13 ms·

13k BTC, 300k LTC Stolen from Cryptsy Exchange

191 points by xyzzy4 11y ago

detaro 11y ago
Info about the backdoor: https://github.com/alerj78/lucky7coin/issues/1 https://github.com/alerj78/lucky7coin/issues/1 So, basically, someone re-released a new, modified codebase for an abadoned coin, and they ran it on their servers without proper isolation, so the backdoor could access their other wallets?
- ossreality 11y ago
  Just plain stupid opsec mistakes. Even a fucking docker container would have helped.
- geofft 11y ago
  That is what it sounds like, yes. It also sounds like this is a new and innovative definition of "cold storage," where the wallet lives on a network-connected computer. The lack of isolation between the various coins reminds me of Allcrypt, the exchange that ran their Bitcoin-trading software on the same database with the same password as their WordPress website. In their explanation they managed to absolve themselves of all responsibility and blame their marketing person whose account was stolen, when in fact the marketing person was the only responsible one in the whole company, alerting the technical folks about the unexpected password reset email: https://archive.is/2UY7e https://archive.is/2UY7e
  - ceejayoz 11y ago
    Gotta love this bit: > Q: You morons! You had a WordPress site that allowed uploading of new files?!?! > A: It was the marketing director’s account. Beings that he was constantly updating files, it was necessary for his account to have the ability to upload new files. The real question, of course, being "You morons! You had a WordPress site on the same server as critical financial services?!?!" edit: Also: > Q: Your security sucks! > A: I see you running an exchange successfully, I’ll take your advice. Says the guy running an exchange unsuccessfully.
- deleted 11y ago
  [deleted]
matt_wulfeck 11y ago
This is the stuff that scares me about Bitcoin. People tout it as being safe from regulation, free, quasi-anonymous... But if you have your savings stolen you want it back.
- x1798DE 11y ago
  The same could be said for any form of cash. Probably you wouldn't keep large amounts of money in any form where you don't trust it to remain safely.
  - davidw 11y ago
    Hence the modern banking system.
  - ori_b 11y ago
    That's why "I've shoved my life savings in my mattress" isn't a very popular form of banking.
    - CyberDildonics 11y ago
      Depends on the country
      - fixermark 11y ago
        ... in the United States, where real banks are FDIC-insured. If this crap had happened to an institution that was audited, protected, and enumerated in US dollars, this whole fiasco would be only a bad day for the Cryptsy owners, not the depositors also. But you get what you get when you go with a non-fiat currency. It's interesting to me to watch people in the BTC space re-learn the lessons learned by financial systems since the dawn of currencies; at least they're learning them faster in the digital age.
  - matt_wulfeck 11y ago
    I agree in principle, but in practice I would say it's a lot easier to hack my father's computer than to break into his house and steal his safe.
zitterbewegung 11y ago
So is this the end of Crypsy? Or the beginning of the end.
- vidarh 11y ago
  Only thing that could save them would be a buyer. It's one thing to suffer a breach and try to make good on it. It's another thing entirely to cover it up for year and a half. Question is what a buyer would be interested in: Their platform is suspect from a security standpoint - if they got this much wrong, then what else did they get wrong? Their brand is shot. The code is hardly going to be worth even a fraction of what it'll cost to make customers good. And it's exceedingly ridiculous to get caught out in this way: No isolation of third party coin daemons, and a very creative interpretation of cold wallets (why in the world was it possible for someone to get the keys for the cold wallets via a network breach) They've demonstrated they can't be trusted to be open about problems, and that they can't be trusted to get even basic security precautions right, so even if they got the funds back somehow, it's extremely unlikely that they'd manage to repair the damage to their trust. So, yes, it's probably the end, whether or not they manage to recover some of the stolen coins.
  - fixermark 11y ago
    In short, the company is not worth the paper its cold-wallet keys weren't printed on. ;)
r721 11y ago
Proper link: http://blog.cryptsy.com/post/137323646202/announcement http://blog.cryptsy.com/post/137323646202/announcement
fuddle 11y ago
I think exchanges need to take responsibility and notify user's straight away about a breach. Multiple exchange's have had large breaches and continue to accept new deposits.
dorianm 11y ago
"Bitcoin: 13,000 BTC Litecoin: 300,000 LTC" "In fact, I’m offering a bounty of 1000 BTC for information which leads to the recovery of the stolen coins." e.g.: ~$350k! This could quickly escalate into an bounty head.
- chillydawg 11y ago
  I imagine assassinations have been carried out for far, far less.
hammock 11y ago
One out of every 14 Bitcoins are stolen property.[1] Does anyone know how this compares to US currency? [1]http://seekingalpha.com/instablog/7360901-robert-wagner/2715103-many-bitcoins-are-now-stolen-property-with-a-public-ledger http://seekingalpha.com/instablog/7360901-robert-wagner/2715...
- deleted 11y ago
  [deleted]
- narrator 11y ago
  Not the same thing, but there's only 1 ounce of gold for every 293 ounces of paper gold. http://www.zerohedge.com/news/2015-11-04/there-are-now-293-ounces-paper-gold-every-ounce-physical-comex-registered-gold-hits- http://www.zerohedge.com/news/2015-11-04/there-are-now-293-o...
