5 ms·

Mt. Gox trades rolled back, thief only got away with $1K in BTC

71 points by mcantelon 15y ago

wccrawford 15y ago
The hacker wasn't trying to get money. He was trying to undermine the system. And it's working. The $1000 was a bonus on top of all the doubt he has now instilled in anyone who has bitcoins.
- mcantelon 15y ago
  Mt. Gox's security concerns are definitely troubling, but my guess is the effect on the market won't be huge as the Bitcoin community seems fairly committed to the long term.
  - xfs 15y ago
    The market is indeed small. From the leaked database of Mt Gox, there are 40k registered mailbox.
    - palish 15y ago
      62k actually.
- hugh3 15y ago
  The hacker wasn't trying to get money. He was trying to undermine the system. What makes you think that? Heck, I've been undermining bitcoin for weeks just for fun, but I'd much rather have a thousand dollars.
  - bobwebb 15y ago
    Not to sound paranoid, but if the hacker had a vested interest in bitcoin being undermined (government agent?) then money wouldn't be his main motive.
    - hugh3 15y ago
      Not to sound paranoid... (government agent?) Uh, sorry, that's pretty much textbook paranoia.
      - mcantelon 15y ago
        It's a possibility. States do work to undermine things that threaten them. The Liberty Dollar project, for example, was recently shut down by the US government: http://en.wikipedia.org/wiki/Liberty_Dollar http://en.wikipedia.org/wiki/Liberty_Dollar . Bitcoin is a potential threat to the state because it provides an ideal instrument for tax avoidance and competition in the drug/force trade.
        hugh3 15y ago
        It's a possibility. States do work to undermine things that threaten them. The Liberty Dollar project, for example, was recently shut down by the US government: http://en.wikipedia.org/wiki/Liberty_Dollar http://en.wikipedia.org/wiki/Liberty_Dollar Sure, and they shut it down openly using the hammer and anvil of the FBI and the judicial system. If and when the US Government decides to act against bitcoin, they'll do it loudly and openly... not by some complicated, difficult and illegal scheme that doesn't really achieve anything. Currency issues fall into the jurisdiction of the US Secret Service, an agency not known for subtlety.
        deleted 15y ago
        [deleted]
        mcantelon 15y ago
        Yeah, if legal and open is more cost effective, they'll likely go that route. Otherwise, they may revert to skullduggery (as they have in the past: http://en.wikipedia.org/wiki/COINTELPRO http://en.wikipedia.org/wiki/COINTELPRO).
        tedunangst 15y ago
- drivebyacct2 15y ago
  This isn't a weakness in BTC. This was a weakness with MtGox. They're only related because the attacked tried to get out of BTC into USD. It's not really BTC's fault.
  - ugh 15y ago
    It’s not Bitcoin’s fault but it’s Bitcoin’s problem. Life isn’t fair and Bitcoin needs trust (like every other currency) if it wants to succeed.
    - drivebyacct2 15y ago
      No, no they don't. BTC can never be trusted like other currencies. It was designed that way intentionally. Frankly, I kinda surprise I'm still having to repeat this even with the huge volume of BTC posts here and even with a post specifically talking about this yesterday (entitled "BTC's value is decentralization" or something). The value in BTC isn't that it's a rival to USD/GBP/CAD. It's that it's decentralized and untraceable. You can't offer guarantees. You can't offer FDIC. You can't offer protection and you can't give someone their money back if it's stolen. That's intentional and it's by design. It is Bitcoin's problem, but only because people are too dumb to realize that BTC != Mt.Gox. EDIT: I misspoke. BTC itself can be trusted, but it can't be insured or surveilled and controlled like other traditional currencies. Saying "BTC can never be trusted like other currencies" was sloppy and erroneous on my part.
      - ugh 15y ago
        Bitcoin doesn’t need to be trusted? People will use it despite not trusting it? I have trouble believing that. This looks like a PR problem to me, the best infrastructure won’t help you with that.
        drivebyacct2 15y ago
