7 ms·

Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

60 points by qwertzlcoatl 13y ago

aw3c2 13y ago
Misleading. 1295 BTC were stolen, no USD.
- jzwinck 13y ago
  Well thank goodness for that. At least this way there is no chance of recovery. I enjoyed the bit at the end about a potential lawsuit to get the BTC back. Sounds awfully familiar to the legal posturing after some other BTC heists--none of which got anywhere AFAIK. Do people still think the irrevocability of BTC transactions is a good thing?
  - executive 13y ago
    yes. events like this encourage better security.
    - jzwinck 13y ago
      If that's true, why did we see three significant Bitcoin services get hacked in basically the same way in the last year? I'm talking about the Linode ones. Events like this encourage better thieves.
      - Sae5waip 13y ago
        Because the people running these services apparently cared more for quick money than for security. Or running their own server. I mean, who runs that kind of thing on a cheap rented server? No pity here. They took a risk, and one don't always win when taking a risk. (You startup folks should know.)
  - ogig 13y ago
    >Do people still think the irrevocability of BTC transactions is a good thing? Yes. Third parties will provide escrow/insurance services if there is demand for them. Transactions been irreversible "by default" is a core benefit of bitcoin and merchants may preffer that over chargebacks at 18€.
    - fat0wl 13y ago
      I've heard that this type of insurance is expensive and a large part of banks' transaction fees. I can only imagine how expensive an insurance service like that for Bitcoin would be.
      - maaku 13y ago
        However unlike the existing system there will be a transparent, competitive market for such insurance mechanisms, and they will be available to consumers/businesses directly.
        fat0wl 13y ago
        I think the banks are pretty focused on offering competitive products that are packaged together neatly to avoid putting too much of burden on consumers (what's the diff between choosing a bank or choosing a private transaction-insurance service?). I'm paranoid of investment banks but I think plain old banks are benign. You put a certain amount of money in your account and they handle all this for you. There is usually no charge for checking. Credit cards don't charge interest unless you go into debt, etc. I don't think lack of competition is so much an issue, it seems that the Bitcoin movement just has a fundamental distrust of govt/corporations. I think if Bitcoin money didn't magically appreciate in value so much it wouldn't be much cheaper than banking except for big international money transfers.
    - filam 13y ago
      Insurance does not eliminate risk from the market.
      - 13y ago
  - oleganza 13y ago
    Gold, which was easier to track down and confiscate "back" was historically confiscated in much larger quantities by much tougher guys. This "insured" government debt-backed money that you have today is a result of having heavy money that is ultimately owned by someone who is bigger than you. While Bitcoin is stolen from some exchanges from time to time, it's much more diffused and it's enormously harder to take bitcoins massively from population than gold. See also: http://en.wikipedia.org/wiki/Executive_Order_6102 http://en.wikipedia.org/wiki/Executive_Order_6102 By the way, these "insured" USDs that you have in your account are not owned by you. Try to cash out everything in paper. Or move anywhere at once without asking for permission. Or what would you do when they impose capital controls like in Cyprus or Argentina? Or when your % of total USDs in the economy is going down while Fed is printing more dollars? Or when some new taxation is applied retroactively? Or when some bureaucrat didn't see your tax return papers in time and your entire account is frozen during investigation? Bitcoin reduces systemic risk like the one present in banking system and shifts the burden on individual users. You can still create a bank if you want, but that's totally optional and you have many other options as well. In the future people will develop hundreds really different devices, services and tricks to store your coins securely. Compare that with monopolised non-innovative heavily regulated banking. As bitcoins are so cheap to store, security is asymmetrical: it's much harder to take, than to hide. Gold, or any physical commodity, are as hard to protect as to take from you. Hence, most brutal guys end up owning precious metals over the course of the history. Average Joe can only have as much gold as he can hide in his pants.
