions for manual approval. Mitch Ratcliffe once said, “Computers have enabled people to make more mistakes faster than almost any invention in history, with the possible exception of tequila and hand guns.” There is a place for manual review of extreme withdrawals, and it can be done in a way that does not impose much delay.

Other gateways, and Ripple has well over two dozen now, said that someone attempted to hack them the same way that Justcoin was hacked, however they lost no funds because they they implemented stronger controls.