22 ms·

Silk Road 2 Hacked, All Bitcoins Stolen

449 points by nikcub 13y ago

atwebb 13y ago
Wow, it really is the wild west out there right now... I wish that some of the "post-mortem" reports I've seen were this good and detailed with problem, explaination, resolutions. I don't have a horse in this race so people affected probably feel differently.
- ye 13y ago
  I wouldn't call this "wild west". Regular banks experience much worse thefts, and pretty regularly.
jfasi 13y ago
Given illegal nature of Silk Road 2, I can't help but be suspicious of this explanation of the hack. If someone's sufficiently willing to flaunt laws as to operate a site devoted to selling contraband, what stops them from taking advantage of their position of power and stealing from their users?
- short_circut 13y ago
  That is roughly what I thought when I saw this. These people are dealing with criminal enterprises. What do they expect?
  - redthrowaway 13y ago
    SR1 was a criminal enterprise as well, and there's no indication DPR was stealing from his users. Trust is at least as valuable in the criminal world as it is in legitimate enterprise, if not more so. A criminal who runs a trustworthy criminal enterprise is likelier to do well in the long run than one who rips off his customers.
    - EpicEng 13y ago
      A criminal who runs a trustworthy criminal enterprise is likelier to do well in the long run than one who rips off his customers. Sure, yet it happens all of the time. Not everyone is logical and forward thinking, and sometimes they just want a big score.
    - spinlock 13y ago
      did DPR do well in the long run?
      - redthrowaway 13y ago
        DPR's failure was opsec, not trustworthiness. Dishonest criminals get caught due to poor opsec, too.
    - sliverstorm 13y ago
      SR1 was a criminal enterprise as well, and there's no indication DPR was stealing from his users That reminds me of arguing along the lines of, I played Russian Roulette before, and I didn't lose. Therefore, I will not lose this time either.
      - Malician 13y ago
        Allegedly, SR2 was setup in ways which made it much, much easier to run off with larger quantities of money than with SR1. Given the circumstances, you could reasonably conclude this would happen.
        ericb 13y ago
        Running off with the money is probably the smart move. The quicker you can get off the radar with something like this, the better your chance of not ending up in jail. It is entirely possible they are made for life, and with no more incoming transactions, if they haven't left a trail, they can have their cake and eat it too.
    - gtirloni 13y ago
- mscarborough 13y ago
  This is also the guy that just talked a bunch of trash about the last Dread Pirate Roberts, and how he was so much better about security. Jinxed yourself, bro. Granted this was supposedly in the Bitcoin protocol itself, but for real, there's really never any need to stick your neck out to talk about how great your security is...
  - haakon 13y ago
    I think you're confusing Silk Road 2 with Atlantis. They did talk trash and flapped their wings with fancy Youtube commercials etc before they suddenly closed down soon before Silk Road got busted. Silk Road 2 always claimed to be the rightful heir to the original Silk Road, and have their own Dread Pirate Roberts.
    - mscarborough 13y ago
      This is the interview I was referring to: http://arstechnica.com/tech-policy/2014/02/dread-pirate-roberts-2-0-an-interview-with-silk-roads-new-boss/ http://arstechnica.com/tech-policy/2014/02/dread-pirate-robe... A lot of talk for something that just started, and had a massive fail one week after publication.
  - yscale 13y ago
    * this was supposedly in the Bitcoin protocol itself* Cue a line of BTC-promoting ostriches claiming that the protocol is fan-fucking-tastic and in no need of improvement.
- chrisBob 13y ago
  I see your point, but stealing from drug dealers is usually a dangerous business.
  - riquito 13y ago
    It's not like he can say "sorry, but it wasn't me. Still friends?". The risks are probably the same, so it's better to be hated AND a thief :-P
  - catshirt 13y ago
    i'm assuming if dealers know who he is then dea, atf, or whoever would get to him first.
- brubaker 13y ago
  They are not criminals, they are "freedom fighters" Well atleast that is how they delusionaly see it.
- twelvechairs 13y ago
  The fact that they would be cutting their own revenue stream? I'm not saying its not possible but really this is just speculation. I could just as easily surmise that it was from a government or banks who feel threatened by bitcoin...
  - jfasi 13y ago
    With any other business I would agree, but a $90k+ payout would probably be very attractive for someone running a clone of a drug site that got publicly busted just months before. I would imagine these guys have a countdown to when they get arrested ticking in their heads...
    - twelvechairs 13y ago
      until you have proof its all just speculation. there are many possibilities.
    - gwern 13y ago
      No, $90k is peanuts. Ross Ulbricht was making $19k a day on SR1, according to the complaint. Given that SR2, for all its problems and pissed off users, was still the biggest market, $90k is not worth killing it over. The estimates of >4500btc, on the other hand...
- binocarlos 13y ago
  lol and there was gullible little me thinking 'wow the hackers moved fast'
  - gwern 13y ago
    Well, the hackers did move fast, from the Bitcoin discussions I've been following. That's why it's such a good excuse for the SR2 operators: because it's a real hack, it has a surface plausibility.
- fleitz 13y ago
  The sad thing is that not only will people trust people like this, but they'll advocate for them having more power over their lives. http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair http://en.wikipedia.org/wiki/Troubled_Asset_Relief_Program http://en.wikipedia.org/wiki/Troubled_Asset_Relief_Program
- vbuterin 13y ago
  There is a huge moral difference between the sort of victimless-crime-contraband that is on SR (especially since SR1 at least, not sure about SR2, actively filtered out child porn, weapons, assassinations and all of the other truly scary things that you can potentially sell on an anonymous market), and stealing millions of dollars from people at least a few of whom are dependent on substances and desperately need the money to get them in time. Also, it hasn't really happened yet, but vigilantes.
  - Touche 13y ago
    > especially since SR1 at least, not sure about SR2, actively filtered out child porn, weapons, assassinations Except for when they needed those things.
  - jfasi 13y ago
    Notice that morality doesn't have to have anything to do with this argument. As a matter of pragmatism, the operator of a Silk Road-type site is almost certain to harbor a conviction that he can do so without getting caught (regardless of whether the authorities have morality on their side). The same same goes for stealing from your customers: of course you won't get caught, what are your victims going to do? File a police report that the money they gave to a contraband site to presumably purchase contraband was stolen? The same conviction that makes it possible for them to operate Silk Road 2 makes it possible for them to steal from their customers.
    - pikachu_is_cool 13y ago
      I think what he's trying to say that it's far less likely for a libertarian "legalize drugs" type of person to screw a bunch of people over. Like, when you facilitate selling drugs, there is no victim. Hell, you probably prevented having a victim. When you facilitate selling weapons/assassinations/child porn, there is a victim. The latter type of person would be more likely to victimize his/her customers than the former.
      - mbillie1 13y ago
- aegiso 13y ago
  It's entirely possible to be in support of a free and peaceful drug trade, while at the same time being morally against theft. I don't know why you're lumping the two.
  - mbillie1 13y ago
    There's a difference between supporting a free and peaceful drug trade and participating in a very-much illegal drug trade. It's possible to be a hemp-wearing, tree-hugging hippie and be pro-death penalty - it also happens to be rare.
    - MarkPNeyer 13y ago
      the law has very little to do with supporting freedom and peace these days.
      - mbillie1 13y ago
        That is very true, but there's still an enormous chasm for your average person between being mostly-law-abiding (I'm not counting things like jaywalking or going 5mph over the limit) and participating in drug sales, which could land you life in prison. Hell, I think drug laws are incredibly unjust in the US, and that the government is overstepping its bounds left and right. By no means should you infer from this that I'm not careful of the legality of my actions. I think it's perfectly reasonable to assume that someone participating in a life-in-prison-risking drug enterprise would also be willing to make other illegal/immoral decisions - in fact I think it would be foolish and naive NOT to assume that as a default, despite the fact that it will of course not be true in every case.
        DerpDerpDerp 13y ago
        Having dealt passingly with a large number of marijuana dealers, I disagree strongly with your assessment. Do you have any statistics to back this up, or just the naive reasoning "Well, it's a /serious/ crime, so they'd probably commit others, because only bad people commit /serious/ crimes"?
- kolbe 13y ago
  How about self-interest? SR2 was not a very big site, and building a much larger business based on being a good operator of an underground market would earn him significantly more money than what he would have made by stealing the funds.
- rurban 13y ago
  Given the latest news it is also very likely that the FBI with the help of some other government cyber-crime unit raided Silk Road 2. You will see it only when the thieves will try to sell or exchange the bitcoins. The FBI won't do, and it will be in the news sooner and later.
d23 13y ago
Is our only recourse downloading the entire block-chain to keep our wallets stored offline? Or do I have some misunderstanding? I just really like the convenience of services like coinbase.
- vertex-four 13y ago
  You can keep your wallet on your own computer with a "light" client like Electrum, which doesn't need to download the whole blockchain. There are some security tradeoffs, but nobody can outright steal your bitcoins without you doing anything.
- facepalm 13y ago
  You don't need the block chain to keep coins. You only need a wallet. Technically your private keys never need to see the internet at all. Edit: here is one way to do it https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_savings_wallet https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_sa... At a recent meetup there was a presentation recommending Electrum with HD wallets instead. That would mean you really would only need to memorize a passphrase, all the keys would be generated from that so no backup necessary. Personally I am not yet 100% sure HD wallets are safe, need to look into it.
- sexmonad 13y ago
  You can also use something like blockchain.info for slightly better security than coinbase. They do client-side encryption and decryption of wallets. Of course, if you forget your password, your coins are gone. And blockchain.info could always modify their code to steal your coins later. At least they couldn't steal them without you logging in. But a thin wallet like Electrum is probably your best bet.
pstrateman 13y ago
The claim that this was caused by transaction malleability rings hollow. The reference client (github.com/bitcoin/bitcoin) does not resend transactions because of malleability. The only way you can have double transfers due to malleability is if you are manually reviewing transfers and re-sending them yourself manually. This seems like a very convenient scapegoat.
- Mchl 13y ago