    - foobarqux 13y ago
      States are powerful. You are mistaken if you think bitcoin can somehow materially evade that power, you have to interact with the real world some time. Putting aside the increasingly clear fact that network-attached computers won't be secure from state-actors for the foreseeable future --- and bitcoin transactions always have to hit the network --- states can effectively control bitcoin being spent or bitcoin cash-outs being transferred in country as well as any currency. Presently the risk of losing or having stolen your bitcoin is far higher than the same for gold or conventional stores of value.
- pallandt 13y ago
  They seem to be currently worth more than $1 million USD though. Maybe the USD equivalent was chosen for the title because more people would be able to immediately relate to it as a value.
  - deleted 13y ago
    [deleted]
  - fat0wl 13y ago
    this is common linkbait tactic now. They take the current high trading value of BTC & multiply by the number of BTC involved to get some crazy-high-looking USD price. It's not money in hand, the reality of getting that money out of BTC can be pricey.
    - pistle 13y ago
      Which is why bitcoin is secure and liquid - great as a utility currency. So you're saying the transaction costs of converting from bitcoin to any useful currency is really high and that we should see the unattractiveness of money-servicing costs as a security-assurance since script-kiddie criminals don't like seeing any portion of their free "money" siphoned away by the money-changers in the temple.
      - fat0wl 13y ago
        heh they DO hate that ;) my point was simpler tho which is just that the real numbers being applied to these amounts rely on ecosystem stability and the market cap (a term a trader helpfully pointed me to in order to understand their favorite stat, which these "multiply by exchange rate" figures are an extension of) really doesn't represent the real world value of assets in Bitcoin since the value declines as money is pulled out of the system. It seems to be anyone's guess as to whether or not it has real value or is a pyramid scheme. There's no way to tell without a mass cashout. Then we'd see how many BTC can get sold off before one starts to incur heavy losses. I think if some of the big players cashed out (early adopters with an inordinate amount of essentially self-printed wealth) the system would destabilize and finally flop. It's why they instead drive the price up & try to trickle units out one by one.
stpddts 13y ago
Can we get a break from all these Bitcoin posts please?
- ye 13y ago
  Why did you click on it? Just ignore or downvote next time. Bitcoin is a hot topic these days, tons of people are interested in what's going on.
  - MichaelApproved 13y ago
    This isn't reddit. There's no downvote on stories for (most) users on HN.
- iamshs 13y ago
  I agree, there are six posts about Bitcoin right now on top. On one hand it is community regulated matter, but on other hand 20% of top posts is too much.
  - bdcravens 13y ago
    When Steve Jobs passed, the entire home page was related articles.
- waterlesscloud 13y ago
  I just don't read posts I'm not interested in. I never feel compelled to complain that others are interested.
- VMG 13y ago
  It's just a reflection of what is happening in the world. Like it or not, Bitcoin is a big deal now.
- speeder 13y ago
  I don't work with web dev, can't we get a break from all those ruby, mongo, go and JavaScript posts please?
- 13y ago
M4v3R 13y ago
Ugh. There are much better solutions than keeping user funds in the hot wallet (fully cold storage with manual withdrawals, multi-signature wallets), but many "reputable" businesses STILL uses them. I don't understand why. If you want to store your customers funds online, do it the right way, or don't do it at all.
- dragontamer 13y ago
  You cannot automate a cold-wallet scheme. Any automated website or tool will require a "hot wallet" of some kind. The more funds in the hot wallet, the longer the website / BTC Bank can go automatically. Customers like having funds available to them immediately... among other things.
  - M4v3R 13y ago
    > You cannot automate a cold-wallet scheme. That's why I said that it would be manual. Actually, it could be semi-automatic - a script could generate all relevant transactions, and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key. > Customers like having funds available to them immediately... among other things. Either security or convenience. This service was aimed for merchants, which are used to get their funds from payment processors much slower than in a matter of hours. Also, that's only one of the solutions that I mentioned. Second one, which is convenient and more secure at the same time, is using multisignature wallets.