- FatalLogic 11y ago
  How could you estimate the rate of theft for US currency? It depends on how you define 'stolen'. Was the 2008 global financial crash a huge case of theft? It also depends on how you define 'currency', as there are various measures of money supply, not just physical currency. One case, Bernie Madoff: $65 billion stolen Though that 1 in 14 number which you cited is barely even a guesstimate, for bitcoin it is easier to estimate the rate of theft, because at least you know exactly how many bitcoins exist now, or will exist in future, unlike the USD. A few other points for us to consider.. * About 75%-80% of banknotes in developed countries have traces of illegal drugs. One study suggested about 4% were involved in illegal activity such as purchasing, selling or using drugs[1]. Other crimes do not leave obvious chemical traces of course. * The further back into history you look, into colonial times and earlier, the more true becomes the statement "All wealth is stolen" [1]https://en.wikipedia.org/wiki/Contaminated_currency https://en.wikipedia.org/wiki/Contaminated_currency
  - Animats 11y ago
    "One case, Bernie Madoff: $65 billion stolen" From bop.gov: BERNARD L MADOFF Register Number: 61727-054 Age: 77 Race: White Sex: Male Located at: Butner Medium I FCI Release Date: 11/14/2139
sirsar 11y ago
> About a year and a half ago, we were alerted in the early AM of a reduction in our safe/cold wallet balances of Bitcoin and Litecoin If this happened, it means what were thought of as "cold wallets" were not implemented properly. When handling millions of dollars of coins, as Cryptsy was, a deep cold wallet [1] should be used. Take an offline computer and an offline printer. Generate a bunch of (optionally multisig) addresses. Print the private keys. Copy the addresses to your server that processes transactions. Lock away the private keys (optionally in multiple places). Never connect the offline computer or printer to the internet. Send every X bitcoins to a new address from the cold wallet. This takes a few hours and a few hundred bucks to implement. It requires human intervention to access the cold wallet (to replenish the internet-facing "hot" wallet), but that is what you want! It is a whole lot easier to manually move coins once a week than it is to check for bugs and backdoors in your whole stack. Worst case, customers suffer a delay in withdrawals and a hack causes you to lose X bitcoins. Edit: Of course, it could also be an inside job. An "exit scam." Moving coins to a new address and then not spending them is pretty hard to get caught doing. [1] https://en.bitcoin.it/wiki/Cold_storage https://en.bitcoin.it/wiki/Cold_storage
- datapat 11y ago
  >Edit: Of course, it could also be an inside job. An "exit scam." Has there ever been any real or serious evidence to demonstrate that any of these seemingly numerous Bitcoin 'hacks' have been legit and not inside jobs, which is exactly what they all look like? There are so many 'exit hacks' it seems virtually standard practice in the Bitcoin world, perhaps because nobody seems to actually go to jail for it or even face any serious legal investigations into it. If a bank announced a multi-million dollar 'hack' I'd expect the authorities would be heavily involved, immediately, and everyone with a position to have facilitated a theft would be under suspicion and investigated until ruled out. One the one hand Bitcoin is a supposedly serious, game changing currency and has billions of dollars tied up in it; on the other, it's treated as little more than internet karma points, and if people have it stolen from a wallet or someone announces yet another million dollar 'hack' at some comical 'exchange' any old clown/scammer can throw up, it seems to be simply 'tough shit' and nothing to see here. This may be the non-regulated world the fanatics want, but it's a major reason why sane people (currently almost everyone on Earth) will continue to avoid Bitcoin like the plague.
dlsx 11y ago
BTC is funny, it is revolutionary, but it does not really have anything to offer over insured money in a real bank. Bitcoin, if it ever wants to have the every-man invest in this "currency" it needs to offer some sort of insurance, which usually requires identity. Digital cash that is anonymous can not offer this, so it is inherently flawed. To use it, quite simply puts yourself at risk. So really the banks are correct in their assesment, the real value quite obviously is indeed in the blockchain technology.
- um_ya 11y ago
  Some of us would call it's anonymous nature and lack of government control, a benefit to the currency.
  - dlsx 11y ago
    it has benefited the criminals who have stolen all of these bitcoins, and criminals who cannot get banked because they commit crime. I will never use it again, and I tried it for 3 years.
- scotty79 11y ago
  > it does not really have anything to offer over insured money in a real bank 100% growth in few months?
- fixermark 11y ago
  I would imagine there is little stopping someone from forming an insurance company in the BTC space: pay them BTCn a month, and they will ensure you for losses due to fraud for up to BTCx. I believe in previous scandals, some talk was made of doing precisely this (basically constructing an FDIC-equivalent BTC holding structure). There's nothing really stopping someone from setting up an insurance backstop in a non-fiat currency; it's just harder to do than having a government declare "If the whole system tanks, we will magic up a trillion goon-dollars to cover everyone's losses." Of course, that replaces the issue of technological fraud with insurance fraud (and the technological risk of compromise to the insurance holder itself, though "put all your eggs in one basket and make sure it's the BEST basket" is an old and trusted software engineering paradigm). It actually feels like a way big, stodgy institutions could get into the BTC space if they chose to.
