12 ms·

Inputs.io hacked – 4100 BTC stolen

161 points by citricsquid 13y ago

elango 13y ago
Do bit coins have identity and hence be flagged as stolen somewhere ?.
- steveklabnik 13y ago
  Each bitcoin goes into a wallet, which contains an address. There's no connection between a person and a wallet, though, and it's not a 1:1 mapping, either. > flagged as stolen That would imply some sort of centralized authority to decide exactly what 'stolen' means. Even if a third-party service kept track, it'd be meaningless in short order, as mixers exist...
  - josephagoss 13y ago
    Also there is no connection between a wallet and an address except the wallet stores the address. When the client sends the address the change is returned to a new change address, and the wallets are being designed now to never reuse addresses. So it would become very hard to determine which of the outputs are change addresses and in the same wallet.
- qnr 13y ago
  In theory, each coin (called transaction output in bitcoin lingo) can be traced through a chain of transactions to its originating block. In practice, this is useless because there is no correspondence between bitcoin addresses and individuals (except in certain points like exchanges that require your ID) In other words, each time a coin changes addresses there is a plausible deniability for the owner of the receiving address that s/he received the coin as a result of a legitimate transaction (sale of goods/services, donation, whatever)
- artiface 13y ago
  This is the wallet that the owner of Inputs.IO has claimed[1] is where the stolen funds were transferred:http://blockchain.info/fb/1emztw http://blockchain.info/fb/1emztw Blockchain.info has tagged it as inputs.io hack. And a couple users have tagged it as well with public messages. But besides that, as far as I know, all anyone can do is watch it get drained. [1] https://bitcointalk.org/index.php?topic=248803.msg3509247#msg3509247 https://bitcointalk.org/index.php?topic=248803.msg3509247#ms...
o2sd98 13y ago
Which begs the question, how can one determine the veracity of the security claims of website operators? Bitcoins are a convertible currency but are not regulated, insured or guaranteed by any authority. I guess even modern fiat currencies had their teething problems with theft and counterfeiting, so this is not too surprising.
- steveklabnik 13y ago
  You cannot, just like you can't determine the claims of any other random server responding to port 80 somewhere on the 'net.
- TheTaytay 13y ago
  I wouldn't be surprised (or disappointed) if some enterprising company developed a security certification (a la PCI) for Bitcoin-related providers. You wouldn't _have_ to offer it, but the market might favor those that had subjected themselves to that scrutiny.
  - o2sd98 13y ago
    It would be great to see a market solution to this. Bitcoin is a bit like the gold rush/wild west at the moment which is fine for those who understand this before diving in, but until these types of trust issues are resolved market participation will be limited, which presumably will eventually effect the liquidity of the market for btc.
M4v3R 13y ago
4100 BTC = 1.1 mil USD at current prices. These Bitcoins were stolen from website's "hot wallet" (every shared wallet has to operate one to process current withdrawals). This hot wallet was probably too hot though, as it seems that they had most of their coins online, and only about one third offline (other services claim to store 80-90% offline). According to postings on Bitcointalk.org forums people are getting back partial refunds. One person claimed to receive 37% of his balance back [1]. UPDATE: Correction - according to [4] it seems that almost all funds were stoled in the hot wallet, and the hacker was "nice" enough to not steal it all at once, presumably to stay undetected and come back for more. I'm not sure if I buy this argument though. Also, according to the owners the hack occurred on 26th October [2]. It may be possible that if you deposited funds after that date you will receive full refund, as they should still be on their wallets. Unless hackers took that too. UPDATE: Also according to [4] the funds that were being deposited after 26th were being withdrawn at the same time by other users. So they're as gone as the ones from before 26th. You will be refunded in full only if you deposited very recently. This whole situation (and a bunch of previous ones) is also why at Bitalo [3], we are developing an exchange which will not have this problem, as we use multi-signature addressees to store the coins. This means that you need two signatures to spend funds - one from us, and second one from the user. We also never transmit users password over the wire, as we use SRP protocol for authentication. In unrelated news, China just passed 1800 CNY per BTC :). I wonder how's the security status of chinese exchanges/wallets. Unfortunately I don't know the language, so can't test that. [1] https://bitcointalk.org/index.php?topic=248803.msg3505884#msg3505884 https://bitcointalk.org/index.php?topic=248803.msg3505884#ms... [2] https://bitcointalk.org/index.php?topic=248803.msg3505966#msg3505966 https://bitcointalk.org/index.php?topic=248803.msg3505966#ms... [3] http://bitalo.com http://bitalo.com (in private beta, drop a message to martin@bitalo.com to receive an invite) [4] https://bitcointalk.org/index.php?topic=248803.msg3506034#msg3506034 https://bitcointalk.org/index.php?topic=248803.msg3506034#ms...
- deleted 13y ago
  [deleted]
- clarkmoody 13y ago
  I see what you did there[3] ;-) Also, it's a shame that this kind of breach happens, but it seems like it's been a while since a "$COMPANY hacked X BTC stolen" headline was out there[1]. There seem to have been more of those in the past and they appear with less frequency, which is a good thing, I guess. [1] Silk Road doesn't count toward this recollection, since it falls under the "Bitcoin $COMPANY busted by the feds" headline, which will probably happen more often in the future.
martin_ 13y ago
From their website: "Security + privacy The most secure wallet ever created."
- raverbashing 13y ago
  That's usually true... Until it isn't
yowza 13y ago
What happens when bitcoins are stolen? Can they be use again without being traced?
- steveklabnik 13y ago
  It depends on what you mean by 'traced.' All bitcoin transactions are 'traced,' but you can just set up a few thousand wallets, transfer some money to all of them, send them between each other, trade some away to other people for things... it's not clear simply from the transaction log who actually took them, and who is just receiving BTC from an anonymous buyer for some sort of service.
