8 ms·

500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

276 points by eis 15y ago

deleted 15y ago
[deleted]
base 15y ago
Out of curiosity, how does the Mt.Gox hold the bitcoins. Do they have a bitcoin account for every user or do they hold all the bitcoins in their account and trades are only changes in their database?
- wmf 15y ago
  The latter; in the block chain you can see a single address that holds over 400K BTC.
nazgulnarsil 15y ago
This is an "I told you so" post, but not about bitcoin, about the current exchanges. I haven't cashed out any bitcoins because the current exchanges are a fucking joke and I've said as much many times in the IRC channel and forums. Bitcoins will remain a novelty for people with lots of disposable income until it has a real money changing service linking it to other exchanges. I can not conceive of the level of folly it would take for me to put anything more than pocket money on one of the current exchanges.
citricsquid 15y ago
So for someone who doesn't understand economics that much, what does this mean? Have bitcoins finally failed?
- lordgilman 15y ago
  Someone just went to sell a ton of bitcoins at once. Because the market's so small they were able to fill all the buy orders placed all the way down to 1 cent per bitcoin. Some people with long-shot bets made quite a bit of money. About half of the 500k filled the buy orders on the way down and half of them were sold at the 1 cent price.
  - joezydeco 15y ago
    Which kind of implies someone was doing this with stolen coins, right? You don't sell so cheap if you have USD 8,500,000 on paper and want to get as much possible out of the sale.
    - lubos 15y ago
      unless you are US government trying to destroy alternative currency. right?
      - joezydeco 15y ago
        This didn't destroy bitcoin... but it made a lot of cash for some bottom feeders.
        barkingcat 15y ago
        What they did was destroyed the reputation of Mt. Gox - I don't think the Gox people will have a very good outcome as their customers jump ship to other exchanges. BUT on the other hand, you could say Mt. Gox was asking for it with such poor security measures. A day ago, it was a CSRF hack ... and today it's a database dump. I tell ya, tomorrow, the code for their trading platform will hit the net. In fact, I wouldn't put it past the operators of the other exchanges to perpetrate something like this. In reality, no damage to the bitcoin network was done, but Mt.Gox ended up with egg on their face. Where will all the trades go? To other bitcoin exchanges - and there goes the services charges too. There's a sizable amount of money to be made by taking down Mt. Gox.
- deleted 15y ago
  [deleted]
- InclinedPlane 15y ago
  Imagine if someone stole 7% of all printed currency in the US and then traded it for gold at effective prices as low as pennies on the dollar. That's effectively what just happened with bitcoins.
- Tichy 15y ago
  BitCoins haven't really started yet in my opinion. It seems far too early to say they have failed or not.
- rmc 15y ago
  Not as such. As an example, Steve Jobs ownes 7% the shared of Disney. If tomorrow, he were to sell them all, no matter what the price, there might not be enough people to buy them all, so people who, for the laugh, said they'd buy Disney stock at $0.01 a share would eventually get the shares. Thus the stock price for Disney would drop to $0.01. A similar thing just happened to BitCoin, but rather than shares of Disney being traded, it was bitcoins.
  - chamakits 15y ago
    This is the best explanation so far. Thanks!
crayz 15y ago
That's about 7% of the total number of bitcoins in circulation. Anyone have details on how this happened? http://blockexplorer.com/q/totalbc http://blockexplorer.com/q/totalbc
- enki 15y ago
  according to the guy running the exchange: user with 500k bitcoins was hacked (probably password bruteforce or csrf). they'll probably reverse all transactions since then
  - andypants 15y ago
    Who is 'they'? As far as I understood bitcoin, there is no authority. Nobody can do anything about a user having 500k of his coins hacked, and nobody can do anything about the market crash either.
    - Osiris 15y ago
      As long as the money hasn't been withdrawn from the market, the market should be able to reverse all the transactions. The problem would be if the BTC or USD were withdrawn from the market before they shut down trading.
    - enki 15y ago
      the exchange is a central authority, and acts like one. you can do whatever you want with your bitcoins, but currency exchange is liable to laws and regulations.
    - jaekwon 15y ago
      as far as i know you're right. there is no infrastructure for rollbacks of any kind.
      - olex 15y ago
        MtGox != Bitcoin. Transactions on bitcoin network cannot be undone, that is true; however, MtGox will undo the transactions inside their system (buys and sells within MtGox). The only thing that cannot be undone is the withdrawal of 80 stolen BTC from a MtGox account into Bitcoin network.
Osiris 15y ago
mtgox.com is offline. Did they shut trading down?
- tijs 15y ago
  the site has been on and off for the past week or so. not intentional perse just busy servers as far as i can tell.
  - swishercutter 15y ago
    I was in the bitcoin forums and mt gox as this happened...they shut down afterwards.
eis 15y ago
A little bit explanation: Mt.Gox is the biggest bitcoin market place by far. During the last 1h the whole volume of about 500k BTC was traded making the price drop from somewhere around $17 to virtually nothing. Details are not available yet. It could have been a bug or an intrudor. Rumors have it that someone with a huge wallet got hacked. <+MagicalTux> someone with lots of coins did get hacked MagicalTux is working on Mt.Gox Also some other markets like btcex or tradehill are seeing problems and/or price drops. Update: Mt.Gox have published an announcement: https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...
