Bitcoinica MtGox account compromised

[sadpandatech]

What about refusing to raise those limits at MtGox if two steps authentication isn't used?

this a million times. how about it, Gox?

[Maria]

Hi everyone

We are once again very sorry to hear what's happening to many of you and that once again Bitconica has been the victim of a theft.

As far as Mt.Gox is concerned and as Genjix explained, we did not suffer any breach or any hack, all other account are safe and the thief only targeted Bitconica's account. Mark (MagicalTux) has been in contact with many Bitcoin players since this announcement and offered any help we can give, but unfortunately all funds (USD & BTC) are no longer within our reach.

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Despite our effort on securing Mt.Gox and protecting everyone's asset I would like to remind everyone that it is also your responsibility to secure your account with a very strong password and use either a Yubikey or Google Auth (You can even use both at the same time).

Of course and within our capacity we at Mt.Gox are ready to give a hand in anyway we can to help Bitconica's team.

Mt.Gox

So you Verified and lifted the limits to the Max for a 17 year old boy, Bruno there goes your unanswered question about Mtgox approving minors.

Zhoutong, In my eyes you are the one to blame because this is your fault for not letting me know you was going to sell bitcoinica to intersango. You lied and sold private property trusted in your hands. Unfortunately somebody has to take responsibility for my 16,000 missing bitcoins.

Mtgox, you verify a 17 year old, is that legal to do? Please answer.

Maria.

[ninjarobot]

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Thanks for the update. Can you please clarify when the theft occurred?

[Raoul Duke]

/bitcoinica_legacy/.git/logs/HEAD

Code:

0000000000000000000000000000000000000000 939e877106a5bd479f350adc6d9e4170c62df8f3 genjix <genjix@nite.(none)> 1338505438 +0200	clone: from git@github.com:bitcoinica/bitcoinica_legacy.git

hmmm... so, it was genjix who leaked the Bitcoinica source code?
That unix timestamp is Thu, 31 May 2012 23:03:58 GMT

That source code came from github, not from the deleted servers. On that date the servers were already gone.

Genjix, please explain this.

And it was also genjix who packed that tar file 6 days ago as pointed by bitclown a few posts above mine

Code:

$ tar -jtvf bitcoinica.tar.bz2 | head -n1
drwxr-xr-x genjix/genjix     0 2012-07-07 20:18 bitcoinica_legacy/

He has some splainin' to do, allright

[Mt.Gox Support]

Hi everyone

We are once again very sorry to hear what's happening to many of you and that once again Bitconica has been the victim of a theft.

As far as Mt.Gox is concerned and as Genjix explained, we did not suffer any breach or any hack, all other account are safe and the thief only targeted Bitconica's account. Mark (MagicalTux) has been in contact with many Bitcoin players since this announcement and offered any help we can give, but unfortunately all funds (USD & BTC) are no longer within our reach.

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Despite our effort on securing Mt.Gox and protecting everyone's asset I would like to remind everyone that it is also your responsibility to secure your account with a very strong password and use either a Yubikey or Google Auth (You can even use both at the same time).

Of course and within our capacity we at Mt.Gox are ready to give a hand in anyway we can to help Bitconica's team.

Mt.Gox

So you Verified and lifted the limits to the Max for a 17 year old boy, Bruno there goes your unanswered question about Mtgox approving minors.

Zhoutong, In my eyes you are the one to blame because this is your fault for not letting me know you was going to sell bitcoinica to intersango. You lied and sold private property trusted in your hands. Unfortunately somebody has to take responsibility for my 16,000 missing bitcoins.

Mtgox, you verify a 17 year old, is that legal to do? Please answer.

Maria.

Let's clarify the situation, Bitcoinica is not verified as an individual but as a company.

[Raoul Duke]

Isn't it amazing that users with AML verification completed struggle to get $5k transfered out of MtGox, sometimes having to wait several weeks for the funds and somehow one "hacker" withdraws almost half a million quickly without anyone noticing?
Double standards much?

