7 ms·
BitGrail lost $170M because only client-side validation was used
- fabian2k 9y agoThis seems to be based entirely on an anonymous post, at least as far as the linked tweet goes. It wouldn't really surprise me anymore if anything like this happened, but there doesn't seem to be any evidence here. Or did I miss something here and there is more than just the anonymous post here?
- chrishn 9y agoYeah, who'd believe an anon on 4chan...
- ukulele 9y agoThe referenced post [0] came to the same conclusion as my first thought: this was very possibly an intentional security hole to allow someone on the team to get away with something. [0] https://amp.reddit.com/r/CryptoCurrency/comments/7wonkf/the_stolen_xrb_has_already_been_redistributedsold https://amp.reddit.com/r/CryptoCurrency/comments/7wonkf/the_...
- StavrosK 9y agoThis echoes my experience, because this client-side check was definitely on the server side too, when, uhh, a friend tried to break it.
- Nicksil 9y agoNon-AMP link: https://www.reddit.com/r/CryptoCurrency/comments/7wonkf/the_stolen_xrb_has_already_been_redistributedsold/ https://www.reddit.com/r/CryptoCurrency/comments/7wonkf/the_...
- nothrabannosir 9y agoIronically, that doesn’t work with JavaScript disabled. I don’t know what to believe, anymore ...
- oneweekwonder 9y agoDoes the old i version use js? https://i.reddit.com/r/CryptoCurrency/comments/7wonkf/the_stolen_xrb_has_already_been_redistributedsold/ https://i.reddit.com/r/CryptoCurrency/comments/7wonkf/the_st...
- nothrabannosir 9y agoAh, nice. Thanks. No it does not.
- highace 9y agoDon't attribute to malice what can be explained by stupidity ;) There's been a shockingly high amount of young inexperienced devs involved in building for crypto. I remember making similar mistakes when I was starting out as a dev... except I wasn't solely responsible for systems handling millions of dollars.
- ukulele 9y agoTherein lies my skepticism. It's an industry that seems to be full of "oops we lost your money, trust me" problems. Malice becomes a lot more likely when life changing sums of money are involved.
- jpatokal 9y agoRemember, a lot of these cryptocoins started out as toys, experiments or get-rich-quick schemes that were never seriously designed to handle millions of dollars. MtGox is perhaps the classic example here: the biggest Bitcoin exchange of its time started out life as a Magic the Gathering trading cards exchange, and just kept on hacking on that shitty codebase until it inevitably got pwned.
- IntronExon 9y agoCounterpoint, Heinlein’s Razor. "Never attribute to malice that which can be adequately explained by stupidity, but don't rule out malice.”
- beaconstudios 9y agobut then, any sufficiently advanced stupidity is indistinguishable from malice.
- IntronExon 9y agoVery true, but the “means, motive, opportunity” test can help there. The motive here would be $170 million usd.
- 9y ago
- redm 9y agoI'm not so sure this was intentional, as some people have speculated, nor do I see any evidence that a check was not previously in place. Remember when Dropbox allowed anyone to login to an account without a password? [0] That doesn't mean Dropbox never checked passwords, or intentionally dropped the check. Especially in the crypto space, iteration happens fast and bugs like this can come up. It seems pretty obvious that they not only had a defect, but did not have the appropriate monitoring, or alternating in place to identify the issue either. I try not to leave coin on exchanges due to hacking, bankruptcy, fraud, etc. [0] https://www.cnet.com/news/dropbox-confirms-security-glitch-no-password-required/ https://www.cnet.com/news/dropbox-confirms-security-glitch-n...
- IntronExon 9y agoRight, but Dropbox had plenty to lose and nothing to gain from their mistake. If this was intentional, there are 170 million reasons why.
- StreamBright 9y ago"Especially in the crypto space, iteration happens fast and bugs like this can come up." You think it is ok in the crypto space to itroduce bugs like this?
- sincerely 9y agoI am struggling to read their comment in a way that suggests that.
- justherefortart 9y agoIf this is legitimate, it's hilarious.
- LyalinDotCom 9y agoHire great people with a passion for the trade and most employers won’t have to suffer through crap like this.
- bdcravens 9y agoI believe we're seeing a generation of developers with passions for things like client-side development and the "disruption" of cryptocurrency, who don't see the server-side as the true gold in the vault that it is.
- brailsafe 9y agoWhile I don't necessarily disagree, wouldn't this be more of an example of naive server-side development? One of the first things you learn—as an educated—front-end developer is that you don't trust the client.
- bdcravens 9y agoTrue, except that in a lot of small teams, you see the same developers handling both.
- bpicolo 9y agoIt's not impossible (or even unusual) to do both competently. Helps that frontend is a smaller surface area.
- bdcravens 9y agoI completely agree. I just think that we're seeing a category of developers that consider the front-end to be of higher priority, with everything that goes with that mindset.
- brailsafe 9y agoDo you feel as though there can be an objectively higher priority end of development? If so, why?
- PricelessValue 9y agoReminds me of coinbase using mongodb with silent fail and no ACID transactions a few years back. And of course the mtgox fiasco. The amount of amateurishness in the cryptocurrency ecosystem is disappointing.
