[Payout Updates] Bitcoinica site is taken offline for security investigation

[Raoul Duke]

I have 6,325 BTC and 53,244.35 USD in bitcoinica. I will join forces with AurumXchange. I want MTGOX CODES for each TODAY or I will prosecute to the full extent of the law.

Maria.

Just exchanged 3,000 BTC. Everything is working smooth now. Makes me wonder, Why MTGOX does not offer instant LR payouts? Great Job www.CoinExchanger.com

Maria.

Good luck.

PS. I can't seem to locate your claim. Where should they send the money to?

Zhou Thank you for looking into it personally and for responding so fast. You can send me the MTGOX CODES in a PM this way the admins can confirm the payment. Again thank you Zhou it makes me happy to hear that the big accounts will be paid out first!!

Thank you Zhou Tong!! I will keep the community posted.

Maria.

Are you really that dumb or just playing dumb?

[1714017367]

1714017367

[1714017367]

1714017367

[1714017367]

1714017367

[1714017367]

1714017367

[1714017367]

1714017367

[Mushoz]

Anyway I'm going to avoid posting now, since the technical problems have been resolved, and the remaining things are legal. I've probably made a bunch of mistakes or inaccuracies above as I don't have a complete understanding of this and don't have a legal background.

How many times are you going to make this mistake? Don't stop posting!
What do you mean by technical problems have been resolved? Does that mean the entire database has been reconstructed?
And if not, how much has been reconstructed so far?

[BCB]

We have quickly added database locking to every single transaction that involves money. Database locking ensures and strictly requires concurrent processes to process data entries exclusively.


You were running Bitcoinica on ISAM!!??

[genjix]

This is the third time Bitcoinica has been compromised. Everyone knew there were security problems. That's why we were signed on to help secure it. Not only that, but the site was losing money because of the inefficient way it was being run. These were problems which were identified, and a plan drawn up to fix them. The plan did not get a chance to run beyond the bare beginning. Normally our policy for identified flaws in Intersango is to shut down the site until it's fixed. However I think with Bitcoinica, it wasn't our site to shut down (imagine bringing someone on and they shut down your site). But once Bitcoinica was compromised, we had it shut down, and it will stay shut down until people are paid. It will not go back online unless it is secure and in our total control. This is different to Bitomat or MtGox who were compromised and had identified flaws, but kept operating regardless. The situation here is complicated by the fact that Bitcoinica was undergoing a transition during this interval, and the specifics or leadership and technicals were still being agreed upon. It was during this time, that the keys were being slowly handed over and the documents were being signed (I only went to try and notarise my signature the day before the attack).

[genjix]

Bitcoinica was hacked cuz intersango e-mail account was hacked right?  How did you guys make this safe?

No. It was hacked because someone's personal email was compromised.

[Raoul Duke]

Bitcoinica was hacked cuz intersango e-mail account was hacked right?  How did you guys make this safe?

No. It was hacked because someone's personal email was compromised.

Probably nobody asked before, but: Are you 100% sure that was really the cause?

After all, if the password reset email was sent to 4 different emails how can you be sure that they clicked the link from Patricks email and it wasn't Zhou Tong to click it from his email or someone else?

Just askin'...

[hatshepsut]

Cool story bro,

So where are the refunds?

[genjix]

Cool story bro,

So where are the refunds?

Hopefully they get done soon I think. One of the points outlined today by Tihan was:

"This is what I need from each of you today:

1) A sign of life that the claims processing has begun -- an announcement to that effect and/or actually paying people back

..."

So things are moving forwards now after the hiatus. Most people involved are in agreement on what needs to be done.

[BadBitcoin (James Sutton)]

Cool story bro,

So where are the refunds?

Hopefully they get done soon I think. One of the points outlined today by Tihan was:

"This is what I need from each of you today:

1) A sign of life that the claims processing has begun -- an announcement to that effect and/or actually paying people back

..."

So things are moving forwards now after the hiatus. Most people involved are in agreement on what needs to be done.

would it be possible for you to reply to our emails and let us know if we need any additional information to proceed with the claims? I have sent in a ton of paperwork but I'm not sure if anything else is needed or not.

[bitcoinBull]

Cool story bro,

So where are the refunds?