jimrandomh 11y ago
https://99bitcoins.com/federal-investigations-of-cryptsy-underway/ https://99bitcoins.com/federal-investigations-of-cryptsy-und... alleges Cryptsy was the subject of a federal criminal investigation going back at least as far as October. Having lost all their customer's deposits a year and a half ago will certainly not help their case.
cfcef 11y ago
About time. Cryptsy's end has been more telegraphed and expected than Mtgox's was. The site had many bugs in basic functionality long before the hack.
jonesb6 11y ago
Tomorrow a new person will still pour his/her heart out to me on the virtues of bitcoin and how the world is blind and should adopt it, in its current state, as soon as possible.
- vocatus_gate 11y ago
  Well, to be fair it wasn't a problem with bitcoin itself that caused this. Exchanges (companies) tanking don't concern me as much as if an actual vulnerability was found in bitcoin itself.
datapat 11y ago
>If you happen to be the [current owner of $5 million in Bitcoins], and want to [give away your $5 million in Bitcoins] no questions asked, then you can simply send them to this address
gizi 11y ago
My job is to evolve and secure a particular bitcoin platform. Money directly stolen out of a platform wallet is an unneeded problem. It should never happen. It should not be possible for an attacker to give that instruction. The system should not even know where to send such instruction to. So, how could an attacker ever do that? The real difficulty is to prevent an attacker to inject misleading/deceptive messages into the system that cause the system to pay out to the wrong address. This does happen, if only because of bugs in the system.
quadlock 11y ago
criminal for covering this up.
rlanday 11y ago
So they lost something on the order of $10 million (if my math is right) and waited a year and a half before telling anyone? This is some Mt. Gox-level sleaze.
- fuddle 11y ago
  13k BTC x $369.39 = $4,802,070 300k LTC x $3.31 = $ 993,000 Total: $5,795,070
  - jpatokal 11y ago
    When the heist happened in Aug 2014, BTC was trading at ~$600, so it actually was close to $10m at the time.
    - jonlucc 11y ago
      Maybe they just hoped the value would keep decreasing until they could cover it up? Their loss already was halved by waiting 1.5 years.
cenal 11y ago
2016 Seemingly this is the year that Bit Coin stumbled.
- Asparagirl 11y ago
  ...have you not been paying attention the past few years?
logicallee 11y ago
I Googled Lucky7Coin (the wallet that the article says its developer had placed an IRC backdoor into). Check this out: https://github.com/alerj78/lucky7coin/issues/1 https://github.com/alerj78/lucky7coin/issues/1 It's like a living Underhanded C competition.
nikolay 11y ago
Do you see the recurring pattern here?!
hijinks 11y ago
I spent almost 4 years working at a PCI level 1 compliant company that handled subscriptions. It's really a joke the lack of security these bitcoin "banks" have around their vaults. Our PCI auditor wouldn't pass us if he audited our firewall and noticed the crypto servers that stored the credit cards had outbound access to anything other then the 1 vlan that acted as a API layer from those servers and the banks. These companies should really just follow PCI and start there.
- threeseed 11y ago
  It is getting beyond a joke. The US government et al should really classify these as banks and force them to address the same privacy, disclosure, fraud prevention etc regulations. The potential of Bitcoin as something your grandparents could one day use is constantly being undermined by these cowboy operators.
  - Lazare 11y ago
    1) Nothing is stopping you from refusing to deal with any Bitcoin exchange that is not audited to adhere to PCI 1 standards as adapted to deal with Bitcoins. If no such exchange exists, nothing is starting you from starting one. 2) I think far more damage is being done to Bitcoin by the political fighting and poor technical decisions of the core developers. Bitcoin weathered Mt Gox, it can weather Cryptsy.
- noir_lord 11y ago
  Not in payment industry, but side project requires heavy security, any good guides to PCI auditing, I see lots of fluff when I search and the auditors I've run into in the past have been at best a bit of a joke :)
Animats 11y ago
"Some may ask why we didn’t report this to the authorities when this occurred, and the answer is that we just didn’t know what happened, didn’t want to cause panic, and were unsure who exactly we should be contacting." This happened back in July 2014. $5M stolen and you didn't call the cops. They continued to do business and accept deposits even though insolvent. Only when a class action was filed because they were not paying out timely withdrawals did they disclose this theft. That just screams "inside job". (Yesterday I made the comment on another thread that Bitcoin exchanges seemed to be doing better; no major exchange had collapsed in 2015. Here we go again.)
- rwmj 11y ago
  Or perhaps just badly run, bordering on fraudulent. Where is this company based? Trading while insolvent is explicitly illegal, at least in the UK (https://en.wikipedia.org/wiki/Trading_while_insolvent https://en.wikipedia.org/wiki/Trading_while_insolvent).
  - Animats 11y ago
    Southern Florida, the scam capital of the United States. Or they were. From the class action complaint: "CRYPTSY has vacated its Delray Beach, Florida physical office space without any indication where it would be relocating." Also, Paul Vern, the CEO, seems to be missing. One site claims he's in China, based on an IP address seen.
