[Payout Updates] Bitcoinica site is taken offline for security investigation

[Inedible]

Thanks Herodes. Your support means a lot to us. We are a for-profit corporation, true, but I personally CARE for Bitcoin, and we are putting a lot on the line (including having our name dragged through the mud by clearly paid shills) to bring some accountability and transparency to the Bitcoin world, and we are not going to stop on that quest.

Are you referring to the donations that Matthew referred to? I think Vladimir said that it was to BitcoinTV. If not, what evidence makes the shilling 'clear'?

I personally don't see any shilling because both sides make good points (except those that somehow know ZT is lying and that his friend doesn't exist).

[Bitcoin Oz]

The way the forum reacted was kind of predictable, but it's not something AurumXchange can do much about

Shouldn't ZT have been given an opportunity to respond to the accusations first? Without that opportunity to respond, don't you think AX ought to be held responsible for the result of publishing the information that was published?

Imagine how this might have turned out if ZT had been given an opportunity to respond to the accusations? Wouldn't AX have used AML laws to determine if he was telling the truth or not before publishing? And once that had been determined, I still think publishing would be a bad thing to do but at least the outcry would have been just.

+1

[sadpandatech]

The way the forum reacted was kind of predictable, but it's not something AurumXchange can do much about

Shouldn't ZT have been given an opportunity to respond to the accusations first? Without that opportunity to respond, don't you think AX ought to be held responsible for the result of publishing the information that was published?

Imagine how this might have turned out if ZT had been given an opportunity to respond to the accusations? Wouldn't AX have used AML laws to determine if he was telling the truth or not before publishing? And once that had been determined, I still think publishing would be a bad thing to do but at least the outcry would have been just.

+1

-1

[repentance]

Just browsed through this, as the last pages are a complete shitstorm discussing minutious details that are completely uninteresting.

It is interesting. It's at the very heart of the whole controversy.

If the information hadn't been released or if ZT hadn't been incriminated BEFORE he had a chance to at least reply to the accusations then we wouldn't be in this situation.

None of us would know whether ZT was the main suspect (well there would be theories on the matter but nothing conclusive as AX wouldn't have substantiated it) until a full investigation had been done.

At that point, ZT would have either been proved a liar or the investigation would have determined that the money really did come from a friend.

But the point is that there's no point arguing over minute details while millions worth of USD is missing.

There is nothing else to do whilst the investigation is ongoing. I'm sure the AML investigation is going as fast as it can because until it's resolved, we won't find out if ZT is telling the truth or not.

This is really the whole problem here. I don't know if ZT is telling the truth. You don't know if he's telling the truth. The investigation will though. Those that say they KNOW he's lying already - I can't see how they could possibly know that. I'm not saying he isn't but how could I conclusively decide that with the information I have?

All logic dictates that when Zhou Tong at the same time of the hack tries to withdraw an amount equal to that stolen, and an e-mail address associated to him is used along with the 'hack', then it's all reason to be suspicious.

How can logic determine if ZT is lying or not? Doesn't this also mean you believe he's guilty? How have you proved that his friend doesn't exist? Again, I'm not saying you're wrong but how did you come to that conclusion?

I would've acted exactly the same way as aurumexchange in such a case

I would have done everything AX did except I would withold all information until an investigation had been done. That's the way it's meant to be done.

, and if anyone thought I acted illegally or unethical, then bring the lawsuits on, I applaud aurumxchange for hos he acted in this case.

Lawsuits can still be brought because the information effectively painted ZT as guilty without giving him an opportunity to reply to the accusations. See how the news media goes about news items - they give both parties the opportunity to address the matter and they publish both sides if it's to be published at all.

How would you feel if someone stole a large amount of money from you ?

This implies he's already guilty. Or are you literally just wanting to know how he would feel in that scenario?

I do wonder whether funds from the hack would be being transferred back now had this not become public.  In the short-term, the outcome may be better for Bitcoinica users than it would have been had AurumXchange handled this more conventionally.

[Herodes]

I do wonder whether funds from the hack would be being transferred back now had this not become public.  In the short-term, the outcome may be better for Bitcoinica users than it would have been had AurumXchange handled this more conventionally.

I see nothing wrong with how AurumXchange handled this matter, but that's merely my personal opinion. Let's see how this turns out and whether the people owed money gets the money back eventually. As I see, now a conventional lawyer has been put on the case AFAIK, and then we can probably expect a large lump of the money ending up in the pockets of that particular lawyer, esp. if this drags out, and there will be court case(s) and so on.