  - kevin_nisbet 13y ago
    From my understanding of bitcoin, doing this would be trivially easy to track also. However, I haven't studied this in great detail, so what is said here may be incorrect. *simplified view Wallet 1 stores 50 bitcoin for(i = 1; i < 100000; i++) { Transfer 1 bitcoin from Wallet i to Wallet i+1 } At this point, wallet 100000 contains exactly 1 bitcoin, that every transaction can be traced back to wallet 0. I understand that you would include more wallets, varying values, etc. But the point is every one of those bitcoins can be traced back to the original wallet which has the stolen funds. The only way to make this behavior viable that I can see, is to have intermediate services that mix up funds. So you have 50BTC Stolen funds in Wallet A. I run Wallet B, that takes transactions from many people. You give me the 50BTC that is stolen. I send you 50 bitcoins in small increments randomly over a set period of time, but from the other transactions I have. I do the same for other people, using the 50BTC that you sent me. As such, my service mixed the coins through a common point, which now makes tracking the chain very difficult. If I didn't mix this with other people's transactions, and gave you back you're own coin numbers, the coins would just track through me back to the original stolen wallet. This would need a party to offer this type of service, with enough volume to obscure the source, and for that service to not keep records (or not be inspected through other means). Again, I want to re-iterate, my knowledge of bitcoin is somewhat superficial, so don't take this as an authoritative post on the subject.
    - 13y ago
deleted 13y ago
[deleted]
verroq 13y ago
How do we know it's not the owner of input.io cashing out?
- steveklabnik 13y ago
  You don't! This is the risk of transferring your money to someone without any sort of regulations whatsoever.
- citricsquid 13y ago
  Here is his proof that it is not an inside job: https://bitcointalk.org/index.php?topic=283756.msg3505394#msg3505394 https://bitcointalk.org/index.php?topic=283756.msg3505394#ms...
  - lopatin 13y ago
    I'm curious, how would someone go about proving this wasn't an inside job. Is that possible?
    - steveklabnik 13y ago
      Nope.
    - YokoZar 13y ago
      Short of the actual thief publicly outing himself, I can't really think of any way.
josephagoss 13y ago
I had hundreds of Bitcoin on Coinlenders up until very recently when they switched to a "demo" legal-workaround that was legally terrible and childish. Coinlenders is a sister site to Inputs that share the same wallets. Coinlenders funds are being re-distributed to Inputs wallets. I obviously made a good decision to leave Coinlenders when I did as Coinlenders users are going to get perhaps 40% of their invested amounts back. What really should happen is the owner (Tradefortress on BitcoinTalk) Should use his own massive stash of Bitcoins to compensate all his users.
- nwh 13y ago
  Looks like they are - https://blockchain.info/address/1GLadosEkeAsLReqS3yQ51E1R3wVtbJCDF https://blockchain.info/address/1GLadosEkeAsLReqS3yQ51E1R3wV...
- tempestn 13y ago
  I don't know, $1.1M is a lot of money. If someone stole a million dollars from my company, I don't know if I'd be rushing to reimburse it with personal funds (assuming I even could), however bad I felt for the users. That said, if I recall correctly, one case where the corporate veil can potentially be pierced in a lawsuit is negligence. IANAL, but maybe users would have a legitimate case against personal funds, assuming keeping a large percentage of deposits online was found to be negligent. It'd obviously be an incredibly complicated and expensive class action suit if it were to happen though. Also it would probably mean trying to bankrupt a guy who just got hacked and lost his company...
  - prophetx10 13y ago
    And there you have it... if you were registered with a regulator you would have insurance and have had put up a multimillion dollar bond in some cases for a scenario were YOU screw up.
  - makomk 13y ago
    Well, the site owner apparently promised to reimburse any deposit losses with his own funds back when he was trying to convince people to deposit money on the site: https://bitcointalk.org/index.php?topic=283756.msg3505423#msg3505423 https://bitcointalk.org/index.php?topic=283756.msg3505423#ms...
albertyw 13y ago
Anybody wondering how long it will take for Bitcoin to gain enough respectability for the FBI or Secret Service to get involved after hacks like this? If the same amount of money was stolen from a normal bank, it'd likely be covered by every news outlet.
- ChuckMcM 13y ago
  I don't think it is the FBI a BitCoin thief needs to fear. That said, it is fascinating to watch people getting caught out when they have a "few dollars" in BitCoin and now its "a few hundred thousand dollars" suddenly the security requirements change dramatically. One would hope that would be bitcoin wallet holders are taking notes and things like daily security audits are the new normal.
- jzwinck 13y ago
  The BBC, Ars Technica, and others covered a theft one year ago of about one-quarter this much value (when converted to USD at the time). And the FBI was involved (not that they recovered the funds or anything): http://www.bbc.co.uk/news/technology-19633980 http://www.bbc.co.uk/news/technology-19633980
- at-fates-hands 13y ago
  Not sure about that. Also, I read somewhere that the going rate of solving bank robberies is around 75-80% and many robbers are only caught because a) they do something stupid like not wear a mask or do anything to conceal their identity, or b) continuing robbing banks until their caught. Considering hacks like this take time and a fairly high level of sophistication, not sure the FBI would want to employ the amount of long term resources needed to hunt these guys down.
  - mrb 13y ago
    The inputs.io hack required zero sophistication. Did you read TradeFortress' explanation? The hacker merely used the password reset feature on an email account, and then reset the Linode Manager password from the email.
nnoitra 13y ago
This is exactly why not everyone should learn how to code and be a developer.
- coralreef 13y ago
  No it isn't. Its why you shouldn't keep your money in places that aren't secure.
- aegiso 13y ago
  I think it's exactly why they should. If these unfortunate folk knew their internet security they would know better than to pump their money into random internet wallets, despite claims that it's the "most secure wallet ever created".
