12 ms·

Mark Karpeles' blog hacked

152 points by drewblaisdell 13y ago

bhaumik 13y ago
Original post from his reddit account: http://www.reddit.com/r/Bitcoin/comments/1zz21j/mtgox_2014_hack_database_revealed_live_from_mark/ http://www.reddit.com/r/Bitcoin/comments/1zz21j/mtgox_2014_h... Bitcoin's history already has a trilogy's worth of entertainment
deleted 13y ago
[deleted]
bertil 13y ago
Does this (the almost one million BitCoins) mean that he openly lied about being insolvent, or is this an undisclosed donation?
- mpyne 13y ago
  It might be as simple as there being a balance in the accounts, but being insolvent on the books due to outstanding liabilities owed by MtGox. But I'm not an accountant so YMMV.
  - fredgrott 13y ago
    even at $100 is more than the liabialities of 66 million
- sp332 13y ago
  Remember, the "transaction malleability" attack would have siphoned money from their real wallet while not showing up in their accounting software. So having a balance in this file doesn't mean the wallet actually has BTC left.
deleted 13y ago
[deleted]
antonius 13y ago
Waiting for a class-action against Mark Karpeles any minute now.
- deleted 13y ago
  [deleted]
- rmc 13y ago
  Does Japan have class action lawsuits? Not all countries do.
wfn 13y ago
I wonder if the balances revealed are concretely tied to wallet data, or rather simply are entries in a database. If the latter (and from what they said it seems to indeed be the latter), doesn't really mean much / doesn't contradict Mark's words in itself. (cf. Mark's comment that 'technically speaking [bitcoins are] not "lost" just yet, just temporarily unavailable.')
- nwh 13y ago
  They would just be balances, otherwise every trade in their engine would hammer the Bitcoin network with transactions. No sane person would do anything but have an external databases with a fairly tenuous connection to the actual wallet balances.
yanghan 13y ago
It's just a database dump. This doesn't mean that these values are backed by their wallets. It's possible the bitcoin could be stolen and not reflected in the data.
iamshs 13y ago
My cousin had an account on there with 102 BTC, and bought it while the price was around $650. He was having a hard time since last few days, but after a trekking trip and being with him since the fiasco he seems to be coping up fine. He is more worried about the Driver's license copy he provided as a verification. The database sure is leaked, and Identity theft seems real possibility. What are the safeguards that can be adopted now? Any help will be good.
- jsaxton86 13y ago
  FWIW, the original reddit post says "Keeping in line with fucking Gox alone, no user database dumps have been included."
  - nwh 13y ago
    Just because it's not posted publicly doesn't mean it won't be used by whatever parties have it. Given that this seems to be an American posting (comments about pizza and beer) and not the badly-typed Russian hacker earlier, it would appear that two parties at least have a copy of this information now (or alternatively got the information independently). You'd be a fool to assume this person is acting in good faith, they've exposed a hell of a lot of private data by posting this alone.
  - iamshs 13y ago
    True. They have not included it, they probably have it. Maybe there are other people who already have accessed it. He is effectively considering it in hands he may not want.
  - LocalPCGuy 13y ago
    But, if that hacker can get in, more nefarious ones can as well. You should assume that any information stored with Gox is now no longer private.
  - gwern 13y ago
    That's because they may be selling the rest of it. A 'nanashi' has already posted on Bitcointalk their terms (100btc for the entire dump, 10btc for 2gb etc).
sp332 13y ago
magnet:?xt=urn:btih:b6545ecc7db8d44c8cbc4e93989edf8221af75f5&dn=MtGox2014Leak.zip If you can't get a peer via DHT, add tracker udp://tracker.publicbt.com:80
- deleted 13y ago
  [deleted]
- natdempk 13y ago
  Probably worth adding openbittorrent as a tracker as well: udp://tracker.openbittorrent.com:80/announce
- skorgu 13y ago
  From the reddit thread: http://burnbit.com/torrent/280433/MtGox2014Leak_zip http://burnbit.com/torrent/280433/MtGox2014Leak_zip
  - sp332 13y ago
    That has some advantages, but also some disadvantages. It uses the original server as a "web seed", so even though it's a torrent, it's still putting a little strain on the web server for no good reason. Also with all those unnecessary trackers in there, it's long and awkward to copy-and-paste.
deleted 13y ago
[deleted]
Cless 13y ago
Just because my database says I have $100 trillion does not mean I have $100 trillion.
aegiso 13y ago
You know what would be brilliant? If this were Karpeles himself using "hackings" in a desperate attempt to deflect legal responsibility. I have no idea what the likelihood of this is, but it's in the realm of plausibility with all of the feces hitting the fan at Gox.
- yanghan 13y ago