    - a3voices 13y ago
      Any wallet that has been exposed to a computer connected to the Internet, or is sitting on one, is a "hot wallet".
    - ye 13y ago
      > and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key. It's a payment system. This would be unacceptable.
ori_b 13y ago
I'm not a bitcoin expert, so I may end up off base, but... The US government seemed surprisingly warm to bitcoin in the senate hearing. I suspect that if governments end up getting involved in bitcoin, each merchant will require some form of ID for each wallet that they interact with. This will mean that tracking down crimes like this will be fairly easy, since there's a record of each transaction. Trace down the chain, find the people involved, and if an anonymous wallet shows up, you investigate the people that it transferred to or from. Sure, it erodes privacy, but bitcoin has the potential to make things much easier for law enforcement (and anyone else interested in money transfers) by causing registration of endpoints, giving very strong leads to investigators.
- GigabyteCoin 13y ago
  If the US government decides to take this approach, I am sure that a few of these guys will do the exact opposite: http://en.wikipedia.org/wiki/Tax_haven#Examples http://en.wikipedia.org/wiki/Tax_haven#Examples
  - dublinben 13y ago
    Jurisdictions like that have been increasingly disappearing. If regulators in major countries make it illegal to exchange BTC anonymously, it will significantly hamper its adoption.
- dmix 13y ago
  ID'ing hasn't stopped stolen guns from being used by criminals, I highly doubt it will stop hackers from being able to use Bitcoin. Harder maybe. But there will be thousands of markets that exist outside of USA regulation (or black markets within the USA). Especially by the time the USA would be capable of implementing some sort of ID system. There is also factoring in the complexity added to associating any form of ID to a particular coin, if CoinJoin or similar trustless anonymizing mixing services reach widespread adoption. This is all assuming Bitcoin continues it's mainstream course.
cryptocoin 13y ago
If you are new to bitcoin-related sites, you might find this story legitimate. But anyone that reads the article will see there is a basic flaw: DDoS attacks do not give access to the server, they just make the service inaccessible. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier. The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact.
clarkmoody 13y ago
I know it makes for a better headline to say $1M stolen, but unless actual USD was taken in the theft, I wish these headlines would say "X BTC stolen, valued at $Y." But then again, the headline made it to the front page and got me to comment...
- peteretep 13y ago
  Why do you wish that? Every news source on the planet localizes currency amounts to their audience. Are you actually making some weird political point about BTC value, or are you surprised that a news source is localizing currency values?
  - clarkmoody 13y ago
    1) When large amount of BTC are stolen or moved, the fiat value would be far less if the coins were sold on the open exchange. 2) The article title becomes immediately obsolete due to exchange rate fluctuations. On the day of the theft for instance, the BTC/USD rate was hugely volatile, fluctuating between $522 and $788. We could go dig up the old Bitcoin Forum posts about people losing 25k coins and mark-to-market those losses for more sensational headlines. Or we could simply post the BTC amount in the headline along with present fiat value.
    - veemjeem 13y ago
      Well, it's a news article. The goal of the journalist is to get people to read it. It would be a less interesting headline if it forced people to do the conversion since many people still do not yet understand BTC. Putting both values (BTC & USD) into the headlines would make it redundant.
- fat0wl 13y ago
  hah i suggested this a few posts ago & people got pissed. https://news.ycombinator.com/item?id=6783710 https://news.ycombinator.com/item?id=6783710 granted, i don't present these things very tactfully
Vitaly 13y ago
Whale Communications, before they were purchased by Microsoft, had a hardware solution where a shared HDD disk was used to physically switch it between 2 different hosts to enable file sharing in a shared directory. would be almost perfect to secure the hot wallet of a BT service. MS seem to discontinued the product. I wander if something like this still exists from another vendor?