Hopefully they get done soon I think. One of the points outlined today by Tihan was:

"This is what I need from each of you today:

1) A sign of life that the claims processing has begun -- an announcement to that effect and/or actually paying people back

..."

So things are moving forwards now after the hiatus. Most people involved are in agreement on what needs to be done.

Sounds like you guys got the go-ahead.

[proudhon]

Some good news...?

[zhoutong]

Some accounts like mine for example have not had any significant transactions for many weeks. What is the problem with verifying those? Do you have any backups at all, even if two month old?

There were no backups.

If you have access to the three accounting reports, you'll get a more complete picture. I'm sure vladimir's account can be identified as "accurate" with the data on hand.

[ninjarobot]

Now the thing is that for payments to be processed, we need legal authorisation from the person in charge. Tihan denies being in charge, which means his parent company (Core Credit) has to authorise the payments. However Tihan is saying we don't need that.

I might be mistaken but from what I understand Tihan is correct. Bitcoinica Consultancy Ltd is the general partner and has the exclusive legal authority to manage the company. And since BITCOINICA CONSULTANCY LIMITED and CORE CREDIT LIMITED are one and the same company with the same company ID (3715077) that means YOU are in charge (or perhaps more specifically Donald Norman as CEO of the Bitcoin consultancy assuming you use the same management structure for both).

So no need to ask Core Credit for permission as that would be the same as asking yourself for permission. No wonder things move so slowly.

[repentance]

Now the thing is that for payments to be processed, we need legal authorisation from the person in charge. Tihan denies being in charge, which means his parent company (Core Credit) has to authorise the payments. However Tihan is saying we don't need that.

Authorising the payments could be seen as taking a management role in the business.  If it's not a "safe harbour activity" (and it's probably not), then the limited partner cannot do it and retain limited liability.

Core Credit Ltd (now Bitcoinica Consultancy Ltd) is the general partner in Bitcoinica LP and people have been led to believe that the general partners are "the Intersango guys".  If that's not the case and Bitcoinica Ltd is actually controlled by Tihan's group of investors, then people need to be made aware of that.

[XVacant]

Anyway I'm going to avoid posting now, since the technical problems have been resolved, and the remaining things are legal. I've probably made a bunch of mistakes or inaccuracies above as I don't have a complete understanding of this and don't have a legal background.

Does it means the way of open position liquidation was finalized already? What is it?

[zhoutong]

I have 6,325 BTC and 53,244.35 USD in bitcoinica. I will join forces with AurumXchange. I want MTGOX CODES for each TODAY or I will prosecute to the full extent of the law.

Maria.

Just exchanged 3,000 BTC. Everything is working smooth now. Makes me wonder, Why MTGOX does not offer instant LR payouts? Great Job www.CoinExchanger.com

Maria.

Good luck.

PS. I can't seem to locate your claim. Where should they send the money to?

Zhou Thank you for looking into it personally and for responding so fast. You can send me the MTGOX CODES in a PM this way the admins can confirm the payment. Again thank you Zhou it makes me happy to hear that the big accounts will be paid out first!!

Thank you Zhou Tong!! I will keep the community posted.

Maria.

PS: This is the last email i received from bitcoinca.

Bitcoinica's Recent Data Errors
September 20
 
 
What happened?

We have been constantly upgrading our algorithm to provide better services and cheaper rates to our customers. However, despite the intensive testing that has done internally, sometimes the algorithm may break under certain market conditions (such as a spike or crash).

Therefore, we have also implemented a data integrity checker, which verifies the consistency and integrity of all important financial data of our customers.

Today, our data integrity checker has reported an abnormally high percentage of errors. And we have also received service requests from a few customers regarding this issue. Common problems are: duplicated orders, extra orders or positions and unupdated account balance after liquidation.
 
Why it happened?

Bitcoinica has a scaling issue about two days ago. Since our site is expanding so fast, certain types of processing jobs are slower and slower due to the huge increase in database size. We have added more processes ("dynos" in Heroku term) into the application stack, and the extra concurrency seems to solve the problem.

After that, we have found that it's possible to have two concurrent processes processing the same order or user at the same time. This has caused some conflicts, which result in duplication of some data entries. Some users' account balances haven't been updated correctly because of this.