- weavejester 15y ago
  I'm surprised that people with large amounts of bitcoin don't have better security measures. For that amount of money, I'd consider securing the private key in a safety deposit box. Probably several safety deposit boxes, actually.
  - tlrobinson 15y ago
    They apparently had 500k BTC in their MtGox account, which is insane. Unless they were actively trading all of that they should have withdrawn from MtGox to the BitCoin network.
    - saalweachter 15y ago
      I keep reading about people only being able to take a small number (50 or 80 BTC) out of the market at once, which is why the hacker couldn't do the same. If that is true, then once you have your 500k BTC in the exchange, it will take you over a decade to get them out, either as cash or as bitcoins.
    - joeyh 15y ago
      If they were Satoshi, they could be sitting on enough early-adopter bitcoins that 500k is relatively not insane.
skrebbel 15y ago
i must admit i'm somewhat impressed how fast the hackers and cheaters managed to take over bitcoin trading. i think it's kind of cute. people hoped for an economy no government could control, and got exactly that: anarchy and a burning world.
- leon_ 15y ago
  well the IRL exchanges are run by cheaters and there's not much anarchy around yet.
- kiba 15y ago
  It just mean that the market is really small.
  - mikemoka 15y ago
    do you mean that if the market would be bigger such things won't be done? they could do more of the same unfortunately..
    - Macha 15y ago
      If the market was bigger, 500k would not crash it, as there would be enough buy orders to take someone dumping 500k. It would still be crashable, but more would be needed if it was bigger.
    - seats 15y ago
      When the market is really big, then only the really rich people can manipulate it. Comforting thought ;)
      - wmf 15y ago
        It's already a little disturbing to realize that a single account held 261K BTC out of 6.5M BTC in circulation.
        15y ago
deleted 15y ago
[deleted]
mikemoka 15y ago
maybe they did it for the lulz again? http://twitter.com/#!/LulzSec/status/79678588407906304 http://twitter.com/#!/LulzSec/status/79678588407906304
lubos 15y ago
If this was legitimate "dump" (by someone who obviously didn't care about the money), it was certainly the fastest crash of any known market ever.
ebaysucks 15y ago
If the 500K Bitcoins sold are the total of the Bitcoins in all MtGox wallets, than Bitcoin is over. Sample of one: I have for about 100 USD in Bitcoins at MtGox, if they got stolen today, I will leave the project.
- erikpukinskis 15y ago
  Yea, I had been keeping my bitcoins in MtGox too, but I figured at the very least I wanted to have two points of failure, so I moved half of them onto my computer. Figured worst case scenario I'd lose half in a single day. But hopefully that's not what happened!
- andypants 15y ago
  I think the bitcoins belonged to a guy who had his wallet of 500k stolen some time around last week.
  - lubos 15y ago
    he had only 25k stolen.
  - romland 15y ago
    You're probably thinking of the guy who claimed he lost 25k bit coins (which at that moment was "worth" 500k USD). This was a trade of 500,000 bit coins.
    - andypants 15y ago
      Ahh yes, you're correct, I got confused.
Tichy 15y ago
Does anybody have a link to instructions for reading that kind of chart (or the name of the chart type)? I used to know, but it has been many years. I suppose green bars means the price went up and red down, and the bar extends between the high and low price. But what does the chunk in the middle mean? And where can I see that 500k were traded?
- Macha 15y ago
  EDIT: The below is wrong, see here: http://en.wikipedia.org/wiki/Candlestick_chart http://en.wikipedia.org/wiki/Candlestick_chart The chunk in the middle is the price for the majority of trades, and the lighter bar is all trades, if I remember right.
  - yesimahuman 15y ago
    The small bar indicates the range of prices during the time frame (for example, each bar could represent 15 minutes of trading on a 15 minute chart). The big bar shows the closing and opening prices for that time range. If the closing price is below the opening price the bar is red, and vice versa. The red bar that shoots up from the bottom is the trading volume, and usually isn't covering up the bars so it looks strange. It just says a ton of BTC was sold in that time frame.
- yesimahuman 15y ago
  It's called a candlestick chart. http://en.wikipedia.org/wiki/Candlestick_chart http://en.wikipedia.org/wiki/Candlestick_chart
- knowtheory 15y ago
  There are two charts here. Along the bottom of the chart is the volume of trades, i.e. how many shares/coins are being sold or bought (and whether they're being sold or bought). The chart in the middle is the price and variability of the trades (i think). Not a stock person or a BTC trader. Just gawking at the spectacle.
gburt 15y ago
Lower limit of $0 a bitcoin showing there, did someone really dump bitcoins at $0.01?
- eli 15y ago
  $0.01 is still a profit if you stole the coins.
Tichy 15y ago
Interesting that on bitmarket.eu there are a lot of buy offers for 0.01€ suddenly. I wonder if those are already bots trying to automatically react to the mtgox price.
- joezydeco 15y ago
  More likely, people trying to make bank when (not if) it happens again.
  - Tichy 15y ago
    Ah, true, taking advantage of market glitches. I should add some positions for that, too :-)
    - joezydeco 15y ago
      The real question is if mtgox can actually reverse trades like they claim they're going to do as a result of this situation. In a regulated exchange it's certainly possible. Is it possible with bitcoin? Once the block is away...it's away.
deleted 15y ago