- pera 13y ago
  This is exactly why everyone SHOULD learn how to code and be a developer. They were negligent.
  - prophetx10 13y ago
    Who will bake my bread and pump my gas?
    - steveklabnik 13y ago
      "Everyone should learn to code" != "everyone should have a job as a programmer." "Everyone should learn to write" does not mean that everyone is an author.
    - JetSpiegel 13y ago
      There's an API for that!
    - pacofvf 13y ago
      bread will be made by robots (well actually already is.) and it will be delivered by automated drones, and your car is going to be electric and it's going to be charged just by parking it over a wireless charger.
Helianthus 13y ago
I don't know what you expected, Bitcoin enthusiasts. You bought into a system where coins could be permanently lost because you forgot a password. You bought into a system where the government cheerfully gained control of a large share of the market by simple confiscation. You have recreated money. But you aren't even good at it! You still think that simple cryptography will excuse you from the fact that you're greedy bastards. The reason I hate Bitcoin is that it intentionally promotes a counter-establishment treatise, and you have the batshit insane gall to claim that it is different. I'm venting.
- drstewart 13y ago
  >You bought into a system where coins could be permanently lost because you forgot a password. As opposed to a system where coins can be permanently lost because you have a hole in your pocket?
  - jamesaguilar 13y ago
    Would have to be a rather large hole to lose a million dollars through it. Would have to be about 43" wide.
    - Helianthus 13y ago
      It's funny seeing you on my side. How you been? I haven't crossed words with you in a while. james_d?
      - jamesaguilar 13y ago
        Different, James, I think. I'm not completely on board with your view, but your criticism here is valid and should be acknowledged by BTC proponents if they have any hope of observing their currency as realists. This kind of thing is a major drawback to using Bitcoin.
        Helianthus 13y ago
2810 13y ago
is a trend.. start up a legit Bitcoin service. Run it well with high aims, etc, etc to make an impression to the public. Consciously create a loop hole and hack your own Bitcoin service and close it down.
Taylorious 13y ago
So I have seen several of these stories pop up and I am still kind of confused by them. Are these hackers actually getting "real" money at some point? Are they able to cash out these bitcoins to USD or something else in a reasonable time-frame, or do they simply have a large amount of "fake" money that they can use for very specific goods and services?
- bdcravens 13y ago
  They're likely moving the Bitcoins to their own cryptowallet. At that point they could spend on sources that accept Bitcoin for payment (Silk Road and the like, Reddit Gold, the small but growing set of real-world places that take Bitcoin, etc) or could transfer to an exchange to cash out. tl;dr - both.
  - hvidgaard 13y ago
    Problem is that the coins can be traced, so they need to spend them anonymously.
    - hackerboos 13y ago
      Couldn't they tumble the coins and cash out?
      - Xdes 13y ago
        Tumbling simply makes the accounting harder, but not impossible.
      - hvidgaard 13y ago
        Even if they do, the mixing service must be anonymous too. The blockchain provides irrefutable evidence, and you need at least one step to make the coins anonymous.
- jamesaguilar 13y ago
  They can sell the coins on any exchange that allows them to convert it to real money. Not sure how deep the order book is so they may not be able to convert it all at once.
superuser2 13y ago
Is there anything to stop the community from creating a database of known-stolen Bitcoins which participants can choose to reject? I guess all it takes is one non-participating exchange, but it seems like you could make it much less convenient to cash out.
- patio11 13y ago
  Many members of the community have reacted quite loudly and negatively to the suggestion that a central authority should be able to declare certain bitcoins tainted. This effectively introduces an external-to-the-blockchain way to essentially remove their bitcoins from their control, which they (currently) believe is impossible in bitcoin, and which they believe would devalue their bitcoins if it were known to be possible.
  - tempestn 13y ago
    I wonder if this is a problem that could be solved with an evolution of the technology. Meaning bitcoin (or a future crypto-currency) policing itself in a distributed manner, without requiring a central authority. Perhaps some way to hold referendums as to whether specific coins should be considered stolen. And if passed, some predetermined resolution mechanism would come into play, whereby the stolen coins would no longer be valid anywhere, and new coins would become available - either returned to the theft victim, or added to the mining pool, or something.
  - ronaldx 13y ago
    I gather that it would be straightforward for individual bitcoin users to refuse to handle known-stolen bitcoins. Perhaps this is illegal already - under local handling of stolen goods laws. People would likely be inclined to take up this policy were there a single case of legal enforcement. I believe this would lead to a stable situation where those known-stolen bitcoins were worth far less than regular bitcoins. The present loud reaction would become irrelevant. What's more, I believe it would benefit bitcoin to remove some of the danger of (irreversible) theft.
- clarkm 13y ago
nwh 13y ago
This was a long time coming. The owner of the site's first posts on the forum was offering blackhat SEO and forum spamming services. Anybody who looked into the background of the creator could see that. https://bitcointalk.org/index.php?topic=111563.msg1208770#msg1208770 https://bitcointalk.org/index.php?topic=111563.msg1208770#ms...
lbarrow 13y ago
"No regulations" sounds great up until the moment when the bank gets robbed, the police don't care, and the only proof that it wasn't an inside job is a screenshot of the banker's email[1]. (Not that I think that it was an inside job. I just think this whole situation is kinda funny.) https://bitcointalk.org/index.php?topic=283756.msg3505394#msg3505394 https://bitcointalk.org/index.php?topic=283756.msg3505394#ms...
- jschmitz28 13y ago