We have quickly added database locking to every single transaction that involves money. Database locking ensures and strictly requires concurrent processes to process data entries exclusively.

However, some of our database locking was not correctly implemented. Concurrency problems still continued. Today, during the spike in BTCUSD, increased number of orders have added extra probability of processing the same order at the same time. And our system was kept busy with a long queue of tasks.
 
Is it corrected?

We have an automated system to correct these errors. In order to protect our customers, and fulfill our promise of "bear the cost of financial losses that were not caused by our customers", we have implemented this policy:

If you were made worse off (less profit or more loss than expected) because of the errors, all errors have been corrected for you.

If you were made better off (more profit or less loss than expected) because of the errors, we bear all the associated cost and your account remained unchanged.

In the extreme cases (such as $1,000 difference in adjustment), we have reviewed on case-by-case basis and taken manual actions respectively.

We hope our resolution for this recent issue is much more professional than simply reverse the trades.
 
What should I do next?

You should check your account, and make sure that all the data is correct.

If there are still some incorrect data entries, please send an email to support@bitcoinica.com, including the following information:

- Your username
- What is incorrect
- What should be the correct value

We will verify your information as soon as possible.

If you were made better off because of the errors, or you simply want to share part of your profit with us to help Bitcoinica grow, you can donate to Bitcoinica anonymously by sending any amount of Bitcoins to this address:

196D4C3f2MgFrjfRoAh4mkQKfALBvPEnB1

At this moment, our finances are healthy and we can absolutely afford to compensate for this issue. More importantly, we will keep Bitcoinica continued and more exciting features will be announced soon.
 
The Bug Bounty Program

We're introducing the Bug Bounty Program. If you have found any bugs, security loopholes or irregularities in our technical systems, you can report them to us and get the chance to win bounties. This is our offering:

Security-related or critical loopholes: 5 - 100 BTC each

Operational bugs: 1 - 25 BTC each

User experience issues: 1 - 25 BTC each

Please note that only the first person that reports a particular issue can win the bounty. Also, "potential improvements" are not considered as bugs as long as the features are fairly working.

We will determine the amount of the bounties based on the urgency and importance of the issue.

Please send any issues you have found to support@bitcoinica.com, including detailed instructions on how to reproduce the issue.
 
Thank you!

Thank you for your support! We hope that Bitcoinica can become your favorite trading platform for Bitcoins.

More features are coming up soon. We will continue using newsletters to communicate with you all.

Again, thank you!

I'm afraid that you have to submit a claim to get your money. I'm not in charge of the refunding process so the claim site is the only way that the guys in charge can see your request.

[zhoutong]

I know as much as Zhoutong really.

That's pretty disturbing.  While zhoutang not being privy to everything that is going on behind the scenes is understandable, it's hard to think of any positive reasons why you would be excluded from the loop.  

Who the hell does know what is happening and when are they going to announce how user funds will be returned?  This appalling lack of communication isn't just damaging the image of Bitcoinica - it's raising serious doubts about the competence of "The Intersango Guys" in general and tarnishing the reputations of their other business ventures.

@repentance: you seem to be pretty versed in court matters. PLEASE contact us by PM. Perhaps you can help us build our legal framework.

@Maria: I will be happy to work with you, and any other investor been owned a substantial amount.

We will go after the legal structures, and the individuals involved. I think it is time to bring some sort of accountability to the bitcoin world. It is not even about the money at this point, and those familiar with our company know we have the deep pockets and the infrastructure to make it happen.

I have already received 8 private messages from people interested in joining forces with us. Many of these are very well known Bitcoin players and companies. I will be having a series of meetings with the board this and next week to start putting the gears in motion.

Just a heads up, you should probably verify each account owner's integrity before you take any actions. Maria didn't even submit a claim. Working with people like that will only delay your legal process.

[Maria]

I know as much as Zhoutong really.

That's pretty disturbing.  While zhoutang not being privy to everything that is going on behind the scenes is understandable, it's hard to think of any positive reasons why you would be excluded from the loop.  

Who the hell does know what is happening and when are they going to announce how user funds will be returned?  This appalling lack of communication isn't just damaging the image of Bitcoinica - it's raising serious doubts about the competence of "The Intersango Guys" in general and tarnishing the reputations of their other business ventures.