[deleted]
- swishercutter 15y ago
  You know whats funny about that whole 25k thing...he has shown no proof, says he filed a police report but has not shown it, media went wild with it (with no evidence) and to the best of my knowledge no media outlet has interviewed the supposed law enforcement regarding the matter....I smell some FUD...there are numerous more inconsistencies with his story and many believe him to be a troll. NO early adopter leaves his wallet.dat file unprotected on a known compromised computer. Especially one who claims to be an early adopter and saying he got in later in the same post. If you really read that whole thread you will smell a rat or troll also.
  - marshray 15y ago
    NO early adopter leaves his wallet.dat file unprotected on a known compromised computer. Now that's making claims without proof.
    - ScottBurson 15y ago
      Not only is it making claims without proof, the claims make no sense. Why would anyone with a large pile of Bitcoins want to drive the price down by advertising how insecure the currency can be?
    - swishercutter 15y ago
      My response was to a comment that was deleted...If you go and read the thread he posted to...which is about the supposed theft last week there seem to be a bunch of inconsistencies with the story...the biggest being he supposedly had 3btc stolen but he leaves his wallet unencrypted, unprotected, on a computer that after having supposed 3btc stolen and flagging a virus threat...either he is lying or he is very stupid...either way I do not feel bad. As for what happened this morning I believe that the market snapped right back was a good sign...someone dumping .5M BTC at once at the lowest possible amount and it still came back in minutes.
buro9 15y ago
From the mt.gox site: Huge Bitcoin sell off due to a compromised account - rollback The bitcoin will be back to around 17.5$/BTC after we rollback all trades that have happened after the huge Bitcoin sale that happened on June 20th near 3:00am (JST). Service should be back by June 20th 10:00am (JST, 01:00am GMT) with all the trades reversed and accounts available. One account with a lot of coins was compromised and whoever stole it (using a HK based IP to login) first sold all the coins in there, to buy those again just after, and then tried to withdraw the coins. The $1000/day withdraw limit was active for this account and the hacker could only get out with $1000 worth of coins. Apart from this no account was compromised, and nothing was lost. Due to the large impact this had on the Bitcoin market, we will rollback every trade which happened since the big sale, and ensure this account is secure before opening access again. I'm interested in the fact that they can do a rollback... is that just a rollback of their transaction log? Are they buffering transactions for a significant period before submitting them back to the network?
- iki23 15y ago
  [Update - 2:06 GMT] What we know and what is being done. * It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked. * Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hashing. The unsalted user accounts in the wild are ones that haven't been accessed in over 2 months and are considered idle. Once we are back up we will have implemented SHA-512 multi-iteration salted hashing and all users will be required to update to a new strong password. * We have been working with Google to ensure any gmail accounts associated with Mt.Gox user accounts have been locked and need to be reverified. * Mt.Gox will continue to be offline as we continue our investigation, at this time we are pushing it to 8:00am GMT. * When Mt.Gox comes back online, we will be putting all users through a new security measure to authenticate the users. This will be a mix of matching the last IP address that accessed the account, verifying their email address, account name and old password. Users will then be prompted to enter in a new strong password. * Once Mt.Gox is back online, trades 218869~222470 will be reverted. https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...
eis 15y ago
Newest update: Apparently someone got the whole user account database of Mt.Gox I wont publish the link to it though for obvious reasons. Quick analysis: the database is legit, it contains user id, username, email if set, and a bcrypt hash. The hashes seem salted with a global salt.
- kabushikigaisha 15y ago
  I don't think the db is public, it's being sold for a price.
  - omarchowdhury 15y ago
    http://evilrouters.net/wp-content/uploads/2011/06/accounts.csv.bz2 http://evilrouters.net/wp-content/uploads/2011/06/accounts.c...
  - gokhan 15y ago
    Quite public. At least passwords seem to be hashed, though.
  - personalcompute 15y ago
    It's public. I have the db loaded in mysql right now, and have confirmed its validity (my account is in there).
- deleted 15y ago
  [deleted]
- olex 15y ago
  Password hashes are standard php crypt() ones. I'm in that DB, was able to generate the hash using the DB entry (in contains the salt for each password) and my one-time password from mtgox. One-time PWs ftw.
- deleted 15y ago
  [deleted]
- xfs 15y ago
  About 1600 passwords in this database are hashed with plain md5 without salt. I found quite a lot hits (34% success rate) using a rainbow table cracker.
spenvo 15y ago
The flash sale broke the price resistance chart: http://mtgoxlive.com/orders http://mtgoxlive.com/orders
tlrobinson 15y ago
There's an alleged database dump of Mt Gox floating around... https://twitter.com/#!/954/status/82531189705019392 https://twitter.com/#!/954/status/82531189705019392 UPDATE: looks legit. http://forum.bitcoin.org/index.php?topic=19543.0 http://forum.bitcoin.org/index.php?topic=19543.0 https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...
- kristofferR 15y ago
