8 ms·

Australian bitcoin site hacked, $1 million in virtual currency stolen

46 points by apapli 13y ago

dredwerker 13y ago
Makes you think though. Setup a site take the lot, blame it on a robbery == Millionaire.
nwh 13y ago
Seems to be an issue of his age there. He claims to be much older on Bitcointalk. He owns a $750k house and previously rented a $500/week apartment too, so I highly doubt he is truly 18.
- maxden 13y ago
  Why do you question his age, but apparently accept that he owns a $750k house etc? Not being snarky, but has he provided evidence etc? I'm not sure how the ABC got to talk to him but he sounds young on the radio interview, for what it's worth.
  - nwh 13y ago
    It wasn't given by him, other users have done their jobs tracking down information about this person - https://bitcointalk.org/index.php?topic=326914 https://bitcointalk.org/index.php?topic=326914 Seems credible enough to be real in my eyes.
i_am_dead 13y ago
This kid is 18? And people trusted a million dollars in untraceable money to him?
- nwh 13y ago
  A kid offering spamming and hacked twitter accounts using the same account on the forums too, so I doubt anybody did any real research into this person before sending him money.
- selmnoo 13y ago
  Zhou Tong was 17, when his Bitcoin project was hacked (this is the thread where he announced the project, and was astutely pointed out (concernedly, not mockingly) that he was destined for spectacular failure: https://news.ycombinator.com/item?id=2973301 https://news.ycombinator.com/item?id=2973301 ). I really don't know why we keep trusting very young individuals on things that require implementation of _really_ good security. This is one of the places where ageism probably /should/ exist in some ways -- but the other way around from how we know it, because experience is one of the things that is really important here.
  - freehunter 13y ago
    Age isn't the only factor in experience, though. Reputation and relevant experience is the key. There are people I would trust at 35 (for 15 years of experience) where I wouldn't trust someone at 45 (for 3 years of experience). And then remember, John McAfee started McAfee in 1987 and left in 1994. He's 68 years old and I wouldn't trust him to tie my shoes.
  - mkramlich 13y ago
    indeed upside of Bitcoin: no banks needed. or, anybody can run their own bank. innovate downside of Bitcoin: anyone will run their own "bank". They will put Fortress in the name. It will be their first or second Rails app. They will live in their parent's basement. They will be experiencing puberty. But their stuff will be "secure" because they use "https://" https://" on a few of their pages. Yeah.
josephagoss 13y ago
| "And the more of it that is out there, the more thieves will be drawn to it. Bitcoin will eventually be the defacto valuable item to steal, however I see the community is in its early days and perhaps Bitcoin will lead to even safer computing as our operating systems will need to be more secure. Theres a lot of things we can learn.
- Phlarp 13y ago
  A while back PG asked "what motive could a government actor have to create bitcoin?" Could the long game answer be "To teach the masses of idiot developers basic info security"? If you take a step back the whole thing is a pretty neat experiment in punishing poor security practices. As a soon to graduate computer science graduate, learning the in's and out's of bitcoin in the hope of making money has taught me way more about application security and the underlying crypto than four years of state schooling did.
adamconroy 13y ago
Call me a luddite if you like, and I will probably be left behind in work and life, but I really can't shake the feeling that Bitcoin is an unworkable bad idea. Taking into account the risks of theft, the risk of government legislation, the risk of the system being gamed, the risk of wild fluctuations in value without rhyme or reason....
- nmarley 13y ago
  How are the risks any different than with cash? Leave your cash in an unsecure location and it will be stolen as well. I would argue that the risk of government legislation is greater with fiat currencies (capital controls) than with Bitcoin, because regulations are inherently more difficult to actually enforce. Currencies also have fluctuations in value (which central banks try to manage as best they can).
  - ChuckMcM 13y ago
    If you don't mind me being a bit pedantic ... The primary difference is that a person in a far away land is unable able steal my actual currency without putting a lot of their own funds at risk. Which is to say they would have to fly out here, find my house and/or wallet, take out money, leave, and then fly home. Its the same reason cash is more secure than a debit card. Debit card readers can be hacked with skimmers, nothing to 'skim' with cash. So the risks with BitCoin are that from far away people can steal it from where it is being kept. These are the same risks as having cash in a banking instituion, except the bank has regulations that it has to meet in terms of being able to guarantee that even if they lose my funds they will replace them. Without the equivalent of the FDIC for BitCoin is qualifies as "higher risk."
    - gnerd 13y ago
      A person in a far away land is unlikely to be able to steal funds you put in a physical BitCoin wallet generated offline that has never had any transaction outputs. Less likely than the cash analogy. They can get my debit card number and steal money remotely though.
- 13y ago
sanskritabelt 13y ago
Say what you like about 'fiat money' and 'taxation is theft' and big gov't and etcetcetc but if somebody robs my bank it doesn't cost me anything directly.
- mrb 13y ago
  Same with Bitcoin. When Bitcoin exchange MtGox was hacked on June 19, 2011, the attacker stole 2000 coins (worth $0.6 million today), but MtGox covered the losses with their own funds. Customers lost nothing. Large, reputable, mature businesses will cover losses for you, no matter if it is USD or BTC.
  - stephenr 13y ago
    Banks have some kind of regulation (even in the financial wild west that is the USA), and deposit insurance covers their customers against theft. This jackass has said he isn’t likely to even report the theft to police. That another bit coin exchange was able to cover the losses from a theft out of its own pocket is more likely good luck than good planning.
