bitstamp 18,000 bitcoins stolen? -confirmed

[600watt]

Smells like fractional reserves...

Bitstamp was audited by Mike Hearn, a Bitcoin dev back in May 2014. He said that everything seemed OK and all the funds were fully backed in their cold storage wallets. This was just 8 months ago and I'd be surprised if the situation has changed since then.

Yeah, well... This was before the hack, huh...

Now, there are not a million options here:
1. Bitstamp pays $5M with the fees they charged. That's tough, because they had about $1.5M worth of trading each day. At a 0.3% average, that gives $4500 per day. It would take them 1111 days of such fees to pay for those $5M, running costs non accounted for. Impossible.
2. They get $5M from their insurance. I've been working with insurers for such matters myself. Can't find one that would do that, so I'd bet they weren't insured for such a hack.
3. They get $5M from investors. That's tricky. New investors won't be stepping into this mess, so that leaves the previous VC that brought $10M. But this money was probably spent. If not, why bringing it in in the first place? Maybe they'd add $5M to protect the $10M they invested prior to the hack, but that's a dangerous move. Not impossible, but doubtful...
4. They run on fractional reserves. Easy, as long as 88% of the funds remain there.

On which option would you bet?

the owners are millionaires. they are some kind of stars of the slovenian (IT) economy and have won shiny international awards for their company. concerning reputation, much is at stake for them. how much of their wealth would they sacrifice of get out of this mess without becoming karpeles like persona non gratas for the rest of their lives? all of it ? maybe not ... half of their stash? well, i would speculate they'd do that.
if they get this solved they'd be heroes for many people.
It is not 20 or 50 mio, so my bet is that there is good motivation for them to do everything to get it fixed properly. this is pure speculation, i know, but hey...


edit: i have coins there so maybe hope is influencing my judgement

[bitcodo]

Their volume was much bigger.  http://www.bitcoincharts.com/markets/bitstampUSD_trades.html

I guess they didn't spend much (didn't see any improvements or anything new). So I think they have a big reserve in coins and $. The problem can be future volume - will people still trade there. I think everything will be OK, but they might lose some customers.

PS.: They each own for 23 mil€ (43. and 44. on chart)  http://www.siol.net/novice/gospodarstvo/2014/11/lestvica_najbogatejsih_slovencev.aspx

[spin]

First transaction (3100btc) on this address was 2015-01-04 02:26:20 (CET)... I doubt bitstamp wouldn't notice this already yesterday and closed down

I submitted withdrawal request on my account between 4:00 and 5:00 (GMT) that was never processed.  I think they started blocking withdrawals fairly soon after.  They only announced that (via the email) >24h later though.  Of course they could not block the thief's withdrawals as he somehow has the private keys.

[DoM P]

the owners are millionaires. they are some kind of stars of the slovenian (IT) economy and have won shiny international awards for their company. concerning reputation, much is at stake for them. how much of their wealth would they sacrifice of get out of this mess without becoming karpeles like persona non gratas for the rest of their lives? all of it ? maybe not ... half of their stash? well, i would speculate they'd do that.
if they get this solved they'd be heroes for many people.
It is not 20 or 50 mio, so my bet is that there is good motivation for them to do everything to get it fixed properly. this is pure speculation, i know, but hey...


edit: i have coins there so maybe hope is influencing my judgement

Usually, it doesn't work that way.
There's a difference between personal wealth and corporate wealth. Fortunately, would I add...

But I take that argument: Since they are so rich (but then, why asking for VC to invest in Bitstamp? I don't understand the need. But that's another story...), they may want to save their company.

Their volume was much bigger.  http://www.bitcoincharts.com/markets/bitstampUSD_trades.html

Looks like I had my numbers wrong. Thanks for pointing that out.
at 0.3% average fees, they got over $7M of fees in a year.

I guess they didn't spend much (didn't see any improvements or anything new).

That, you don't know.
There are plenty of improvement that are not immediately visible.
Dare I say: Security improvements (!), data centers, procédures, documentation, regulatory compliance, development, partnerships negociations, etc.

will people still trade there.

Yep, that's the big risk.
But, looking back at BTer, they finally got out of the storm OK, volume globally maintained.

[600watt]

Their volume was much bigger.  http://www.bitcoincharts.com/markets/bitstampUSD_trades.html

I guess they didn't spend much (didn't see any improvements or anything new). So I think they have a big reserve in coins and $. The problem can be future volume - will people still trade there. I think everything will be OK, but they might lose some customers.

PS.: They each own for 23 mil€ (43. and 44. on chart)  http://www.siol.net/novice/gospodarstvo/2014/11/lestvica_najbogatejsih_slovencev.aspx

wow, they got THAT rich via bitstamp ??
if really "only" 5 mio got stolen, this is peanuts. thanks for that, made my day. i will crosspost this.