[Phinnaeus Gage]

/bitcoinica_legacy/.git/logs/HEAD

Code:

0000000000000000000000000000000000000000 939e877106a5bd479f350adc6d9e4170c62df8f3 genjix <genjix@nite.(none)> 1338505438 +0200	clone: from git@github.com:bitcoinica/bitcoinica_legacy.git

hmmm... so, it was genjix who leaked the Bitcoinica source code?
That unix timestamp is Thu, 31 May 2012 23:03:58 GMT

That source code came from github, not from the deleted servers. On that date the servers were already gone.

Wasn't he in Germany at the the time of the hack?

[Bitcoin Oz]

*checks bitcoinica source code for intersango admin password

[Raoul Duke]

/bitcoinica_legacy/.git/logs/HEAD

Code:

0000000000000000000000000000000000000000 939e877106a5bd479f350adc6d9e4170c62df8f3 genjix <genjix@nite.(none)> 1338505438 +0200	clone: from git@github.com:bitcoinica/bitcoinica_legacy.git

hmmm... so, it was genjix who leaked the Bitcoinica source code?
That unix timestamp is Thu, 31 May 2012 23:03:58 GMT

That source code came from github, not from the deleted servers. On that date the servers were already gone.

Wasn't he in Germany at the the time of the hack?

I heard they were all sleeping at 2 pm GMT+1, when the hack happened

[Mt.Gox Support]

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Thanks for the update. Can you please clarify when the theft occurred?

Unfortunately I am no longer at the office (10:21pm), and I do not have access to such data outside of the office.

[sadpandatech]

(40k BTC and 40K USD - the mtgox daily limits)

40k USD and 40k BTC were stolen (~350k USD).

Just to make sure that I am not missing anything. They were able to transfer out 40k in USD?? to where?

[tbcoin]

Hi everyone

We are once again very sorry to hear what's happening to many of you and that once again Bitconica has been the victim of a theft.

As far as Mt.Gox is concerned and as Genjix explained, we did not suffer any breach or any hack, all other account are safe and the thief only targeted Bitconica's account. Mark (MagicalTux) has been in contact with many Bitcoin players since this announcement and offered any help we can give, but unfortunately all funds (USD & BTC) are no longer within our reach.

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Despite our effort on securing Mt.Gox and protecting everyone's asset I would like to remind everyone that it is also your responsibility to secure your account with a very strong password and use either a Yubikey or Google Auth (You can even use both at the same time).

Of course and within our capacity we at Mt.Gox are ready to give a hand in anyway we can to help Bitconica's team.

Mt.Gox

-- EDIT --

We would like to stress that Mt.Gox Verified Bitconica as a Company and NOT as an Individual.

Bitcoins ok, but how 40k dollars disappear? how withdrawn? I do not know how mtgox codes work, but you can not really know where are redeemed? Other options dwolla? OKPAY? Bitinstant? LR? I really can't believe that you can move dollars without knowing where, how and to whom.

[bremer-btc-user]

ok, you guys are very funny, while we are waiting weeks and weeks to get back from you what is ours, you are worried about :

- legal issues
- reasonable concepts of making payouts
- avoiding to payout malicious claims
- not knowing about who is in reponse for whatever

and within the same time you let yourself steal again in remarkable parts whats left to payout?
And this after more than two months time to secure the status Quo after the hack that lead to suspending the page and the business?

Do you really think this is believable?

[proudhon]

We are actively losing money from dealing with the payouts.

Sorry, I know this is horrible, but I don't know what else to do at this point but laugh.  This statement at the end cracked me up.  There are some other people, I think, who will have actively lost money...

At this point it'd probably be better for all of you to just walk away.  Donate what's left to the faucet and deal with the legal consequences.  I'm sure for you guys that'll be significantly easier to deal with than securing the bitcoins you have remaining and attempting to refund anyone their money.

[ninjarobot]

No, this is not the users' fault. Why should the bitcoinica users eat all the loss?

+1

It makes no sense to make us eat the loss. That is their own fault. They need to all stop taking a paycheck like Zhou did and/or start eating muesli with even cheaper milk and cough up the money out of pocket.

