6 ms·

Mt. Gox leak rumor

70 points by yeukhon 13y ago

Zombieball 13y ago
I've loosely been following the MtGox fiasco, including previous hacking that revealed voice conversations, passport scans, etc. However, I don't quite understand the context or ramifications of this leak. Could someone give a brief description? Much appreciated!
- junto 13y ago
  I took this away as a tl;dr Currency: BTC Balance: 951,116.21905382 <– That fat fuck has been lying!!
  - bradyd 13y ago
    But in another part of the statement it says "We stole no bitcoins. There were none to steal.", which seems to contradict them having ~1 million BTC.
    - a_olt 13y ago
      The balance may have been obtained from the logs, rather than from actual funds stored in the wallets.
      - DrStalker 13y ago
        It's a DB dump, so this is exactly what it is. If they had the public keys to all Mt Gox's wallets whey would be able to check them for funds, but there would still be questions about who controlled the wallets and if they had found them all so it would still not be proof of fraud (but the more evidence collected the more likely there will be something confirm-able discovered)
  - Danieru 13y ago
    It appears the hackers think it is a lie because all public statements I remember seeing and even the leaked "resurrection" plan talk about 0.7M BTC. There has been talk of a Wally trading program which is said to have be run by Mt. Gox to profit from the price imbalances. If this is true then the 200k might be Wally's account. Which would explain why Mt. Gox does not consider it real liabilities.
- DrStalker 13y ago
  It means they had a security issue that let someone steal their database. The DB shows they have lots of bitcoins and money available, but that doesn't mean anything because if they were hacked in the manner they described the DB would still show them as having bitcoins that they don't actually have. This means the information presented matches multiple scenarios including the bitcoins were stolen by Gox, the bitcoins were stolen by hackers and the exchange is still operational and fully funded. It rules out a hack that involved someone removing coins in a way that updated the bitcoin balance in the DB (such as password theft) but there was never any speculation that such an attack had occurred so that isn't helpful.
rys 13y ago
The full leak contains a back office administration tool used by Mt.Gox, and what looks to be complete trade logs up to and including November 2013. The leakers haven't included any personally identifiable information. If it means anything, I've had a look for my trading activity and it's all there and completely correct.
- nwh 13y ago
  They certainly have. The amounts withdrawn and deposited are enough to make solid connections between addresses on the blockchain. With this information it's possible to make a lot of associations between addresses you couldn't before knowing this information. From what I've read it gives the amount, account hash and the time, that's more than enough to uniquely identify them on the blockchain.
  - nullc 13y ago
    For people who had frequently reused publicly known addresses it's as good as putting their account name on the records. I guess people didn't learn from the infamous AOL search data release.
  - rys 13y ago
    You're right, I didn't think about the connection between exact BTC amounts and those being visible on the blockchain in plain sight.
542458 13y ago
Before everybody gets all up in arms about how this says that they still had around 1 million BTC, remember that this lines up exactly with what Mt. Gox has been saying. This is Mt. Gox's own accounting. It should report that they still have BTC. But these are just numbers from a database. What Gox has said is that while they thought that they still had BTC, while their systems (AKA this) still reported them having lots of BTC, the actual wallets had long since been emptied. So really, this doesn't help anybody in any ways. It could still be a hack, or it could be Gox screwing with everybody, or it could be something else entirely. It really doesn't mean anything. Other that showing that Gox still can't secure anything to save their life.
- glesica 13y ago
  Can someone explain how these guys managed to write their software in such a way that there was zero automatic verification that what their database said matched what was in the wallets, even just a cron job that ran once a week or something? I mean, I'm assuming there's a good reason, because I can't figure out how anyone could overlook something like that.
  - iSnow 13y ago
    If the rumors are right, then Gox not even had unit tests or a version control system go figure. Bitcoin squarely is in the hand of amateurs - good ones like the dev team and bad ones like Karpeles et al.
  - drewcrawford 13y ago
    It's pretty easy to miss "basics of a good design" like a cron job job when you are also missing actual basics like source control or any release process whatsoever [1]. I understand the Wired article to mean that for awhile they were actually editing source code on production servers in some cases. This really is a case of a company managing assets well in excess of the limitations of its experience or ability, literally a trading card company that found themselves operating as a bank. The thing I don't know was whether their customers had adequate notice that mtgox was grossly incompetent. Smart people have told me they did, but at the same time, the list of services I use where I have personally bothered to check if they use source control and have a test environment is not very long. [1] http://www.wired.com/wiredenterprise/2014/03/bitcoin-exchange/ http://www.wired.com/wiredenterprise/2014/03/bitcoin-exchang...
ossreality 13y ago
It's going to BLOW people minds when they break into my house and see that my Quicken save file has my assets as eleventy billion.
tlrobinson 13y ago
This is the same content posted to Karpeles' blog, already being discussed here: https://news.ycombinator.com/item?id=7369072 https://news.ycombinator.com/item?id=7369072
- yeukhon 13y ago
  Ah thanks. Poster of this HN post here. I posted it on pastebin because the original content could be removed later and I thought saving in a cache like pastebin was a good idea, so I didn't check whether original link has been posted or not.
  - mckee1 13y ago
    Yeah you were quite right, the info has now been removed from Mark's blog.
xpda 13y ago
It is possible that MtGox lost its money by dipping into deposits and pending cash withdrawals for its own use. Then, maybe some bad investments snowballed and they couldn't recover. This seems more likely than someone hacking them and ripping off hundreds of millions of dollars worth of bitcoins without them noticing. There is regulation that prevents this (most of the time) in banks, but in an unregulated exchange it would be easy (and stupid) to start gambling with customer deposits and pending withdrawals. A few months ago I set up a MtGox account, and noticed the MtGox policy of taking weeks or months to wire the proceeds from a bitcoin sale. That seemed like a red flag, and made me wonder what they're doing with the cash between the bitcoin sale and the wire transfer. I'm glad I opted out of MtGox.
fleitz 13y ago
From a legal perspective for mtgox you really couldn't hope for better news, not only have their systems been tampered with but now there is undoubted proof. Just paint yourself as the good guy amongst a scene of money launderers, hackers and drug dealers. This isn't proof of fraud, it's proof that people broke into their systems and tampered with them.
- DrStalker 13y ago
  The attackers here broke in and stole a DB copy, they may not have been able to tamper (e.g.: they had access to a backup of the DB but not the running copy) It's probably still a good part of a "we're incompetent not malicious!" defense, if that is how they decide to handle things.
dcc1 13y ago
Its correct, has 20 euro balance on an account I haven't used in 2 years and forgot about until this hoopla began