  It's more likely the other way around. The same hackers dumping it to put the blame on Mark and deflect it from themselves.
- itry 13y ago
  Karpeles posting about himself "That fat fuck has been lying!!" is an amusing thought :)
  - rdl 13y ago
    Just as long as it isn't him saying "every statement I make is a lie".
- Aqueous 13y ago
  "Brilliant" seems like the wrong word for that.
  - jpatokal 13y ago
    I'd go for "brillant": http://thedailywtf.com/Articles/The_Brillant_Paula_Bean.aspx http://thedailywtf.com/Articles/The_Brillant_Paula_Bean.aspx
- easy_rider 13y ago
  "I only took a little bit" [1] "Or Aliens" [2] [1] http://business.asiaone.com/sites/default/files/2014/01/07/20140107_japanbusiness_yomiri.jpg http://business.asiaone.com/sites/default/files/2014/01/07/2... [2] http://i.ytimg.com/vi/ijhzD7FFHSA/0.jpg http://i.ytimg.com/vi/ijhzD7FFHSA/0.jpg
Aqueous 13y ago
They might very well be in possession of the 950k but have lost the private key to spend those funds. It looks like in recent days they regained control of 200k BTC, so perhaps they've recovered a key or two? I sure wish they would make a statement soon because if it was in fact the case that they recovered a large portion of their BTC, that would go a long way to bolstering faith in BitCoin itself, whose brand they totally damaged by blaming transaction malleability in the first place.
- sp332 13y ago
  They never mentioned losing a private key, did they?
  - Aqueous 13y ago
    Not specifically - perhaps because saying they were stolen is slightly (but only slightly) less embarrassing than saying they misplaced the key. Karpeles did say something to the effect that the funds were "temporarily unavailable" - which would be consistent with losing the key, if they had any hope of getting it back.
    - sp332 13y ago
      The attack that they claim happened was due to a bug in their accounting software. The software sometimes wouldn't record that a transaction had finished, so that account's balance didn't go down. Nothing to do with losing keys. Karpeles was trying to get investors to cover the losses after the bug was found. That's why he was hoping the losses would be temporary. But Mt Gox's business practices are so bad no one wanted to invest in them, so that's almost certainly not going to happen. There is only one way the coins could be recovered: if the thieves are found with the stash intact. Just keep in mind that Karpeles might be the thief.
      - danielweber 13y ago
        Last week people had tracked down Gox's prior BTC transactions and they still had the coins in an address they controlled. I've theorized that they lost the key, not because of any direct evidence, but because it's the only thing that makes a little bit of sense without out-and-out fraud.
danielweber 13y ago
According to /r/Bitcoin the .zip file contains a virus. It's taking forever-and-a-day for me to download it so I can't verify that.
- sp332 13y ago
  Which post? I see several that say it's clean.
rmc 13y ago
Does this mean MtGox should get on haveibeenpwned.com ?
codewiz 13y ago
Until a few minutes ago, you could see this hidden message: $ curl http://89.248.171.30/ <a href='MtGox2014Leak.zip'>They were not made out of magic Mark...</a>  The machine seems down now.
- wcummings 13y ago
  Up now
MiWDesktopHack 13y ago
The leaked data set contains: * screenshot of the back office application * OSX and Windows back office application binaries * btc_xfer_total_summary.txt * CV-Mark_Karpeles_20100325.pdf * home_addresses.txt * trades_summary.txt * btc_xfer_report.csv containing every deposit and withdraw * mtgox_balances containing the balances of all user wallets * trades.zip containing monthly csv files of all trades within mtgox & coinlab between 2011-04 to 2013-11 * trades csvs have fields: Trade_Id Date User_Id User User_Id_Hash Japan Type Currency Bitcoins Money Money_Rate Money_JPY Money_Fee Money_Fee_Rate Money_Fee_JPY Bitcoin_Fee Bitcoin_Fee_JPY User_Country User_State From this data you could reconstruct every trade within the site, and identify the address from transaction values. This dataset could lead to loss of anonymity to a significant number of people in the cryptocurrency world.
- Phlarp 13y ago
  If what you say is true and this data is sufficient to recreate and de-anonymize the trades on gox against withdrawals from their addresses shouldn't we be able to see if coins were actually stolen through tx malleability?
cauterize 13y ago
Would it be possible to use an alternative blockchain (maybe currency) to do internal accounting? Low confirmation requirement, add the BTC block chain transaction ID as a memo, consistency, etc.
callahad 13y ago
Wow, this is interesting. The folks dumping the dox asked for donations via Bitcoin. Thanks to the public nature of the blockchain, we can watch in real time as the donations come in: https://blockchain.info/address/1859rayqN1X7DYjD1BrAHm4vaQxoUhhzsN https://blockchain.info/address/1859rayqN1X7DYjD1BrAHm4vaQxo...