  Damn, I'm in there. Glad I used a generated password (from LastPass) so I don't have to change my passwords on a lot of various sites.
  - deleted 15y ago
    [deleted]
  - lubos 15y ago
    this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into google from that file and yes, many of them are present in rainbow tables. damn. makes me angry as a programmer how financial website can be this unsecure and easy to compromise.
    - jtchang 15y ago
      They look like salted hashes to me.
      - lubos 15y ago
        you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)
        15y ago
nkohari 15y ago
The entire account database was also leaked: http://forum.bitcoin.org/index.php?topic=19543.0 http://forum.bitcoin.org/index.php?topic=19543.0
- sudonim 15y ago
  So it was... I confirmed my username is in there but at least passwords are hashed. Luckily, I never added an email address and used a different Username and pw than I do everywhere else. Gotta take precautions with bitcoin!
  - Tichy 15y ago
    Doesn't look as if passwords were salted, though :-( (Edit: just read in another comment that there seems to have been a global salt)
    - funkah 15y ago
      Very sloppy. When you're dealing with actual money, industry-standard practices like this shouldn't be considered optional.
      - rchowe 15y ago
        Legally, they're not. Bitcoin just isn't actual money in any country. Someone should buy sealand and change the national currency to bitcoin...
        weavejester 15y ago
        What would be the point of doing that?
        lutorm 15y ago
        You can also have real money in your mtgox account.
    - olex 15y ago
aquarin 15y ago
We shouldn't be surprised by this. This monetary have no authority behind it.
- aquarin 15y ago
  What is the point of down votes without explanation?
  - vessenes 15y ago
    You're being downvoted because you neither understand the Bitcoin system nor the mechanics of how Mt. Gox works, as evidenced by your post.
    - aquarin 15y ago
      Sure, i don't understand it, neither the people who brought bitcoins.
      - weavejester 15y ago
        And you're basing this statement on what evidence?
  - blackbeltjones 15y ago
    Your post ran counter to internet-libertarian dogma.
    - aquarin 15y ago
      Probably. I regret each time i comment here, but I attribute this to the cultural differences between California based NH-users and the rest of the world.
      - weavejester 15y ago
        It's not cultural differences between California and the rest of the world. It's simply that your statements indicate you're commenting without an understanding the subject matter. This incident occurred because (a) people with large amounts of bitcoin do not always store them securely, and (b) the bitcoin market is very small, and therefore can be destabilised by relatively small amounts of money (a few million dollars, for instance).
phamilton 15y ago
I'm a little annoyed that MtGox effectively is bitcoin. I've been spending my mined coins on goods from various merchants and it has been working great. That's what bitcoin is designed to be, a currency. Recently there's so much speculation and people buying, holding and selling that so much focus has shifted away from the real use.
- caf 15y ago
  Mining was never supposed to be the primary means to obtain bitcoins. As long as people are still being paid salaries in other currencies, they'll need to use an exchange to buy bitcoins if you want them to participate. On the other side of the (bit)coin, do you suppose those merchants you're buying from can pay all of their suppliers in bitcoins? So they need the service of an exchange, too.
funkah 15y ago
I wanted to see if I could buy some on the cheap, but I wasn't already set up to do so. I would never take this currency seriously, but I'd be willing to put in a bit of money to speculate a bit. I looked at bitmarket.eu but they have a manual verification process, which I'm sure would not complete until after the price recovers. Oh well.
trotsky 15y ago
This was apparently on HN 14 hours ago: Mtgox hacked database listed for sale (pastebin.com) http://news.ycombinator.com/item?id=2670302 http://news.ycombinator.com/item?id=2670302 pointed to: http://pastebin.com/ui0nusuZ http://pastebin.com/ui0nusuZ which says: I have hacked into mtgox database. Got a huge number of logins password combos. Mtgox has fixed the problem now. Too late, cause I've already got the data. Will sell the database for the right price. Send your offers to： gfc06@hotmail.com
- Tichy 15y ago
  Was he accepting BitCoins?
Tichy 15y ago
I like the looks of this chart of the crash, haven't seen that kind before: http://leanback.eu/bitcoin/plots/20110619195756-mtgox.png http://leanback.eu/bitcoin/plots/20110619195756-mtgox.png (found via @zedshaw on Twitter)
- Macha 15y ago
  And Zed found it from me on Twitter, and I found it on this thread: http://news.ycombinator.com/item?id=2671576 http://news.ycombinator.com/item?id=2671576 (Just setting the record straight as Zed attributed it to me)
mrkva 15y ago
If you feel like complaining, check Complainr: http://complainr.syx.sk/ http://complainr.syx.sk/ Some people already started :)
pnathan 15y ago
I'm on record here as saying a few weeks ago that a BTC bank needs to be established. I reiterate my position. A BTC bank needs to be established, with appropriate data protection features.
- Astrohacker 15y ago
  Sounds like a startup opportunity.
  - pnathan 15y ago
    Absolutely. I wish I had enough time and security knowledge to do it. A BTC bank will have to have some no-kidding competent security around it.
omarchowdhury 15y ago
<CorvusCorax> poor bot had a division by zero when trying to calculate the mt gox exchange rate
anonymous 15y ago
haha
KarlFreeman 15y ago
If you want to check if you've been Mt.Goxed I whipped up a little something for that http://mtgoxed.herokuapp.com/ http://mtgoxed.herokuapp.com/