  If the owner is either incapable or unwilling to refund everybody's money then it doesn't even matter whether it was an inside job or not. It's pretty telling that he's posting a screenshot that essentially says nothing instead of being open about whether or not he'll be able to fully reimburse the people who lost money. I don't think it was explicitly stated, but it seems like people are just getting whatever percentage of the remaining funds that they owned.
  - camus2 13y ago
    If that guy did not have some kind of insurance like banks do, how can he refund anyone? ( that's a question ). And would insurances insure this kind of business ? Now are bitcoin wallets banks ? and are they subject to the same regulations ? Is that guy a US citizen ? can he be sued by his clients ?
    - riquito 13y ago
      I would add "Must he refund anything at all by contract/policies?"
    - computer 13y ago
      I read that he's an Australian citizen. But I'm not sure if anyone asked for his real identity (before trusting him with $1mm worth of bitcoin)
    - n3rdy 13y ago
      > If that guy did not have some kind of insurance like banks do, how can he refund anyone? Bitcoin is a relatively new thing, would not be surprised to start seeing bitcoin insurance for these types of services. > Is that guy a US citizen ? can he be sued by his clients ? I think it would depend if his clients have contracts, otherwise its a caveat emptor deal, especially when dealing with bitcoin.
icedicedavid 13y ago
Back in July, TradeFortress, the operator of input.io claimed that 0 coins are store on the web facing server. https://bitcointalk.org/index.php?topic=251553.0 https://bitcointalk.org/index.php?topic=251553.0
simonebrunozzi 13y ago
1.1 Million US$ is a strong incentive to fake a theft. How can they prove it was someone else?
- sz4kerto 13y ago
  They don't need to
grey-area 13y ago
These coins were stored on a VPS? On Linode? All it took to steal 1 million USD was to hack an email account? Insanity.
- tinco 13y ago
  This needs to be upvoted more. How can someone have a hosting provider whilst claiming to be the most secure BANK out there? This should have been pointed out long ago. It's a terrible thing that people get away with this. Arrogant developers who think they can do without sysadmin skills when building crucial software.
  - nwh 13y ago
    > This should have been pointed out long ago. It was. The creator smugly relied that it wasn't going to be an issue.
- rmc 13y ago
  BitCoin is security amateur hour. That's why the BitCoin protocol and client hasn't been attacked too much. It's just easier to hack some exchange.
justinholmes 13y ago
When are these online wallet companies going to start using colocated servers owned by themselves instead of Linode and other vps companies.
borplk 13y ago
Smells like inside job
- sjwright 13y ago
  It doesn't smell like either, because a competent outside or inside job will smell the same.
sojorn 13y ago
Interesting that the "theft" didn't happen until BTC reached $300.
barkingcat 13y ago
"Please don't store Bitcoins on an internet connected device, regardless of it is your own or a service's." Best advice I've read so far about bitcoins. All these services that's started up around keeping bitcoins for you, wallets, banks, they are all dodgy and no matter how well their marketing seems or how nice their webpages look, I think in the end - I'd like to keep my own money.
martinml 13y ago
They seem to be using Google Apps for the e-mail. And they claim: > The attacker was able to bypass 2FA due to a flaw on the server host side Which flaw is this? Is it a known issue for Google? I would like to know more details.
- jtolj 13y ago
  As a Linode & GApps customer that uses DFA I'm curious about this as well... Are they talking about Google, Linode or their own app?
  - moneyrich4 13y ago
    the last update they added to their site was "new 2fa added", im leaning towards their own app but not sure. also curious about this
ryanthejuggler 13y ago
I had 0.25 BTC on Inputs.io and was uneasy about using the service. I withdrew it all on Monday to my phone... now I'm so glad that I did!
aric 13y ago
People who don't understand the importance of storing their own bitcoins spread across plenty of cold addresses -- generated from fresh, never-connected boxes and enough entropy -- are begging for loss. Given the attitude people have with security and the nature of viruses alone, 99%+ of people aren't 'ready' to use bitcoin beyond small amounts. It's inherently risky for any considerable amount. I never recommend bitcoin to most other people. It's recommended as worthy in and of itself, though. Bitcoin's digital fungibility, which will always be a curse to some, will always be its greatest virtue. Distrust is one of its most valuable effects. Respect it or don't respect it. That's up to you.
odihack 13y ago
Available BANK HACKING SOFTWARE = $1500 This software hacks bank accounts. HACKDOO (TROJAN) = $1100 Can steal information from any computer, informations like username and passwords, other account login details and credit card details. VAMPIRE 3.5 = $200 Helps in hiding your ip unlimitedly. you can use any ip address you want SOFTWARE BUG WESTERN UNION VERSION 2013 = $900 Western Union Bug is a software that cracks Western Union databases and gives the DATA of Western Union infomation for payment made to any country in the world. It scans the Western Union worldwide database and gets you MTCN from any country and city you choose just within 20 Minutes of clicking on the button start hack The Western Union Bug 2013 version comes with two types of Activation code, the first 20 digit activation code logs you into the first panel whereby you do fresh transfer while the second 20 digit activation code logs you into the Western Union database You can also use the software to make a fresh transfer by also scanning out a Western Union agent logins and using it to make a transfer to any Western receiving country in the world It is easy to use. And make quickly countries such as Africa, EU, CA, AU. TEACHING FEES BUY BANK HACKING SOFTWARE I will teach you Hacking 3 months with all softwares for $3000 Become a hacker today. Contact me Odidollarsman@gmail.com Bank transfers are now available to the following countries : USA UK EU Canada Australia Russia Singapore Dubai Vietnam $2,000 - $10,000 per transfer to Personal accounts (Checking accounts, Savings accounts, Current accounts, Standard accounts) Transfers over $10,000 are available to Business or Corporate accounts only Same day service to UK/USA/EU/Canada/Australia - 1 to 2 business days service to Russia/Dubai/Singapore, Contact: odidollarsman@gmail.com

