11 ms·
Computer compromise leads to theft of bitcoins valued at $500,000 USD
- StavrosK 15y agoThe worst part of this is how irreversible it is. With a bank you might be able to get it back, with cash nobody can just siphon the actual paper money remotely, but with bitcoin you're out of luck.
- imjustatechguy 15y agoTraceability in the real world banking institutions has its advantages. As a business owner I've once had a mistaken transactions that resulted in erroneous withdrawal of +10,000 from business bank account. A phone call to the bank and a bit of investigation fixed things and I don't think the bank was out any money either, it was just a wrong account number issue. With bitcoin, things are not at all reversible. Also I expect bitcoin to be shutdown because it could be a great way to fund terrorist activities. (There are major federal investments in anti-money laundering systems that monitor bank transactions, bitcoin transactions operate outside of this system and thus will be suspect.)
- chopsueyar 15y agoThere are major federal investments in anti-money laundering systems that monitor bank transactions That worked really well for Wachovia... http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-drug-gangs http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-d...
- drivingmenuts 15y agoEven if it's not, that's the easy claim to make these days that will get them shut down. Kind of like "it's for the children". That phrase alone can be used to justify so many actions.
- mootothemax 15y agoWith bitcoin, things are not at all reversible. True of plenty of payment methods, e.g. CHAPS in the UK: Unlike other forms of payment such as cheques, CHAPS payments are irrevocable http://www.ukpayments.org.uk/payment_options/chaps/ http://www.ukpayments.org.uk/payment_options/chaps/
- ubernostrum 15y agoI think a better word is "traceable". Presumably with CHAPS one can find out who the money went to, and other mechanisms can come into play to get it back. Bitcoin, though, is supposed to herald the awesome future of totally anonymous, totally untraceable transactions in which once your money's gone, you're fucked.
- jasongullickson 15y agoAlso I expect bitcoin to be shutdown because it could be a great way to fund terrorist activities. So is cash :)
- mbreese 15y agoIt's pretty hard to move large quantities of cash around... it's pretty easy to move a flash drive with a bitcoin wallet around.
- imjustatechguy 15y agoThat is why people who try to bring into the US large amounts of cash through border control have it confiscated if they don't declare it. http://www.ehow.com/about_5445167_laws-bringing-cash-america.html http://www.ehow.com/about_5445167_laws-bringing-cash-america...
- gwern 15y ago> With a bank you might be able to get it back Only if it hasn't been transferred elsewhere and laundered and whatnot. Then all the bank is doing is penalizing its other customers to make you whole.
- amalcon 15y agoThere's some capacity for error or crime built into the numbers as they stand. This means that the bank is more-or-less insuring against those things. All customers reap the benefits of insurance, because the benefit is the security, not the restitution.
- BigZaphod 15y agoNobody would keep $500,000 in cash sitting around their house, but that's essentially what this guy did.
- brk 15y agoCompletely untrue. I've witnessed stacks of cash far in excess of that. However, when it is done, there is usually a fair bit of armament around the cash, and the kinds of people that keep that sort of cash on hand are also not the sort you want to commit an amateur robbery against.
- deleted 15y ago[deleted]
- stef25 15y agoWe're not all criminals. Civilians keeping 500K in their house is plain stupid.
- jlangenauer 15y agoDoubly so in the UK. Here, the police can presume without proof (and have done so) that any cash in excess of GBP1000 is the "proceeds of crime", and the onus is then upon the owner of the cash to prove that it isn't.
- gyom 15y agoSounds like a convenient rule for law enforcement to incriminate people when they have a "hunch" about their illegal actions. When I was 12 y.o. I had that sort of money in my bedroom (years of saving money from my paper route job, and factoring inflation). Of course, I could prove that it was mine, but it seems like the bar is somewhat low if it's set at GBP1000. It's the kind of money that you use to pay to rent a cottage for your vacations, not ludicrous drug-traffic amounts ...
- cakeface 15y agoIt seems like secure servers where you can store / access your bitcoins could be a good product.