        People that don't trust BTC, don't trust it because they don't understand it. Bitcoin isn't trying to compete with USD. It's a niche market for people interseted in trading anonymously and buying goods that they can't otherwise. Eventually it may grow, and that's fine. What do you propose? A big PR push that BTC is safe? What if another exchange screws up? How are you going to explain that BTC itself is safe, but that third parties that interact with it require a seperate layer of trust? I trust BTC. I use BTC. I don't trust Mt.Gox, so I'll go use another exchange. Again, none of this was the result of ANY flaw in BTC. I mean, I guess bitcoin.org can run a banner "Mt.Gox's problems were unassociate with the safety of Bitcoin", but that's not going to help anything... and besides, there is still literally nothing that can ever be done about securing the currency of uninformed users. If people want insured, centrally-authorized currencies, they need to go elsewhere. There's nothing to trust in BTC except the cryptographic soundness of SHA-whatever.
DavidSJ 15y ago
Homework assignment: what's $1k in BTC at $0.01/BTC?
- ebaysucks 15y ago
  That $1K stolen represents the first trades at the starting price of the crash, i.e. 50 or so Bitcoins. Given the profits MtGox is making, it wouldn't surprise me the exchange buys $1K in Bitcoins for the account holder so he has his 500K coins again.
  - mcantelon 15y ago
    Hopefully they'll hire some security consultants as well.
    - mehwoot 15y ago
      Actually, the problem might have been exactly that. An updated posting on their sites says "It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database."
    - hugh3 15y ago
      For a currency invented by a bunch of cryptography geeks, it's astonishingly insecure.
      - mcantelon 15y ago
        Mt. Gox is an exchange, not the currency. The currency is secure. This is analogous to a bank getting robbed.
        bermanoid 15y ago
        That's right, and let's be clear here: Mt. Gox has been kind of a mess from the beginning. They've never appeared to have a clue about security, and performance has been a complete and utter mess for quite a while now. To give you some idea, the trade that blew through the entire buy-side took over 30 minutes to execute, and the exchange essentially slowed to a standstill during that time. I realize that there are a lot of orders on any exchange at any moment, but 30 minutes of downtime in response to a single order? Come on...that's not even to mention the complete lack of sanity checks or catastrophe reporting that you'd expect in any system like this that touches people's money - it should not have required people directly tracking down the site owner to get a human looking at this stuff! That type of thing is maybe acceptable from a lean startup that's learning as it goes, but when you're transacting over a million dollars in trades per day, there's an expectation that you'll figure out what you need to do to get things running smoothly. This might not be totally fair, but when I saw the .php extension on all the trade API URLs and noticed that there was a dynamically generated price chart on the front page (apparently not cached, based on how long it took to load) I was immediately suspicious of the competence of the Mt. Gox devs to handle the scale of what they'd created (or rather, AFAIK, the scale of the system that they purchased from the original creator)...I'm not really that surprised that security was completely botched, this has seemed like a very amateur operation from the beginning.
tlrobinson 15y ago
Does the $1000/day limit apply to withdrawing to the Bitcoin network in addition to the bank options? If not the thief could have just send the 500K BTC to one of his Bitcoin addresses, and laundered the money and traded if for real currency at his leisure. Mt Gox can only roll back trades within their system, not transactions involving the Bitcoin network once they're in the block chain.
- ebaysucks 15y ago
  Good point, it would make much more sense to just run away with the Bitcoins rather than dumping them.
  - tlrobinson 15y ago
    Looks like he might have done just that: http://blockexplorer.com/tx/84f96975ea88d317676771a482c71f39ff53beda790c89c07ae82e427b4d090f http://blockexplorer.com/tx/84f96975ea88d317676771a482c71f39... Impossible to know without confirmation from MtGox though.
- mehwoot 15y ago
  Yeah, I thought this as well- why the hell, if you had access to all the accounts, you wouldn't just take all the coins. But- mtgox is the main exchange (handles 90% of volume), so how would you launder the money elsewhere? There just wouldn't be the volume to get it out. Also, everyone can trace bitcoins- if you took them, people can see what you are doing with them. I think this was possibly the easier, surefire way to go.
cjg 15y ago
Mt. Gox are now accepting claims to recover accounts.