  Yeah. The moment I got to " a vendor exploited a recently discovered vulnerability in the Bitcoin protocol known as “transaction malleability”" I was like "Riiiiight....". It's not even 'recently discovered', and as far as I understand it it does not let anyone to drain other persons' wallet (if it did, that'd be a killer to entire bitcoin the moment it was discovered)
  - rdtsc 13y ago
    They wanted to exit the business from the start. Saw a convenient time with everyone discussing a vulnerability, claim right away that vulnerability was used to steal all the money to avoid backlash from users.
    - ChuckMcM 13y ago
      If one were sufficiently cynical one could argue that this was the plan from the start. Build another version of the site, wait for some BitCoin disaster, take all the funds and claim it was the disaster that done did it. Of course to pull that off you'd really need to employ the disaster yourself so that you have the ledger entries to "prove" it.
      - girvo 13y ago
        Don't need to be cynical: that has happened with multiple other markets. I think that's exactly what happened here.
    - pikachu_is_cool 13y ago
tedivm 13y ago
About 150 coins were stolen by the main attacker- $91,870.
deleted 13y ago
[deleted]
bhouston 13y ago
How much was stolen? How many bitcoins are we talking about. It isn't very clear.
- kylebrown 13y ago
  4,474 BTC ~= $2.7 million
  - devindotcom 13y ago
    Source? I've seen 150 and 88,000 but not 4474
    - kseistrup 13y ago
      http://www.reddit.com/r/DarkNetMarkets/comments/1xtqty/sr_has_been_hacked/ http://www.reddit.com/r/DarkNetMarkets/comments/1xtqty/sr_ha...
    - kseistrup 13y ago
      https://twitter.com/NCWeaver/status/434073747050352640 https://twitter.com/NCWeaver/status/434073747050352640
- rqebmm 13y ago
  at the top of the article: Update: The amount of BTC that was stolen was calculated by Nicholas Weaver @NCWeaver – Computer Security Researcher, to be around: 4474.266369160003BTC that are with the value of about $2.7 Million.
  - polarix 13y ago
    That's a lot of significant figures for a round number...
  - jboggan 13y ago
    That should be 4474.26636916 . . . who is doing BTC calculations with floats?
theswan 13y ago
Not having very much knowledge about the financial industry - is this also an issue with marketplaces that deal with fiat monies? i.e. Dwolla, Balanced, Stripe, Venmo, all serve as intermediaries for moving money - do these companies have bank accounts that hold onto massive sums of money? What protections would go into keep those accounts secure?
- brycekahle 13y ago
  Dwolla uses a credit union pool account. Taken from https://www.dwolla.com/security https://www.dwolla.com/security Dwolla, Inc. is an agent of Veridian Credit Union and all funds associated with your account in the Dwolla network are held in a pooled account at Veridian Credit Union. These funds are not eligible for individual insurance, and may not be eligible for share insurance by the National Credit Union Share Insurance Fund. Dwolla, Inc. is the operator of a software platform that communicates user instructions for funds transfers to Veridian Credit Union.
- jfasi 13y ago
  I have the sense that the protections in place on above-the-board, regulated financial services companies are more meaningful than those placed on companies dedicated to selling contraband. (That is: none)
- beat 13y ago
  Modern banking is over 100 years old. There is 100+ years of fraud protection processes, legal experience, etc built into the system, plus a huge and complex industry that has a vested interest in overall currency stability. Bitcoin and other digital currencies are learning firsthand what it means to "disrupt" on this scale. Part of that is learning the hard way what the old industry has known since before any of us were born.
  - weavejester 13y ago
    Modern banking is also largely reversible, so stolen funds can often be recovered, and insurance covers the other cases. Bitcoin has the problem of having irreversible transactions, and it's also a lot more difficult to determine whether or not an account has been legitimately stolen from. I don't think it's the case that the current banking industry is insulated from theft due to superior security. From what I've heard from programmers working in the financial industry, the software there can be quite ropey, or at least no better than anywhere else.
gesman 13y ago
Owner decided to cash in and retire to no extradition treaty island?
- riquito 13y ago
  Why "no extradition"? Would he risk anything penal? If bitcoins are not money he may risk just a fine.
  - ErsatzVerkehr 13y ago
    http://en.wikipedia.org/wiki/Fraud http://en.wikipedia.org/wiki/Fraud
    - Crito 13y ago
      If he is ever found, criminal charges are the least of his worries. We are supposing that he stole lots of money from lots of different drug dealers.
      - fleitz 13y ago
        Dime Bag Donny is hardly pablo escobar. If it took the FBI 2 years to track him down, unless he fucked over the Zapatas exactly nothing will be done about this. But then again the Zapatas hide behind guns, not crypto currency.
  - Phlarp 13y ago
    The website, it's all about selling drugs and then mailing them across international borders. I imagine there is something considered criminal in there.
- rqebmm 13y ago
  Last I checked, jilted drug dealers don't follow extradition
Meekro 13y ago
This is nonsense. The transaction malleability issue doesn't cause coins to be automatically resent. The simple explanation is that the owner ran off with everybody's money.
dreamdu5t 13y ago
How do we know the founder didn't steal everyone's coins and is using hacking as a scapegoat?
- aparadja 13y ago
  We don't know that.
- gwern 13y ago
  We don't know that, and there's good reason to think they're doing just that.
deleted 13y ago
[deleted]
rglover 13y ago
Reports like these make me wonder what Hacker News would have looked like during the gold rush in the 1800s.
- jaekwon 13y ago
  Hello good sirs, I am able bodied and in want of land and picket. Please reach me at the bar, call for Sam.
  - samstave 13y ago
    Exhibit HN: I've concocted a most healthful and beneficial syrum of the utmost pure ingredients! This here oil shall alleviate ye of all woe, misery and weak-of-knee! Looking for a most suitable alchemical co-founder to assist in mine taking this to production ready status for this year's county fair! Please contact me by post or telegram! Dr. Samuel's Special Synergistic Syrum One Market Plaza, San Francisco
- mapgrep 13y ago
  Pretty much the same.
  - Mchl 13y ago
    Except it would use one of those western fonts.
- thebiglebrewski 13y ago
  Can somebody build this please?!
- CoachRufus87 13y ago
  Show HN: Levis 501
- pirateking 13y ago
  Rusher News 1. Mine Plundered: $2300 in Nuggets Stolen! (439 points) 2. Gold Is Where You Find It (102 points) 3. Show RN: A Better Shovel (32 points) 4. WANTED: No good pickaxe thief, DoA (8 points)
deleted 13y ago
[deleted]
ye 13y ago
Looks like 88,000 BTC were stolen, much more than originally reported. http://www.cryptocoinsnews.com/2014/02/13/silk-road-2-0-has-been-hacked-and-88000-btc-stolen-operator-says-centralized-escrow-system-cant-ever-work/ http://www.cryptocoinsnews.com/2014/02/13/silk-road-2-0-has-...
tillinghast 13y ago
I suspect bandits.
swalsh 13y ago
My favorite part of bitcoin is just how wild west it always feels. Real money, in very massive quantities is stolen, and there's no authorities who will do anything about it. Old school scams are new again. Crashes happen on a monthly basis. I'm staying out of it in any serious quantities because frankly i'm having too much fun watching it.
- emhart 13y ago
  It's even more fun with skin in the game.
  - NathanKP 13y ago
    Just remember to never invest more than you can afford to lose.
    - dopamean 13y ago
      Heh.. "invest."
  - StavrosK 13y ago
    That's true, I had half a bitcoin from back when it was worth $20, and I'm having loads of fun with it.
- dreamdu5t 13y ago
  You can do something about it, you just can't offload those costs onto other people you've never met. Anyone is free to attempt to investigate and go after this guy.
  - comicjk 13y ago
    Yeah, just like anyone is free to keep their sheep off the commons. It's still going to get grazed flat.
- jakejake 13y ago
  There are certainly fortunes to be made as well as lost. I probably would not put "serious" quantities into bitcoin myself either, but it definitely is more interesting to watch it when you have a small amount in it.
Steko 13y ago
For anyone still drinking the "Bitcoin is frictionless" kool-aid, this hasn't been a good week.
- dispense 13y ago
  Either SR2 was hacked or someone ran off with the funds. Whatever the case may be, I do not see how the friction (or lack thereof) of Bitcoin has anything to do with this.
- MarkPNeyer 13y ago
  for anyone who sees bitcoin as a 'wild west' environment, this sort of thing is obvious and just moves the bitcoin economy forward. problems found now are fixed, and won't be as big of a deal later.
  - Steko 13y ago
    "just moves the bitcoin economy forward" Contrary to popular(?) opinion, there is such a thing as bad publicity. At least when you're selling a get rich quick scheme.
  - chasing 13y ago
    But this isn't a beta test. People treat Bitcoin as if it's ready for primetime and ready to replace traditional currency.
    - DerpDerpDerp 13y ago
      Yes, there's never limits on cash withdrawl in the glorious banking system. [0] http://www.bbc.co.uk/news/business-25861717 http://www.bbc.co.uk/news/business-25861717
      - Steko 13y ago
        If one of the main bullet points of your currency replacement is that "it's frictionless unlike regular money", and you ever find yourself pointing the finger at regular money and saying "it has frictions too" you already lost the argument.
deleted 13y ago
[deleted]
primitivesuave 13y ago
> our projections of order finalization volume indicated that we would need the community’s full balance in hot storage. As a bitcoin community leader, you have to stay informed with how other people got hacked in the past, and there are so many cases where all the bitcoins were foolishly kept out of air-gapped cold storage until an adventurous hacker plundered them. I guess history is doomed to repeat itself.
padseeker 13y ago
This is why bitcoin is a sham. The premise of perceived bitcoin value is based on the greater fool theory. What the hell were any of these people thinking? http://en.wikipedia.org/wiki/Greater_fool_theory http://en.wikipedia.org/wiki/Greater_fool_theory
- shawnz 13y ago
  That has nothing to do with what has happened here and has been argued ad nauseam in other threads already. In short: the only aspect of bitcoin that may be considered an instance of the greater fool theory is the idea that it is a guarenteed investment. Obviously it is not, and this news has nothing to do with bitcoin as an investment vehicle anyway.
  - padseeker 13y ago
    It has everything to do with this - the reason it was stolen is it is a crypto currency with no legitimacy or inherit value. It's not even a physical object, its more like a stock that is not regulated. If this were real currency or a stock, then there might be some regulation and stealing would be hard to pull off. This virtual currency's value is based on nothing. The whole hacked account thing has a lot in common with some of the stock scams that occurred pre-depression. You have phony stocks which people buy into, it gets pumped, value is inflated, then dumped only to find out there was no company or the books were cooked. For all we know the guy that created silk road 2 'hacked' it himself and pocketed the bitcoins. This has more in common with a bad stock deal than a real robbery. And bitcoin has about the same real value as one of the phony stocks peddled on the market in the 1920s.
    - RankingMember 13y ago
      What about the USD's value is based on something other than a mental construct shared by billions of people?
samstave 13y ago
SO, I am completely ignorant on exactly how bitcoin works; but how the hell is it not possible to secure a bitcoin one owns.
- pat2man 13y ago