161 points by citricsquid 13y ago

elango 13y ago

Do bit coins have identity and hence be flagged as stolen somewhere ?.

steveklabnik 13y ago
Each bitcoin goes into a wallet, which contains an address. There's no connection between a person and a wallet, though, and it's not a 1:1 mapping, either. > flagged as stolen That would imply some sort of centralized authority to decide exactly what 'stolen' means. Even if a third-party service kept track, it'd be meaningless in short order, as mixers exist...
- josephagoss 13y ago
  Also there is no connection between a wallet and an address except the wallet stores the address. When the client sends the address the change is returned to a new change address, and the wallets are being designed now to never reuse addresses. So it would become very hard to determine which of the outputs are change addresses and in the same wallet.
qnr 13y ago
In theory, each coin (called transaction output in bitcoin lingo) can be traced through a chain of transactions to its originating block. In practice, this is useless because there is no correspondence between bitcoin addresses and individuals (except in certain points like exchanges that require your ID) In other words, each time a coin changes addresses there is a plausible deniability for the owner of the receiving address that s/he received the coin as a result of a legitimate transaction (sale of goods/services, donation, whatever)
artiface 13y ago
This is the wallet that the owner of Inputs.IO has claimed[1] is where the stolen funds were transferred:http://blockchain.info/fb/1emztw http://blockchain.info/fb/1emztw Blockchain.info has tagged it as inputs.io hack. And a couple users have tagged it as well with public messages. But besides that, as far as I know, all anyone can do is watch it get drained. [1] https://bitcointalk.org/index.php?topic=248803.msg3509247#msg3509247 https://bitcointalk.org/index.php?topic=248803.msg3509247#ms...

o2sd98 13y ago

Which begs the question, how can one determine the veracity of the security claims of website operators? Bitcoins are a convertible currency but are not regulated, insured or guaranteed by any authority. I guess even modern fiat currencies had their teething problems with theft and counterfeiting, so this is not too surprising.

steveklabnik 13y ago
You cannot, just like you can't determine the claims of any other random server responding to port 80 somewhere on the 'net.
TheTaytay 13y ago
I wouldn't be surprised (or disappointed) if some enterprising company developed a security certification (a la PCI) for Bitcoin-related providers. You wouldn't _have_ to offer it, but the market might favor those that had subjected themselves to that scrutiny.
- o2sd98 13y ago
  It would be great to see a market solution to this. Bitcoin is a bit like the gold rush/wild west at the moment which is fine for those who understand this before diving in, but until these types of trust issues are resolved market participation will be limited, which presumably will eventually effect the liquidity of the market for btc.

M4v3R 13y ago

4100 BTC = 1.1 mil USD at current prices. These Bitcoins were stolen from website's "hot wallet" (every shared wallet has to operate one to process current withdrawals). This hot wallet was probably too hot though, as it seems that they had most of their coins online, and only about one third offline (other services claim to store 80-90% offline). According to postings on Bitcointalk.org forums people are getting back partial refunds. One person claimed to receive 37% of his balance back [1]. UPDATE: Correction - according to [4] it seems that almost all funds were stoled in the hot wallet, and the hacker was "nice" enough to not steal it all at once, presumably to stay undetected and come back for more. I'm not sure if I buy this argument though. Also, according to the owners the hack occurred on 26th October [2]. It may be possible that if you deposited funds after that date you will receive full refund, as they should still be on their wallets. Unless hackers took that too. UPDATE: Also according to [4] the funds that were being deposited after 26th were being withdrawn at the same time by other users. So they're as gone as the ones from before 26th. You will be refunded in full only if you deposited very recently. This whole situation (and a bunch of previous ones) is also why at Bitalo [3], we are developing an exchange which will not have this problem, as we use multi-signature addressees to store the coins. This means that you need two signatures to spend funds - one from us, and second one from the user. We also never transmit users password over the wire, as we use SRP protocol for authentication. In unrelated news, China just passed 1800 CNY per BTC :). I wonder how's the security status of chinese exchanges/wallets. Unfortunately I don't know the language, so can't test that. [1] https://bitcointalk.org/index.php?topic=248803.msg3505884#msg3505884 https://bitcointalk.org/index.php?topic=248803.msg3505884#ms... [2] https://bitcointalk.org/index.php?topic=248803.msg3505966#msg3505966 https://bitcointalk.org/index.php?topic=248803.msg3505966#ms... [3] http://bitalo.com http://bitalo.com (in private beta, drop a message to martin@bitalo.com to receive an invite) [4] https://bitcointalk.org/index.php?topic=248803.msg3506034#msg3506034 https://bitcointalk.org/index.php?topic=248803.msg3506034#ms...

deleted 13y ago
[deleted]
clarkmoody 13y ago
I see what you did there[3] ;-) Also, it's a shame that this kind of breach happens, but it seems like it's been a while since a "$COMPANY hacked X BTC stolen" headline was out there[1]. There seem to have been more of those in the past and they appear with less frequency, which is a good thing, I guess. [1] Silk Road doesn't count toward this recollection, since it falls under the "Bitcoin $COMPANY busted by the feds" headline, which will probably happen more often in the future.

martin_ 13y ago

From their website: "Security + privacy The most secure wallet ever created."

raverbashing 13y ago
That's usually true... Until it isn't

yowza 13y ago

What happens when bitcoins are stolen? Can they be use again without being traced?