152 points by drewblaisdell 13y ago

Original post from his reddit account: http://www.reddit.com/r/Bitcoin/comments/1zz21j/mtgox_2014_hack_database_revealed_live_from_mark/ http://www.reddit.com/r/Bitcoin/comments/1zz21j/mtgox_2014_h... Bitcoin's history already has a trilogy's worth of entertainment

deleted 13y ago

[deleted]

bertil 13y ago

Does this (the almost one million BitCoins) mean that he openly lied about being insolvent, or is this an undisclosed donation?

mpyne 13y ago
It might be as simple as there being a balance in the accounts, but being insolvent on the books due to outstanding liabilities owed by MtGox. But I'm not an accountant so YMMV.
- fredgrott 13y ago
  even at $100 is more than the liabialities of 66 million
sp332 13y ago
Remember, the "transaction malleability" attack would have siphoned money from their real wallet while not showing up in their accounting software. So having a balance in this file doesn't mean the wallet actually has BTC left.

deleted 13y ago

[deleted]

antonius 13y ago

Waiting for a class-action against Mark Karpeles any minute now.

deleted 13y ago
[deleted]
rmc 13y ago
Does Japan have class action lawsuits? Not all countries do.

wfn 13y ago

I wonder if the balances revealed are concretely tied to wallet data, or rather simply are entries in a database. If the latter (and from what they said it seems to indeed be the latter), doesn't really mean much / doesn't contradict Mark's words in itself. (cf. Mark's comment that 'technically speaking [bitcoins are] not "lost" just yet, just temporarily unavailable.')

nwh 13y ago
They would just be balances, otherwise every trade in their engine would hammer the Bitcoin network with transactions. No sane person would do anything but have an external databases with a fairly tenuous connection to the actual wallet balances.

yanghan 13y ago

It's just a database dump. This doesn't mean that these values are backed by their wallets. It's possible the bitcoin could be stolen and not reflected in the data.

iamshs 13y ago

My cousin had an account on there with 102 BTC, and bought it while the price was around $650. He was having a hard time since last few days, but after a trekking trip and being with him since the fiasco he seems to be coping up fine. He is more worried about the Driver's license copy he provided as a verification. The database sure is leaked, and Identity theft seems real possibility. What are the safeguards that can be adopted now? Any help will be good.

jsaxton86 13y ago
FWIW, the original reddit post says "Keeping in line with fucking Gox alone, no user database dumps have been included."
- nwh 13y ago
  Just because it's not posted publicly doesn't mean it won't be used by whatever parties have it. Given that this seems to be an American posting (comments about pizza and beer) and not the badly-typed Russian hacker earlier, it would appear that two parties at least have a copy of this information now (or alternatively got the information independently). You'd be a fool to assume this person is acting in good faith, they've exposed a hell of a lot of private data by posting this alone.
- iamshs 13y ago
  True. They have not included it, they probably have it. Maybe there are other people who already have accessed it. He is effectively considering it in hands he may not want.
- LocalPCGuy 13y ago
  But, if that hacker can get in, more nefarious ones can as well. You should assume that any information stored with Gox is now no longer private.
- gwern 13y ago
  That's because they may be selling the rest of it. A 'nanashi' has already posted on Bitcointalk their terms (100btc for the entire dump, 10btc for 2gb etc).

sp332 13y ago

magnet:?xt=urn:btih:b6545ecc7db8d44c8cbc4e93989edf8221af75f5&dn=MtGox2014Leak.zip If you can't get a peer via DHT, add tracker udp://tracker.publicbt.com:80

deleted 13y ago
[deleted]
natdempk 13y ago
Probably worth adding openbittorrent as a tracker as well: udp://tracker.openbittorrent.com:80/announce
skorgu 13y ago
From the reddit thread: http://burnbit.com/torrent/280433/MtGox2014Leak_zip http://burnbit.com/torrent/280433/MtGox2014Leak_zip
- sp332 13y ago
  That has some advantages, but also some disadvantages. It uses the original server as a "web seed", so even though it's a torrent, it's still putting a little strain on the web server for no good reason. Also with all those unnecessary trackers in there, it's long and awkward to copy-and-paste.

deleted 13y ago

[deleted]

Cless 13y ago

Just because my database says I have $100 trillion does not mean I have $100 trillion.

aegiso 13y ago

You know what would be brilliant? If this were Karpeles himself using "hackings" in a desperate attempt to deflect legal responsibility. I have no idea what the likelihood of this is, but it's in the realm of plausibility with all of the feces hitting the fan at Gox.