  It is entirely possible. Being a marketplace their software sends coins around for all sorts of reason, this is what was hacked. Someone's personal bit coins are not at risk.
- dispense 13y ago
  It is perfectly possible. Your only task is to secure the private keys. These are short enough to be printed as a QR code or written down. keep that piece of paper somewhere safe. Alternatively, it is possible to use a good, random, long passphrase as your de facto private key. That way, the keys to your wallet are literally stored in your mind and nowhere else. As of now, there are no known fatal flaws or weaknesses in the Bitcoin protocol itself. The network is secure and as long as you manage to secure your private keys, Bitcoin is extremely safe.
  - interstitial 13y ago
    And you can always melt down your bitcoin into a pure gold.
  - robzyb 13y ago
    > It is perfectly possible [to secure a bitcoin one owns]. You're forgetting about social engineering.
    - dispense 13y ago
      Social engineering applies to pretty much everything. It has nothing to do with Bitcoin (or whatever else a social engineer wants from you) and everything with your own lack of due diligence and gullibility.
      - 13y ago
gojomo 13y ago
Whatever happened to honor among thieves?
- samstave 13y ago
  Well.. if they weren't stealing them bitcoins, then they wouldn't be thieves to uphold said honor...
mindstab 13y ago
... and things like this do to a point hilight why there is a lot of regulation around money and trying to create a new "freer" currency is actually really dangerous. I'm pretty sure his operating practice of keeping all the money in one place would be against regulations. Also usually there are big security standards. And finally high transaction fees do in some part support insurance so when my/your visa is stolen or what ever, the bank can just refund me, and take it out of its insurance. Because storing a lot of money for a lot of people is a big deal, but its a well looked at deal, and trying to start from scratch ignoring all of that... well... you just end up with people loosing money in ways that would never happen otherwise. :/
blhack 13y ago
This is almost certainly hogshit, and anybody who has been paying even a little bit of attention over the last week can probably smell it. The "hole" in MtGox's security was a social one. You could contact customer support and claim that you had not received your coins, and they could re-issue you new ones if they chose to. There is also no evidence that this ever happened. This wasn't, and isn't, a flaw in the underlying architecture, it's just a way to convince a customer service rep that you weren't lying. If SR was re-issuing coins automatically, it's because they were being intentionally stupid. -- They're using this as a scapegoat. Either somebody ran off with the coins, or something otherwise hacked them and they're using this as an explanation.
- sillysaurus2 13y ago
  If SR was re-issuing coins automatically, it's because they were being intentionally stupid. MtGox was re-issuing coins automatically. Due to this, Gox has lost money. Possibly a huge amount. Were they being intentionally stupid, or just stupid? Source: https://news.ycombinator.com/item?id=7222690 https://news.ycombinator.com/item?id=7222690 This transaction malleability flaw is certainly a convenient excuse. But if these people implemented their wallet software in the same manner as Gox, then they would've suffered the same fate: a loss of thousands of coins, which is exactly what they claim happened.
  - deleted 13y ago
    [deleted]
  - blhack 13y ago
    Maybe I just haven't had enough coffee today, but: where does it say there that gox was re-issuing coins automatically?
    - deleted 13y ago
      [deleted]
    - sillysaurus2 13y ago
      Sorry, I should have linked two comments higher: https://news.ycombinator.com/item?id=7222457 https://news.ycombinator.com/item?id=7222457 You'll note that mtgox had funds taken from it. None of these other sites [did]. They're just being flooded with junk that screws up their transaction processing. It's not really the same thing at all.
jessaustin 13y ago
Interesting... I’ve included transaction logs at the bottom of this message. Review the vendor’s dishonest actions and use whatever means you deem necessary to bring this person to justice. More details will emerge as we continue to investigate. Presumably the particular addresses used will be noted for future reference by vengeance-minded parties? Perhaps the list should be referenced by popular client software so innocents can avoid receiving BTC, even indirectly, from the blamed addresses...
npcc 13y ago
Okay, I'm going to go out on a branch and throw up a strange hypothesis. I don't have any stake in the Bitcoin or drug dealing games, apart from generalized anarchistic tendancy: Silk Road 2 was a project set-up by some government agency or gangsters. The overall plan is to eliminate competition and sow uncertainty around both Bitcoin and Silk Road type unregulated markets with anonymous owners. The "transaction malleability" issue is totally unrelated to this event - it's not an exploit that can be used to 'steal' Bitcoins, only to corrupt the blockchain and/or mess with transactions (eg. cause them to fail or end up in limbo). "We were planning on re-launching the new auto-finalize and Dispute Center this past weekend, and our projections of order finalization volume indicated that we would need the community’s full balance in hot storage." - a silly excuse for such an obvious mistake. No imaginable system would require the entire balance of the community to be stored in such a way, no reasonable systems architect would do this. "The details we have on the hacker are below. Stop at nothing to bring this person to your own definition of justice. We normally do not doxx anyone, and hold user information sacred. But this is an extreme situation affecting our entire community, and all three users who have exploited this vulnerability are very much at risk until they approach us directly to assist with any information. Do not reveal any details of the attack. This will jeopardize your reward. Contact us directly. If anyone has purchased or sold to these usernames, expect generous bounties for any information you can contribute which leads to identification." - hold on, where's the evidence? What is he going to do with any information provided by his internet personal army? Why should others do his work for him in tracking these supposed hackers down? "Few hours before the announcement we at DeepDotWeb received a mail saying: 'SilkRoad hacked, 150 BTC stolen, you heard it first from me' this was sent to us by a reddit user who claimed since yesterday he was going to hack SR and steal the sites money" - Wouldn't that just be the perfect cover? Get some small-timers to grab a little and point the finger at them while he makes off with the much larger remainder. Besides, didn't this guy just say that he needs help tracking the attackers down? How does he then know enough to attach addresses to particular handles and countries? I admit some unfamiliarity with both Bitcoin and Silk Road/2 here so I hope somebody else can fill me in on this. "It takes the integrity of all of us to push this movement forward. Whoever you are, you still have a chance to act in the interest of helping this community. Keep a percentage, return the rest. Don’t walk away with your fellow freedom fighters’ coins." - An attempt to insinuate that the 'thief' is a member of the Bitcoin in-group, alongside the author. An appeal to those already attached to the in-group to 'join' the author in 'solidarity' and painting this event as an battle to defend Bitcoin itself. One that was already 'lost', I note. "Multi-signature transactions are the only way this community will be protected long-term." - oh yes, if ditching anonymity by tying identities and transactions together in an easily auditable fashion is 'protection' in this business. "I should have taken MtGox and Bitstamp’s lead and disabled withdrawals as soon as the malleability issue was reported. I was slow to respond and too skeptical of the possible issue at hand." - I believe this to be a stretch of the truth, weren't the MtGox and Bitstamp shutdowns totally unrelated to this 'exploit'? "If this financial hardship places you at risk of physical harm, contact me directly and I will do my best to help you with my remaining personal funds." - Give us all your information and I promise I'll send you some money! "Hindsight is already suggesting dozens of ways this could have been prevented, but we must march onward." - Translation: I just lost a lot of your money, trust me so I can do it again or lose faith in Bitcoin entirely. "In retrospect this was incredibly foolish, and I take full responsibility for this decision. I have failed you as a leader, and am completely devastated by today’s discoveries." - Awesome, an anonymous guy with nothing to lose takes full responsibility. I'd love to hear some thoughts on these comments and if anybody is thinking along the same lines? Alternatively, I'd also love to hear good arguments against this position.
zedshaw 13y ago
This is seriously the most hilarious thing I have read in a long time. Here we have a group of objectivist libertarians who believe that there should be effectively no laws other than the law of economics and self-interest who run an illegal website devoted to the pure greed of cashing in on contraband, and this is what they write: "I’ve included transaction logs at the bottom of this message. Review the vendor’s dishonest actions and use whatever means you deem necessary to bring this person to justice." We need the government! Please, come find the guy who took all of our illegal drug money and give it back to us so we can continue to say you aren't necessary. "Given the right flavor of influence from our community, we can only hope that he will decide to return the coins with integrity as opposed to hiding like a coward." Yes, you bad guy, you should do the right thing and think of the community not your self-interests by giving back your illegal gains back to the guy named Dead Pirate Roberts (that's totally his real name). "Whoever you are, you still have a chance to act in the interest of helping this community." In the interest of the community?! Bwahahahaa! "I will fight here by your side, even the greedy bastards amongst us." Like everyone on the site?! "The only way to reverse a community’s greed is through generosity." Just like Ayn Rand said my brothers! Then I come here and not a single person on here even notices the massive hypocrisy and lack of self-awareness. Amazing.
- apalmer 13y ago
  I get your point, but I think you are missing the glaring nuance here... He is basically saying if you are reading this and you were affected its in your best interest to participate in catching this guy and 'persuading' him to give us the bitcoins... he isnt appealing to government or some over arching entity or morality.
  - zedshaw 13y ago
    Yes he is! In fact he appeals to morality just about every other sentence. It's rather hilarious.
    - DennisP 13y ago
      Libertarians have a strong sense of morality based on property rights. You might be thinking of anarchism.
aaronem 13y ago
"Movement"? "Comrades"? "Freedom fighters"? Excuse me, isn't this the online equivalent of an open-air drug market he's talking about here?
notastartup 13y ago
how the hell do they get away with kind of heist? Wouldn't they be able to follow the blockchain addresses until arriving at the wallet they are using to cash out?
- smtddr 13y ago