276 points by eis 15y ago

deleted 15y ago

[deleted]

base 15y ago

Out of curiosity, how does the Mt.Gox hold the bitcoins. Do they have a bitcoin account for every user or do they hold all the bitcoins in their account and trades are only changes in their database?

wmf 15y ago
The latter; in the block chain you can see a single address that holds over 400K BTC.

nazgulnarsil 15y ago

This is an "I told you so" post, but not about bitcoin, about the current exchanges. I haven't cashed out any bitcoins because the current exchanges are a fucking joke and I've said as much many times in the IRC channel and forums. Bitcoins will remain a novelty for people with lots of disposable income until it has a real money changing service linking it to other exchanges. I can not conceive of the level of folly it would take for me to put anything more than pocket money on one of the current exchanges.

citricsquid 15y ago

So for someone who doesn't understand economics that much, what does this mean? Have bitcoins finally failed?

lordgilman 15y ago
Someone just went to sell a ton of bitcoins at once. Because the market's so small they were able to fill all the buy orders placed all the way down to 1 cent per bitcoin. Some people with long-shot bets made quite a bit of money. About half of the 500k filled the buy orders on the way down and half of them were sold at the 1 cent price.
- joezydeco 15y ago
  Which kind of implies someone was doing this with stolen coins, right? You don't sell so cheap if you have USD 8,500,000 on paper and want to get as much possible out of the sale.
  - lubos 15y ago
    unless you are US government trying to destroy alternative currency. right?
    - joezydeco 15y ago
      This didn't destroy bitcoin... but it made a lot of cash for some bottom feeders.
      - barkingcat 15y ago
        What they did was destroyed the reputation of Mt. Gox - I don't think the Gox people will have a very good outcome as their customers jump ship to other exchanges. BUT on the other hand, you could say Mt. Gox was asking for it with such poor security measures. A day ago, it was a CSRF hack ... and today it's a database dump. I tell ya, tomorrow, the code for their trading platform will hit the net. In fact, I wouldn't put it past the operators of the other exchanges to perpetrate something like this. In reality, no damage to the bitcoin network was done, but Mt.Gox ended up with egg on their face. Where will all the trades go? To other bitcoin exchanges - and there goes the services charges too. There's a sizable amount of money to be made by taking down Mt. Gox.
deleted 15y ago
[deleted]
InclinedPlane 15y ago
Imagine if someone stole 7% of all printed currency in the US and then traded it for gold at effective prices as low as pennies on the dollar. That's effectively what just happened with bitcoins.
Tichy 15y ago
BitCoins haven't really started yet in my opinion. It seems far too early to say they have failed or not.
rmc 15y ago
Not as such. As an example, Steve Jobs ownes 7% the shared of Disney. If tomorrow, he were to sell them all, no matter what the price, there might not be enough people to buy them all, so people who, for the laugh, said they'd buy Disney stock at $0.01 a share would eventually get the shares. Thus the stock price for Disney would drop to $0.01. A similar thing just happened to BitCoin, but rather than shares of Disney being traded, it was bitcoins.
- chamakits 15y ago
  This is the best explanation so far. Thanks!

crayz 15y ago

That's about 7% of the total number of bitcoins in circulation. Anyone have details on how this happened? http://blockexplorer.com/q/totalbc http://blockexplorer.com/q/totalbc

enki 15y ago
according to the guy running the exchange: user with 500k bitcoins was hacked (probably password bruteforce or csrf). they'll probably reverse all transactions since then
- andypants 15y ago
  Who is 'they'? As far as I understood bitcoin, there is no authority. Nobody can do anything about a user having 500k of his coins hacked, and nobody can do anything about the market crash either.
  - Osiris 15y ago
    As long as the money hasn't been withdrawn from the market, the market should be able to reverse all the transactions. The problem would be if the BTC or USD were withdrawn from the market before they shut down trading.
  - enki 15y ago
    the exchange is a central authority, and acts like one. you can do whatever you want with your bitcoins, but currency exchange is liable to laws and regulations.
  - jaekwon 15y ago
    as far as i know you're right. there is no infrastructure for rollbacks of any kind.
    - olex 15y ago
      MtGox != Bitcoin. Transactions on bitcoin network cannot be undone, that is true; however, MtGox will undo the transactions inside their system (buys and sells within MtGox). The only thing that cannot be undone is the withdrawal of 80 stolen BTC from a MtGox account into Bitcoin network.