    - Animats 11y ago
      More info: WHOIS for cryptsy.com: Name: PAUL VERNON Organization: CRYPTSY INTERNATIONAL LTD Street: 5 CALLE AL MAR City: BELIZE CITY State/Province: BELIZE Postal Code: 00000 Country: BZ Phone: +1.8889639935 which is a "virtual office" space in Belize.[1] Cryptsy is not in Dun and Bradstreet or the Florida Department of Corporations database. But they have another corporate name, "Project Investors Inc." It has a BBB rating of F, with 17 complaints.[2] That business is registered with the state of Florida.[3] Those records include the CEO's home address, which is in Boynton Beach, FL. [1] https://www.abcn.com/offices-belize-city--calle-al-mar-3605 https://www.abcn.com/offices-belize-city--calle-al-mar-3605 [2] http://www.bbb.org/south-east-florida/business-reviews/business-and-trade-organizations/project-investors-in-delray-beach-fl-90098747 http://www.bbb.org/south-east-florida/business-reviews/busin... [3] http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName&directionType=Initial&searchNameOrder=PROJECTINVESTORS%20P130000104300&aggregateId=domp-p13000010430-6fc732fd-6494-4bce-a64e-bde23ee31e09&searchTerm=Project%20Investors&listNameOrder=PROJECTINVESTORS%20P130000104300 http://search.sunbiz.org/Inquiry/CorporationSearch/SearchRes...
lini 11y ago
Isn't every BTC transaction easily traceable? How can you prevent someone from examining the blockchain and following the stolen BTC until they are transferred to a known/public address?
- Joeri 11y ago
  You use standard laundering practices. Mix good money and bad money in one legitimate account, then pass it on from there minus a commission fee. It's impossible to track which money came from which account once it leaves the laundering operation.
bitJericho 11y ago
Seems like a good time to promote this alternative exchange: http://bitcoinsexchange.itmustbetrue.com http://bitcoinsexchange.itmustbetrue.com
- bitJericho 11y ago
  It's interesting how people appreciate this link when a new exchange is in the news, but how people dislike this link when an exchange gets compromised!
- LyndsySimon 11y ago
  Interesting. A Bitcoin Sex Change. We're truly living in the future.
Joeri 11y ago
Why weren't they insured against theft? Why did people deposit money with an exchange that is not insured against theft? Theft is a fact of life. You cannot have a perfectly secure bank, and you cannot have a perfectly secure bitcoin exchange. If you don't want to be hurt by theft, get insurance.
- fixermark 11y ago
  It's okay; the FDIC will.... Oh. Whoops. ;)
- perlgeek 11y ago
  > Why weren't they insured against theft? Because the insurance would have been way too expensive, or would have demanded way better operational security and auditing. And because they were able to operate without one.
unkoman 11y ago
Another day in bitcoin land. Sorry for your losses!
gchokov 11y ago
Oh Bitcoin.
forgetsusername 11y ago
>"Hello, Lucky7Coin is not maintained and I would like to take care of it. I have announced that on bitcointalk.org in Lucky7Coin thread. You’re the only exchange for this coin and I hope you will let me take care of it. I’m responsible. You don’t have to be afraid of errors or forks. I’m developing multipool and I know bitcoin internals and protocol." That's the email they received, and did business with this company, while overseeing millions of dollars in other people's money. Then got ripped off. Who needs banks? >If they are returned, then we will assume that no harm was meant and will not take any action to reveal who you are. If not, well, then I suppose the entire community will be looking for you. Not the FBI? Oh, right, they don't care. By the way, the guy who stole the coins was part of "the community". >2. Somebody else comes in to purchase and run Cryptsy while also making good on requested withdrawals. How is that even an option? What a bizarre story.
- deleted 11y ago
  [deleted]
wyldfire 11y ago
I love cryptocoins. But I think these high profile thefts will continue. And I think adoption/popularity will continue. If so, I would wager global law enforcement organizations will want to step in and offer merchants and users a service which traces and blacklists the outputs from thefts like this (until/unless returned to the original owner). If so, it would create a big rift between the many who enjoy cryptocoins' fungibility and independence from the state and those who want to punish/deter thieves. Big merchants like Overstock would want to publicly align themselves with "bitcoin is legit" and "we don't want to profit from that theft" activity. There'd be little that anyone could do to stop the law enforcement agencies from providing such a theft tracking service. And little anyone could do to stop merchants from integrating it into their services. It would be an interesting threat to the fungibility of bitcoin. Some cryptocoins (monero, et al) use ring-signatures that mask their specific input/output address path. I suspect if these events came to pass, those coins would become much more popular.
Animats 11y ago
Update: "cryptsy.com" is down. Not even responding to pings. Their blog ("blog.cryptsy.com") is still up, but that's hosted by Tumblr. Other reports indicate that the company's offices are vacant. It's time to get an arrest warrant out for the CEO, Paul Vernon.
- Animats 11y ago
  Update: Server is back up, but not doing transactions, all the numbers have frozen, and there's an announcement from "Big Vern" about the shutdown. (When the CEO calls himself "Big Vern", one might question the legitimacy of the company.)