71 points by mcantelon 15y ago

The hacker wasn't trying to get money. He was trying to undermine the system. And it's working. The $1000 was a bonus on top of all the doubt he has now instilled in anyone who has bitcoins.

mcantelon 15y ago
Mt. Gox's security concerns are definitely troubling, but my guess is the effect on the market won't be huge as the Bitcoin community seems fairly committed to the long term.
- xfs 15y ago
  The market is indeed small. From the leaked database of Mt Gox, there are 40k registered mailbox.
  - palish 15y ago
    62k actually.
hugh3 15y ago
The hacker wasn't trying to get money. He was trying to undermine the system. What makes you think that? Heck, I've been undermining bitcoin for weeks just for fun, but I'd much rather have a thousand dollars.
- bobwebb 15y ago
  Not to sound paranoid, but if the hacker had a vested interest in bitcoin being undermined (government agent?) then money wouldn't be his main motive.
  - hugh3 15y ago
    Not to sound paranoid... (government agent?) Uh, sorry, that's pretty much textbook paranoia.
    - mcantelon 15y ago
      It's a possibility. States do work to undermine things that threaten them. The Liberty Dollar project, for example, was recently shut down by the US government: http://en.wikipedia.org/wiki/Liberty_Dollar http://en.wikipedia.org/wiki/Liberty_Dollar . Bitcoin is a potential threat to the state because it provides an ideal instrument for tax avoidance and competition in the drug/force trade.
      - hugh3 15y ago
        It's a possibility. States do work to undermine things that threaten them. The Liberty Dollar project, for example, was recently shut down by the US government: http://en.wikipedia.org/wiki/Liberty_Dollar http://en.wikipedia.org/wiki/Liberty_Dollar Sure, and they shut it down openly using the hammer and anvil of the FBI and the judicial system. If and when the US Government decides to act against bitcoin, they'll do it loudly and openly... not by some complicated, difficult and illegal scheme that doesn't really achieve anything. Currency issues fall into the jurisdiction of the US Secret Service, an agency not known for subtlety.
        deleted 15y ago
        [deleted]
        mcantelon 15y ago
        Yeah, if legal and open is more cost effective, they'll likely go that route. Otherwise, they may revert to skullduggery (as they have in the past: http://en.wikipedia.org/wiki/COINTELPRO http://en.wikipedia.org/wiki/COINTELPRO).
        tedunangst 15y ago
drivebyacct2 15y ago
This isn't a weakness in BTC. This was a weakness with MtGox. They're only related because the attacked tried to get out of BTC into USD. It's not really BTC's fault.
- ugh 15y ago
  It’s not Bitcoin’s fault but it’s Bitcoin’s problem. Life isn’t fair and Bitcoin needs trust (like every other currency) if it wants to succeed.
  - drivebyacct2 15y ago
    No, no they don't. BTC can never be trusted like other currencies. It was designed that way intentionally. Frankly, I kinda surprise I'm still having to repeat this even with the huge volume of BTC posts here and even with a post specifically talking about this yesterday (entitled "BTC's value is decentralization" or something). The value in BTC isn't that it's a rival to USD/GBP/CAD. It's that it's decentralized and untraceable. You can't offer guarantees. You can't offer FDIC. You can't offer protection and you can't give someone their money back if it's stolen. That's intentional and it's by design. It is Bitcoin's problem, but only because people are too dumb to realize that BTC != Mt.Gox. EDIT: I misspoke. BTC itself can be trusted, but it can't be insured or surveilled and controlled like other traditional currencies. Saying "BTC can never be trusted like other currencies" was sloppy and erroneous on my part.
    - ugh 15y ago
      Bitcoin doesn’t need to be trusted? People will use it despite not trusting it? I have trouble believing that. This looks like a PR problem to me, the best infrastructure won’t help you with that.
      - drivebyacct2 15y ago
        People that don't trust BTC, don't trust it because they don't understand it. Bitcoin isn't trying to compete with USD. It's a niche market for people interseted in trading anonymously and buying goods that they can't otherwise. Eventually it may grow, and that's fine. What do you propose? A big PR push that BTC is safe? What if another exchange screws up? How are you going to explain that BTC itself is safe, but that third parties that interact with it require a seperate layer of trust? I trust BTC. I use BTC. I don't trust Mt.Gox, so I'll go use another exchange. Again, none of this was the result of ANY flaw in BTC. I mean, I guess bitcoin.org can run a banner "Mt.Gox's problems were unassociate with the safety of Bitcoin", but that's not going to help anything... and besides, there is still literally nothing that can ever be done about securing the currency of uninformed users. If people want insured, centrally-authorized currencies, they need to go elsewhere. There's nothing to trust in BTC except the cryptographic soundness of SHA-whatever.