- mootothemax 15y agoWith a bank you might be able to get it back I'm not sure that's true. As I mentioned in another comment, the CHAPS payment system doesn't allow transactions to be reversed, and the other major system in the UK, Faster Payments, I believe has a 24 window for banks to request a reversal, usually in case they transmit something by mistake. Honestly, I think we place too much faith in banks sometimes.
- StavrosK 15y agoProbably... At least it would be more traceable, though...
- nokcha 15y agoIn the US, consumer liability for fraudulent withdrawals from bank accounts is generally limited to $500 by federal law, provided that the consumer detects the fraud and notifies the bank within 60 days. The bank is responsible for the amount in excess of $500. Many banks even have a policy to refund the entire amount fraudulently deducted.
- chopsueyar 15y agoNope. http://www.wired.com/threatlevel/2011/06/bank-ach-theft/ http://www.wired.com/threatlevel/2011/06/bank-ach-theft/
- deleted 15y ago[deleted]
- pavel_lishin 15y agoValued by who? Hasn't this been fluctuating like crazy lately?
- chopsueyar 15y agoNo. One exchange one day.
- ctide 15y agoNo? I'd say a high of $24 and a low of $16.10 over the last 48 hours most assuredly qualifies as 'fluctuating like crazy.'
- chopsueyar 15y agoMan, JCP is fluctuating like crazy.
- ansy 15y agoI'm a BitCoin skeptic with the best of them. But this is breathtaking. That's one thing about bitcoins. There's no FDIC or SIPC watching your back. It's the wild west with train robberies and stage coach heists in all.
- astrodust 15y agoThe thing I find more dangerous than that is anyone with your wallet.dat file can go and do whatever with your account. There really should be additional checks. Having to sign your transfer requests and allow people to impose a voluntary delay on their transactions to allow time for cancellation would help significantly.
- Ixiaus 15y agoMy wallet is on an IronKey - in order for me to use it I have to plug it in and decrypt it. I also backup my wallet on a NAS server but the wallet is encrypted with GPG. Gotta protect your data!!
- recoiledsnake 15y agoAnd it's simple to run a keylogger after a brower/flash/pdf/java exploit to grab your password, isn't it? Not even admin/root access is needed.
- Groxx 15y agoNot if you have a secure means of input in your OS. OSX does, for instance, you can turn it on in the Terminal application and no loggers will see what you type. Unless they install as a kernel extension, then you're screwed. But that requires a password.
- trotsky 15y agoor a bog standard privilege escalation bug
- hullo 15y agoSeems fairly inevitable: if I sat by the window of my house, talking to anyone who walked by about having a large cache of money, which it was clear was also in my house... well, I would probably want to do one or all of: (a) invest in some quality locks; (b) stop talking about it; (c) keep my money somewhere else
- gravitronic 15y agohttp://blockexplorer.com/address/176LRX4WRWD5LWDMbhr94ptb2MW9varCZP http://blockexplorer.com/address/176LRX4WRWD5LWDMbhr94ptb2MW... That's the account record of the address that supposedly stole the huge amount of bitcoin. The maximum balance I see it have is 400 blocks. Is it missing from the record or is a bitcoin block larger than 1 BTC?
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- sp332 15y agoA BTC "block" is currently 50 BTC, I think.
- sp332 15y agoThis reminds me of the "come from" statement. COMEFROM is a long-running joke, it's a flow control statement which is intentionally confusing. It works like a GOTO but backwards. There is no indication in the area being jumped from that flow control is about to go somewhere else in the program. https://secure.wikimedia.org/wikipedia/en/wiki/COMEFROM https://secure.wikimedia.org/wikipedia/en/wiki/COMEFROM I think, when parts of your currency start to resemble any part of INTERCAL, you have a big problem :-)
- mrvc 15y agoIt's not really $500,000 though is it? As soon as you exchange a small amount of that into dollars you crash the exchange and the value drops significantly. I'd estimate it at about $30,000 worth.
- roel_v 15y agoCan you elaborate on how to came to the discount factor you used?
- mrvc 15y agoWithout knowing how much real backing the exchanges have it's hard to get a figure on what effect a large dump would have on the market. Additionally, you'll get shock dumpers who do a run on the exchange once they see value erosion. $30,000, although fabricated, feels right. Although i'd add that's probably an upper bound rather than expected value.