60 points by qwertzlcoatl 13y ago

aw3c2 13y ago

Misleading. 1295 BTC were stolen, no USD.

jzwinck 13y ago
Well thank goodness for that. At least this way there is no chance of recovery. I enjoyed the bit at the end about a potential lawsuit to get the BTC back. Sounds awfully familiar to the legal posturing after some other BTC heists--none of which got anywhere AFAIK. Do people still think the irrevocability of BTC transactions is a good thing?
- executive 13y ago
  yes. events like this encourage better security.
  - jzwinck 13y ago
    If that's true, why did we see three significant Bitcoin services get hacked in basically the same way in the last year? I'm talking about the Linode ones. Events like this encourage better thieves.
    - Sae5waip 13y ago
      Because the people running these services apparently cared more for quick money than for security. Or running their own server. I mean, who runs that kind of thing on a cheap rented server? No pity here. They took a risk, and one don't always win when taking a risk. (You startup folks should know.)
- ogig 13y ago
  >Do people still think the irrevocability of BTC transactions is a good thing? Yes. Third parties will provide escrow/insurance services if there is demand for them. Transactions been irreversible "by default" is a core benefit of bitcoin and merchants may preffer that over chargebacks at 18€.
  - fat0wl 13y ago
    I've heard that this type of insurance is expensive and a large part of banks' transaction fees. I can only imagine how expensive an insurance service like that for Bitcoin would be.
    - maaku 13y ago
      However unlike the existing system there will be a transparent, competitive market for such insurance mechanisms, and they will be available to consumers/businesses directly.
      - fat0wl 13y ago
        I think the banks are pretty focused on offering competitive products that are packaged together neatly to avoid putting too much of burden on consumers (what's the diff between choosing a bank or choosing a private transaction-insurance service?). I'm paranoid of investment banks but I think plain old banks are benign. You put a certain amount of money in your account and they handle all this for you. There is usually no charge for checking. Credit cards don't charge interest unless you go into debt, etc. I don't think lack of competition is so much an issue, it seems that the Bitcoin movement just has a fundamental distrust of govt/corporations. I think if Bitcoin money didn't magically appreciate in value so much it wouldn't be much cheaper than banking except for big international money transfers.
  - filam 13y ago
    Insurance does not eliminate risk from the market.
    - 13y ago
- oleganza 13y ago
  Gold, which was easier to track down and confiscate "back" was historically confiscated in much larger quantities by much tougher guys. This "insured" government debt-backed money that you have today is a result of having heavy money that is ultimately owned by someone who is bigger than you. While Bitcoin is stolen from some exchanges from time to time, it's much more diffused and it's enormously harder to take bitcoins massively from population than gold. See also: http://en.wikipedia.org/wiki/Executive_Order_6102 http://en.wikipedia.org/wiki/Executive_Order_6102 By the way, these "insured" USDs that you have in your account are not owned by you. Try to cash out everything in paper. Or move anywhere at once without asking for permission. Or what would you do when they impose capital controls like in Cyprus or Argentina? Or when your % of total USDs in the economy is going down while Fed is printing more dollars? Or when some new taxation is applied retroactively? Or when some bureaucrat didn't see your tax return papers in time and your entire account is frozen during investigation? Bitcoin reduces systemic risk like the one present in banking system and shifts the burden on individual users. You can still create a bank if you want, but that's totally optional and you have many other options as well. In the future people will develop hundreds really different devices, services and tricks to store your coins securely. Compare that with monopolised non-innovative heavily regulated banking. As bitcoins are so cheap to store, security is asymmetrical: it's much harder to take, than to hide. Gold, or any physical commodity, are as hard to protect as to take from you. Hence, most brutal guys end up owning precious metals over the course of the history. Average Joe can only have as much gold as he can hide in his pants.
  - foobarqux 13y ago
    States are powerful. You are mistaken if you think bitcoin can somehow materially evade that power, you have to interact with the real world some time. Putting aside the increasingly clear fact that network-attached computers won't be secure from state-actors for the foreseeable future --- and bitcoin transactions always have to hit the network --- states can effectively control bitcoin being spent or bitcoin cash-outs being transferred in country as well as any currency. Presently the risk of losing or having stolen your bitcoin is far higher than the same for gold or conventional stores of value.
pallandt 13y ago
They seem to be currently worth more than $1 million USD though. Maybe the USD equivalent was chosen for the title because more people would be able to immediately relate to it as a value.
- deleted 13y ago
  [deleted]
- fat0wl 13y ago
  this is common linkbait tactic now. They take the current high trading value of BTC & multiply by the number of BTC involved to get some crazy-high-looking USD price. It's not money in hand, the reality of getting that money out of BTC can be pricey.
  - pistle 13y ago
    Which is why bitcoin is secure and liquid - great as a utility currency. So you're saying the transaction costs of converting from bitcoin to any useful currency is really high and that we should see the unattractiveness of money-servicing costs as a security-assurance since script-kiddie criminals don't like seeing any portion of their free "money" siphoned away by the money-changers in the temple.
    - fat0wl 13y ago
      heh they DO hate that ;) my point was simpler tho which is just that the real numbers being applied to these amounts rely on ecosystem stability and the market cap (a term a trader helpfully pointed me to in order to understand their favorite stat, which these "multiply by exchange rate" figures are an extension of) really doesn't represent the real world value of assets in Bitcoin since the value declines as money is pulled out of the system. It seems to be anyone's guess as to whether or not it has real value or is a pyramid scheme. There's no way to tell without a mass cashout. Then we'd see how many BTC can get sold off before one starts to incur heavy losses. I think if some of the big players cashed out (early adopters with an inordinate amount of essentially self-printed wealth) the system would destabilize and finally flop. It's why they instead drive the price up & try to trickle units out one by one.

stpddts 13y ago

Can we get a break from all these Bitcoin posts please?

ye 13y ago
Why did you click on it? Just ignore or downvote next time. Bitcoin is a hot topic these days, tons of people are interested in what's going on.
- MichaelApproved 13y ago
  This isn't reddit. There's no downvote on stories for (most) users on HN.
iamshs 13y ago
I agree, there are six posts about Bitcoin right now on top. On one hand it is community regulated matter, but on other hand 20% of top posts is too much.
- bdcravens 13y ago
  When Steve Jobs passed, the entire home page was related articles.
waterlesscloud 13y ago
I just don't read posts I'm not interested in. I never feel compelled to complain that others are interested.
VMG 13y ago
It's just a reflection of what is happening in the world. Like it or not, Bitcoin is a big deal now.
speeder 13y ago
I don't work with web dev, can't we get a break from all those ruby, mongo, go and JavaScript posts please?
13y ago