- ozmbie 9y agoIt’s worse when you want to store the coins yourself, so you withdraw from an exchange only to realise that the wallets available are either broken or have horrible UX. I just don’t see how an altcoin without a functioning wallet can have billions of dollars of market cap.
- charlesdm 9y agoEasy: $1 invested does not equal $1 in market cap. Not sure where I read this, but there was a post where a guy wrote he invested $5,000 in a coin and it increased the market cap by $4m.
- ricardobeat 9y agoThis is also true for stocks. As a buy pulls the latest price up, all of the other shares are worth more, and the opposite is true: for every sale, the price might slip down a bit; in the event of a large sell-off, you end up reaching zero value a lot earlier than everything can be sold off. Market cap is a bit of a fantasy metric, but has utility - just less so for crypto where you can't make any comparisons to tangible assets, liabilities or even market potential.
- granaldo 9y agoTrue for coin with low liquidity which is why chart ranking solely based on market cap is inaccurate, an alternative is https://www.coingecko.com/en https://www.coingecko.com/en If the orderbook is thin and supply circulated is plenty, the market cap moves by the tradr
- latchkey 9y agoMarket cap is a useless number in the crypto world that people quote because it sounds nice. It is simply current price * number of outstanding shares [1]. It has no reflection on the actual money being put into the market, which is what people would like to transform it into in their heads. [1] https://www.google.com/search?q=market+capitalization+definition https://www.google.com/search?q=market+capitalization+defini...
- philfrasty 9y agoThey had multiple other „problems“, too. See for example https://www.reddit.com/r/RaiTrade/comments/7n0ou8/an_explanation_of_how_the_shitshow_that_youve/ https://www.reddit.com/r/RaiTrade/comments/7n0ou8/an_explana... The chat log from Exchange-Owner + Nano-team also speaks volumes https://www.dropbox.com/s/3g38y67luolfvqs/Colin_ZS_Bitgrail_chat_log.pdf?dl=0 https://www.dropbox.com/s/3g38y67luolfvqs/Colin_ZS_Bitgrail_...
- deleted 9y ago[deleted]
- kaivi 9y agoThere is a chat group in Telegram, called "BitGrail Trollbox". It doesn't have a direct link, but one can join when searching the group name through client application. The Bomber dude is there, and it seemed like there is a discussion about what car to buy with all that money. I was removed from it the instant I joined, maybe someone can join and quickly dump the chat log?
- jxub 9y agoIt seems relevant to add here that the most famous message from the trollbox was "What if price falls to 2k?", which became a popular meme in the community when talking about price. The guy was referring to satoshis instead of dollars though. Many people believed BitGrail was a good guy, a tiny minority thought they were evil, and few believed that they were just plain stupid. And we believed that a centralised entity can paradoxically store Nano better than some web wallet, and waited patiently for Ledger support. It's a shame that this stuff happened to Nano as the community is one of the best in crypto, with quite a lot of developer involvement [1]. If Nano meets it's TX throughput and speed guarantees, all of that while proving that the network is resistant to spamming or can cope with it by chain pruning effectively, this little DAG wunderkind will definitely be here to stay. A large part of the early holders may be bitter by what happened on that Italian exchange though. Nano's struggle resembles the Bitcoin Early Days. Being a Protocol Adopter means ultimately embracing the idea of being a lab rat. And rats may inherit the post-human (or post-fiat money) world. [1] https://github.com/RaiMakers/awesome-nano https://github.com/RaiMakers/awesome-nano
- yorby 9y agoWhat car to buy with $170M? it must be a kid...
- wcr3 9y agoIt's just JavaScript(TM)!
- jimjimjim 9y agoremember, just ship it. doesn't work? ship it and let the users tell us what's wrong. maintenance nightmare? ship it and then ship it's replacement later. not designed for security? just get bob's cousin, who says he's a hacker to try it, then ship it.
- latchkey 9y agoAnother interesting link that puts together a timeline of events: https://www.reddit.com/r/CryptoCurrency/comments/7wp334/the_bitgrail_hack_what_we_know_and_what_we_dont/ https://www.reddit.com/r/CryptoCurrency/comments/7wp334/the_...
- lsmod 9y agophp has nothing to do with it. Can't say the same for the second part though.
- deleted 9y ago[deleted]
- almostApatriot1 9y agoI don't buy this claim. Negative numeric values would break the backend in 99% of scenarios. I also don't really buy the claims he personally was involved in stealing the xrb. Bitgrail has existed for a while, and presumably the owner would have some interest in XRB, probably owning a substantial amount since it was worth nothing. Considering its meteoric rise, he probably became rich himself. So why try to steal 170 million dollars in a scam where you're bound to be accused of being suspect number 1?
- cmer 9y agoI've been closing this very closely for a few months. I think he thought he could arbitrage and benefit from the increase in BTC's price and get away with it somehow. The market came crashing down, XRB got listed on Binance and Kucoin and a lot of shadiness happened right around the same time. I was expecting this "hack" to be announced and founder to exit-scam just based on his behaviour and actions he was taking. I wouldn't be surprised at all if he ended up in jail.
- bb88 9y agoThat's one way to short a cryptocurrency.