  I've talked about this before. http://news.ycombinator.com/item?id=7086399 http://news.ycombinator.com/item?id=7086399 You won't be able to find me without the authorities forcing the exchanges to provide info since they make their own cut helping me move the funds around in transaction-fees if they keep quiet about these kinds of things. As long as I'm not too greedy/eager and don't rush things, I can collect on these funds over the course of several months. I can even spice things up by sending a bunch into an online bitcoin-gambling-site. Gamble a little bit; perhaps lose some then withdraw after a few days. So now if I had sent 10 BTC in then 9 BTC goes somewhere else, you don't know if I lost 9 BTC to the casino or if I lost 1 to the casino and 9 is going to another wallet of mine. All this will look pretty crazy to anyone trying to follow me on the blockchain. You can't know which coins are actually mine and which belong to the exchanges & casinos. Maybe I legitimately won the jackpot; who knows. Also, there's this: http://www.bitcoinfog.com/ http://www.bitcoinfog.com/ Sidenote: Casinos are a great business to launder real life fiat money too...
barkingcat 13y ago
They were just asking for it. If you work with bitcoins in such quantities, you will have an attack surface so appealing that every single hacker on earth will be targeting you. You better treat security seriously.
mathattack 13y ago
I’ve included transaction logs at the bottom of this message. Review the vendor’s dishonest actions and use whatever means you deem necessary to bring this person to justice. More details will emerge as we continue to investigate. This seems like absolving themselves of responsibility. Was that in the spirit of how this was set up? I understand that this is different than a bank, both in spirit and law. But is there really nobody who would go after Silk Road 2 to get the money back?
memracom 13y ago
index.php? Can we say that they were inviting themselves to be hacked? Really, the only way to not have all their cash stolen would be for the NSA to hack them first and close up all the security holes.
toasted 13y ago
In the San Fran startup world where iphone taxi requesting and self-deleting video clips for 14 yr olds are the cusp of innovation, thank god for bitcoin and all the fun that comes with it.
shomyo 13y ago
"hacked"
relampago 13y ago
What it means to be a libertarian by Harvard Professor [VIDEO] (01:57)https://www.youtube.com/watch?v=zxj00QD6fNY https://www.youtube.com/watch?v=zxj00QD6fNY
mattdeboard 13y ago
This thread is now about zed shaw
roymurdock 13y ago
Sounds like Defcon got the excuse he needed to line his pockets with all of the Silk Road 2 money. I don't run a marketplace, but I would assume that an alarm protocol would be implemented and triggered when thousands of bitcoins start to drain out of "hot storage". Exploiting the transaction malleability bug wouldn't net you 4,500 BTC at once. It would take a lot of requests of broken transactions to drain the entire marketplace of thousands of BTC. Defcon and SR2 should have been on high alert for this kind of problem after the Mt. Gox announcement. Anyone who runs a Bitcoin marketplace would not be "slow to respond and skeptical of the issue at hand", especially not when the entire balance of the marketplace is in such a vulnerable state. Defcon has been around this business for years, he isn't an amateur. How could he make such a fundamental, incredibly ignorant error? Even if we believe the "bad luck, terrible timing" explanation, Defcon's lack of caution and general awareness is simply inexplicable. There is no way he would be so nonchalant about any kind of fault in the Bitcoin protocol with everyone's money sitting out in the open, just waiting to be stolen. I think the moral of this story is to not open an account with an anonymous exchange. Instead, open an account with a marketplace backed by some high-profile VC's who have some skin in the game. You can bet that Andreesen isn't going to be careless and ignorant enough to let the same thing happen to Coinbase. Not when he's got $25m and his invaluable image on the line.
- gwern 13y ago
  > I think the moral of this story is to not open an account with an anonymous exchange. Instead, open an account with a marketplace backed by some high-profile VC's who have some skin in the game. You can bet that Andreesen isn't going to be careless and ignorant enough to let the same thing happen to Coinbase. Great. Call me when Andreesen funds a black-market for highly illegal drugs.
  - roymurdock 13y ago
    I think people are less worried about finding a source for illegal drugs, and more worried about finding a secure marketplace where they can trust the administration and exchange their funds securely. Theoretically, I would be relatively bummed out if my favorite drug dealer was arrested. Then I would get over it and find a new dealer. I would be livid if my drug dealer took my money, pointed a gun at my head, then got in his car and drove away, all the while claiming that he wasn't robbing me and that he had always had my best intentions at heart. So I'm not so concerned about a new marketplace popping up. The market demands drugs, and it will have them (SR3?). My point was simple: if you don't want to lose your money, don't store your money in an anonymous, drug-dealing marketplace. I'm not sure why this warranted such a sarcastic response?
EGreg 13y ago
Ummm seriously why do these marketplaces hold your bitcoins??? Don't they know bitcoins support m-of-n transactions? There should be a marketplace without the ability to have bitcoins stolen! It's rather straighforward people.
- gwern 13y ago
  > There should be a marketplace without the ability to have bitcoins stolen! There is at least one, and it's pretty well-known. You underestimate how much ordinary people don't want to deal with things like m-of-n transactions/multi-sig.
  - EGreg 13y ago
    So why can't it be made more user friendly? Marketplace initiates the transaction, and all you have to do is sign it with your bitcoin client.
    - gwern 13y ago
      > Marketplace initiates the transaction, and all you have to do is sign it with your bitcoin client. 'All'?
cbeach 13y ago
This is why we need to find decentralised means of exchanging Bitcoins. I built https://www.cointouch.com/ https://www.cointouch.com/ to find trading partners in my extended social network. I don't want to use a centralised third party. There's little need for a centralised exchange given we have a rich social graph, and a programmable currency that is truly P2P. Keep it all P2P.
bhaumik 13y ago
On 1/31, a SR Forum user warned, "SR2 massive scam about to hit very soon" >no Auto Finalize/no resolution center coins are pilling up massively whitout anyone even realising what s coming . >there is propably couple millions $$ just in escrow alone and no one is fucking complaining. >You guys really think it takes more than a month to implement a resolution center?how dumb are you >This is about to be the biggest scam in the history of the darkmarkets. >Defcon postponing dates again and again,then annoucing that a fix has been done when clearly it hasn t done shit ?(captcha)in this case. >Can t you fucking see throught their bullshit and blatant lies that the ship is about to go down the drain very soon??wake the fuck up . Follow-up from today: >well,I ve done what I could to warn you at least,next time you call me a troll rethink maybe. >my posts weren t really convincing because of the bad grammar (not english) but the message was there for everyone willing to hear it. >If you believe all this bullshit again from defcon ,then I am affraid you d get scammed over and over again.SR isn t what it once was, it is run by a greedy cunt. >This was just so predictable,it doesn t take 2 fucking month to implement a resolution center ,not having it was the main tool of their scamming operation. >The funniest thing in that story is that SR would still be up , means this scams could go on forever because people are licking blindly these greedy mofo. >don t be fooled by the green camel next time rant over/ http://www.reddit.com/r/DarkNetMarkets/comments/1xu8wc/sr_forum_post_31st_january_sr2_massive_scam_about/ http://www.reddit.com/r/DarkNetMarkets/comments/1xu8wc/sr_fo...
crystaln 13y ago
The hatred for Mt Gox in the bitcoin community blinded them to the reality that the malleability bug is very serious. The way the bitcoin community responded was irresponsible. Regardless of whether there are workarounds, it's a tragic security flaw in the protocol and should have been treated as such.
- jadeddrag 13y ago
  As I understand it, this was a problem that was identified over 2 years ago, and fixed for over a year. The problem is that MtGox implemented their own wallet software, and neglected to include bug fixes from the reference client.
  - crystaln 13y ago
    I don't believe that is correct. The core devs relied on people implementing workarounds.
tethis 13y ago
Yeah, right, they "got hacked".
DigitalSea 13y ago
Irony at its finest here. If you're going to go to the effort to use a decentralised currency that is difficult to track to a particular individual for a website selling illicit drugs and items served via a decentralised and anonymously run network, don't expect any sympathy when your Bitcoin goes missing... You go to the great effort of avoiding conventional means of currency (banking, trackable transactions to individuals) and yet you realise how the traditional banking system in many ways while not being perfect protects you from a lot of this type of activity. If an attacker hacks into your Internet banking or your credit card is stolen, you in most cases get the money back. No monetary system is perfect, and I think these increasingly frequent scenarios where X amount of crypto-currency is "stolen" and cannot be recovered drive that point home. I strongly believe that crypto-currency has a bright future, I own a few Bitcoin myself and many other alternative crypto, but I don't entrust and never would entrust my coins in a drug-dealer exchange escrow wallet, I keep them on my computer and in cold storage. These kind of situations just keep driving BTC's price down further, we don't need a Silk Road for Bitcoin to succeed. This whole situation really just makes me laugh. Some people have no faith in the traditional system of Government or currency, but for some reason have faith in a system and currency that is inherently insecure, unpredictable and when shit hits the fan, there's nobody to help you...
- aianus 13y ago
  Your point about the traditional banking system is irrelevant since there's zero chance of successfully buying a kilo of coke with your Visa card. So whether it's bricks of cash or shady darknet sites, the prohibition on drugs necessarily doesn't leave one with much recourse when transactions go wrong.
- girvo 13y ago
  Well, actually, people don't trust these new markets either. So many have been hacked, or been scams, that those with the most to lose have been pretty careful or exited this online game altogether.
watty 13y ago
Play with fire and get burned. Sounds like the thugs have started tracking the thief, which would end in blood if caught. Classy stuff here folks, amazed drug dealers and crooks seem "normal" now.
microcolonel 13y ago
TL;DR one opportunist business with no strong external audits has failed its customers, and everyone who wasn't affected seems to think it's the perfect opportunity to criticise the philosophical views of people who may not even be involved. Please stop upvoting such low quality threads. We can do better than this, guys. :P
MrJagil 13y ago
All the Reddit kids are talking about a new site called The Marketplace, apparently very secure. http://www.reddit.com/r/themarketplace/comments/1tx26z/the_marketplace_simple_guide_with_pictures_latest/ http://www.reddit.com/r/themarketplace/comments/1tx26z/the_m... Anyone with more knowledge and less bias care to elaborate?
- gwern 13y ago
  Multi-sig seems like it would prevent these problems of markets scamming their users, and thus far seems to have worked for TMP, but the major issue is that TMP hasn't been very popular because it's harder to use, and so we don't know how robust multi-sig is in practice.
  - MrJagil 13y ago
    Thanks for answering Gwern. I admire your work, trust your opinion, and it resonates with my impression.
ausjke 13y ago
How much is the loss? Who is going to cover it? don't think there is an insurance policy for bitcoin hacking.