191 points by xyzzy4 11y ago

Info about the backdoor: https://github.com/alerj78/lucky7coin/issues/1 https://github.com/alerj78/lucky7coin/issues/1 So, basically, someone re-released a new, modified codebase for an abadoned coin, and they ran it on their servers without proper isolation, so the backdoor could access their other wallets?

ossreality 11y ago
Just plain stupid opsec mistakes. Even a fucking docker container would have helped.
geofft 11y ago
That is what it sounds like, yes. It also sounds like this is a new and innovative definition of "cold storage," where the wallet lives on a network-connected computer. The lack of isolation between the various coins reminds me of Allcrypt, the exchange that ran their Bitcoin-trading software on the same database with the same password as their WordPress website. In their explanation they managed to absolve themselves of all responsibility and blame their marketing person whose account was stolen, when in fact the marketing person was the only responsible one in the whole company, alerting the technical folks about the unexpected password reset email: https://archive.is/2UY7e https://archive.is/2UY7e
- ceejayoz 11y ago
  Gotta love this bit: > Q: You morons! You had a WordPress site that allowed uploading of new files?!?! > A: It was the marketing director’s account. Beings that he was constantly updating files, it was necessary for his account to have the ability to upload new files. The real question, of course, being "You morons! You had a WordPress site on the same server as critical financial services?!?!" edit: Also: > Q: Your security sucks! > A: I see you running an exchange successfully, I’ll take your advice. Says the guy running an exchange unsuccessfully.
deleted 11y ago
[deleted]

matt_wulfeck 11y ago

This is the stuff that scares me about Bitcoin. People tout it as being safe from regulation, free, quasi-anonymous... But if you have your savings stolen you want it back.

x1798DE 11y ago
The same could be said for any form of cash. Probably you wouldn't keep large amounts of money in any form where you don't trust it to remain safely.
- davidw 11y ago
  Hence the modern banking system.
- ori_b 11y ago
  That's why "I've shoved my life savings in my mattress" isn't a very popular form of banking.
  - CyberDildonics 11y ago
    Depends on the country
    - fixermark 11y ago
      ... in the United States, where real banks are FDIC-insured. If this crap had happened to an institution that was audited, protected, and enumerated in US dollars, this whole fiasco would be only a bad day for the Cryptsy owners, not the depositors also. But you get what you get when you go with a non-fiat currency. It's interesting to me to watch people in the BTC space re-learn the lessons learned by financial systems since the dawn of currencies; at least they're learning them faster in the digital age.
- matt_wulfeck 11y ago
  I agree in principle, but in practice I would say it's a lot easier to hack my father's computer than to break into his house and steal his safe.

zitterbewegung 11y ago

So is this the end of Crypsy? Or the beginning of the end.

vidarh 11y ago
Only thing that could save them would be a buyer. It's one thing to suffer a breach and try to make good on it. It's another thing entirely to cover it up for year and a half. Question is what a buyer would be interested in: Their platform is suspect from a security standpoint - if they got this much wrong, then what else did they get wrong? Their brand is shot. The code is hardly going to be worth even a fraction of what it'll cost to make customers good. And it's exceedingly ridiculous to get caught out in this way: No isolation of third party coin daemons, and a very creative interpretation of cold wallets (why in the world was it possible for someone to get the keys for the cold wallets via a network breach) They've demonstrated they can't be trusted to be open about problems, and that they can't be trusted to get even basic security precautions right, so even if they got the funds back somehow, it's extremely unlikely that they'd manage to repair the damage to their trust. So, yes, it's probably the end, whether or not they manage to recover some of the stolen coins.
- fixermark 11y ago
  In short, the company is not worth the paper its cold-wallet keys weren't printed on. ;)

r721 11y ago

Proper link: http://blog.cryptsy.com/post/137323646202/announcement http://blog.cryptsy.com/post/137323646202/announcement

fuddle 11y ago

I think exchanges need to take responsibility and notify user's straight away about a breach. Multiple exchange's have had large breaches and continue to accept new deposits.

dorianm 11y ago

"Bitcoin: 13,000 BTC Litecoin: 300,000 LTC" "In fact, I’m offering a bounty of 1000 BTC for information which leads to the recovery of the stolen coins." e.g.: ~$350k! This could quickly escalate into an bounty head.

chillydawg 11y ago
I imagine assassinations have been carried out for far, far less.

hammock 11y ago

One out of every 14 Bitcoins are stolen property.[1] Does anyone know how this compares to US currency? [1]http://seekingalpha.com/instablog/7360901-robert-wagner/2715103-many-bitcoins-are-now-stolen-property-with-a-public-ledger http://seekingalpha.com/instablog/7360901-robert-wagner/2715...