- csomar 15y agoHe means that there isn't enough people to cash with the current rate. That is $500K.
- roel_v 15y agoYes, I realize that, I'm just wondering how he came to 30k.
- pygy_ 15y agoIf you try to cash them out all at once, yes. On June 12th, $3,5M were exchanged on MtGox. For 8 of the last 10 days, the daily volume has been above $1M. I think that you could get these $500K in small chunks in a few days, provided you do it full time. Edit -- Source: http://bitcoincharts.com/charts/mtgoxUSD#rg30zigDailyzvzcvzlztgSzm1g10zm2g25 http://bitcoincharts.com/charts/mtgoxUSD#rg30zigDailyzvzcvzl...
- mrvc 15y ago
- recoiledsnake 15y agoMaybe there's value in creating a BitCoin bank that will hold money for people, just like real banks?
- jaysonelliot 15y agoMt. Gox and Bitcoin Market already do that.
- tybris 15y agoI now understand that BitCoin is actually an experiment to teach people basic economics and why many of today's rules and institutions (e.g., banks) exist. Sorry for criticizing it. BitCoin is an awesome educational tool.
- byrneseyeview 15y agoWhat prevents you from setting up a BitCoin bank? More interestingly: are the features that let you set up a dollar-denominated bank features or bugs?
- recoiledsnake 15y agoBanks are regulated by law and have the funds insured by FDIC. i.e even if the bank goes belly up, the FDIC will make sure the depositors get the money. With BitCoin, how do you trust a bank? Even if it's just by word-of-mouth trust, eventually the bank will be taken over or run by non-trustworthy people. The threat of federal prison keeps most real banks honest. Nothing like that exists in the BTC world.
- Astrohacker 15y ago> Banks are regulated by law and have the funds insured by FDIC. i.e even if the bank goes belly up, the FDIC will make sure the depositors get the money. With BitCoin, how do you trust a bank? There were banks before the FDIC and people trusted them. The threat of insolvency can (but doesn't always) keep them honest.
- recoiledsnake 15y agoTrue, but atleast the banks were real physical places with real people at the helm. It is really hard to trust anything over the internet these days,except if one of the big financial players like Citibank or someone like Amazon starts a bitcoin bank. AFAIK any of the online banks could be running out of a hole in the wall in Ukraine or Nigeria. Even paying online sites with credit cards is risky these days with the rampant fraud etc, I wouldn't trust anything online only enough to entrust my money unless backed by a big player.
- joeyh 15y agoIMHO the shadiest side of the bitcoin daemon is that it discovers peers by connecting to an irc channel. Just like a typical virus botnet handles command and control. Connecting these two uses of IRC is pretty obvious, and then you get a virus that attacks windows machines running bitcoin and steals wallets.
- cheez 15y agoThird sentence: > If only the wallet file was encrypted on the HD. Yep. Anyone who doesn't do this is stupid.
- berberich 15y agoI haven't used Bitcoin, so this is an honest question - Why doesn't the software encrypt the wallet automatically?
- cheez 15y agoBeats me. Probably one of those "get around to it later" things.
- nickik 15y agoBitcoin is a Thesis of one Guy. Its great in many ways but in terms of Softwaredesing and Engeniering at least the Client sucks. I've the Auther had knew it would be blowing up like this he would probebly have build something better. Its Open Source and you can interact via JSON so it would be that hard to build a good client that does this kind of stuff.
- adrianwaj 15y agoIt's in the works: http://goo.gl/XAiBr http://goo.gl/XAiBr and http://goo.gl/7HvQ4 http://goo.gl/7HvQ4 (see quote in #3)
- stuhood 15y agoSee https://github.com/bitcoin/bitcoin/pull/232 https://github.com/bitcoin/bitcoin/pull/232
- DrewHintz 15y agoI doubt that encrypting the wallet on the HD would have helped much. It sounds like allinvain's computer was compromised. The attacker could have copied the decryption key when it was used legitimately by allinvain.