@repentance: you seem to be pretty versed in court matters. PLEASE contact us by PM. Perhaps you can help us build our legal framework.

@Maria: I will be happy to work with you, and any other investor been owned a substantial amount.

We will go after the legal structures, and the individuals involved. I think it is time to bring some sort of accountability to the bitcoin world. It is not even about the money at this point, and those familiar with our company know we have the deep pockets and the infrastructure to make it happen.

I have already received 8 private messages from people interested in joining forces with us. Many of these are very well known Bitcoin players and companies. I will be having a series of meetings with the board this and next week to start putting the gears in motion.

Just a heads up, you should probably verify each account owner's integrity before you take any actions. Maria didn't even submit a claim. Working with people like that will only delay your legal process.

I have not submitted a claim because I had faith you was going to work out the problem and restart the service. I really need a service like bitcoinica because my trading robot performs best on Zhoutongs bitcoinica. If you come back online say today or tomorrow, then you can leave my money in there, but it seems like you guys have no intention of either coming back online or refunding so please Roberto, you have my full support.

Last, your unsecured claims process gives me a bad feeling of distrust. Consider my claim here public. Where is my money?

[zhoutong]

I know as much as Zhoutong really.

That's pretty disturbing.  While zhoutang not being privy to everything that is going on behind the scenes is understandable, it's hard to think of any positive reasons why you would be excluded from the loop.  

Who the hell does know what is happening and when are they going to announce how user funds will be returned?  This appalling lack of communication isn't just damaging the image of Bitcoinica - it's raising serious doubts about the competence of "The Intersango Guys" in general and tarnishing the reputations of their other business ventures.

@repentance: you seem to be pretty versed in court matters. PLEASE contact us by PM. Perhaps you can help us build our legal framework.

@Maria: I will be happy to work with you, and any other investor been owned a substantial amount.

We will go after the legal structures, and the individuals involved. I think it is time to bring some sort of accountability to the bitcoin world. It is not even about the money at this point, and those familiar with our company know we have the deep pockets and the infrastructure to make it happen.

I have already received 8 private messages from people interested in joining forces with us. Many of these are very well known Bitcoin players and companies. I will be having a series of meetings with the board this and next week to start putting the gears in motion.

Just a heads up, you should probably verify each account owner's integrity before you take any actions. Maria didn't even submit a claim. Working with people like that will only delay your legal process.

I have not submitted a claim because I had faith you was going to work out the problem and restart the service. I really need a service like bitcoinica because my trading robot performs best on Zhoutongs bitcoinica. If you come back online say today or tomorrow, then you can leave my money in there, but it seems like you guys have no intention of either coming back online or refunding so please Roberto, you have my full support.

Last, your unsecured claims process gives me a bad feeling of distrust. Consider my claim here public. Where is my money?

Please send your username, password, passport scan and email proof to verify@bitcoinica.com. We will verify accordingly. If you can make it public you should have no problems filling a form or sending an email.

[Raoul Duke]

I know as much as Zhoutong really.

That's pretty disturbing.  While zhoutang not being privy to everything that is going on behind the scenes is understandable, it's hard to think of any positive reasons why you would be excluded from the loop.  

Who the hell does know what is happening and when are they going to announce how user funds will be returned?  This appalling lack of communication isn't just damaging the image of Bitcoinica - it's raising serious doubts about the competence of "The Intersango Guys" in general and tarnishing the reputations of their other business ventures.

@repentance: you seem to be pretty versed in court matters. PLEASE contact us by PM. Perhaps you can help us build our legal framework.

@Maria: I will be happy to work with you, and any other investor been owned a substantial amount.

We will go after the legal structures, and the individuals involved. I think it is time to bring some sort of accountability to the bitcoin world. It is not even about the money at this point, and those familiar with our company know we have the deep pockets and the infrastructure to make it happen.

I have already received 8 private messages from people interested in joining forces with us. Many of these are very well known Bitcoin players and companies. I will be having a series of meetings with the board this and next week to start putting the gears in motion.

Just a heads up, you should probably verify each account owner's integrity before you take any actions. Maria didn't even submit a claim. Working with people like that will only delay your legal process.

Do you have a database backup to "backup" your statement?
In other words, can you deny that youramoron@gmail.com had an account with bitcoinica?