deleted 11y ago
[deleted]
narrator 11y ago
Not the same thing, but there's only 1 ounce of gold for every 293 ounces of paper gold. http://www.zerohedge.com/news/2015-11-04/there-are-now-293-ounces-paper-gold-every-ounce-physical-comex-registered-gold-hits- http://www.zerohedge.com/news/2015-11-04/there-are-now-293-o...
FatalLogic 11y ago
How could you estimate the rate of theft for US currency? It depends on how you define 'stolen'. Was the 2008 global financial crash a huge case of theft? It also depends on how you define 'currency', as there are various measures of money supply, not just physical currency. One case, Bernie Madoff: $65 billion stolen Though that 1 in 14 number which you cited is barely even a guesstimate, for bitcoin it is easier to estimate the rate of theft, because at least you know exactly how many bitcoins exist now, or will exist in future, unlike the USD. A few other points for us to consider.. * About 75%-80% of banknotes in developed countries have traces of illegal drugs. One study suggested about 4% were involved in illegal activity such as purchasing, selling or using drugs[1]. Other crimes do not leave obvious chemical traces of course. * The further back into history you look, into colonial times and earlier, the more true becomes the statement "All wealth is stolen" [1]https://en.wikipedia.org/wiki/Contaminated_currency https://en.wikipedia.org/wiki/Contaminated_currency
- Animats 11y ago
  "One case, Bernie Madoff: $65 billion stolen" From bop.gov: BERNARD L MADOFF Register Number: 61727-054 Age: 77 Race: White Sex: Male Located at: Butner Medium I FCI Release Date: 11/14/2139

sirsar 11y ago

> About a year and a half ago, we were alerted in the early AM of a reduction in our safe/cold wallet balances of Bitcoin and Litecoin If this happened, it means what were thought of as "cold wallets" were not implemented properly. When handling millions of dollars of coins, as Cryptsy was, a deep cold wallet [1] should be used. Take an offline computer and an offline printer. Generate a bunch of (optionally multisig) addresses. Print the private keys. Copy the addresses to your server that processes transactions. Lock away the private keys (optionally in multiple places). Never connect the offline computer or printer to the internet. Send every X bitcoins to a new address from the cold wallet. This takes a few hours and a few hundred bucks to implement. It requires human intervention to access the cold wallet (to replenish the internet-facing "hot" wallet), but that is what you want! It is a whole lot easier to manually move coins once a week than it is to check for bugs and backdoors in your whole stack. Worst case, customers suffer a delay in withdrawals and a hack causes you to lose X bitcoins. Edit: Of course, it could also be an inside job. An "exit scam." Moving coins to a new address and then not spending them is pretty hard to get caught doing. [1] https://en.bitcoin.it/wiki/Cold_storage https://en.bitcoin.it/wiki/Cold_storage

datapat 11y ago
>Edit: Of course, it could also be an inside job. An "exit scam." Has there ever been any real or serious evidence to demonstrate that any of these seemingly numerous Bitcoin 'hacks' have been legit and not inside jobs, which is exactly what they all look like? There are so many 'exit hacks' it seems virtually standard practice in the Bitcoin world, perhaps because nobody seems to actually go to jail for it or even face any serious legal investigations into it. If a bank announced a multi-million dollar 'hack' I'd expect the authorities would be heavily involved, immediately, and everyone with a position to have facilitated a theft would be under suspicion and investigated until ruled out. One the one hand Bitcoin is a supposedly serious, game changing currency and has billions of dollars tied up in it; on the other, it's treated as little more than internet karma points, and if people have it stolen from a wallet or someone announces yet another million dollar 'hack' at some comical 'exchange' any old clown/scammer can throw up, it seems to be simply 'tough shit' and nothing to see here. This may be the non-regulated world the fanatics want, but it's a major reason why sane people (currently almost everyone on Earth) will continue to avoid Bitcoin like the plague.

dlsx 11y ago

BTC is funny, it is revolutionary, but it does not really have anything to offer over insured money in a real bank. Bitcoin, if it ever wants to have the every-man invest in this "currency" it needs to offer some sort of insurance, which usually requires identity. Digital cash that is anonymous can not offer this, so it is inherently flawed. To use it, quite simply puts yourself at risk. So really the banks are correct in their assesment, the real value quite obviously is indeed in the blockchain technology.

um_ya 11y ago
Some of us would call it's anonymous nature and lack of government control, a benefit to the currency.
- dlsx 11y ago
  it has benefited the criminals who have stolen all of these bitcoins, and criminals who cannot get banked because they commit crime. I will never use it again, and I tried it for 3 years.
scotty79 11y ago
> it does not really have anything to offer over insured money in a real bank 100% growth in few months?
fixermark 11y ago
I would imagine there is little stopping someone from forming an insurance company in the BTC space: pay them BTCn a month, and they will ensure you for losses due to fraud for up to BTCx. I believe in previous scandals, some talk was made of doing precisely this (basically constructing an FDIC-equivalent BTC holding structure). There's nothing really stopping someone from setting up an insurance backstop in a non-fiat currency; it's just harder to do than having a government declare "If the whole system tanks, we will magic up a trillion goon-dollars to cover everyone's losses." Of course, that replaces the issue of technological fraud with insurance fraud (and the technological risk of compromise to the insurance holder itself, though "put all your eggs in one basket and make sure it's the BEST basket" is an old and trusted software engineering paradigm). It actually feels like a way big, stodgy institutions could get into the BTC space if they chose to.