    - mrb 13y ago
      "Good luck"?? No that's planning. Read about some of the security mechanisms that reputable exchanges put in place: http://blog.coinbase.com/post/33197656699/coinbase-now-storing-87-of-customer-funds-offline http://blog.coinbase.com/post/33197656699/coinbase-now-stori...
- gnerd 13y ago
  So what about if the government decides to devalue the currency by printing more money? Hasn't that 'quantitive easing' eroded your stored value? Your balance might be the same but the purchasing power and thus value isn't. Best bit is you won't know till after its done, way after. It might be a nice incentive for investing money to keep value ahead of inflation but to the man-on-the-street its a bit like robbery in some sense in that it deprives you of the full expected value of your funds.
knodi 13y ago
More like he may have stole the BTCs him self. A lot of his security claims where false and he failed to disclose the hack after it happened for almost a week but during this week he still allowed people to transfer BTCs into inputs.io. http://www.reddit.com/r/Bitcoin/comments/1q3rpp/tradefortress_stole_30_of_my_btc/ http://www.reddit.com/r/Bitcoin/comments/1q3rpp/tradefortres...
VexXtreme 13y ago
Incidents like this are good. They will teach idiots not to trust "online wallets". Why on earth would you entrust a 3rd party service with your coins when you can keep your private key safe on your own and never have to worry about this? When will people finally learn that since Bitcoin is decentralized by nature, that there is no need to re-invent these online "banks" to store coins? Serves them right.
- sireat 13y ago
  Problem with incidents like these is that they keep happening. This means two things. One, there exists real demand for a secure online wallet, because just like most people are not comfortable storing massive amounts of cash at home, they are not comfortable storing Bitcoin in their paper wallets, brain wallets, etc. There is the convenience factor, as well. Two, online wallets entail a number of risks, and seem inherently unsafe. How do you reconcile the two?
- asperous 13y ago
  Well you're making the assumption that people can protect their wallets better than a bank. I hope I'm not making a crazy statement to say that people in general aren't that great at security. Unless you have the wisdom to keep your wallets offline or secured with a password longer than 20+ (or whatever) charactes, it's only a matter of time before a worm or virus gathers up hundreds of insecure wallets. Secondly, there's nothing intrinsically wrong with banks. Banks help the supply of money and keep economies going through investment. Banks can build green addresses for instant purchases which Bitcoin needs to be successful. Bitcoin wasn't designed to get rid of banks. Bitcoin was designed to give banks and people a common way of transferring money without expensive accounting auditing, secret protocols, and government centralization.
  - andrewfong 13y ago
    In addition to worms and viruses, consider the risk of good old fashioned data loss. Everyone knows they should back up their hard-drive but many (if not most) users do a piss-poor job of it. Storing your bitcoins online somewhere increases the risk they'll be compromised by an online attacker, but it reduces the risk that you'll lose everything in a fire.
nl 13y ago
In some kind of very weird way, these incidents give me more confidence in bitcoin-the-currency. There are so many attacks on "bitcoin infrastructure" it is pretty clear that it is seen as a target by criminals (of various degrees of skill). And yet there is no evidence of any critical break in bitcoin itself. They still haven't worked out how to print money. I'm still a bitcoin cynic, but I'm slowly gaining confidence in it as a store of value. Like I said: Weird.
Mustafabei 13y ago
Guys help me here. It seems that I don't understand and maybe don't really know how bitcoin works. How can it be stolen? A change in the logs? A pseudo-transaction?
- deleted 13y ago
  [deleted]
- A1kmm 13y ago
  If you know the private key for a wallet, you can transfer all the coins out to another wallet (i.e. make a real transaction). Anyone holding BitCoins for someone else should protect the private key for the wallets holding the coins strongly - for example, by moving most coins to a 'cold wallet' where the private key is kept on an airgapped computer encrypted with a long secure password, and only occasionally accessed when the hot wallet runs out of funds, and protecting the computer with the hot wallet strongly as well (with multiple layers of defense and controls to detect and stop activity that might represent an attack).
gnerd 13y ago
It seems to me the gold analogy is more applicable when storing BTC than the cash one. I might be OK storing my gold with some institutions, especially ones with a proven track record and insurance policy, but other than those few institutions, I'd probably opt for a fire proof safe (a safe rated to protect the amount of money stored). If one were to use BTC to store vast sums of money, you can store your BTC with a traditional bank. Simply generate a wallet offline on new hardware with a relatively secure USB bootable OS, write the keys down on a piece of old fashioned paper (use carbon paper and store the copy, destroying the original) and cover with some sort of tamper proof seal. Lock inside a lead box and then put it in a safety deposit box.
- davidsong 13y ago
  Please excuse my ignorance, but why would you use carbon paper and store the copy rather than the original?
  - gnerd 13y ago
    Paranoid overkill really. Suppose you didn't have access to a locked lead box and stored your extremely large sum in an envelope, you would feel silly in 10 years when you realized someone was able to steam the envelope and use the raised letters from the pressure when writing to reveal the key without removing the tamper proof seal. There are better, more modern methods of applying a seal or printing but it increases the attack surface so for the truly paranoid, they should probably be avoided (unless using something like Shamirs Secret Sharing Algorithm).