[bitcodo]

I think from Bitstamp, yes. They were not on the list in 2013. They also invested 700k in http://newsbtc.com/2014/06/20/bitstamp-founders-invest-700k-worth-bitcoin-slovenian-start-cubesensors/. Maybe some more, I don't know.

This numbers are from finance journalists (from official data and journalistic research - tax havens, anonymous accounts ..). People usually do not dispute this numbers, so they are quite reliable. But I guess they didn't check bitcoin wallets, so there must be even more.

[celebreze32]

Their volume was much bigger.  http://www.bitcoincharts.com/markets/bitstampUSD_trades.html

Looks like I had my numbers wrong. Thanks for pointing that out.
at 0.3% average fees, they got over $7M of fees in a year.

Bitstamp's also a ripple gateway, so it also makes money selling ripples (XRP), and through trades and withdrawals from ripple's distributed exchange. I don't know how much they make from ripple, but it takes your total over $7M a year.

[DoM P]

Their volume was much bigger.  http://www.bitcoincharts.com/markets/bitstampUSD_trades.html

Looks like I had my numbers wrong. Thanks for pointing that out.
at 0.3% average fees, they got over $7M of fees in a year.

Bitstamp's also a ripple gateway, so it also makes money selling ripples (XRP), and through trades and withdrawals from ripple's distributed exchange. I don't know how much they make from ripple, but it takes your total over $7M a year.

Yes.

And still a bit more I didn't include: deposit and withdrawal fees.

But again, they pay for servers, employees, electicity, taxes, etc.

[p4n]

Finally, they are moving the coins from the hack address, splitting them.

11k coins moved away since this morning, 7,7k coins left

https://blockchain.info/es/address/1L2JsXHPMYuAa9ugvHGLwkdstCPUDemNCf

[awais3344_1]

4k left now.

[eboard10]

4k left now.

Only 159 left.

One thing is sure, when they dump all those Bitcoins on other exchanges, they will push the price further down.

[illodin]

when they dump all those Bitcoins

Why would Bitcoin enthusiasts dump their coins? They must be very interested in and involved with Bitcoin so much so that they made the effort to figure out a way to steal them.

[awais3344_1]

when they dump all those Bitcoins

Why would Bitcoin enthusiasts dump their coins? They must be very interested in and involved with Bitcoin so much so that they made the effort to figure out a way to steal them.

why do a thief rob you off, he's in so much love with the dollar that he finds a way to rob you? 

[wpalczynski]

Option 4 seems most likely.

Smells like fractional reserves...

Bitstamp was audited by Mike Hearn, a Bitcoin dev back in May 2014. He said that everything seemed OK and all the funds were fully backed in their cold storage wallets. This was just 8 months ago and I'd be surprised if the situation has changed since then.

Yeah, well... This was before the hack, huh...

Now, there are not a million options here:
1. Bitstamp pays $5M with the fees they charged. That's tough, because they had about $1.5M worth of trading each day. At a 0.3% average, that gives $4500 per day. It would take them 1111 days of such fees to pay for those $5M, running costs non accounted for. Impossible.
2. They get $5M from their insurance. I've been working with insurers for such matters myself. Can't find one that would do that, so I'd bet they weren't insured for such a hack.
3. They get $5M from investors. That's tricky. New investors won't be stepping into this mess, so that leaves the previous VC that brought $10M. But this money was probably spent. If not, why bringing it in in the first place? Maybe they'd add $5M to protect the $10M they invested prior to the hack, but that's a dangerous move. Not impossible, but doubtful...
4. They run on fractional reserves. Easy, as long as 88% of the funds remain there.

On which option would you bet?

[podyx]

135k address sent 5k in December

https://blockchain.info/tx/9d25b5eaa65de602fe6a11ba9db83f3b1105899b12664f3302a5ccf1cff955d8

here
https://blockchain.info/address/1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew

which sent this today to the 'hack address'
https://blockchain.info/tx/bd1182f6b676c13dfc0ab28097dc43eac43554006854ab785b20b4a6bb307b73

interesting...
or I got something wrong?

Doesn't this prove that bitstamp controlled the address which the hacked coins were sent to?

[phoenix1]

Now, there are not a million options here:
1. Bitstamp pays $5M with the fees they charged. That's tough, because they had about $1.5M worth of trading each day. At a 0.3% average, that gives $4500 per day. It would take them 1111 days of such fees to pay for those $5M, running costs non accounted for. Impossible.
2. They get $5M from their insurance. I've been working with insurers for such matters myself. Can't find one that would do that, so I'd bet they weren't insured for such a hack.
3. They get $5M from investors. That's tricky. New investors won't be stepping into this mess, so that leaves the previous VC that brought $10M. But this money was probably spent. If not, why bringing it in in the first place? Maybe they'd add $5M to protect the $10M they invested prior to the hack, but that's a dangerous move. Not impossible, but doubtful...
4. They run on fractional reserves. Easy, as long as 88% of the funds remain there.