Since I don't have a stake here, it's not that important for me personally, however I do have sympathy for those who has lost their funds, and I hope they get paid back.

ZT has been communicating, while the others haven't been communicating that much. And obv. they should. But not much more to say about that as you can't mend broken characters through a forum.

[augustocroppo]

Users accusing Aurumexchange of TOS break are indirectly supporting the hypothesis that Zhou Tong is the hacker.

If Zhou Tong is the hacker, then Aurumexchange released information of a customer.

If Zhou Tong is NOT the hacker, them Aurumexchange released information of an unknown person.

[Phinnaeus Gage]

Users accusing Aurumexchange of TOS break are indirectly supporting the hypothesis that Zhou Tong is the hacker.

If Zhou Tong is the hacker, then Aurumexchange released information of a customer.

If Zhou Tong is NOT the hacker, them Aurumexchange released information of an unknown person.

You forgot one!

If Zhou Tong is NOT real, then Aurumexchange released information of a fictitious character.

~Bruno~

[JoelKatz]

Users accusing Aurumexchange of TOS break are indirectly supporting the hypothesis that Zhou Tong is the hacker.

If Zhou Tong is the hacker, then Aurumexchange released information of a customer.

If Zhou Tong is NOT the hacker, them Aurumexchange released information of an unknown person.

This makes no sense at all.

Consider this hypothetical: You open an account with some service. I hack your account and use the service to buy 1,000 copies of Mein Kampf which I leave on the doorsteps of Holocaust survivors. There's a public outcry over this event and the purchase is investigated. The service publicly announces that your account was used to buy those 1,000 copies of Mein Kampf, which embarrasses you. You receive death threats, harassment, and so on. When you respond that you didn't buy them and that someone else must have hacked your account, does that let the service off the hook for the privacy violation? After all, it wasn't your transaction.

[repentance]

Users accusing Aurumexchange of TOS break are indirectly supporting the hypothesis that Zhou Tong is the hacker.

If Zhou Tong is the hacker, then Aurumexchange released information of a customer.

If Zhou Tong is NOT the hacker, them Aurumexchange released information of an unknown person.

This makes no sense at all.

Consider this hypothetical: You open an account with some service. I hack your account and use the service to buy 1,000 copies of Mein Kampf which I leave on the doorsteps of Holocaust survivors. There's a public outcry over this event and the purchase is investigated. The service publicly announces that your account was used to buy those 1,000 copies of Mein Kampf, which embarrasses you. You receive death threats, harassment, and so on. When you respond that you didn't buy them and that someone else must have hacked your account, does that let the service off the hook for the privacy violation? After all, it wasn't your transaction.

That one doesn't quite work because users had noticed Zhou's LR transactions and commented on them just after the hack and Zhou had already said that AurumXchange had frozen his funds for unknown reasons before AurumXchange made their statement.  While I still believe that the AurumXchange statement was ill-advised, both Zhou's LR transactions and the fact that AurumXchange had frozen his account had been discussed in this community prior to that statement.  Zhou is not claiming that his AurumXchange account through which he sold LR for a friend was hacked.

While I believe that AurumXchange/Mt Gox were justified in confirming to the community that the stolen funds had been converted to LR, I think that their public statement should have stopped at "we've identified and frozen accounts suspected of being associated with the Mt Gox theft and referred the matter to the appropriate authorities for further investigation".  The public request for further documentation from Zhou and information about whether or not it had been provided were utterly inappropriate.

[augustocroppo]

Users accusing Aurumexchange of TOS break are indirectly supporting the hypothesis that Zhou Tong is the hacker.

If Zhou Tong is the hacker, then Aurumexchange released information of a customer.

If Zhou Tong is NOT the hacker, them Aurumexchange released information of an unknown person.

This makes no sense at all.

Consider this hypothetical: You open an account with some service. I hack your account and use the service to buy 1,000 copies of Mein Kampf which I leave on the doorsteps of Holocaust survivors. There's a public outcry over this event and the purchase is investigated. The service publicly announces that your account was used to buy those 1,000 copies of Mein Kampf, which embarrasses you. You receive death threats, harassment, and so on. When you respond that you didn't buy them and that someone else must have hacked your account, does that let the service off the hook for the privacy violation? After all, it wasn't your transaction.