steveklabnik 13y ago
It depends on what you mean by 'traced.' All bitcoin transactions are 'traced,' but you can just set up a few thousand wallets, transfer some money to all of them, send them between each other, trade some away to other people for things... it's not clear simply from the transaction log who actually took them, and who is just receiving BTC from an anonymous buyer for some sort of service.
- kevin_nisbet 13y ago
  From my understanding of bitcoin, doing this would be trivially easy to track also. However, I haven't studied this in great detail, so what is said here may be incorrect. *simplified view Wallet 1 stores 50 bitcoin for(i = 1; i < 100000; i++) { Transfer 1 bitcoin from Wallet i to Wallet i+1 } At this point, wallet 100000 contains exactly 1 bitcoin, that every transaction can be traced back to wallet 0. I understand that you would include more wallets, varying values, etc. But the point is every one of those bitcoins can be traced back to the original wallet which has the stolen funds. The only way to make this behavior viable that I can see, is to have intermediate services that mix up funds. So you have 50BTC Stolen funds in Wallet A. I run Wallet B, that takes transactions from many people. You give me the 50BTC that is stolen. I send you 50 bitcoins in small increments randomly over a set period of time, but from the other transactions I have. I do the same for other people, using the 50BTC that you sent me. As such, my service mixed the coins through a common point, which now makes tracking the chain very difficult. If I didn't mix this with other people's transactions, and gave you back you're own coin numbers, the coins would just track through me back to the original stolen wallet. This would need a party to offer this type of service, with enough volume to obscure the source, and for that service to not keep records (or not be inspected through other means). Again, I want to re-iterate, my knowledge of bitcoin is somewhat superficial, so don't take this as an authoritative post on the subject.
  - 13y ago

deleted 13y ago

[deleted]

verroq 13y ago

How do we know it's not the owner of input.io cashing out?

steveklabnik 13y ago
You don't! This is the risk of transferring your money to someone without any sort of regulations whatsoever.
citricsquid 13y ago
Here is his proof that it is not an inside job: https://bitcointalk.org/index.php?topic=283756.msg3505394#msg3505394 https://bitcointalk.org/index.php?topic=283756.msg3505394#ms...
- lopatin 13y ago
  I'm curious, how would someone go about proving this wasn't an inside job. Is that possible?
  - steveklabnik 13y ago
    Nope.
  - YokoZar 13y ago
    Short of the actual thief publicly outing himself, I can't really think of any way.

josephagoss 13y ago

I had hundreds of Bitcoin on Coinlenders up until very recently when they switched to a "demo" legal-workaround that was legally terrible and childish. Coinlenders is a sister site to Inputs that share the same wallets. Coinlenders funds are being re-distributed to Inputs wallets. I obviously made a good decision to leave Coinlenders when I did as Coinlenders users are going to get perhaps 40% of their invested amounts back. What really should happen is the owner (Tradefortress on BitcoinTalk) Should use his own massive stash of Bitcoins to compensate all his users.

nwh 13y ago
Looks like they are - https://blockchain.info/address/1GLadosEkeAsLReqS3yQ51E1R3wVtbJCDF https://blockchain.info/address/1GLadosEkeAsLReqS3yQ51E1R3wV...
tempestn 13y ago
I don't know, $1.1M is a lot of money. If someone stole a million dollars from my company, I don't know if I'd be rushing to reimburse it with personal funds (assuming I even could), however bad I felt for the users. That said, if I recall correctly, one case where the corporate veil can potentially be pierced in a lawsuit is negligence. IANAL, but maybe users would have a legitimate case against personal funds, assuming keeping a large percentage of deposits online was found to be negligent. It'd obviously be an incredibly complicated and expensive class action suit if it were to happen though. Also it would probably mean trying to bankrupt a guy who just got hacked and lost his company...
- prophetx10 13y ago
  And there you have it... if you were registered with a regulator you would have insurance and have had put up a multimillion dollar bond in some cases for a scenario were YOU screw up.
- makomk 13y ago
  Well, the site owner apparently promised to reimburse any deposit losses with his own funds back when he was trying to convince people to deposit money on the site: https://bitcointalk.org/index.php?topic=283756.msg3505423#msg3505423 https://bitcointalk.org/index.php?topic=283756.msg3505423#ms...

albertyw 13y ago

Anybody wondering how long it will take for Bitcoin to gain enough respectability for the FBI or Secret Service to get involved after hacks like this? If the same amount of money was stolen from a normal bank, it'd likely be covered by every news outlet.

ChuckMcM 13y ago
I don't think it is the FBI a BitCoin thief needs to fear. That said, it is fascinating to watch people getting caught out when they have a "few dollars" in BitCoin and now its "a few hundred thousand dollars" suddenly the security requirements change dramatically. One would hope that would be bitcoin wallet holders are taking notes and things like daily security audits are the new normal.
jzwinck 13y ago
The BBC, Ars Technica, and others covered a theft one year ago of about one-quarter this much value (when converted to USD at the time). And the FBI was involved (not that they recovered the funds or anything): http://www.bbc.co.uk/news/technology-19633980 http://www.bbc.co.uk/news/technology-19633980
at-fates-hands 13y ago
Not sure about that. Also, I read somewhere that the going rate of solving bank robberies is around 75-80% and many robbers are only caught because a) they do something stupid like not wear a mask or do anything to conceal their identity, or b) continuing robbing banks until their caught. Considering hacks like this take time and a fairly high level of sophistication, not sure the FBI would want to employ the amount of long term resources needed to hunt these guys down.
- mrb 13y ago
  The inputs.io hack required zero sophistication. Did you read TradeFortress' explanation? The hacker merely used the password reset feature on an email account, and then reset the Linode Manager password from the email.

nnoitra 13y ago

This is exactly why not everyone should learn how to code and be a developer.

coralreef 13y ago
No it isn't. Its why you shouldn't keep your money in places that aren't secure.
aegiso 13y ago
I think it's exactly why they should. If these unfortunate folk knew their internet security they would know better than to pump their money into random internet wallets, despite claims that it's the "most secure wallet ever created".
pera 13y ago
This is exactly why everyone SHOULD learn how to code and be a developer. They were negligent.
- prophetx10 13y ago
  Who will bake my bread and pump my gas?
  - steveklabnik 13y ago
    "Everyone should learn to code" != "everyone should have a job as a programmer." "Everyone should learn to write" does not mean that everyone is an author.
  - JetSpiegel 13y ago
    There's an API for that!
  - pacofvf 13y ago
    bread will be made by robots (well actually already is.) and it will be delivered by automated drones, and your car is going to be electric and it's going to be charged just by parking it over a wireless charger.