yanghan 13y ago
It's more likely the other way around. The same hackers dumping it to put the blame on Mark and deflect it from themselves.
itry 13y ago
Karpeles posting about himself "That fat fuck has been lying!!" is an amusing thought :)
- rdl 13y ago
  Just as long as it isn't him saying "every statement I make is a lie".
Aqueous 13y ago
"Brilliant" seems like the wrong word for that.
- jpatokal 13y ago
  I'd go for "brillant": http://thedailywtf.com/Articles/The_Brillant_Paula_Bean.aspx http://thedailywtf.com/Articles/The_Brillant_Paula_Bean.aspx
easy_rider 13y ago
"I only took a little bit" [1] "Or Aliens" [2] [1] http://business.asiaone.com/sites/default/files/2014/01/07/20140107_japanbusiness_yomiri.jpg http://business.asiaone.com/sites/default/files/2014/01/07/2... [2] http://i.ytimg.com/vi/ijhzD7FFHSA/0.jpg http://i.ytimg.com/vi/ijhzD7FFHSA/0.jpg

Aqueous 13y ago

They might very well be in possession of the 950k but have lost the private key to spend those funds. It looks like in recent days they regained control of 200k BTC, so perhaps they've recovered a key or two? I sure wish they would make a statement soon because if it was in fact the case that they recovered a large portion of their BTC, that would go a long way to bolstering faith in BitCoin itself, whose brand they totally damaged by blaming transaction malleability in the first place.

sp332 13y ago
They never mentioned losing a private key, did they?
- Aqueous 13y ago
  Not specifically - perhaps because saying they were stolen is slightly (but only slightly) less embarrassing than saying they misplaced the key. Karpeles did say something to the effect that the funds were "temporarily unavailable" - which would be consistent with losing the key, if they had any hope of getting it back.
  - sp332 13y ago
    The attack that they claim happened was due to a bug in their accounting software. The software sometimes wouldn't record that a transaction had finished, so that account's balance didn't go down. Nothing to do with losing keys. Karpeles was trying to get investors to cover the losses after the bug was found. That's why he was hoping the losses would be temporary. But Mt Gox's business practices are so bad no one wanted to invest in them, so that's almost certainly not going to happen. There is only one way the coins could be recovered: if the thieves are found with the stash intact. Just keep in mind that Karpeles might be the thief.
    - danielweber 13y ago
      Last week people had tracked down Gox's prior BTC transactions and they still had the coins in an address they controlled. I've theorized that they lost the key, not because of any direct evidence, but because it's the only thing that makes a little bit of sense without out-and-out fraud.

danielweber 13y ago

According to /r/Bitcoin the .zip file contains a virus. It's taking forever-and-a-day for me to download it so I can't verify that.

sp332 13y ago
Which post? I see several that say it's clean.

rmc 13y ago

Does this mean MtGox should get on haveibeenpwned.com ?

codewiz 13y ago

Until a few minutes ago, you could see this hidden message: $ curl http://89.248.171.30/ <a href='MtGox2014Leak.zip'>They were not made out of magic Mark...</a>  The machine seems down now.

wcummings 13y ago
Up now

MiWDesktopHack 13y ago

The leaked data set contains: * screenshot of the back office application * OSX and Windows back office application binaries * btc_xfer_total_summary.txt * CV-Mark_Karpeles_20100325.pdf * home_addresses.txt * trades_summary.txt * btc_xfer_report.csv containing every deposit and withdraw * mtgox_balances containing the balances of all user wallets * trades.zip containing monthly csv files of all trades within mtgox & coinlab between 2011-04 to 2013-11 * trades csvs have fields: Trade_Id Date User_Id User User_Id_Hash Japan Type Currency Bitcoins Money Money_Rate Money_JPY Money_Fee Money_Fee_Rate Money_Fee_JPY Bitcoin_Fee Bitcoin_Fee_JPY User_Country User_State From this data you could reconstruct every trade within the site, and identify the address from transaction values. This dataset could lead to loss of anonymity to a significant number of people in the cryptocurrency world.

Phlarp 13y ago
If what you say is true and this data is sufficient to recreate and de-anonymize the trades on gox against withdrawals from their addresses shouldn't we be able to see if coins were actually stolen through tx malleability?

cauterize 13y ago

Would it be possible to use an alternative blockchain (maybe currency) to do internal accounting? Low confirmation requirement, add the BTC block chain transaction ID as a memo, consistency, etc.

callahad 13y ago

Wow, this is interesting. The folks dumping the dox asked for donations via Bitcoin. Thanks to the public nature of the blockchain, we can watch in real time as the donations come in: https://blockchain.info/address/1859rayqN1X7DYjD1BrAHm4vaQxoUhhzsN https://blockchain.info/address/1859rayqN1X7DYjD1BrAHm4vaQxo...