449 points by nikcub 13y ago

Wow, it really is the wild west out there right now... I wish that some of the "post-mortem" reports I've seen were this good and detailed with problem, explaination, resolutions. I don't have a horse in this race so people affected probably feel differently.

ye 13y ago
I wouldn't call this "wild west". Regular banks experience much worse thefts, and pretty regularly.

jfasi 13y ago

Given illegal nature of Silk Road 2, I can't help but be suspicious of this explanation of the hack. If someone's sufficiently willing to flaunt laws as to operate a site devoted to selling contraband, what stops them from taking advantage of their position of power and stealing from their users?

short_circut 13y ago
That is roughly what I thought when I saw this. These people are dealing with criminal enterprises. What do they expect?
- redthrowaway 13y ago
  SR1 was a criminal enterprise as well, and there's no indication DPR was stealing from his users. Trust is at least as valuable in the criminal world as it is in legitimate enterprise, if not more so. A criminal who runs a trustworthy criminal enterprise is likelier to do well in the long run than one who rips off his customers.
  - EpicEng 13y ago
    A criminal who runs a trustworthy criminal enterprise is likelier to do well in the long run than one who rips off his customers. Sure, yet it happens all of the time. Not everyone is logical and forward thinking, and sometimes they just want a big score.
  - spinlock 13y ago
    did DPR do well in the long run?
    - redthrowaway 13y ago
      DPR's failure was opsec, not trustworthiness. Dishonest criminals get caught due to poor opsec, too.
  - sliverstorm 13y ago
    SR1 was a criminal enterprise as well, and there's no indication DPR was stealing from his users That reminds me of arguing along the lines of, I played Russian Roulette before, and I didn't lose. Therefore, I will not lose this time either.
    - Malician 13y ago
      Allegedly, SR2 was setup in ways which made it much, much easier to run off with larger quantities of money than with SR1. Given the circumstances, you could reasonably conclude this would happen.
      - ericb 13y ago
        Running off with the money is probably the smart move. The quicker you can get off the radar with something like this, the better your chance of not ending up in jail. It is entirely possible they are made for life, and with no more incoming transactions, if they haven't left a trail, they can have their cake and eat it too.
  - gtirloni 13y ago
mscarborough 13y ago
This is also the guy that just talked a bunch of trash about the last Dread Pirate Roberts, and how he was so much better about security. Jinxed yourself, bro. Granted this was supposedly in the Bitcoin protocol itself, but for real, there's really never any need to stick your neck out to talk about how great your security is...
- haakon 13y ago
  I think you're confusing Silk Road 2 with Atlantis. They did talk trash and flapped their wings with fancy Youtube commercials etc before they suddenly closed down soon before Silk Road got busted. Silk Road 2 always claimed to be the rightful heir to the original Silk Road, and have their own Dread Pirate Roberts.
  - mscarborough 13y ago
    This is the interview I was referring to: http://arstechnica.com/tech-policy/2014/02/dread-pirate-roberts-2-0-an-interview-with-silk-roads-new-boss/ http://arstechnica.com/tech-policy/2014/02/dread-pirate-robe... A lot of talk for something that just started, and had a massive fail one week after publication.
- yscale 13y ago
  * this was supposedly in the Bitcoin protocol itself* Cue a line of BTC-promoting ostriches claiming that the protocol is fan-fucking-tastic and in no need of improvement.
chrisBob 13y ago
I see your point, but stealing from drug dealers is usually a dangerous business.
- riquito 13y ago
  It's not like he can say "sorry, but it wasn't me. Still friends?". The risks are probably the same, so it's better to be hated AND a thief :-P
- catshirt 13y ago
  i'm assuming if dealers know who he is then dea, atf, or whoever would get to him first.
brubaker 13y ago
They are not criminals, they are "freedom fighters" Well atleast that is how they delusionaly see it.
twelvechairs 13y ago
The fact that they would be cutting their own revenue stream? I'm not saying its not possible but really this is just speculation. I could just as easily surmise that it was from a government or banks who feel threatened by bitcoin...
- jfasi 13y ago
  With any other business I would agree, but a $90k+ payout would probably be very attractive for someone running a clone of a drug site that got publicly busted just months before. I would imagine these guys have a countdown to when they get arrested ticking in their heads...
  - twelvechairs 13y ago
    until you have proof its all just speculation. there are many possibilities.
  - gwern 13y ago
    No, $90k is peanuts. Ross Ulbricht was making $19k a day on SR1, according to the complaint. Given that SR2, for all its problems and pissed off users, was still the biggest market, $90k is not worth killing it over. The estimates of >4500btc, on the other hand...
binocarlos 13y ago
lol and there was gullible little me thinking 'wow the hackers moved fast'
- gwern 13y ago
  Well, the hackers did move fast, from the Bitcoin discussions I've been following. That's why it's such a good excuse for the SR2 operators: because it's a real hack, it has a surface plausibility.
fleitz 13y ago
The sad thing is that not only will people trust people like this, but they'll advocate for them having more power over their lives. http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair http://en.wikipedia.org/wiki/Troubled_Asset_Relief_Program http://en.wikipedia.org/wiki/Troubled_Asset_Relief_Program
vbuterin 13y ago
There is a huge moral difference between the sort of victimless-crime-contraband that is on SR (especially since SR1 at least, not sure about SR2, actively filtered out child porn, weapons, assassinations and all of the other truly scary things that you can potentially sell on an anonymous market), and stealing millions of dollars from people at least a few of whom are dependent on substances and desperately need the money to get them in time. Also, it hasn't really happened yet, but vigilantes.
- Touche 13y ago
  > especially since SR1 at least, not sure about SR2, actively filtered out child porn, weapons, assassinations Except for when they needed those things.
- jfasi 13y ago
  Notice that morality doesn't have to have anything to do with this argument. As a matter of pragmatism, the operator of a Silk Road-type site is almost certain to harbor a conviction that he can do so without getting caught (regardless of whether the authorities have morality on their side). The same same goes for stealing from your customers: of course you won't get caught, what are your victims going to do? File a police report that the money they gave to a contraband site to presumably purchase contraband was stolen? The same conviction that makes it possible for them to operate Silk Road 2 makes it possible for them to steal from their customers.
  - pikachu_is_cool 13y ago
    I think what he's trying to say that it's far less likely for a libertarian "legalize drugs" type of person to screw a bunch of people over. Like, when you facilitate selling drugs, there is no victim. Hell, you probably prevented having a victim. When you facilitate selling weapons/assassinations/child porn, there is a victim. The latter type of person would be more likely to victimize his/her customers than the former.
    - mbillie1 13y ago
aegiso 13y ago
It's entirely possible to be in support of a free and peaceful drug trade, while at the same time being morally against theft. I don't know why you're lumping the two.
- mbillie1 13y ago
  There's a difference between supporting a free and peaceful drug trade and participating in a very-much illegal drug trade. It's possible to be a hemp-wearing, tree-hugging hippie and be pro-death penalty - it also happens to be rare.
  - MarkPNeyer 13y ago
    the law has very little to do with supporting freedom and peace these days.
    - mbillie1 13y ago
      That is very true, but there's still an enormous chasm for your average person between being mostly-law-abiding (I'm not counting things like jaywalking or going 5mph over the limit) and participating in drug sales, which could land you life in prison. Hell, I think drug laws are incredibly unjust in the US, and that the government is overstepping its bounds left and right. By no means should you infer from this that I'm not careful of the legality of my actions. I think it's perfectly reasonable to assume that someone participating in a life-in-prison-risking drug enterprise would also be willing to make other illegal/immoral decisions - in fact I think it would be foolish and naive NOT to assume that as a default, despite the fact that it will of course not be true in every case.
      - DerpDerpDerp 13y ago
        Having dealt passingly with a large number of marijuana dealers, I disagree strongly with your assessment. Do you have any statistics to back this up, or just the naive reasoning "Well, it's a /serious/ crime, so they'd probably commit others, because only bad people commit /serious/ crimes"?
kolbe 13y ago
How about self-interest? SR2 was not a very big site, and building a much larger business based on being a good operator of an underground market would earn him significantly more money than what he would have made by stealing the funds.
rurban 13y ago
Given the latest news it is also very likely that the FBI with the help of some other government cyber-crime unit raided Silk Road 2. You will see it only when the thieves will try to sell or exchange the bitcoins. The FBI won't do, and it will be in the news sooner and later.

d23 13y ago

Is our only recourse downloading the entire block-chain to keep our wallets stored offline? Or do I have some misunderstanding? I just really like the convenience of services like coinbase.

vertex-four 13y ago
You can keep your wallet on your own computer with a "light" client like Electrum, which doesn't need to download the whole blockchain. There are some security tradeoffs, but nobody can outright steal your bitcoins without you doing anything.
facepalm 13y ago
You don't need the block chain to keep coins. You only need a wallet. Technically your private keys never need to see the internet at all. Edit: here is one way to do it https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_savings_wallet https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_sa... At a recent meetup there was a presentation recommending Electrum with HD wallets instead. That would mean you really would only need to memorize a passphrase, all the keys would be generated from that so no backup necessary. Personally I am not yet 100% sure HD wallets are safe, need to look into it.
sexmonad 13y ago
You can also use something like blockchain.info for slightly better security than coinbase. They do client-side encryption and decryption of wallets. Of course, if you forget your password, your coins are gone. And blockchain.info could always modify their code to steal your coins later. At least they couldn't steal them without you logging in. But a thin wallet like Electrum is probably your best bet.

pstrateman 13y ago

The claim that this was caused by transaction malleability rings hollow. The reference client (github.com/bitcoin/bitcoin) does not resend transactions because of malleability. The only way you can have double transfers due to malleability is if you are manually reviewing transfers and re-sending them yourself manually. This seems like a very convenient scapegoat.