I do not feel embarrassed to be associated with Adolf Hitler historical character.

I do not support fictional Jewish storytelling.

I do not care about threats made in Internet forums.

Then I would not even "respond" for whatever enquires would be made regarding your hypothetical event.

[Inedible]

I do not feel embarrassed to be associated with Adolf Hitler historical character.

I do not support fictional Jewish storytelling.

I do not care about threats made in Internet forums.

Then I would not even "respond" for whatever enquires would be made regarding your hypothetical event.

And what about the people who are convinced that you were the one that did it and will do as much as they can to damage you, your family and your career off of the forums?

[augustocroppo]

I do not feel embarrassed to be associated with Adolf Hitler historical character.

I do not support fictional Jewish storytelling.

I do not care about threats made in Internet forums.

Then I would not even "respond" for whatever enquires would be made regarding your hypothetical event.

And what about the people who are convinced that you were the one that did it and will do as much as they can to damage you, your family and your career off of the forums?

This reasoning is completely out of context since your hypothesis did not occurred in the case of the user Zhou Tong.

So please, you and other users, stop with the emotional arguments.

[Inedible]

And what about the people who are convinced that you were the one that did it and will do as much as they can to damage you, your family and your career off of the forums?

This reasoning is completely out of context since your hypothesis did not occurred in the case of the user Zhou Tong.

So please, you and other users, stop with the emotional arguments.

I disagree that it's a plea to anyone's emotions. I can only speak for myself but you wouldn't hear any arguments from me (emotional or otherwise) if others wouldn't make arguments stating as absolute fact that he's guilty.

[Coinoisseur]

Why harp on people who say he's 100% guilty, just as useless as trashing the people who say he is 100% innocent? I'm in the "seems pretty flimsy" camp and Bitcoinica should have been wound up in NZ more than a month ago, haven't heard a good argument for why I should change stances.

And what about the people who are convinced that you were the one that did it and will do as much as they can to damage you, your family and your career off of the forums?

This reasoning is completely out of context since your hypothesis did not occurred in the case of the user Zhou Tong.

So please, you and other users, stop with the emotional arguments.

I disagree that it's a plea to anyone's emotions. I can only speak for myself but you wouldn't hear any arguments from me (emotional or otherwise) if others wouldn't make arguments stating as absolute fact that he's guilty.

[Matthew N. Wright]

I honestly don't understand why AurumXchange continues to evade my very important questions, questions that would obviously help put this entire argument to bed. I think it's important that we solve this issue. I did a bit more research to see if I could answer these questions on my own for the inexplicable behavior addressed earlier in the thread and happened upon this: http://icbit.se/

AurumXchange is listed as a partner of Bitcoinica's competitor for margin trading/futures. I hope this doesn't have anything to do with their interests in attacking Zhou, but even Charlie Shrem told me that it was intended to be a private investigation and not public. Weird.

Roberto, if you could be so kind as to answer the questions below I've already ever so politely asked (twice!), I would be ever so grateful. I have never run an exchange before myself, so I understand there are some things I might not be aware of. I look forward to your explanation! Thanks!

The matter of the fact is, we have never released any personal, sensitive, and/or confidential information regarding Zhou Tong that has not been previously and compulsory disclosed by himself to the public.

* To my surprise, upon further examination of our order system, I found an order from Zhou Tong to sell Liberty Reserve to us for the amount of USD 40,000, requesting a wire to his bank account in Singapore. The amount for the order closely matches the total USD exchanged through us (after fees) using the MtGox USD codes stolen from the Bitcoinica account.

1) Shouldn't the amount of the active order be covered by the customer's privacy agreement?
2) Shouldn't the location of the customer's bank account be covered by the customer's privacy agreement?

1. Here is the information Zhou Tong released BEFORE any statement from us:
- He acknowledge that he performed an exchange with our company for 40K LR:

I have also placed a single $40K AurumXchange order during the same period.

Note that he neither mentions it being frozen nor active, and does not give a specific date, just vaguely refers to having made a transfer.

* This order was placed the next day the hacking attempts occurred.

1) Shouldn't the time of the active order be covered by the customer's privacy agreement?

* Mark replied stating that there was activity on this account, that the account was opened using an IP address belonging to Microsoft Singapore, that Zhou Tong was known to have worked for said company at said location, that the email stevejobs807@gmail.com have been verified, and that ALL activity on this account is linked to the MtGox account belonging to Zhou Tong.