M4v3R 13y ago

Ugh. There are much better solutions than keeping user funds in the hot wallet (fully cold storage with manual withdrawals, multi-signature wallets), but many "reputable" businesses STILL uses them. I don't understand why. If you want to store your customers funds online, do it the right way, or don't do it at all.

dragontamer 13y ago
You cannot automate a cold-wallet scheme. Any automated website or tool will require a "hot wallet" of some kind. The more funds in the hot wallet, the longer the website / BTC Bank can go automatically. Customers like having funds available to them immediately... among other things.
- M4v3R 13y ago
  > You cannot automate a cold-wallet scheme. That's why I said that it would be manual. Actually, it could be semi-automatic - a script could generate all relevant transactions, and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key. > Customers like having funds available to them immediately... among other things. Either security or convenience. This service was aimed for merchants, which are used to get their funds from payment processors much slower than in a matter of hours. Also, that's only one of the solutions that I mentioned. Second one, which is convenient and more secure at the same time, is using multisignature wallets.
  - a3voices 13y ago
    Any wallet that has been exposed to a computer connected to the Internet, or is sitting on one, is a "hot wallet".
  - ye 13y ago
    > and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key. It's a payment system. This would be unacceptable.

ori_b 13y ago

I'm not a bitcoin expert, so I may end up off base, but... The US government seemed surprisingly warm to bitcoin in the senate hearing. I suspect that if governments end up getting involved in bitcoin, each merchant will require some form of ID for each wallet that they interact with. This will mean that tracking down crimes like this will be fairly easy, since there's a record of each transaction. Trace down the chain, find the people involved, and if an anonymous wallet shows up, you investigate the people that it transferred to or from. Sure, it erodes privacy, but bitcoin has the potential to make things much easier for law enforcement (and anyone else interested in money transfers) by causing registration of endpoints, giving very strong leads to investigators.

GigabyteCoin 13y ago
If the US government decides to take this approach, I am sure that a few of these guys will do the exact opposite: http://en.wikipedia.org/wiki/Tax_haven#Examples http://en.wikipedia.org/wiki/Tax_haven#Examples
- dublinben 13y ago
  Jurisdictions like that have been increasingly disappearing. If regulators in major countries make it illegal to exchange BTC anonymously, it will significantly hamper its adoption.
dmix 13y ago
ID'ing hasn't stopped stolen guns from being used by criminals, I highly doubt it will stop hackers from being able to use Bitcoin. Harder maybe. But there will be thousands of markets that exist outside of USA regulation (or black markets within the USA). Especially by the time the USA would be capable of implementing some sort of ID system. There is also factoring in the complexity added to associating any form of ID to a particular coin, if CoinJoin or similar trustless anonymizing mixing services reach widespread adoption. This is all assuming Bitcoin continues it's mainstream course.

cryptocoin 13y ago

If you are new to bitcoin-related sites, you might find this story legitimate. But anyone that reads the article will see there is a basic flaw: DDoS attacks do not give access to the server, they just make the service inaccessible. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier. The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact.

clarkmoody 13y ago

I know it makes for a better headline to say $1M stolen, but unless actual USD was taken in the theft, I wish these headlines would say "X BTC stolen, valued at $Y." But then again, the headline made it to the front page and got me to comment...

peteretep 13y ago
Why do you wish that? Every news source on the planet localizes currency amounts to their audience. Are you actually making some weird political point about BTC value, or are you surprised that a news source is localizing currency values?
- clarkmoody 13y ago
  1) When large amount of BTC are stolen or moved, the fiat value would be far less if the coins were sold on the open exchange. 2) The article title becomes immediately obsolete due to exchange rate fluctuations. On the day of the theft for instance, the BTC/USD rate was hugely volatile, fluctuating between $522 and $788. We could go dig up the old Bitcoin Forum posts about people losing 25k coins and mark-to-market those losses for more sensational headlines. Or we could simply post the BTC amount in the headline along with present fiat value.
  - veemjeem 13y ago
    Well, it's a news article. The goal of the journalist is to get people to read it. It would be a less interesting headline if it forced people to do the conversion since many people still do not yet understand BTC. Putting both values (BTC & USD) into the headlines would make it redundant.
fat0wl 13y ago
hah i suggested this a few posts ago & people got pissed. https://news.ycombinator.com/item?id=6783710 https://news.ycombinator.com/item?id=6783710 granted, i don't present these things very tactfully

Vitaly 13y ago

Whale Communications, before they were purchased by Microsoft, had a hardware solution where a shared HDD disk was used to physically switch it between 2 different hosts to enable file sharing in a shared directory. would be almost perfect to secure the hot wallet of a BT service. MS seem to discontinued the product. I wander if something like this still exists from another vendor?