70 points by yeukhon 13y ago

I've loosely been following the MtGox fiasco, including previous hacking that revealed voice conversations, passport scans, etc. However, I don't quite understand the context or ramifications of this leak. Could someone give a brief description? Much appreciated!

junto 13y ago
I took this away as a tl;dr Currency: BTC Balance: 951,116.21905382 <– That fat fuck has been lying!!
- bradyd 13y ago
  But in another part of the statement it says "We stole no bitcoins. There were none to steal.", which seems to contradict them having ~1 million BTC.
  - a_olt 13y ago
    The balance may have been obtained from the logs, rather than from actual funds stored in the wallets.
    - DrStalker 13y ago
      It's a DB dump, so this is exactly what it is. If they had the public keys to all Mt Gox's wallets whey would be able to check them for funds, but there would still be questions about who controlled the wallets and if they had found them all so it would still not be proof of fraud (but the more evidence collected the more likely there will be something confirm-able discovered)
- Danieru 13y ago
  It appears the hackers think it is a lie because all public statements I remember seeing and even the leaked "resurrection" plan talk about 0.7M BTC. There has been talk of a Wally trading program which is said to have be run by Mt. Gox to profit from the price imbalances. If this is true then the 200k might be Wally's account. Which would explain why Mt. Gox does not consider it real liabilities.
DrStalker 13y ago
It means they had a security issue that let someone steal their database. The DB shows they have lots of bitcoins and money available, but that doesn't mean anything because if they were hacked in the manner they described the DB would still show them as having bitcoins that they don't actually have. This means the information presented matches multiple scenarios including the bitcoins were stolen by Gox, the bitcoins were stolen by hackers and the exchange is still operational and fully funded. It rules out a hack that involved someone removing coins in a way that updated the bitcoin balance in the DB (such as password theft) but there was never any speculation that such an attack had occurred so that isn't helpful.

rys 13y ago

The full leak contains a back office administration tool used by Mt.Gox, and what looks to be complete trade logs up to and including November 2013. The leakers haven't included any personally identifiable information. If it means anything, I've had a look for my trading activity and it's all there and completely correct.

nwh 13y ago
They certainly have. The amounts withdrawn and deposited are enough to make solid connections between addresses on the blockchain. With this information it's possible to make a lot of associations between addresses you couldn't before knowing this information. From what I've read it gives the amount, account hash and the time, that's more than enough to uniquely identify them on the blockchain.
- nullc 13y ago
  For people who had frequently reused publicly known addresses it's as good as putting their account name on the records. I guess people didn't learn from the infamous AOL search data release.
- rys 13y ago
  You're right, I didn't think about the connection between exact BTC amounts and those being visible on the blockchain in plain sight.