46 points by apapli 13y ago

Makes you think though. Setup a site take the lot, blame it on a robbery == Millionaire.

nwh 13y ago

Seems to be an issue of his age there. He claims to be much older on Bitcointalk. He owns a $750k house and previously rented a $500/week apartment too, so I highly doubt he is truly 18.

maxden 13y ago
Why do you question his age, but apparently accept that he owns a $750k house etc? Not being snarky, but has he provided evidence etc? I'm not sure how the ABC got to talk to him but he sounds young on the radio interview, for what it's worth.
- nwh 13y ago
  It wasn't given by him, other users have done their jobs tracking down information about this person - https://bitcointalk.org/index.php?topic=326914 https://bitcointalk.org/index.php?topic=326914 Seems credible enough to be real in my eyes.

i_am_dead 13y ago

This kid is 18? And people trusted a million dollars in untraceable money to him?

nwh 13y ago
A kid offering spamming and hacked twitter accounts using the same account on the forums too, so I doubt anybody did any real research into this person before sending him money.
selmnoo 13y ago
Zhou Tong was 17, when his Bitcoin project was hacked (this is the thread where he announced the project, and was astutely pointed out (concernedly, not mockingly) that he was destined for spectacular failure: https://news.ycombinator.com/item?id=2973301 https://news.ycombinator.com/item?id=2973301 ). I really don't know why we keep trusting very young individuals on things that require implementation of _really_ good security. This is one of the places where ageism probably /should/ exist in some ways -- but the other way around from how we know it, because experience is one of the things that is really important here.
- freehunter 13y ago
  Age isn't the only factor in experience, though. Reputation and relevant experience is the key. There are people I would trust at 35 (for 15 years of experience) where I wouldn't trust someone at 45 (for 3 years of experience). And then remember, John McAfee started McAfee in 1987 and left in 1994. He's 68 years old and I wouldn't trust him to tie my shoes.
- mkramlich 13y ago
  indeed upside of Bitcoin: no banks needed. or, anybody can run their own bank. innovate downside of Bitcoin: anyone will run their own "bank". They will put Fortress in the name. It will be their first or second Rails app. They will live in their parent's basement. They will be experiencing puberty. But their stuff will be "secure" because they use "https://" https://" on a few of their pages. Yeah.

josephagoss 13y ago

| "And the more of it that is out there, the more thieves will be drawn to it. Bitcoin will eventually be the defacto valuable item to steal, however I see the community is in its early days and perhaps Bitcoin will lead to even safer computing as our operating systems will need to be more secure. Theres a lot of things we can learn.