1) If there is an active AML investigation, wouldn't providing this information publicly be against the law for both parties?

At this time, it appears that there is an overwhelming amount of evidence linking Zhou Tong personally to the Bitcoinica account hack at MtGox. Our legal department has advised us to freeze the funds for the exchange order mentioned above until further investigation by the authorities and/or legal proceedings are concluded.

Anyone can understand that as an exchange, you wouldn't want stolen funds running through you. What you have repeatedly failed to answer (and I mean -repeatedly-) is whether or not it is true in the operating country of AurumXchange that discussing details of an open investigation (which had been going on for over 10 days, correct?) publicly is in fact illegal and punishable by up to 10 years in prison. If it was not an open investigation, then you'd have to change a lot of what you've been saying.

By making this information public, and by begin the question of why his funds were being withheld on a public forum, we are well within our rights, both from a legal and ethical stand point, to make an statement regarding the situation. I will invite anyone to challenge this under the laws of the Commonwealth of Dominica.

Not even Charlie Shrem agrees with you on that.

Whether or not we have information on this and Zhou, our lawyers told us its a breach of TOS to release it without Zhou's permission or a letter for the authorities

So Matthew, Vitali et al, would you be so kind as to point out what specific sensitive information we have disclosed that was not compulsorily offered by Zhou Tong previous to our statement? Could you also indicate how have we broken our own terms and conditions specifically?

I believe I have above, thank you for being so cordial. I still invite you to contact Vitalik Buterin directly if you have any issue with the article he wrote, but in the meantime, most of us will still like an answer to the question that has been repeatedly unanswered.

Our legal department has advised us to freeze the funds for the exchange order mentioned above until further investigation by the authorities and/or legal proceedings are concluded.

Is it not illegal to discuss openly an active AML investigation with the public, including freezing their accounts for the purpose of an AML investigation regardless of what the customer in question has posted on a public forum?
Is it not illegal to hold funds for longer than 7 days if there was no investigation?

At this time, it appears that there is an overwhelming amount of evidence linking Zhou Tong personally to the Bitcoinica account hack at MtGox.

Is it not unlawful as an exchange to publicly insinuate that one of your customers is a thief without empirical conclusive evidence provided by authorities care of an AML investigation?

Thanks for helping to resolve these confusions. Feel free to answer when more information is allowed to be revealed. I am confident we can get to the bottom of these confusions that are causing us to butt heads so long as both parties are willing to answer questions openly and transparently.

Cheers

P.S. For anyone interested in the Bitcoinica debacle, we've interviewed the major parties involved and compared it with publicly available information. You can read the balanced and consolidated results of our findings in Issue #2 of the Bitcoin Magazine, here.

[Raoul Duke]

AurumXchange is listed as a partner of Bitcoinica's competitor for margin trading/futures.

Isn't that kronos.io, the company where you have some kind of major role?

[Matthew N. Wright]

AurumXchange is listed as a partner of Bitcoinica's competitor for margin trading/futures.

Isn't that kronos.io, the company where you have some kind of major role?

No, I've never heard AurumXChange being mentioned as a partner or even remotely connected to Kronos.io.

[Raoul Duke]

AurumXchange is listed as a partner of Bitcoinica's competitor for margin trading/futures.

Isn't that kronos.io, the company where you have some kind of major role?

No, I've never heard AurumXChange being mentioned as a partner or even remotely connected to Kronos.io.

So, who is that competitor you're talking about?

[Matthew N. Wright]

AurumXchange is listed as a partner of Bitcoinica's competitor for margin trading/futures.

Isn't that kronos.io, the company where you have some kind of major role?

No, I've never heard AurumXChange being mentioned as a partner or even remotely connected to Kronos.io.

So, who is that competitor you're talking about?

I honestly don't understand why AurumXchange continues to evade my very important questions, questions that would obviously help put this entire argument to bed. I think it's important that we solve this issue. I did a bit more research to see if I could answer these questions on my own for the inexplicable behavior addressed earlier in the thread and happened upon this: http://icbit.se/

AurumXchange is listed as a partner of Bitcoinica's competitor for margin trading/futures. I hope this doesn't have anything to do with their interests in attacking Zhou, but even Charlie Shrem told me that it was intended to be a private investigation and not public. Weird.