jimrandomh 11y ago

https://99bitcoins.com/federal-investigations-of-cryptsy-underway/ https://99bitcoins.com/federal-investigations-of-cryptsy-und... alleges Cryptsy was the subject of a federal criminal investigation going back at least as far as October. Having lost all their customer's deposits a year and a half ago will certainly not help their case.

cfcef 11y ago

About time. Cryptsy's end has been more telegraphed and expected than Mtgox's was. The site had many bugs in basic functionality long before the hack.

jonesb6 11y ago

Tomorrow a new person will still pour his/her heart out to me on the virtues of bitcoin and how the world is blind and should adopt it, in its current state, as soon as possible.

vocatus_gate 11y ago
Well, to be fair it wasn't a problem with bitcoin itself that caused this. Exchanges (companies) tanking don't concern me as much as if an actual vulnerability was found in bitcoin itself.

datapat 11y ago

>If you happen to be the [current owner of $5 million in Bitcoins], and want to [give away your $5 million in Bitcoins] no questions asked, then you can simply send them to this address

gizi 11y ago

My job is to evolve and secure a particular bitcoin platform. Money directly stolen out of a platform wallet is an unneeded problem. It should never happen. It should not be possible for an attacker to give that instruction. The system should not even know where to send such instruction to. So, how could an attacker ever do that? The real difficulty is to prevent an attacker to inject misleading/deceptive messages into the system that cause the system to pay out to the wrong address. This does happen, if only because of bugs in the system.

quadlock 11y ago

criminal for covering this up.

rlanday 11y ago

So they lost something on the order of $10 million (if my math is right) and waited a year and a half before telling anyone? This is some Mt. Gox-level sleaze.

fuddle 11y ago
13k BTC x $369.39 = $4,802,070 300k LTC x $3.31 = $ 993,000 Total: $5,795,070
- jpatokal 11y ago
  When the heist happened in Aug 2014, BTC was trading at ~$600, so it actually was close to $10m at the time.
  - jonlucc 11y ago
    Maybe they just hoped the value would keep decreasing until they could cover it up? Their loss already was halved by waiting 1.5 years.

cenal 11y ago

2016 Seemingly this is the year that Bit Coin stumbled.

Asparagirl 11y ago
...have you not been paying attention the past few years?

logicallee 11y ago

I Googled Lucky7Coin (the wallet that the article says its developer had placed an IRC backdoor into). Check this out: https://github.com/alerj78/lucky7coin/issues/1 https://github.com/alerj78/lucky7coin/issues/1 It's like a living Underhanded C competition.

nikolay 11y ago

Do you see the recurring pattern here?!

hijinks 11y ago

I spent almost 4 years working at a PCI level 1 compliant company that handled subscriptions. It's really a joke the lack of security these bitcoin "banks" have around their vaults. Our PCI auditor wouldn't pass us if he audited our firewall and noticed the crypto servers that stored the credit cards had outbound access to anything other then the 1 vlan that acted as a API layer from those servers and the banks. These companies should really just follow PCI and start there.

threeseed 11y ago
It is getting beyond a joke. The US government et al should really classify these as banks and force them to address the same privacy, disclosure, fraud prevention etc regulations. The potential of Bitcoin as something your grandparents could one day use is constantly being undermined by these cowboy operators.
- Lazare 11y ago
  1) Nothing is stopping you from refusing to deal with any Bitcoin exchange that is not audited to adhere to PCI 1 standards as adapted to deal with Bitcoins. If no such exchange exists, nothing is starting you from starting one. 2) I think far more damage is being done to Bitcoin by the political fighting and poor technical decisions of the core developers. Bitcoin weathered Mt Gox, it can weather Cryptsy.
noir_lord 11y ago
Not in payment industry, but side project requires heavy security, any good guides to PCI auditing, I see lots of fluff when I search and the auditors I've run into in the past have been at best a bit of a joke :)

Animats 11y ago

"Some may ask why we didn’t report this to the authorities when this occurred, and the answer is that we just didn’t know what happened, didn’t want to cause panic, and were unsure who exactly we should be contacting." This happened back in July 2014. $5M stolen and you didn't call the cops. They continued to do business and accept deposits even though insolvent. Only when a class action was filed because they were not paying out timely withdrawals did they disclose this theft. That just screams "inside job". (Yesterday I made the comment on another thread that Bitcoin exchanges seemed to be doing better; no major exchange had collapsed in 2015. Here we go again.)