Mchl 13y ago
Yeah. The moment I got to " a vendor exploited a recently discovered vulnerability in the Bitcoin protocol known as “transaction malleability”" I was like "Riiiiight....". It's not even 'recently discovered', and as far as I understand it it does not let anyone to drain other persons' wallet (if it did, that'd be a killer to entire bitcoin the moment it was discovered)
- rdtsc 13y ago
  They wanted to exit the business from the start. Saw a convenient time with everyone discussing a vulnerability, claim right away that vulnerability was used to steal all the money to avoid backlash from users.
  - ChuckMcM 13y ago
    If one were sufficiently cynical one could argue that this was the plan from the start. Build another version of the site, wait for some BitCoin disaster, take all the funds and claim it was the disaster that done did it. Of course to pull that off you'd really need to employ the disaster yourself so that you have the ledger entries to "prove" it.
    - girvo 13y ago
      Don't need to be cynical: that has happened with multiple other markets. I think that's exactly what happened here.
  - pikachu_is_cool 13y ago

tedivm 13y ago

About 150 coins were stolen by the main attacker- $91,870.

deleted 13y ago

[deleted]

bhouston 13y ago

How much was stolen? How many bitcoins are we talking about. It isn't very clear.

kylebrown 13y ago
4,474 BTC ~= $2.7 million
- devindotcom 13y ago
  Source? I've seen 150 and 88,000 but not 4474
  - kseistrup 13y ago
    http://www.reddit.com/r/DarkNetMarkets/comments/1xtqty/sr_has_been_hacked/ http://www.reddit.com/r/DarkNetMarkets/comments/1xtqty/sr_ha...
  - kseistrup 13y ago
    https://twitter.com/NCWeaver/status/434073747050352640 https://twitter.com/NCWeaver/status/434073747050352640
rqebmm 13y ago
at the top of the article: Update: The amount of BTC that was stolen was calculated by Nicholas Weaver @NCWeaver – Computer Security Researcher, to be around: 4474.266369160003BTC that are with the value of about $2.7 Million.
- polarix 13y ago
  That's a lot of significant figures for a round number...
- jboggan 13y ago
  That should be 4474.26636916 . . . who is doing BTC calculations with floats?

theswan 13y ago

Not having very much knowledge about the financial industry - is this also an issue with marketplaces that deal with fiat monies? i.e. Dwolla, Balanced, Stripe, Venmo, all serve as intermediaries for moving money - do these companies have bank accounts that hold onto massive sums of money? What protections would go into keep those accounts secure?

brycekahle 13y ago
Dwolla uses a credit union pool account. Taken from https://www.dwolla.com/security https://www.dwolla.com/security Dwolla, Inc. is an agent of Veridian Credit Union and all funds associated with your account in the Dwolla network are held in a pooled account at Veridian Credit Union. These funds are not eligible for individual insurance, and may not be eligible for share insurance by the National Credit Union Share Insurance Fund. Dwolla, Inc. is the operator of a software platform that communicates user instructions for funds transfers to Veridian Credit Union.
jfasi 13y ago
I have the sense that the protections in place on above-the-board, regulated financial services companies are more meaningful than those placed on companies dedicated to selling contraband. (That is: none)
beat 13y ago
Modern banking is over 100 years old. There is 100+ years of fraud protection processes, legal experience, etc built into the system, plus a huge and complex industry that has a vested interest in overall currency stability. Bitcoin and other digital currencies are learning firsthand what it means to "disrupt" on this scale. Part of that is learning the hard way what the old industry has known since before any of us were born.
- weavejester 13y ago
  Modern banking is also largely reversible, so stolen funds can often be recovered, and insurance covers the other cases. Bitcoin has the problem of having irreversible transactions, and it's also a lot more difficult to determine whether or not an account has been legitimately stolen from. I don't think it's the case that the current banking industry is insulated from theft due to superior security. From what I've heard from programmers working in the financial industry, the software there can be quite ropey, or at least no better than anywhere else.

gesman 13y ago

Owner decided to cash in and retire to no extradition treaty island?

riquito 13y ago
Why "no extradition"? Would he risk anything penal? If bitcoins are not money he may risk just a fine.
- ErsatzVerkehr 13y ago
  http://en.wikipedia.org/wiki/Fraud http://en.wikipedia.org/wiki/Fraud
  - Crito 13y ago
    If he is ever found, criminal charges are the least of his worries. We are supposing that he stole lots of money from lots of different drug dealers.
    - fleitz 13y ago
      Dime Bag Donny is hardly pablo escobar. If it took the FBI 2 years to track him down, unless he fucked over the Zapatas exactly nothing will be done about this. But then again the Zapatas hide behind guns, not crypto currency.
- Phlarp 13y ago
  The website, it's all about selling drugs and then mailing them across international borders. I imagine there is something considered criminal in there.
rqebmm 13y ago
Last I checked, jilted drug dealers don't follow extradition

Meekro 13y ago

This is nonsense. The transaction malleability issue doesn't cause coins to be automatically resent. The simple explanation is that the owner ran off with everybody's money.

dreamdu5t 13y ago

How do we know the founder didn't steal everyone's coins and is using hacking as a scapegoat?

aparadja 13y ago
We don't know that.
gwern 13y ago
We don't know that, and there's good reason to think they're doing just that.

deleted 13y ago

[deleted]

rglover 13y ago

Reports like these make me wonder what Hacker News would have looked like during the gold rush in the 1800s.

jaekwon 13y ago
Hello good sirs, I am able bodied and in want of land and picket. Please reach me at the bar, call for Sam.
- samstave 13y ago
  Exhibit HN: I've concocted a most healthful and beneficial syrum of the utmost pure ingredients! This here oil shall alleviate ye of all woe, misery and weak-of-knee! Looking for a most suitable alchemical co-founder to assist in mine taking this to production ready status for this year's county fair! Please contact me by post or telegram! Dr. Samuel's Special Synergistic Syrum One Market Plaza, San Francisco
mapgrep 13y ago
Pretty much the same.
- Mchl 13y ago
  Except it would use one of those western fonts.
thebiglebrewski 13y ago
Can somebody build this please?!
CoachRufus87 13y ago
Show HN: Levis 501
pirateking 13y ago
Rusher News 1. Mine Plundered: $2300 in Nuggets Stolen! (439 points) 2. Gold Is Where You Find It (102 points) 3. Show RN: A Better Shovel (32 points) 4. WANTED: No good pickaxe thief, DoA (8 points)

deleted 13y ago

[deleted]

ye 13y ago

Looks like 88,000 BTC were stolen, much more than originally reported. http://www.cryptocoinsnews.com/2014/02/13/silk-road-2-0-has-been-hacked-and-88000-btc-stolen-operator-says-centralized-escrow-system-cant-ever-work/ http://www.cryptocoinsnews.com/2014/02/13/silk-road-2-0-has-...

tillinghast 13y ago

I suspect bandits.

swalsh 13y ago

My favorite part of bitcoin is just how wild west it always feels. Real money, in very massive quantities is stolen, and there's no authorities who will do anything about it. Old school scams are new again. Crashes happen on a monthly basis. I'm staying out of it in any serious quantities because frankly i'm having too much fun watching it.

emhart 13y ago
It's even more fun with skin in the game.
- NathanKP 13y ago
  Just remember to never invest more than you can afford to lose.
  - dopamean 13y ago
    Heh.. "invest."
- StavrosK 13y ago
  That's true, I had half a bitcoin from back when it was worth $20, and I'm having loads of fun with it.
dreamdu5t 13y ago
You can do something about it, you just can't offload those costs onto other people you've never met. Anyone is free to attempt to investigate and go after this guy.
- comicjk 13y ago
  Yeah, just like anyone is free to keep their sheep off the commons. It's still going to get grazed flat.
jakejake 13y ago
There are certainly fortunes to be made as well as lost. I probably would not put "serious" quantities into bitcoin myself either, but it definitely is more interesting to watch it when you have a small amount in it.

Steko 13y ago

For anyone still drinking the "Bitcoin is frictionless" kool-aid, this hasn't been a good week.

dispense 13y ago
Either SR2 was hacked or someone ran off with the funds. Whatever the case may be, I do not see how the friction (or lack thereof) of Bitcoin has anything to do with this.
MarkPNeyer 13y ago
for anyone who sees bitcoin as a 'wild west' environment, this sort of thing is obvious and just moves the bitcoin economy forward. problems found now are fixed, and won't be as big of a deal later.
- Steko 13y ago
  "just moves the bitcoin economy forward" Contrary to popular(?) opinion, there is such a thing as bad publicity. At least when you're selling a get rich quick scheme.
- chasing 13y ago
  But this isn't a beta test. People treat Bitcoin as if it's ready for primetime and ready to replace traditional currency.
  - DerpDerpDerp 13y ago
    Yes, there's never limits on cash withdrawl in the glorious banking system. [0] http://www.bbc.co.uk/news/business-25861717 http://www.bbc.co.uk/news/business-25861717
    - Steko 13y ago
      If one of the main bullet points of your currency replacement is that "it's frictionless unlike regular money", and you ever find yourself pointing the finger at regular money and saying "it has frictions too" you already lost the argument.

deleted 13y ago

[deleted]

primitivesuave 13y ago

> our projections of order finalization volume indicated that we would need the community’s full balance in hot storage. As a bitcoin community leader, you have to stay informed with how other people got hacked in the past, and there are so many cases where all the bitcoins were foolishly kept out of air-gapped cold storage until an adventurous hacker plundered them. I guess history is doomed to repeat itself.

padseeker 13y ago

This is why bitcoin is a sham. The premise of perceived bitcoin value is based on the greater fool theory. What the hell were any of these people thinking? http://en.wikipedia.org/wiki/Greater_fool_theory http://en.wikipedia.org/wiki/Greater_fool_theory

shawnz 13y ago
That has nothing to do with what has happened here and has been argued ad nauseam in other threads already. In short: the only aspect of bitcoin that may be considered an instance of the greater fool theory is the idea that it is a guarenteed investment. Obviously it is not, and this news has nothing to do with bitcoin as an investment vehicle anyway.
- padseeker 13y ago
  It has everything to do with this - the reason it was stolen is it is a crypto currency with no legitimacy or inherit value. It's not even a physical object, its more like a stock that is not regulated. If this were real currency or a stock, then there might be some regulation and stealing would be hard to pull off. This virtual currency's value is based on nothing. The whole hacked account thing has a lot in common with some of the stock scams that occurred pre-depression. You have phony stocks which people buy into, it gets pumped, value is inflated, then dumped only to find out there was no company or the books were cooked. For all we know the guy that created silk road 2 'hacked' it himself and pocketed the bitcoins. This has more in common with a bad stock deal than a real robbery. And bitcoin has about the same real value as one of the phony stocks peddled on the market in the 1920s.
  - RankingMember 13y ago
    What about the USD's value is based on something other than a mental construct shared by billions of people?