Osiris 15y ago

mtgox.com is offline. Did they shut trading down?

tijs 15y ago
the site has been on and off for the past week or so. not intentional perse just busy servers as far as i can tell.
- swishercutter 15y ago
  I was in the bitcoin forums and mt gox as this happened...they shut down afterwards.

eis 15y ago

A little bit explanation: Mt.Gox is the biggest bitcoin market place by far. During the last 1h the whole volume of about 500k BTC was traded making the price drop from somewhere around $17 to virtually nothing. Details are not available yet. It could have been a bug or an intrudor. Rumors have it that someone with a huge wallet got hacked. <+MagicalTux> someone with lots of coins did get hacked MagicalTux is working on Mt.Gox Also some other markets like btcex or tradehill are seeing problems and/or price drops. Update: Mt.Gox have published an announcement: https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...

weavejester 15y ago
I'm surprised that people with large amounts of bitcoin don't have better security measures. For that amount of money, I'd consider securing the private key in a safety deposit box. Probably several safety deposit boxes, actually.
- tlrobinson 15y ago
  They apparently had 500k BTC in their MtGox account, which is insane. Unless they were actively trading all of that they should have withdrawn from MtGox to the BitCoin network.
  - saalweachter 15y ago
    I keep reading about people only being able to take a small number (50 or 80 BTC) out of the market at once, which is why the hacker couldn't do the same. If that is true, then once you have your 500k BTC in the exchange, it will take you over a decade to get them out, either as cash or as bitcoins.
  - joeyh 15y ago
    If they were Satoshi, they could be sitting on enough early-adopter bitcoins that 500k is relatively not insane.

skrebbel 15y ago

i must admit i'm somewhat impressed how fast the hackers and cheaters managed to take over bitcoin trading. i think it's kind of cute. people hoped for an economy no government could control, and got exactly that: anarchy and a burning world.

leon_ 15y ago
well the IRL exchanges are run by cheaters and there's not much anarchy around yet.
kiba 15y ago
It just mean that the market is really small.
- mikemoka 15y ago
  do you mean that if the market would be bigger such things won't be done? they could do more of the same unfortunately..
  - Macha 15y ago
    If the market was bigger, 500k would not crash it, as there would be enough buy orders to take someone dumping 500k. It would still be crashable, but more would be needed if it was bigger.
  - seats 15y ago
    When the market is really big, then only the really rich people can manipulate it. Comforting thought ;)
    - wmf 15y ago
      It's already a little disturbing to realize that a single account held 261K BTC out of 6.5M BTC in circulation.
      - 15y ago

deleted 15y ago

[deleted]

mikemoka 15y ago

maybe they did it for the lulz again? http://twitter.com/#!/LulzSec/status/79678588407906304 http://twitter.com/#!/LulzSec/status/79678588407906304

lubos 15y ago

If this was legitimate "dump" (by someone who obviously didn't care about the money), it was certainly the fastest crash of any known market ever.

ebaysucks 15y ago

If the 500K Bitcoins sold are the total of the Bitcoins in all MtGox wallets, than Bitcoin is over. Sample of one: I have for about 100 USD in Bitcoins at MtGox, if they got stolen today, I will leave the project.

erikpukinskis 15y ago
Yea, I had been keeping my bitcoins in MtGox too, but I figured at the very least I wanted to have two points of failure, so I moved half of them onto my computer. Figured worst case scenario I'd lose half in a single day. But hopefully that's not what happened!
andypants 15y ago
I think the bitcoins belonged to a guy who had his wallet of 500k stolen some time around last week.
- lubos 15y ago
  he had only 25k stolen.
- romland 15y ago
  You're probably thinking of the guy who claimed he lost 25k bit coins (which at that moment was "worth" 500k USD). This was a trade of 500,000 bit coins.
  - andypants 15y ago
    Ahh yes, you're correct, I got confused.

Tichy 15y ago

Does anybody have a link to instructions for reading that kind of chart (or the name of the chart type)? I used to know, but it has been many years. I suppose green bars means the price went up and red down, and the bar extends between the high and low price. But what does the chunk in the middle mean? And where can I see that 500k were traded?

Macha 15y ago
EDIT: The below is wrong, see here: http://en.wikipedia.org/wiki/Candlestick_chart http://en.wikipedia.org/wiki/Candlestick_chart The chunk in the middle is the price for the majority of trades, and the lighter bar is all trades, if I remember right.
- yesimahuman 15y ago
  The small bar indicates the range of prices during the time frame (for example, each bar could represent 15 minutes of trading on a 15 minute chart). The big bar shows the closing and opening prices for that time range. If the closing price is below the opening price the bar is red, and vice versa. The red bar that shoots up from the bottom is the trading volume, and usually isn't covering up the bars so it looks strange. It just says a ton of BTC was sold in that time frame.
yesimahuman 15y ago
It's called a candlestick chart. http://en.wikipedia.org/wiki/Candlestick_chart http://en.wikipedia.org/wiki/Candlestick_chart
knowtheory 15y ago
There are two charts here. Along the bottom of the chart is the volume of trades, i.e. how many shares/coins are being sold or bought (and whether they're being sold or bought). The chart in the middle is the price and variability of the trades (i think). Not a stock person or a BTC trader. Just gawking at the spectacle.

gburt 15y ago

Lower limit of $0 a bitcoin showing there, did someone really dump bitcoins at $0.01?

eli 15y ago
$0.01 is still a profit if you stole the coins.