rwmj 11y ago
Or perhaps just badly run, bordering on fraudulent. Where is this company based? Trading while insolvent is explicitly illegal, at least in the UK (https://en.wikipedia.org/wiki/Trading_while_insolvent https://en.wikipedia.org/wiki/Trading_while_insolvent).
- Animats 11y ago
  Southern Florida, the scam capital of the United States. Or they were. From the class action complaint: "CRYPTSY has vacated its Delray Beach, Florida physical office space without any indication where it would be relocating." Also, Paul Vern, the CEO, seems to be missing. One site claims he's in China, based on an IP address seen.
  - Animats 11y ago
    More info: WHOIS for cryptsy.com: Name: PAUL VERNON Organization: CRYPTSY INTERNATIONAL LTD Street: 5 CALLE AL MAR City: BELIZE CITY State/Province: BELIZE Postal Code: 00000 Country: BZ Phone: +1.8889639935 which is a "virtual office" space in Belize.[1] Cryptsy is not in Dun and Bradstreet or the Florida Department of Corporations database. But they have another corporate name, "Project Investors Inc." It has a BBB rating of F, with 17 complaints.[2] That business is registered with the state of Florida.[3] Those records include the CEO's home address, which is in Boynton Beach, FL. [1] https://www.abcn.com/offices-belize-city--calle-al-mar-3605 https://www.abcn.com/offices-belize-city--calle-al-mar-3605 [2] http://www.bbb.org/south-east-florida/business-reviews/business-and-trade-organizations/project-investors-in-delray-beach-fl-90098747 http://www.bbb.org/south-east-florida/business-reviews/busin... [3] http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName&directionType=Initial&searchNameOrder=PROJECTINVESTORS%20P130000104300&aggregateId=domp-p13000010430-6fc732fd-6494-4bce-a64e-bde23ee31e09&searchTerm=Project%20Investors&listNameOrder=PROJECTINVESTORS%20P130000104300 http://search.sunbiz.org/Inquiry/CorporationSearch/SearchRes...

lini 11y ago

Isn't every BTC transaction easily traceable? How can you prevent someone from examining the blockchain and following the stolen BTC until they are transferred to a known/public address?

Joeri 11y ago
You use standard laundering practices. Mix good money and bad money in one legitimate account, then pass it on from there minus a commission fee. It's impossible to track which money came from which account once it leaves the laundering operation.

bitJericho 11y ago

Seems like a good time to promote this alternative exchange: http://bitcoinsexchange.itmustbetrue.com http://bitcoinsexchange.itmustbetrue.com

bitJericho 11y ago
It's interesting how people appreciate this link when a new exchange is in the news, but how people dislike this link when an exchange gets compromised!
LyndsySimon 11y ago
Interesting. A Bitcoin Sex Change. We're truly living in the future.

Joeri 11y ago

Why weren't they insured against theft? Why did people deposit money with an exchange that is not insured against theft? Theft is a fact of life. You cannot have a perfectly secure bank, and you cannot have a perfectly secure bitcoin exchange. If you don't want to be hurt by theft, get insurance.

fixermark 11y ago
It's okay; the FDIC will.... Oh. Whoops. ;)
perlgeek 11y ago
> Why weren't they insured against theft? Because the insurance would have been way too expensive, or would have demanded way better operational security and auditing. And because they were able to operate without one.

unkoman 11y ago

Another day in bitcoin land. Sorry for your losses!

gchokov 11y ago

Oh Bitcoin.

forgetsusername 11y ago

>"Hello, Lucky7Coin is not maintained and I would like to take care of it. I have announced that on bitcointalk.org in Lucky7Coin thread. You’re the only exchange for this coin and I hope you will let me take care of it. I’m responsible. You don’t have to be afraid of errors or forks. I’m developing multipool and I know bitcoin internals and protocol." That's the email they received, and did business with this company, while overseeing millions of dollars in other people's money. Then got ripped off. Who needs banks? >If they are returned, then we will assume that no harm was meant and will not take any action to reveal who you are. If not, well, then I suppose the entire community will be looking for you. Not the FBI? Oh, right, they don't care. By the way, the guy who stole the coins was part of "the community". >2. Somebody else comes in to purchase and run Cryptsy while also making good on requested withdrawals. How is that even an option? What a bizarre story.

deleted 11y ago
[deleted]

wyldfire 11y ago

I love cryptocoins. But I think these high profile thefts will continue. And I think adoption/popularity will continue. If so, I would wager global law enforcement organizations will want to step in and offer merchants and users a service which traces and blacklists the outputs from thefts like this (until/unless returned to the original owner). If so, it would create a big rift between the many who enjoy cryptocoins' fungibility and independence from the state and those who want to punish/deter thieves. Big merchants like Overstock would want to publicly align themselves with "bitcoin is legit" and "we don't want to profit from that theft" activity. There'd be little that anyone could do to stop the law enforcement agencies from providing such a theft tracking service. And little anyone could do to stop merchants from integrating it into their services. It would be an interesting threat to the fungibility of bitcoin. Some cryptocoins (monero, et al) use ring-signatures that mask their specific input/output address path. I suspect if these events came to pass, those coins would become much more popular.

Animats 11y ago

Update: "cryptsy.com" is down. Not even responding to pings. Their blog ("blog.cryptsy.com") is still up, but that's hosted by Tumblr. Other reports indicate that the company's offices are vacant. It's time to get an arrest warrant out for the CEO, Paul Vernon.

Animats 11y ago
Update: Server is back up, but not doing transactions, all the numbers have frozen, and there's an announcement from "Big Vern" about the shutdown. (When the CEO calls himself "Big Vern", one might question the legitimacy of the company.)