samstave 13y ago

SO, I am completely ignorant on exactly how bitcoin works; but how the hell is it not possible to secure a bitcoin one owns.

pat2man 13y ago
It is entirely possible. Being a marketplace their software sends coins around for all sorts of reason, this is what was hacked. Someone's personal bit coins are not at risk.
dispense 13y ago
It is perfectly possible. Your only task is to secure the private keys. These are short enough to be printed as a QR code or written down. keep that piece of paper somewhere safe. Alternatively, it is possible to use a good, random, long passphrase as your de facto private key. That way, the keys to your wallet are literally stored in your mind and nowhere else. As of now, there are no known fatal flaws or weaknesses in the Bitcoin protocol itself. The network is secure and as long as you manage to secure your private keys, Bitcoin is extremely safe.
- interstitial 13y ago
  And you can always melt down your bitcoin into a pure gold.
- robzyb 13y ago
  > It is perfectly possible [to secure a bitcoin one owns]. You're forgetting about social engineering.
  - dispense 13y ago
    Social engineering applies to pretty much everything. It has nothing to do with Bitcoin (or whatever else a social engineer wants from you) and everything with your own lack of due diligence and gullibility.
    - 13y ago

gojomo 13y ago

Whatever happened to honor among thieves?

samstave 13y ago
Well.. if they weren't stealing them bitcoins, then they wouldn't be thieves to uphold said honor...

mindstab 13y ago

... and things like this do to a point hilight why there is a lot of regulation around money and trying to create a new "freer" currency is actually really dangerous. I'm pretty sure his operating practice of keeping all the money in one place would be against regulations. Also usually there are big security standards. And finally high transaction fees do in some part support insurance so when my/your visa is stolen or what ever, the bank can just refund me, and take it out of its insurance. Because storing a lot of money for a lot of people is a big deal, but its a well looked at deal, and trying to start from scratch ignoring all of that... well... you just end up with people loosing money in ways that would never happen otherwise. :/

blhack 13y ago

This is almost certainly hogshit, and anybody who has been paying even a little bit of attention over the last week can probably smell it. The "hole" in MtGox's security was a social one. You could contact customer support and claim that you had not received your coins, and they could re-issue you new ones if they chose to. There is also no evidence that this ever happened. This wasn't, and isn't, a flaw in the underlying architecture, it's just a way to convince a customer service rep that you weren't lying. If SR was re-issuing coins automatically, it's because they were being intentionally stupid. -- They're using this as a scapegoat. Either somebody ran off with the coins, or something otherwise hacked them and they're using this as an explanation.

sillysaurus2 13y ago
If SR was re-issuing coins automatically, it's because they were being intentionally stupid. MtGox was re-issuing coins automatically. Due to this, Gox has lost money. Possibly a huge amount. Were they being intentionally stupid, or just stupid? Source: https://news.ycombinator.com/item?id=7222690 https://news.ycombinator.com/item?id=7222690 This transaction malleability flaw is certainly a convenient excuse. But if these people implemented their wallet software in the same manner as Gox, then they would've suffered the same fate: a loss of thousands of coins, which is exactly what they claim happened.
- deleted 13y ago
  [deleted]
- blhack 13y ago
  Maybe I just haven't had enough coffee today, but: where does it say there that gox was re-issuing coins automatically?
  - deleted 13y ago
    [deleted]
  - sillysaurus2 13y ago
    Sorry, I should have linked two comments higher: https://news.ycombinator.com/item?id=7222457 https://news.ycombinator.com/item?id=7222457 You'll note that mtgox had funds taken from it. None of these other sites [did]. They're just being flooded with junk that screws up their transaction processing. It's not really the same thing at all.

jessaustin 13y ago

Interesting... I’ve included transaction logs at the bottom of this message. Review the vendor’s dishonest actions and use whatever means you deem necessary to bring this person to justice. More details will emerge as we continue to investigate. Presumably the particular addresses used will be noted for future reference by vengeance-minded parties? Perhaps the list should be referenced by popular client software so innocents can avoid receiving BTC, even indirectly, from the blamed addresses...

npcc 13y ago

Okay, I'm going to go out on a branch and throw up a strange hypothesis. I don't have any stake in the Bitcoin or drug dealing games, apart from generalized anarchistic tendancy: Silk Road 2 was a project set-up by some government agency or gangsters. The overall plan is to eliminate competition and sow uncertainty around both Bitcoin and Silk Road type unregulated markets with anonymous owners. The "transaction malleability" issue is totally unrelated to this event - it's not an exploit that can be used to 'steal' Bitcoins, only to corrupt the blockchain and/or mess with transactions (eg. cause them to fail or end up in limbo). "We were planning on re-launching the new auto-finalize and Dispute Center this past weekend, and our projections of order finalization volume indicated that we would need the community’s full balance in hot storage." - a silly excuse for such an obvious mistake. No imaginable system would require the entire balance of the community to be stored in such a way, no reasonable systems architect would do this. "The details we have on the hacker are below. Stop at nothing to bring this person to your own definition of justice. We normally do not doxx anyone, and hold user information sacred. But this is an extreme situation affecting our entire community, and all three users who have exploited this vulnerability are very much at risk until they approach us directly to assist with any information. Do not reveal any details of the attack. This will jeopardize your reward. Contact us directly. If anyone has purchased or sold to these usernames, expect generous bounties for any information you can contribute which leads to identification." - hold on, where's the evidence? What is he going to do with any information provided by his internet personal army? Why should others do his work for him in tracking these supposed hackers down? "Few hours before the announcement we at DeepDotWeb received a mail saying: 'SilkRoad hacked, 150 BTC stolen, you heard it first from me' this was sent to us by a reddit user who claimed since yesterday he was going to hack SR and steal the sites money" - Wouldn't that just be the perfect cover? Get some small-timers to grab a little and point the finger at them while he makes off with the much larger remainder. Besides, didn't this guy just say that he needs help tracking the attackers down? How does he then know enough to attach addresses to particular handles and countries? I admit some unfamiliarity with both Bitcoin and Silk Road/2 here so I hope somebody else can fill me in on this. "It takes the integrity of all of us to push this movement forward. Whoever you are, you still have a chance to act in the interest of helping this community. Keep a percentage, return the rest. Don’t walk away with your fellow freedom fighters’ coins." - An attempt to insinuate that the 'thief' is a member of the Bitcoin in-group, alongside the author. An appeal to those already attached to the in-group to 'join' the author in 'solidarity' and painting this event as an battle to defend Bitcoin itself. One that was already 'lost', I note. "Multi-signature transactions are the only way this community will be protected long-term." - oh yes, if ditching anonymity by tying identities and transactions together in an easily auditable fashion is 'protection' in this business. "I should have taken MtGox and Bitstamp’s lead and disabled withdrawals as soon as the malleability issue was reported. I was slow to respond and too skeptical of the possible issue at hand." - I believe this to be a stretch of the truth, weren't the MtGox and Bitstamp shutdowns totally unrelated to this 'exploit'? "If this financial hardship places you at risk of physical harm, contact me directly and I will do my best to help you with my remaining personal funds." - Give us all your information and I promise I'll send you some money! "Hindsight is already suggesting dozens of ways this could have been prevented, but we must march onward." - Translation: I just lost a lot of your money, trust me so I can do it again or lose faith in Bitcoin entirely. "In retrospect this was incredibly foolish, and I take full responsibility for this decision. I have failed you as a leader, and am completely devastated by today’s discoveries." - Awesome, an anonymous guy with nothing to lose takes full responsibility. I'd love to hear some thoughts on these comments and if anybody is thinking along the same lines? Alternatively, I'd also love to hear good arguments against this position.

zedshaw 13y ago

This is seriously the most hilarious thing I have read in a long time. Here we have a group of objectivist libertarians who believe that there should be effectively no laws other than the law of economics and self-interest who run an illegal website devoted to the pure greed of cashing in on contraband, and this is what they write: "I’ve included transaction logs at the bottom of this message. Review the vendor’s dishonest actions and use whatever means you deem necessary to bring this person to justice." We need the government! Please, come find the guy who took all of our illegal drug money and give it back to us so we can continue to say you aren't necessary. "Given the right flavor of influence from our community, we can only hope that he will decide to return the coins with integrity as opposed to hiding like a coward." Yes, you bad guy, you should do the right thing and think of the community not your self-interests by giving back your illegal gains back to the guy named Dead Pirate Roberts (that's totally his real name). "Whoever you are, you still have a chance to act in the interest of helping this community." In the interest of the community?! Bwahahahaa! "I will fight here by your side, even the greedy bastards amongst us." Like everyone on the site?! "The only way to reverse a community’s greed is through generosity." Just like Ayn Rand said my brothers! Then I come here and not a single person on here even notices the massive hypocrisy and lack of self-awareness. Amazing.

apalmer 13y ago
I get your point, but I think you are missing the glaring nuance here... He is basically saying if you are reading this and you were affected its in your best interest to participate in catching this guy and 'persuading' him to give us the bitcoins... he isnt appealing to government or some over arching entity or morality.
- zedshaw 13y ago
  Yes he is! In fact he appeals to morality just about every other sentence. It's rather hilarious.
  - DennisP 13y ago
    Libertarians have a strong sense of morality based on property rights. You might be thinking of anarchism.

aaronem 13y ago

"Movement"? "Comrades"? "Freedom fighters"? Excuse me, isn't this the online equivalent of an open-air drug market he's talking about here?

notastartup 13y ago

how the hell do they get away with kind of heist? Wouldn't they be able to follow the blockchain addresses until arriving at the wallet they are using to cash out?