542458 13y ago

Before everybody gets all up in arms about how this says that they still had around 1 million BTC, remember that this lines up exactly with what Mt. Gox has been saying. This is Mt. Gox's own accounting. It should report that they still have BTC. But these are just numbers from a database. What Gox has said is that while they thought that they still had BTC, while their systems (AKA this) still reported them having lots of BTC, the actual wallets had long since been emptied. So really, this doesn't help anybody in any ways. It could still be a hack, or it could be Gox screwing with everybody, or it could be something else entirely. It really doesn't mean anything. Other that showing that Gox still can't secure anything to save their life.

glesica 13y ago
Can someone explain how these guys managed to write their software in such a way that there was zero automatic verification that what their database said matched what was in the wallets, even just a cron job that ran once a week or something? I mean, I'm assuming there's a good reason, because I can't figure out how anyone could overlook something like that.
- iSnow 13y ago
  If the rumors are right, then Gox not even had unit tests or a version control system go figure. Bitcoin squarely is in the hand of amateurs - good ones like the dev team and bad ones like Karpeles et al.
- drewcrawford 13y ago
  It's pretty easy to miss "basics of a good design" like a cron job job when you are also missing actual basics like source control or any release process whatsoever [1]. I understand the Wired article to mean that for awhile they were actually editing source code on production servers in some cases. This really is a case of a company managing assets well in excess of the limitations of its experience or ability, literally a trading card company that found themselves operating as a bank. The thing I don't know was whether their customers had adequate notice that mtgox was grossly incompetent. Smart people have told me they did, but at the same time, the list of services I use where I have personally bothered to check if they use source control and have a test environment is not very long. [1] http://www.wired.com/wiredenterprise/2014/03/bitcoin-exchange/ http://www.wired.com/wiredenterprise/2014/03/bitcoin-exchang...

ossreality 13y ago

It's going to BLOW people minds when they break into my house and see that my Quicken save file has my assets as eleventy billion.

tlrobinson 13y ago

This is the same content posted to Karpeles' blog, already being discussed here: https://news.ycombinator.com/item?id=7369072 https://news.ycombinator.com/item?id=7369072

yeukhon 13y ago
Ah thanks. Poster of this HN post here. I posted it on pastebin because the original content could be removed later and I thought saving in a cache like pastebin was a good idea, so I didn't check whether original link has been posted or not.
- mckee1 13y ago
  Yeah you were quite right, the info has now been removed from Mark's blog.

xpda 13y ago

It is possible that MtGox lost its money by dipping into deposits and pending cash withdrawals for its own use. Then, maybe some bad investments snowballed and they couldn't recover. This seems more likely than someone hacking them and ripping off hundreds of millions of dollars worth of bitcoins without them noticing. There is regulation that prevents this (most of the time) in banks, but in an unregulated exchange it would be easy (and stupid) to start gambling with customer deposits and pending withdrawals. A few months ago I set up a MtGox account, and noticed the MtGox policy of taking weeks or months to wire the proceeds from a bitcoin sale. That seemed like a red flag, and made me wonder what they're doing with the cash between the bitcoin sale and the wire transfer. I'm glad I opted out of MtGox.

fleitz 13y ago

From a legal perspective for mtgox you really couldn't hope for better news, not only have their systems been tampered with but now there is undoubted proof. Just paint yourself as the good guy amongst a scene of money launderers, hackers and drug dealers. This isn't proof of fraud, it's proof that people broke into their systems and tampered with them.

DrStalker 13y ago
The attackers here broke in and stole a DB copy, they may not have been able to tamper (e.g.: they had access to a backup of the DB but not the running copy) It's probably still a good part of a "we're incompetent not malicious!" defense, if that is how they decide to handle things.

dcc1 13y ago

Its correct, has 20 euro balance on an account I haven't used in 2 years and forgot about until this hoopla began