Tichy 15y ago

Interesting that on bitmarket.eu there are a lot of buy offers for 0.01€ suddenly. I wonder if those are already bots trying to automatically react to the mtgox price.

joezydeco 15y ago
More likely, people trying to make bank when (not if) it happens again.
- Tichy 15y ago
  Ah, true, taking advantage of market glitches. I should add some positions for that, too :-)
  - joezydeco 15y ago
    The real question is if mtgox can actually reverse trades like they claim they're going to do as a result of this situation. In a regulated exchange it's certainly possible. Is it possible with bitcoin? Once the block is away...it's away.

deleted 15y ago

[deleted]

swishercutter 15y ago
You know whats funny about that whole 25k thing...he has shown no proof, says he filed a police report but has not shown it, media went wild with it (with no evidence) and to the best of my knowledge no media outlet has interviewed the supposed law enforcement regarding the matter....I smell some FUD...there are numerous more inconsistencies with his story and many believe him to be a troll. NO early adopter leaves his wallet.dat file unprotected on a known compromised computer. Especially one who claims to be an early adopter and saying he got in later in the same post. If you really read that whole thread you will smell a rat or troll also.
- marshray 15y ago
  NO early adopter leaves his wallet.dat file unprotected on a known compromised computer. Now that's making claims without proof.
  - ScottBurson 15y ago
    Not only is it making claims without proof, the claims make no sense. Why would anyone with a large pile of Bitcoins want to drive the price down by advertising how insecure the currency can be?
  - swishercutter 15y ago
    My response was to a comment that was deleted...If you go and read the thread he posted to...which is about the supposed theft last week there seem to be a bunch of inconsistencies with the story...the biggest being he supposedly had 3btc stolen but he leaves his wallet unencrypted, unprotected, on a computer that after having supposed 3btc stolen and flagging a virus threat...either he is lying or he is very stupid...either way I do not feel bad. As for what happened this morning I believe that the market snapped right back was a good sign...someone dumping .5M BTC at once at the lowest possible amount and it still came back in minutes.

buro9 15y ago

From the mt.gox site: Huge Bitcoin sell off due to a compromised account - rollback The bitcoin will be back to around 17.5$/BTC after we rollback all trades that have happened after the huge Bitcoin sale that happened on June 20th near 3:00am (JST). Service should be back by June 20th 10:00am (JST, 01:00am GMT) with all the trades reversed and accounts available. One account with a lot of coins was compromised and whoever stole it (using a HK based IP to login) first sold all the coins in there, to buy those again just after, and then tried to withdraw the coins. The $1000/day withdraw limit was active for this account and the hacker could only get out with $1000 worth of coins. Apart from this no account was compromised, and nothing was lost. Due to the large impact this had on the Bitcoin market, we will rollback every trade which happened since the big sale, and ensure this account is secure before opening access again. I'm interested in the fact that they can do a rollback... is that just a rollback of their transaction log? Are they buffering transactions for a significant period before submitting them back to the network?

iki23 15y ago
[Update - 2:06 GMT] What we know and what is being done. * It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked. * Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hashing. The unsalted user accounts in the wild are ones that haven't been accessed in over 2 months and are considered idle. Once we are back up we will have implemented SHA-512 multi-iteration salted hashing and all users will be required to update to a new strong password. * We have been working with Google to ensure any gmail accounts associated with Mt.Gox user accounts have been locked and need to be reverified. * Mt.Gox will continue to be offline as we continue our investigation, at this time we are pushing it to 8:00am GMT. * When Mt.Gox comes back online, we will be putting all users through a new security measure to authenticate the users. This will be a mix of matching the last IP address that accessed the account, verifying their email address, account name and old password. Users will then be prompted to enter in a new strong password. * Once Mt.Gox is back online, trades 218869~222470 will be reverted. https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...

eis 15y ago

Newest update: Apparently someone got the whole user account database of Mt.Gox I wont publish the link to it though for obvious reasons. Quick analysis: the database is legit, it contains user id, username, email if set, and a bcrypt hash. The hashes seem salted with a global salt.

kabushikigaisha 15y ago
I don't think the db is public, it's being sold for a price.
- omarchowdhury 15y ago
  http://evilrouters.net/wp-content/uploads/2011/06/accounts.csv.bz2 http://evilrouters.net/wp-content/uploads/2011/06/accounts.c...
- gokhan 15y ago
  Quite public. At least passwords seem to be hashed, though.
- personalcompute 15y ago
  It's public. I have the db loaded in mysql right now, and have confirmed its validity (my account is in there).
deleted 15y ago
[deleted]
olex 15y ago
Password hashes are standard php crypt() ones. I'm in that DB, was able to generate the hash using the DB entry (in contains the salt for each password) and my one-time password from mtgox. One-time PWs ftw.
deleted 15y ago
[deleted]
xfs 15y ago
About 1600 passwords in this database are hashed with plain md5 without salt. I found quite a lot hits (34% success rate) using a rainbow table cracker.

spenvo 15y ago

The flash sale broke the price resistance chart: http://mtgoxlive.com/orders http://mtgoxlive.com/orders

tlrobinson 15y ago

There's an alleged database dump of Mt Gox floating around... https://twitter.com/#!/954/status/82531189705019392 https://twitter.com/#!/954/status/82531189705019392 UPDATE: looks legit. http://forum.bitcoin.org/index.php?topic=19543.0 http://forum.bitcoin.org/index.php?topic=19543.0 https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback https://support.mtgox.com/entries/20208066-huge-bitcoin-sell...