smtddr 13y ago
I've talked about this before. http://news.ycombinator.com/item?id=7086399 http://news.ycombinator.com/item?id=7086399 You won't be able to find me without the authorities forcing the exchanges to provide info since they make their own cut helping me move the funds around in transaction-fees if they keep quiet about these kinds of things. As long as I'm not too greedy/eager and don't rush things, I can collect on these funds over the course of several months. I can even spice things up by sending a bunch into an online bitcoin-gambling-site. Gamble a little bit; perhaps lose some then withdraw after a few days. So now if I had sent 10 BTC in then 9 BTC goes somewhere else, you don't know if I lost 9 BTC to the casino or if I lost 1 to the casino and 9 is going to another wallet of mine. All this will look pretty crazy to anyone trying to follow me on the blockchain. You can't know which coins are actually mine and which belong to the exchanges & casinos. Maybe I legitimately won the jackpot; who knows. Also, there's this: http://www.bitcoinfog.com/ http://www.bitcoinfog.com/ Sidenote: Casinos are a great business to launder real life fiat money too...

barkingcat 13y ago

They were just asking for it. If you work with bitcoins in such quantities, you will have an attack surface so appealing that every single hacker on earth will be targeting you. You better treat security seriously.

mathattack 13y ago

I’ve included transaction logs at the bottom of this message. Review the vendor’s dishonest actions and use whatever means you deem necessary to bring this person to justice. More details will emerge as we continue to investigate. This seems like absolving themselves of responsibility. Was that in the spirit of how this was set up? I understand that this is different than a bank, both in spirit and law. But is there really nobody who would go after Silk Road 2 to get the money back?

memracom 13y ago

index.php? Can we say that they were inviting themselves to be hacked? Really, the only way to not have all their cash stolen would be for the NSA to hack them first and close up all the security holes.

toasted 13y ago

In the San Fran startup world where iphone taxi requesting and self-deleting video clips for 14 yr olds are the cusp of innovation, thank god for bitcoin and all the fun that comes with it.

shomyo 13y ago

"hacked"

relampago 13y ago

What it means to be a libertarian by Harvard Professor [VIDEO] (01:57)https://www.youtube.com/watch?v=zxj00QD6fNY https://www.youtube.com/watch?v=zxj00QD6fNY

mattdeboard 13y ago

This thread is now about zed shaw

roymurdock 13y ago

Sounds like Defcon got the excuse he needed to line his pockets with all of the Silk Road 2 money. I don't run a marketplace, but I would assume that an alarm protocol would be implemented and triggered when thousands of bitcoins start to drain out of "hot storage". Exploiting the transaction malleability bug wouldn't net you 4,500 BTC at once. It would take a lot of requests of broken transactions to drain the entire marketplace of thousands of BTC. Defcon and SR2 should have been on high alert for this kind of problem after the Mt. Gox announcement. Anyone who runs a Bitcoin marketplace would not be "slow to respond and skeptical of the issue at hand", especially not when the entire balance of the marketplace is in such a vulnerable state. Defcon has been around this business for years, he isn't an amateur. How could he make such a fundamental, incredibly ignorant error? Even if we believe the "bad luck, terrible timing" explanation, Defcon's lack of caution and general awareness is simply inexplicable. There is no way he would be so nonchalant about any kind of fault in the Bitcoin protocol with everyone's money sitting out in the open, just waiting to be stolen. I think the moral of this story is to not open an account with an anonymous exchange. Instead, open an account with a marketplace backed by some high-profile VC's who have some skin in the game. You can bet that Andreesen isn't going to be careless and ignorant enough to let the same thing happen to Coinbase. Not when he's got $25m and his invaluable image on the line.

gwern 13y ago
> I think the moral of this story is to not open an account with an anonymous exchange. Instead, open an account with a marketplace backed by some high-profile VC's who have some skin in the game. You can bet that Andreesen isn't going to be careless and ignorant enough to let the same thing happen to Coinbase. Great. Call me when Andreesen funds a black-market for highly illegal drugs.
- roymurdock 13y ago
  I think people are less worried about finding a source for illegal drugs, and more worried about finding a secure marketplace where they can trust the administration and exchange their funds securely. Theoretically, I would be relatively bummed out if my favorite drug dealer was arrested. Then I would get over it and find a new dealer. I would be livid if my drug dealer took my money, pointed a gun at my head, then got in his car and drove away, all the while claiming that he wasn't robbing me and that he had always had my best intentions at heart. So I'm not so concerned about a new marketplace popping up. The market demands drugs, and it will have them (SR3?). My point was simple: if you don't want to lose your money, don't store your money in an anonymous, drug-dealing marketplace. I'm not sure why this warranted such a sarcastic response?

EGreg 13y ago

Ummm seriously why do these marketplaces hold your bitcoins??? Don't they know bitcoins support m-of-n transactions? There should be a marketplace without the ability to have bitcoins stolen! It's rather straighforward people.

gwern 13y ago
> There should be a marketplace without the ability to have bitcoins stolen! There is at least one, and it's pretty well-known. You underestimate how much ordinary people don't want to deal with things like m-of-n transactions/multi-sig.
- EGreg 13y ago
  So why can't it be made more user friendly? Marketplace initiates the transaction, and all you have to do is sign it with your bitcoin client.
  - gwern 13y ago
    > Marketplace initiates the transaction, and all you have to do is sign it with your bitcoin client. 'All'?

cbeach 13y ago

This is why we need to find decentralised means of exchanging Bitcoins. I built https://www.cointouch.com/ https://www.cointouch.com/ to find trading partners in my extended social network. I don't want to use a centralised third party. There's little need for a centralised exchange given we have a rich social graph, and a programmable currency that is truly P2P. Keep it all P2P.

bhaumik 13y ago

On 1/31, a SR Forum user warned, "SR2 massive scam about to hit very soon" >no Auto Finalize/no resolution center coins are pilling up massively whitout anyone even realising what s coming . >there is propably couple millions $$ just in escrow alone and no one is fucking complaining. >You guys really think it takes more than a month to implement a resolution center?how dumb are you >This is about to be the biggest scam in the history of the darkmarkets. >Defcon postponing dates again and again,then annoucing that a fix has been done when clearly it hasn t done shit ?(captcha)in this case. >Can t you fucking see throught their bullshit and blatant lies that the ship is about to go down the drain very soon??wake the fuck up . Follow-up from today: >well,I ve done what I could to warn you at least,next time you call me a troll rethink maybe. >my posts weren t really convincing because of the bad grammar (not english) but the message was there for everyone willing to hear it. >If you believe all this bullshit again from defcon ,then I am affraid you d get scammed over and over again.SR isn t what it once was, it is run by a greedy cunt. >This was just so predictable,it doesn t take 2 fucking month to implement a resolution center ,not having it was the main tool of their scamming operation. >The funniest thing in that story is that SR would still be up , means this scams could go on forever because people are licking blindly these greedy mofo. >don t be fooled by the green camel next time rant over/ http://www.reddit.com/r/DarkNetMarkets/comments/1xu8wc/sr_forum_post_31st_january_sr2_massive_scam_about/ http://www.reddit.com/r/DarkNetMarkets/comments/1xu8wc/sr_fo...

crystaln 13y ago

The hatred for Mt Gox in the bitcoin community blinded them to the reality that the malleability bug is very serious. The way the bitcoin community responded was irresponsible. Regardless of whether there are workarounds, it's a tragic security flaw in the protocol and should have been treated as such.

jadeddrag 13y ago
As I understand it, this was a problem that was identified over 2 years ago, and fixed for over a year. The problem is that MtGox implemented their own wallet software, and neglected to include bug fixes from the reference client.
- crystaln 13y ago
  I don't believe that is correct. The core devs relied on people implementing workarounds.

tethis 13y ago

Yeah, right, they "got hacked".

DigitalSea 13y ago

Irony at its finest here. If you're going to go to the effort to use a decentralised currency that is difficult to track to a particular individual for a website selling illicit drugs and items served via a decentralised and anonymously run network, don't expect any sympathy when your Bitcoin goes missing... You go to the great effort of avoiding conventional means of currency (banking, trackable transactions to individuals) and yet you realise how the traditional banking system in many ways while not being perfect protects you from a lot of this type of activity. If an attacker hacks into your Internet banking or your credit card is stolen, you in most cases get the money back. No monetary system is perfect, and I think these increasingly frequent scenarios where X amount of crypto-currency is "stolen" and cannot be recovered drive that point home. I strongly believe that crypto-currency has a bright future, I own a few Bitcoin myself and many other alternative crypto, but I don't entrust and never would entrust my coins in a drug-dealer exchange escrow wallet, I keep them on my computer and in cold storage. These kind of situations just keep driving BTC's price down further, we don't need a Silk Road for Bitcoin to succeed. This whole situation really just makes me laugh. Some people have no faith in the traditional system of Government or currency, but for some reason have faith in a system and currency that is inherently insecure, unpredictable and when shit hits the fan, there's nobody to help you...

aianus 13y ago
Your point about the traditional banking system is irrelevant since there's zero chance of successfully buying a kilo of coke with your Visa card. So whether it's bricks of cash or shady darknet sites, the prohibition on drugs necessarily doesn't leave one with much recourse when transactions go wrong.
girvo 13y ago
Well, actually, people don't trust these new markets either. So many have been hacked, or been scams, that those with the most to lose have been pretty careful or exited this online game altogether.

watty 13y ago

Play with fire and get burned. Sounds like the thugs have started tracking the thief, which would end in blood if caught. Classy stuff here folks, amazed drug dealers and crooks seem "normal" now.

microcolonel 13y ago

TL;DR one opportunist business with no strong external audits has failed its customers, and everyone who wasn't affected seems to think it's the perfect opportunity to criticise the philosophical views of people who may not even be involved. Please stop upvoting such low quality threads. We can do better than this, guys. :P

MrJagil 13y ago

All the Reddit kids are talking about a new site called The Marketplace, apparently very secure. http://www.reddit.com/r/themarketplace/comments/1tx26z/the_marketplace_simple_guide_with_pictures_latest/ http://www.reddit.com/r/themarketplace/comments/1tx26z/the_m... Anyone with more knowledge and less bias care to elaborate?

gwern 13y ago
Multi-sig seems like it would prevent these problems of markets scamming their users, and thus far seems to have worked for TMP, but the major issue is that TMP hasn't been very popular because it's harder to use, and so we don't know how robust multi-sig is in practice.
- MrJagil 13y ago
  Thanks for answering Gwern. I admire your work, trust your opinion, and it resonates with my impression.

ausjke 13y ago

How much is the loss? Who is going to cover it? don't think there is an insurance policy for bitcoin hacking.