- 15y ago
- llimllib 15y agoAnybody have the text of the post available? The site's not working for me.
- DrewHintz 15y agoI just got hacked - any help is welcome! allinvain June 13, 2011, 08:47:05 pm Hi everyone. I am totally devastated today. I just woke up to see a very large chunk of my bitcoin balance gone to the following address: 1KPTdMb6p7H3YCwsyFqrEmKGmsHqe1Q3jg Transaction date: 6/13/2011 12:52 (EST) I feel like killing myself now. This get me so f'ing pissed off. If only the wallet file was encrypted on the HD. I do feel like this is my fault somehow for now moving that money to a separate non windows computer. I backed up my wallet.dat file religiously and encrypted it but that does not do me much good when someone or some trojan or something has direct access to my computer somehow. The transaction sent belongs rightfully to this address: 1J18yk7D353z3gRVcdbS7PV5Q8h5w6oWWG Block explorer is down so I cannot even see where the funds went. I tried restoring an earler backup of my wallet but naturally that does not work because the transaction has already been validated. Needles to say I feel like I have lost faith in bitcoin. Anyone have any ideas what I can do besides just jump off a bridge?! --------------- [snipping out posts that don't contribute much] --------------- Re: I just got hacked - any help is welcome! June 13, 2011, 09:05:04 pm allinvain First thing that I noticed is that my slush's pool account got hacked into and someone changed the payout address to this: 15iUDqk6nLmav3B1xUHPQivDpfMruVsu9f I then changed the password and proceeded to run some antivirus and anti malware scans. Some stuff was found, but they were all cleaned up and they were all in my windows user profile temp dir which I deleted all the temp files. God I can't even type properly. Sorry folks I'm a bit emotional now. I then left another virus scanner running and went to sleep. When I woke up I check my bitcoin wallet. I leave the client running to help the network, and I notice -25,000 (and a transaction fee) gone. Fuck, I really should've moved the coins to a vmware linux session I have running. But the question is was it already too late? Could someone had my access to my wallet.dat for a long time and now just decided to "cash out"
- mrcharles 15y agoCorrect me if I'm wrong, but given the P2P nature of bitcoin, wouldn't it effectively give someone interested in malicious activity a list of target IP addresses? In theory he could set up his own P2P, watch for large transactions, and then he has an ip running a bitcoin client who (potentially) has a large wallet. Then it's just a matter of running common exploits (or new ones, if you have them) in order to access the machine and the bitcoin wallet.
- Astrohacker 15y agoThere's no way to know which IP address corresponds to which bitcoin address.
- omarchowdhury 15y agoThe point is that all of the IP addresses recorded in the network transactions are Bitcoin users.
- Groxx 15y agoNo, you can make a receiving address without ever connecting to the network. Current clients won't do so (that I'm aware of), but it's entirely possible. The main reason though is that new addresses aren't broadcast. The only time you know their location is when they send, and only if you were watching their traffic / the traffic of all nodes they sent to.
- cosgroveb 15y agoAlso: this is the perfect crime for those so inclined to do this. What authorities are going to give a damn about your missing Bitcoins?
- Jach 15y agoI've thought about that as well. But I would imagine if you have the technical chops to do that (I'd be interested in seeing a distribution of Mac/Linux/Windows users for BitCoin as well), you'd have the technical chops to get more money from other ways than stealing a few bitcoins. That said if I were a botnet master I'd put in some code to search for a wallet as a 'bonus'.
- AlexV 15y agoThis is why we can't have nice things.
- lukejduncan 15y agoBitCoin has an analog in cash. Yes, it's anonymous but there are things you simply dont do with it.
- william42 15y agoYes, but there's no FDIC-insured BitCoin bank, and there's no way to write a virus that steals cash.
- abofh 15y agoAnd there really can't ever be one. A bank requires some way to offset risk (insurance, etc); If it gets robbed, the insurer pays out; In this case, an insurer would need to physically keep more bitcoins than the insured on hand in order to handle a payout situation. Since bitcoins can't be 'printed' like dollars, there's no way to simply have an 'FBcIC' without allowing them to substitute something for those bitcoins in a payout situation (e.g., the USD cash value).