kristofferR 15y ago
Damn, I'm in there. Glad I used a generated password (from LastPass) so I don't have to change my passwords on a lot of various sites.
- deleted 15y ago
  [deleted]
- lubos 15y ago
  this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into google from that file and yes, many of them are present in rainbow tables. damn. makes me angry as a programmer how financial website can be this unsecure and easy to compromise.
  - jtchang 15y ago
    They look like salted hashes to me.
    - lubos 15y ago
      you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)
      - 15y ago

nkohari 15y ago

The entire account database was also leaked: http://forum.bitcoin.org/index.php?topic=19543.0 http://forum.bitcoin.org/index.php?topic=19543.0

sudonim 15y ago
So it was... I confirmed my username is in there but at least passwords are hashed. Luckily, I never added an email address and used a different Username and pw than I do everywhere else. Gotta take precautions with bitcoin!
- Tichy 15y ago
  Doesn't look as if passwords were salted, though :-( (Edit: just read in another comment that there seems to have been a global salt)
  - funkah 15y ago
    Very sloppy. When you're dealing with actual money, industry-standard practices like this shouldn't be considered optional.
    - rchowe 15y ago
      Legally, they're not. Bitcoin just isn't actual money in any country. Someone should buy sealand and change the national currency to bitcoin...
      - weavejester 15y ago
        What would be the point of doing that?
      - lutorm 15y ago
        You can also have real money in your mtgox account.
  - olex 15y ago

aquarin 15y ago

We shouldn't be surprised by this. This monetary have no authority behind it.

aquarin 15y ago
What is the point of down votes without explanation?
- vessenes 15y ago
  You're being downvoted because you neither understand the Bitcoin system nor the mechanics of how Mt. Gox works, as evidenced by your post.
  - aquarin 15y ago
    Sure, i don't understand it, neither the people who brought bitcoins.
    - weavejester 15y ago
      And you're basing this statement on what evidence?
- blackbeltjones 15y ago
  Your post ran counter to internet-libertarian dogma.
  - aquarin 15y ago
    Probably. I regret each time i comment here, but I attribute this to the cultural differences between California based NH-users and the rest of the world.
    - weavejester 15y ago
      It's not cultural differences between California and the rest of the world. It's simply that your statements indicate you're commenting without an understanding the subject matter. This incident occurred because (a) people with large amounts of bitcoin do not always store them securely, and (b) the bitcoin market is very small, and therefore can be destabilised by relatively small amounts of money (a few million dollars, for instance).

phamilton 15y ago

I'm a little annoyed that MtGox effectively is bitcoin. I've been spending my mined coins on goods from various merchants and it has been working great. That's what bitcoin is designed to be, a currency. Recently there's so much speculation and people buying, holding and selling that so much focus has shifted away from the real use.

caf 15y ago
Mining was never supposed to be the primary means to obtain bitcoins. As long as people are still being paid salaries in other currencies, they'll need to use an exchange to buy bitcoins if you want them to participate. On the other side of the (bit)coin, do you suppose those merchants you're buying from can pay all of their suppliers in bitcoins? So they need the service of an exchange, too.

funkah 15y ago

I wanted to see if I could buy some on the cheap, but I wasn't already set up to do so. I would never take this currency seriously, but I'd be willing to put in a bit of money to speculate a bit. I looked at bitmarket.eu but they have a manual verification process, which I'm sure would not complete until after the price recovers. Oh well.

trotsky 15y ago

This was apparently on HN 14 hours ago: Mtgox hacked database listed for sale (pastebin.com) http://news.ycombinator.com/item?id=2670302 http://news.ycombinator.com/item?id=2670302 pointed to: http://pastebin.com/ui0nusuZ http://pastebin.com/ui0nusuZ which says: I have hacked into mtgox database. Got a huge number of logins password combos. Mtgox has fixed the problem now. Too late, cause I've already got the data. Will sell the database for the right price. Send your offers to： gfc06@hotmail.com

Tichy 15y ago
Was he accepting BitCoins?

Tichy 15y ago

I like the looks of this chart of the crash, haven't seen that kind before: http://leanback.eu/bitcoin/plots/20110619195756-mtgox.png http://leanback.eu/bitcoin/plots/20110619195756-mtgox.png (found via @zedshaw on Twitter)

Macha 15y ago
And Zed found it from me on Twitter, and I found it on this thread: http://news.ycombinator.com/item?id=2671576 http://news.ycombinator.com/item?id=2671576 (Just setting the record straight as Zed attributed it to me)

mrkva 15y ago

If you feel like complaining, check Complainr: http://complainr.syx.sk/ http://complainr.syx.sk/ Some people already started :)

pnathan 15y ago

I'm on record here as saying a few weeks ago that a BTC bank needs to be established. I reiterate my position. A BTC bank needs to be established, with appropriate data protection features.

Astrohacker 15y ago
Sounds like a startup opportunity.
- pnathan 15y ago
  Absolutely. I wish I had enough time and security knowledge to do it. A BTC bank will have to have some no-kidding competent security around it.

omarchowdhury 15y ago

<CorvusCorax> poor bot had a division by zero when trying to calculate the mt gox exchange rate

anonymous 15y ago

haha

KarlFreeman 15y ago

If you want to check if you've been Mt.Goxed I whipped up a little something for that http://mtgoxed.herokuapp.com/ http://mtgoxed.herokuapp.com/