Helianthus 13y ago

I don't know what you expected, Bitcoin enthusiasts. You bought into a system where coins could be permanently lost because you forgot a password. You bought into a system where the government cheerfully gained control of a large share of the market by simple confiscation. You have recreated money. But you aren't even good at it! You still think that simple cryptography will excuse you from the fact that you're greedy bastards. The reason I hate Bitcoin is that it intentionally promotes a counter-establishment treatise, and you have the batshit insane gall to claim that it is different. I'm venting.

drstewart 13y ago
>You bought into a system where coins could be permanently lost because you forgot a password. As opposed to a system where coins can be permanently lost because you have a hole in your pocket?
- jamesaguilar 13y ago
  Would have to be a rather large hole to lose a million dollars through it. Would have to be about 43" wide.
  - Helianthus 13y ago
    It's funny seeing you on my side. How you been? I haven't crossed words with you in a while. james_d?
    - jamesaguilar 13y ago
      Different, James, I think. I'm not completely on board with your view, but your criticism here is valid and should be acknowledged by BTC proponents if they have any hope of observing their currency as realists. This kind of thing is a major drawback to using Bitcoin.
      - Helianthus 13y ago

2810 13y ago

is a trend.. start up a legit Bitcoin service. Run it well with high aims, etc, etc to make an impression to the public. Consciously create a loop hole and hack your own Bitcoin service and close it down.

Taylorious 13y ago

So I have seen several of these stories pop up and I am still kind of confused by them. Are these hackers actually getting "real" money at some point? Are they able to cash out these bitcoins to USD or something else in a reasonable time-frame, or do they simply have a large amount of "fake" money that they can use for very specific goods and services?

bdcravens 13y ago
They're likely moving the Bitcoins to their own cryptowallet. At that point they could spend on sources that accept Bitcoin for payment (Silk Road and the like, Reddit Gold, the small but growing set of real-world places that take Bitcoin, etc) or could transfer to an exchange to cash out. tl;dr - both.
- hvidgaard 13y ago
  Problem is that the coins can be traced, so they need to spend them anonymously.
  - hackerboos 13y ago
    Couldn't they tumble the coins and cash out?
    - Xdes 13y ago
      Tumbling simply makes the accounting harder, but not impossible.
    - hvidgaard 13y ago
      Even if they do, the mixing service must be anonymous too. The blockchain provides irrefutable evidence, and you need at least one step to make the coins anonymous.
jamesaguilar 13y ago
They can sell the coins on any exchange that allows them to convert it to real money. Not sure how deep the order book is so they may not be able to convert it all at once.

superuser2 13y ago

Is there anything to stop the community from creating a database of known-stolen Bitcoins which participants can choose to reject? I guess all it takes is one non-participating exchange, but it seems like you could make it much less convenient to cash out.

patio11 13y ago
Many members of the community have reacted quite loudly and negatively to the suggestion that a central authority should be able to declare certain bitcoins tainted. This effectively introduces an external-to-the-blockchain way to essentially remove their bitcoins from their control, which they (currently) believe is impossible in bitcoin, and which they believe would devalue their bitcoins if it were known to be possible.
- tempestn 13y ago
  I wonder if this is a problem that could be solved with an evolution of the technology. Meaning bitcoin (or a future crypto-currency) policing itself in a distributed manner, without requiring a central authority. Perhaps some way to hold referendums as to whether specific coins should be considered stolen. And if passed, some predetermined resolution mechanism would come into play, whereby the stolen coins would no longer be valid anywhere, and new coins would become available - either returned to the theft victim, or added to the mining pool, or something.
- ronaldx 13y ago
  I gather that it would be straightforward for individual bitcoin users to refuse to handle known-stolen bitcoins. Perhaps this is illegal already - under local handling of stolen goods laws. People would likely be inclined to take up this policy were there a single case of legal enforcement. I believe this would lead to a stable situation where those known-stolen bitcoins were worth far less than regular bitcoins. The present loud reaction would become irrelevant. What's more, I believe it would benefit bitcoin to remove some of the danger of (irreversible) theft.
clarkm 13y ago

nwh 13y ago

This was a long time coming. The owner of the site's first posts on the forum was offering blackhat SEO and forum spamming services. Anybody who looked into the background of the creator could see that. https://bitcointalk.org/index.php?topic=111563.msg1208770#msg1208770 https://bitcointalk.org/index.php?topic=111563.msg1208770#ms...

lbarrow 13y ago

"No regulations" sounds great up until the moment when the bank gets robbed, the police don't care, and the only proof that it wasn't an inside job is a screenshot of the banker's email[1]. (Not that I think that it was an inside job. I just think this whole situation is kinda funny.) https://bitcointalk.org/index.php?topic=283756.msg3505394#msg3505394 https://bitcointalk.org/index.php?topic=283756.msg3505394#ms...