DavidSJ 15y ago

Homework assignment: what's $1k in BTC at $0.01/BTC?

ebaysucks 15y ago
That $1K stolen represents the first trades at the starting price of the crash, i.e. 50 or so Bitcoins. Given the profits MtGox is making, it wouldn't surprise me the exchange buys $1K in Bitcoins for the account holder so he has his 500K coins again.
- mcantelon 15y ago
  Hopefully they'll hire some security consultants as well.
  - mehwoot 15y ago
    Actually, the problem might have been exactly that. An updated posting on their sites says "It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database."
  - hugh3 15y ago
    For a currency invented by a bunch of cryptography geeks, it's astonishingly insecure.
    - mcantelon 15y ago
      Mt. Gox is an exchange, not the currency. The currency is secure. This is analogous to a bank getting robbed.
      - bermanoid 15y ago
        That's right, and let's be clear here: Mt. Gox has been kind of a mess from the beginning. They've never appeared to have a clue about security, and performance has been a complete and utter mess for quite a while now. To give you some idea, the trade that blew through the entire buy-side took over 30 minutes to execute, and the exchange essentially slowed to a standstill during that time. I realize that there are a lot of orders on any exchange at any moment, but 30 minutes of downtime in response to a single order? Come on...that's not even to mention the complete lack of sanity checks or catastrophe reporting that you'd expect in any system like this that touches people's money - it should not have required people directly tracking down the site owner to get a human looking at this stuff! That type of thing is maybe acceptable from a lean startup that's learning as it goes, but when you're transacting over a million dollars in trades per day, there's an expectation that you'll figure out what you need to do to get things running smoothly. This might not be totally fair, but when I saw the .php extension on all the trade API URLs and noticed that there was a dynamically generated price chart on the front page (apparently not cached, based on how long it took to load) I was immediately suspicious of the competence of the Mt. Gox devs to handle the scale of what they'd created (or rather, AFAIK, the scale of the system that they purchased from the original creator)...I'm not really that surprised that security was completely botched, this has seemed like a very amateur operation from the beginning.

tlrobinson 15y ago

Does the $1000/day limit apply to withdrawing to the Bitcoin network in addition to the bank options? If not the thief could have just send the 500K BTC to one of his Bitcoin addresses, and laundered the money and traded if for real currency at his leisure. Mt Gox can only roll back trades within their system, not transactions involving the Bitcoin network once they're in the block chain.

ebaysucks 15y ago
Good point, it would make much more sense to just run away with the Bitcoins rather than dumping them.
- tlrobinson 15y ago
  Looks like he might have done just that: http://blockexplorer.com/tx/84f96975ea88d317676771a482c71f39ff53beda790c89c07ae82e427b4d090f http://blockexplorer.com/tx/84f96975ea88d317676771a482c71f39... Impossible to know without confirmation from MtGox though.
mehwoot 15y ago
Yeah, I thought this as well- why the hell, if you had access to all the accounts, you wouldn't just take all the coins. But- mtgox is the main exchange (handles 90% of volume), so how would you launder the money elsewhere? There just wouldn't be the volume to get it out. Also, everyone can trace bitcoins- if you took them, people can see what you are doing with them. I think this was possibly the easier, surefire way to go.

cjg 15y ago

Mt. Gox are now accepting claims to recover accounts.