On which option would you bet?

I think your numbers are very misleading. At a price of $300, thats 5k coins a day. Most of the time they are doing significiantly higher volumes than this and the price was higher. I think you could reasonably double your volume estimate and the average price for last year for a more reasonable estimate, quadrupling your total, and quartering you time estimate. Not impossible.

[spin]

Now, there are not a million options here:
1. Bitstamp pays $5M with the fees they charged. That's tough, because they had about $1.5M worth of trading each day. At a 0.3% average, that gives $4500 per day. It would take them 1111 days of such fees to pay for those $5M, running costs non accounted for. Impossible.
2. They get $5M from their insurance. I've been working with insurers for such matters myself. Can't find one that would do that, so I'd bet they weren't insured for such a hack.
3. They get $5M from investors. That's tricky. New investors won't be stepping into this mess, so that leaves the previous VC that brought $10M. But this money was probably spent. If not, why bringing it in in the first place? Maybe they'd add $5M to protect the $10M they invested prior to the hack, but that's a dangerous move. Not impossible, but doubtful...
4. They run on fractional reserves. Easy, as long as 88% of the funds remain there.

On which option would you bet?

I think your numbers are very misleading. At a price of $300, thats 5k coins a day. Most of the time they are doing significiantly higher volumes than this and the price was higher. I think you could reasonably double your volume estimate and the average price for last year for a more reasonable estimate, quadrupling your total, and quartering you time estimate. Not impossible.

Agreed.  

The average weekly volume for 2014 was ~BTC 96 000 (~BTC13 700 per day) . (Based on raw data from http://bitcoincharts.com/charts/bitstampUSD)
0.3% x2 of 96 000 * 52 =BTC29 952 in fees.  I'm not sure about the 0.3% number.  The times two is because it's charged on both sides of the trade.
You are assuming they have to repay the full loss.  We can reduce the loss by any safety margins they have already, although they may wish to re-establish those (at a higher level?).
The fee number needs to reduce by operating expenses.

So we have 19 000 less what they have already vs 30 000 less opex.

Where it lands up after those adjustments is anyone's guess.

If they had been converting to USD at higher prices then that would reduce their burden significantly (if they can buy back at current low prices).

[celebreze32]

Now, there are not a million options here:
1. Bitstamp pays $5M with the fees they charged. That's tough, because they had about $1.5M worth of trading each day. At a 0.3% average, that gives $4500 per day. It would take them 1111 days of such fees to pay for those $5M, running costs non accounted for. Impossible.
2. They get $5M from their insurance. I've been working with insurers for such matters myself. Can't find one that would do that, so I'd bet they weren't insured for such a hack.
3. They get $5M from investors. That's tricky. New investors won't be stepping into this mess, so that leaves the previous VC that brought $10M. But this money was probably spent. If not, why bringing it in in the first place? Maybe they'd add $5M to protect the $10M they invested prior to the hack, but that's a dangerous move. Not impossible, but doubtful...
4. They run on fractional reserves. Easy, as long as 88% of the funds remain there.

On which option would you bet?

I think your numbers are very misleading. At a price of $300, thats 5k coins a day. Most of the time they are doing significiantly higher volumes than this and the price was higher. I think you could reasonably double your volume estimate and the average price for last year for a more reasonable estimate, quadrupling your total, and quartering you time estimate. Not impossible.

Agreed.  

The average weekly volume for 2014 was ~BTC 96 000 (~BTC13 700 per day) . (Based on raw data from http://bitcoincharts.com/charts/bitstampUSD)
0.3% x2 of 96 000 * 52 =BTC29 952 in fees.  I'm not sure about the 0.3% number.  The times two is because it's charged on both sides of the trade.
You are assuming they have to repay the full loss.  We can reduce the loss by any safety margins they have already, although they may wish to re-establish those (at a higher level?).
The fee number needs to reduce by operating expenses.

So we have 19 000 less what they have already vs 30 000 less opex.

Where it lands up after those adjustments is anyone's guess.

If they had been converting to USD at higher prices then that would reduce their burden significantly (if they can buy back at current low prices).

And Bitstamp's profits from selling ripples needs adding to the total. You could buy ripples directly from Bitstamp at a price they decided, which was always way above the going market price.

[donk4u]

Will bitstamp ever come back online after this?

yes

[jt byte]

Bitcoin was supposed to be decentralized, but people flocked almost entirely to a single exchange