- stipes 15y agoThe design of BitCoin only includes very weak anonymity. A medium-to-large scale network analysis could most likely break any anonymity people thought they had.
- stuhood 15y agoAdding Tor to the equation makes the system fully anonymous, assuming you don't leak other information.
- shareme 15y agoahem, read up on European history.. The Merchant trade in Europe came up with three valued things: 1. Corporations 2. Insurance 3. Banks Those three items are related to one another. While its true that due to the anonymous nature BitCoin is biased towards illegal mafia-like formation of banks and such for illegal activities as soon as legal activities start using them as trade banks, insurance, etc will form as a nature evolution.
- joeycfan 15y agoNOW will they PLEASE ENCRYPT the wallet.dat file?????
- pnathan 15y agoSounds to me like a BTC bank should be set up, with corresponding accounts. Instead of 'you' holds all your BTC, your BANK holds most of your BTC in a secured location, and you can make withdrawals to your account on demand. Of course, this would effectively require an insurance corp also set up in such a fashion that integrity of the bank could be configured. /hmm... maybe I should do this!
- pnathan 15y agoSounds to me like a BTC bank should be set up, with corresponding accounts. Instead of 'you' holds all your BTC, your BANK holds most of your BTC in a secured location, and you can make withdrawals to your account on demand. Of course, this would effectively require an insurance corp also set up in such a fashion that integrity of the bank could be configured. /hmm... maybe I should do this!
- edw 15y agoThis guy's experience reads like something out of a William Gibson novel. If BTC takes off, I wouldn't be surprised if the world got several orders of magnitude nastier, malware-wise. If the value of breaking into someone's machine is not merely the computer's connectivity or, worse, information to enable identity theft but actual, untraceable value-holding currency, you know the incentive to compromise computers is going to skyrocket. Are we prepared to live in that world?
- wmf 15y agoWhat's the cyber-analog of those "driver carries no cash" signs?
- edw 15y agoFunny. More seriously, this reminds me of the difference in deterrence value between Lojack and The Club: Lojack makes it little less likely that any particular car will get stolen but increases the likelihood that a car thief will be caught. The Club basically says, "Go steal someone else's car." "Driver carries no cash" is well intentioned but says, "Go rob someone who does have cash." It has a local deterrent value perhaps, but is of limited value as a deterrent from robbing people who drive delivery trucks. All of this gets me wondering? Does UPS still do COD? And if so, do they accept cash?
- Vitaly 15y agosomeone should make a physical bitcoin wallet device.
- deleted 15y ago[deleted]
- atakan_gurkan 15y agoIt seems to me that Bitcoin requires an actual wallet. A physical device that will store your "money" ie. verifiable account info, the way a general purpose computer is storing it now.
- insulation 15y agoFor a bunch of DIY hackers, I'm sort of surprised you guys are so willing to hand your money and control over its security over to the government and financial institutions. Then again, I was a computer security guy for the government and online financial institutions, so I guess I'm comfortable with my ability to protect my (very very small amount of) money, or I'm just more cynical about them. Western Union is irreversible, and would probably have been shut down if it wasn't so well-established. Most other US payment systems are reversible, which is why you have holds on getting the money out of those systems - they want time to detect fraud and reverse the fraudulent transaction. This requirement for reversibility seeps through the system, which makes anonymity very difficult, and causes a lot of friction on anything that changes a reversible payment into a non-reversible payment, since that's where you eat the fraud. Now you know why it's hard to get cash equivalents out of the system, especially to a remote party. The point here is that once the money is in a non-reversible network, you can accept a payment and know that it's good very very quickly. If you make bitcoin reversible, you might as well just use one of the old payment systems, where the money might disappear later (and you'll be out your privacy, goods, cash and services), or you'll be paying transaction fees based on your charge-back rates, and unable to charge more for the reversible payments than the non-reversible ones due to contracts you have to sign to be part of the payment network - and thus the non-reversible payers subsidize the reversible payers. What a racket. As we used to say, "there's no good guys in payment processing, only bad guys and less-bad guys".