Phlarp 13y ago
A while back PG asked "what motive could a government actor have to create bitcoin?" Could the long game answer be "To teach the masses of idiot developers basic info security"? If you take a step back the whole thing is a pretty neat experiment in punishing poor security practices. As a soon to graduate computer science graduate, learning the in's and out's of bitcoin in the hope of making money has taught me way more about application security and the underlying crypto than four years of state schooling did.

adamconroy 13y ago

Call me a luddite if you like, and I will probably be left behind in work and life, but I really can't shake the feeling that Bitcoin is an unworkable bad idea. Taking into account the risks of theft, the risk of government legislation, the risk of the system being gamed, the risk of wild fluctuations in value without rhyme or reason....

nmarley 13y ago
How are the risks any different than with cash? Leave your cash in an unsecure location and it will be stolen as well. I would argue that the risk of government legislation is greater with fiat currencies (capital controls) than with Bitcoin, because regulations are inherently more difficult to actually enforce. Currencies also have fluctuations in value (which central banks try to manage as best they can).
- ChuckMcM 13y ago
  If you don't mind me being a bit pedantic ... The primary difference is that a person in a far away land is unable able steal my actual currency without putting a lot of their own funds at risk. Which is to say they would have to fly out here, find my house and/or wallet, take out money, leave, and then fly home. Its the same reason cash is more secure than a debit card. Debit card readers can be hacked with skimmers, nothing to 'skim' with cash. So the risks with BitCoin are that from far away people can steal it from where it is being kept. These are the same risks as having cash in a banking instituion, except the bank has regulations that it has to meet in terms of being able to guarantee that even if they lose my funds they will replace them. Without the equivalent of the FDIC for BitCoin is qualifies as "higher risk."
  - gnerd 13y ago
    A person in a far away land is unlikely to be able to steal funds you put in a physical BitCoin wallet generated offline that has never had any transaction outputs. Less likely than the cash analogy. They can get my debit card number and steal money remotely though.
13y ago

sanskritabelt 13y ago

Say what you like about 'fiat money' and 'taxation is theft' and big gov't and etcetcetc but if somebody robs my bank it doesn't cost me anything directly.

mrb 13y ago
Same with Bitcoin. When Bitcoin exchange MtGox was hacked on June 19, 2011, the attacker stole 2000 coins (worth $0.6 million today), but MtGox covered the losses with their own funds. Customers lost nothing. Large, reputable, mature businesses will cover losses for you, no matter if it is USD or BTC.
- stephenr 13y ago
  Banks have some kind of regulation (even in the financial wild west that is the USA), and deposit insurance covers their customers against theft. This jackass has said he isn’t likely to even report the theft to police. That another bit coin exchange was able to cover the losses from a theft out of its own pocket is more likely good luck than good planning.
  - mrb 13y ago
    "Good luck"?? No that's planning. Read about some of the security mechanisms that reputable exchanges put in place: http://blog.coinbase.com/post/33197656699/coinbase-now-storing-87-of-customer-funds-offline http://blog.coinbase.com/post/33197656699/coinbase-now-stori...
gnerd 13y ago
So what about if the government decides to devalue the currency by printing more money? Hasn't that 'quantitive easing' eroded your stored value? Your balance might be the same but the purchasing power and thus value isn't. Best bit is you won't know till after its done, way after. It might be a nice incentive for investing money to keep value ahead of inflation but to the man-on-the-street its a bit like robbery in some sense in that it deprives you of the full expected value of your funds.

knodi 13y ago

More like he may have stole the BTCs him self. A lot of his security claims where false and he failed to disclose the hack after it happened for almost a week but during this week he still allowed people to transfer BTCs into inputs.io. http://www.reddit.com/r/Bitcoin/comments/1q3rpp/tradefortress_stole_30_of_my_btc/ http://www.reddit.com/r/Bitcoin/comments/1q3rpp/tradefortres...