Some of us have undeniable proof and we want our money back.

Actually they need to honor their terms of use their clients agreed to and if they didn't make any guarantees about security they're off the hook and it's the client's fault for putting money someplace where such guarantees weren't made.

From the Bitcoinica ToS:

[12] Limitation of Liability

IN NO EVENT SHALL BITCOINICA, ITS OFFICERS, DIRECTORS OR EMPLOYEES BE LIABLE FOR LOST PROFITS OR ANY SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH OUR WEB SITE, OUR SERVICES OR THIS AGREEMENT (HOWEVER ARISING, INCLUDING NEGLIGENCE) EXCEPT AS STATED IN THIS AGREEMENT. THE LIABILITY OF BITCOINICA, ITS OFFICERS, DIRECTORS OR EMPLOYEES, TO YOU OR ANY THIRD PARTIES IN ANY PROVEN CIRCUMSTANCE IS LIMITED TO THE AMOUNT OF MONEY YOU TRANSFERRED OR DEPOSITED IN YOUR ACCOUNT AT BITCOINICA IN RELATION TO THE TRANSACTION GIVING RISE TO SUCH LIABILITY. In the case where you make funds available for trading via a voucher, "coupon code", or similar from another financial service, banking institution or exchange, you acknolwedge that you are providing Bitcoinica access to those funds for trading purposes only and that the originating financial institution is the holder of such deposits. Bitcoinica is not liable for any loss if such institutions fail in honoring withdrawal of customer funds.

[Vod]

40k USD and 40k BTC were stolen (~350k USD).

"Stolen"?  Police report or it didn't happen.

[Bitcoin Oz]

One does not simply transfer 40 grand in Mordor.

[flower1024]

TOS does not break local law
LP does not help if the businness owners do BS

[sadpandatech]

[12] Limitation of Liability

IN NO EVENT SHALL BITCOINICA, ITS OFFICERS, DIRECTORS OR EMPLOYEES BE LIABLE FOR LOST PROFITS OR ANY SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH OUR WEB SITE, OUR SERVICES OR THIS AGREEMENT (HOWEVER ARISING, INCLUDING NEGLIGENCE) EXCEPT AS STATED IN THIS AGREEMENT. THE LIABILITY OF BITCOINICA, ITS OFFICERS, DIRECTORS OR EMPLOYEES, TO YOU OR ANY THIRD PARTIES IN ANY PROVEN CIRCUMSTANCE IS LIMITED TO THE AMOUNT OF MONEY YOU TRANSFERRED OR DEPOSITED IN YOUR ACCOUNT AT BITCOINICA IN RELATION TO THE TRANSACTION GIVING RISE TO SUCH LIABILITY. In the case where you make funds available for trading via a voucher, "coupon code", or similar from another financial service, banking institution or exchange, you acknolwedge that you are providing Bitcoinica access to those funds for trading purposes only and that the originating financial institution is the holder of such deposits. Bitcoinica is not liable for any loss if such institutions fail in honoring withdrawal of customer funds.

Shouldn't you have put this part in bold:

IN NO EVENT SHALL BITCOINICA, ITS OFFICERS, DIRECTORS OR EMPLOYEES BE LIABLE FOR LOST PROFITS OR ANY SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH OUR WEB SITE, OUR SERVICES OR THIS AGREEMENT (HOWEVER ARISING, INCLUDING NEGLIGENCE)

Face it people. You agreed to use a service without even a promise that they'll be liable to you if they are negligent. So if you're looking for the guilty you need only look in the mirror.

You're reading it wrong. That statement you posted is not undoing the first in bold. First is to do with 'deposits' and the second with your 'earnings' or lack thereof.

[vampire]

So let me see:

So so called security experts:

Use a mailing list for admin access
Don't disable remote root on VPS
Don't have have offsite backups in 3 different physical location, encrypted
Don't use unique passwords for their accounts
Don't secure their clients' money with two factor authentication
Don't change passwords after their compromise