jschmitz28 13y ago
If the owner is either incapable or unwilling to refund everybody's money then it doesn't even matter whether it was an inside job or not. It's pretty telling that he's posting a screenshot that essentially says nothing instead of being open about whether or not he'll be able to fully reimburse the people who lost money. I don't think it was explicitly stated, but it seems like people are just getting whatever percentage of the remaining funds that they owned.
- camus2 13y ago
  If that guy did not have some kind of insurance like banks do, how can he refund anyone? ( that's a question ). And would insurances insure this kind of business ? Now are bitcoin wallets banks ? and are they subject to the same regulations ? Is that guy a US citizen ? can he be sued by his clients ?
  - riquito 13y ago
    I would add "Must he refund anything at all by contract/policies?"
  - computer 13y ago
    I read that he's an Australian citizen. But I'm not sure if anyone asked for his real identity (before trusting him with $1mm worth of bitcoin)
  - n3rdy 13y ago
    > If that guy did not have some kind of insurance like banks do, how can he refund anyone? Bitcoin is a relatively new thing, would not be surprised to start seeing bitcoin insurance for these types of services. > Is that guy a US citizen ? can he be sued by his clients ? I think it would depend if his clients have contracts, otherwise its a caveat emptor deal, especially when dealing with bitcoin.

icedicedavid 13y ago

Back in July, TradeFortress, the operator of input.io claimed that 0 coins are store on the web facing server. https://bitcointalk.org/index.php?topic=251553.0 https://bitcointalk.org/index.php?topic=251553.0

simonebrunozzi 13y ago

1.1 Million US$ is a strong incentive to fake a theft. How can they prove it was someone else?

sz4kerto 13y ago
They don't need to

grey-area 13y ago

These coins were stored on a VPS? On Linode? All it took to steal 1 million USD was to hack an email account? Insanity.

tinco 13y ago
This needs to be upvoted more. How can someone have a hosting provider whilst claiming to be the most secure BANK out there? This should have been pointed out long ago. It's a terrible thing that people get away with this. Arrogant developers who think they can do without sysadmin skills when building crucial software.
- nwh 13y ago
  > This should have been pointed out long ago. It was. The creator smugly relied that it wasn't going to be an issue.
rmc 13y ago
BitCoin is security amateur hour. That's why the BitCoin protocol and client hasn't been attacked too much. It's just easier to hack some exchange.

justinholmes 13y ago

When are these online wallet companies going to start using colocated servers owned by themselves instead of Linode and other vps companies.

borplk 13y ago

Smells like inside job

sjwright 13y ago
It doesn't smell like either, because a competent outside or inside job will smell the same.

sojorn 13y ago

Interesting that the "theft" didn't happen until BTC reached $300.

barkingcat 13y ago

"Please don't store Bitcoins on an internet connected device, regardless of it is your own or a service's." Best advice I've read so far about bitcoins. All these services that's started up around keeping bitcoins for you, wallets, banks, they are all dodgy and no matter how well their marketing seems or how nice their webpages look, I think in the end - I'd like to keep my own money.

martinml 13y ago

They seem to be using Google Apps for the e-mail. And they claim: > The attacker was able to bypass 2FA due to a flaw on the server host side Which flaw is this? Is it a known issue for Google? I would like to know more details.

jtolj 13y ago
As a Linode & GApps customer that uses DFA I'm curious about this as well... Are they talking about Google, Linode or their own app?
- moneyrich4 13y ago
  the last update they added to their site was "new 2fa added", im leaning towards their own app but not sure. also curious about this

ryanthejuggler 13y ago

I had 0.25 BTC on Inputs.io and was uneasy about using the service. I withdrew it all on Monday to my phone... now I'm so glad that I did!

aric 13y ago

People who don't understand the importance of storing their own bitcoins spread across plenty of cold addresses -- generated from fresh, never-connected boxes and enough entropy -- are begging for loss. Given the attitude people have with security and the nature of viruses alone, 99%+ of people aren't 'ready' to use bitcoin beyond small amounts. It's inherently risky for any considerable amount. I never recommend bitcoin to most other people. It's recommended as worthy in and of itself, though. Bitcoin's digital fungibility, which will always be a curse to some, will always be its greatest virtue. Distrust is one of its most valuable effects. Respect it or don't respect it. That's up to you.

odihack 13y ago

Available BANK HACKING SOFTWARE = $1500 This software hacks bank accounts. HACKDOO (TROJAN) = $1100 Can steal information from any computer, informations like username and passwords, other account login details and credit card details. VAMPIRE 3.5 = $200 Helps in hiding your ip unlimitedly. you can use any ip address you want SOFTWARE BUG WESTERN UNION VERSION 2013 = $900 Western Union Bug is a software that cracks Western Union databases and gives the DATA of Western Union infomation for payment made to any country in the world. It scans the Western Union worldwide database and gets you MTCN from any country and city you choose just within 20 Minutes of clicking on the button start hack The Western Union Bug 2013 version comes with two types of Activation code, the first 20 digit activation code logs you into the first panel whereby you do fresh transfer while the second 20 digit activation code logs you into the Western Union database You can also use the software to make a fresh transfer by also scanning out a Western Union agent logins and using it to make a transfer to any Western receiving country in the world It is easy to use. And make quickly countries such as Africa, EU, CA, AU. TEACHING FEES BUY BANK HACKING SOFTWARE I will teach you Hacking 3 months with all softwares for $3000 Become a hacker today. Contact me Odidollarsman@gmail.com Bank transfers are now available to the following countries : USA UK EU Canada Australia Russia Singapore Dubai Vietnam $2,000 - $10,000 per transfer to Personal accounts (Checking accounts, Savings accounts, Current accounts, Standard accounts) Transfers over $10,000 are available to Business or Corporate accounts only Same day service to UK/USA/EU/Canada/Australia - 1 to 2 business days service to Russia/Dubai/Singapore, Contact: odidollarsman@gmail.com