VexXtreme 13y ago

Incidents like this are good. They will teach idiots not to trust "online wallets". Why on earth would you entrust a 3rd party service with your coins when you can keep your private key safe on your own and never have to worry about this? When will people finally learn that since Bitcoin is decentralized by nature, that there is no need to re-invent these online "banks" to store coins? Serves them right.

sireat 13y ago
Problem with incidents like these is that they keep happening. This means two things. One, there exists real demand for a secure online wallet, because just like most people are not comfortable storing massive amounts of cash at home, they are not comfortable storing Bitcoin in their paper wallets, brain wallets, etc. There is the convenience factor, as well. Two, online wallets entail a number of risks, and seem inherently unsafe. How do you reconcile the two?
asperous 13y ago
Well you're making the assumption that people can protect their wallets better than a bank. I hope I'm not making a crazy statement to say that people in general aren't that great at security. Unless you have the wisdom to keep your wallets offline or secured with a password longer than 20+ (or whatever) charactes, it's only a matter of time before a worm or virus gathers up hundreds of insecure wallets. Secondly, there's nothing intrinsically wrong with banks. Banks help the supply of money and keep economies going through investment. Banks can build green addresses for instant purchases which Bitcoin needs to be successful. Bitcoin wasn't designed to get rid of banks. Bitcoin was designed to give banks and people a common way of transferring money without expensive accounting auditing, secret protocols, and government centralization.
- andrewfong 13y ago
  In addition to worms and viruses, consider the risk of good old fashioned data loss. Everyone knows they should back up their hard-drive but many (if not most) users do a piss-poor job of it. Storing your bitcoins online somewhere increases the risk they'll be compromised by an online attacker, but it reduces the risk that you'll lose everything in a fire.

nl 13y ago

In some kind of very weird way, these incidents give me more confidence in bitcoin-the-currency. There are so many attacks on "bitcoin infrastructure" it is pretty clear that it is seen as a target by criminals (of various degrees of skill). And yet there is no evidence of any critical break in bitcoin itself. They still haven't worked out how to print money. I'm still a bitcoin cynic, but I'm slowly gaining confidence in it as a store of value. Like I said: Weird.

Mustafabei 13y ago

Guys help me here. It seems that I don't understand and maybe don't really know how bitcoin works. How can it be stolen? A change in the logs? A pseudo-transaction?

deleted 13y ago
[deleted]
A1kmm 13y ago
If you know the private key for a wallet, you can transfer all the coins out to another wallet (i.e. make a real transaction). Anyone holding BitCoins for someone else should protect the private key for the wallets holding the coins strongly - for example, by moving most coins to a 'cold wallet' where the private key is kept on an airgapped computer encrypted with a long secure password, and only occasionally accessed when the hot wallet runs out of funds, and protecting the computer with the hot wallet strongly as well (with multiple layers of defense and controls to detect and stop activity that might represent an attack).

gnerd 13y ago

It seems to me the gold analogy is more applicable when storing BTC than the cash one. I might be OK storing my gold with some institutions, especially ones with a proven track record and insurance policy, but other than those few institutions, I'd probably opt for a fire proof safe (a safe rated to protect the amount of money stored). If one were to use BTC to store vast sums of money, you can store your BTC with a traditional bank. Simply generate a wallet offline on new hardware with a relatively secure USB bootable OS, write the keys down on a piece of old fashioned paper (use carbon paper and store the copy, destroying the original) and cover with some sort of tamper proof seal. Lock inside a lead box and then put it in a safety deposit box.

davidsong 13y ago
Please excuse my ignorance, but why would you use carbon paper and store the copy rather than the original?
- gnerd 13y ago
  Paranoid overkill really. Suppose you didn't have access to a locked lead box and stored your extremely large sum in an envelope, you would feel silly in 10 years when you realized someone was able to steam the envelope and use the raised letters from the pressure when writing to reveal the key without removing the tamper proof seal. There are better, more modern methods of applying a seal or printing but it increases the attack surface so for the truly paranoid, they should probably be avoided (unless using something like Shamirs Secret Sharing Algorithm).