Roberto, if you could be so kind as to answer the questions below I've already ever so politely asked (twice!), I would be ever so grateful. I have never run an exchange before myself, so I understand there are some things I might not be aware of. I look forward to your explanation! Thanks!

The matter of the fact is, we have never released any personal, sensitive, and/or confidential information regarding Zhou Tong that has not been previously and compulsory disclosed by himself to the public.

* To my surprise, upon further examination of our order system, I found an order from Zhou Tong to sell Liberty Reserve to us for the amount of USD 40,000, requesting a wire to his bank account in Singapore. The amount for the order closely matches the total USD exchanged through us (after fees) using the MtGox USD codes stolen from the Bitcoinica account.

1) Shouldn't the amount of the active order be covered by the customer's privacy agreement?
2) Shouldn't the location of the customer's bank account be covered by the customer's privacy agreement?

1. Here is the information Zhou Tong released BEFORE any statement from us:
- He acknowledge that he performed an exchange with our company for 40K LR:

I have also placed a single $40K AurumXchange order during the same period.

Note that he neither mentions it being frozen nor active, and does not give a specific date, just vaguely refers to having made a transfer.

* This order was placed the next day the hacking attempts occurred.

1) Shouldn't the time of the active order be covered by the customer's privacy agreement?

* Mark replied stating that there was activity on this account, that the account was opened using an IP address belonging to Microsoft Singapore, that Zhou Tong was known to have worked for said company at said location, that the email stevejobs807@gmail.com have been verified, and that ALL activity on this account is linked to the MtGox account belonging to Zhou Tong.

1) If there is an active AML investigation, wouldn't providing this information publicly be against the law for both parties?

At this time, it appears that there is an overwhelming amount of evidence linking Zhou Tong personally to the Bitcoinica account hack at MtGox. Our legal department has advised us to freeze the funds for the exchange order mentioned above until further investigation by the authorities and/or legal proceedings are concluded.

Anyone can understand that as an exchange, you wouldn't want stolen funds running through you. What you have repeatedly failed to answer (and I mean -repeatedly-) is whether or not it is true in the operating country of AurumXchange that discussing details of an open investigation (which had been going on for over 10 days, correct?) publicly is in fact illegal and punishable by up to 10 years in prison. If it was not an open investigation, then you'd have to change a lot of what you've been saying.

By making this information public, and by begin the question of why his funds were being withheld on a public forum, we are well within our rights, both from a legal and ethical stand point, to make an statement regarding the situation. I will invite anyone to challenge this under the laws of the Commonwealth of Dominica.

Not even Charlie Shrem agrees with you on that.

Whether or not we have information on this and Zhou, our lawyers told us its a breach of TOS to release it without Zhou's permission or a letter for the authorities

So Matthew, Vitali et al, would you be so kind as to point out what specific sensitive information we have disclosed that was not compulsorily offered by Zhou Tong previous to our statement? Could you also indicate how have we broken our own terms and conditions specifically?

I believe I have above, thank you for being so cordial. I still invite you to contact Vitalik Buterin directly if you have any issue with the article he wrote, but in the meantime, most of us will still like an answer to the question that has been repeatedly unanswered.

Our legal department has advised us to freeze the funds for the exchange order mentioned above until further investigation by the authorities and/or legal proceedings are concluded.

Is it not illegal to discuss openly an active AML investigation with the public, including freezing their accounts for the purpose of an AML investigation regardless of what the customer in question has posted on a public forum?
Is it not illegal to hold funds for longer than 7 days if there was no investigation?

At this time, it appears that there is an overwhelming amount of evidence linking Zhou Tong personally to the Bitcoinica account hack at MtGox.

Is it not unlawful as an exchange to publicly insinuate that one of your customers is a thief without empirical conclusive evidence provided by authorities care of an AML investigation?

Thanks for helping to resolve these confusions. Feel free to answer when more information is allowed to be revealed. I am confident we can get to the bottom of these confusions that are causing us to butt heads so long as both parties are willing to answer questions openly and transparently.

Cheers

P.S. For anyone interested in the Bitcoinica debacle, we've interviewed the major parties involved and compared it with publicly available information. You can read the balanced and consolidated results of our findings in Issue #2 of the Bitcoin Magazine, here.

[Raoul Duke]

Were they a competitor of Bitcoinica? Never heard of them on that way, hence my confusion. 
Also, wasn't aurumxchange also a Bitcoinica partner, both of them having a $10k LoC with each other?