16 ms·

Bitstamp is open for business

84 points by jvoorhis 12y ago

ceejayoz 12y ago
> On January 4th, some of Bitstamp’s operational wallets were compromised, resulting in a loss of less than 19,000 BTC. That's a nice way of saying "we're out five and a half million USD"...
- rnhmjoj 12y ago
  The "less than" is ridiculous.
  - sneak 12y ago
    It's relative. The loss is a single-digit percentage of total bitcoin deposits held by Bitstamp. They're eating it.
- joeyspn 12y ago
  Apparently they were the ones moving the famous transaction of 200k bitcoins. So, yes, for them this breach could look like: "Meh, we've lost some pennies". http://www.coindesk.com/194993-btc-transaction-147m-mystery-and-speculation/ http://www.coindesk.com/194993-btc-transaction-147m-mystery-...
  - martinko 12y ago
    Those are all (vast majority) client funds. 5 million is coming out of their pocket.
    - jerguismi 12y ago
      Who knows if it comes from their own pocket, or from the customer funds? It is just their internal accounting in the end. The same way the banks work.
- carbocation 12y ago
  I think it is phrased that way to set an upper bound without being overly precise.
im2w1l 12y ago
Wow they have multi-sig support now, that is pretty amazing. Would easily be worthy of its own article in other circumstances. If I understand it correctly it means money can not be withdrawn without both the account holder and bitstamp signing the transaction. This means that neither can the money be stolen by hackers, nor could bitstamp run off with it. There are actually some bitcoins in the real blockchain "with your name on it", as opposed to you just having a claim on bitstamp.
- zaroth 12y ago
  How would they turn on such a feature without each account holder generating keys specifically for those TxOuts and moving the funds into appropriate P2SH addresses? It sounds more like, it means it's possible given the necessary end-user configuration to enable multi-sig, not that all coins are already benefitting from that level of protection.
- goldmouth 12y ago
  Multi-sig transactions work as you describe but many darknet markets have had that option for some time. It's actually recommended you use multi-sig for every darknet purchase.
- jvoorhis 12y ago
  Not necessarily. Bitgo uses a 2-of-3 scheme, where they provide retail account holders with a primary key, and a backup key. In the usual flow, you and Bitgo sign a transaction. If you need to recover, you can use your backup key. Source: I am a Bitgo retail customer, but I don't have access to an enterprise account and cannot comment on their Bitstamp integration.
- nadaviv 12y ago
  I doubt that. Having the funds jointly controlled by the exchange and the user, and outside the full control of the exchange, would require each fund transfer to be represented as a transaction on the Bitcoin network, which is simply impossible - the volume of transactions on an exchange is a few magnitudes larger than what Bitcoin can currently handle. To keep up with that volume, exchanges must use an internal off-chain accounting system, which precludes the use of multi-signature (or any other smart contract based on Bitcoin scripting). In addition, this would require the user to be online and actively sign transactions when a matching order is found. I think that they most likely meant that they're using multisig internally to protect their funds, in a setup where all the keys are controlled by them.
zaroth 12y ago
Have they figured out how the attackers got in? Have they competed the forensic analysis to determine they can't get back in through the same or similar vectors? There's nothing really here about what happened or how they have mitigated it. Perhaps it's too early and they don't really know, but then isn't going back live fairly risky? Aside from a persistent firmware threat, which has nothing to do with the attack vector, I don't see why "yay we're on AWS now" is any different unless they know the compromise was due to a specific piece of infra which is no longer present. Isn't it much more likely to be a bug in their software logic which would certainly not be fixed by restoring a backup...
- sneak 12y ago
  I'm managing the incident response. The investigation continues in parallel. First priority was safety, which meant shutting everything down to prevent any additional issues or destruction of evidence. Second was giving people the ability to access their funds and to trade - a complete redeploy of the infrastructure which took us working 22/7 since Monday until just now. An investigation is underway and we have some internal speculation from the first bits of information - the real statements will come after we aren't guessing. This is the first minute we've had to breathe this week.
  - im2w1l 12y ago
    So eh, are you sure they couldn't get back in?
    - sneak 12y ago
      Yes.
  - andyrj 12y ago
    This is obviously the second stage of NORK's sophisticated cyber attacks.
  - IkmoIkmo 12y ago
    Could you talk a little about how you covered the first priority, safety? A restart on a fresh server doesn't really inspire the notion that whatever exploit they used can't be used again? i.e. why did you decide to restart when you haven't determined what caused the safety issue?
EvanDotPro 12y ago
> We can assure customers that any bitcoins held with us prior to temporary suspension of services on January 5th at 9am UTC are completely safe and will be fully honored. I, for one, am glad to see a Bitcoin story turn out with a somewhat positive outcome, at least from the users' perspective. That said, the article says a breach resulted in the loss of ~19,000 BTC, or around $5.6 million. If they're honoring all user funds, does that mean they are just eating that loss out of their own profits, and perhaps try to file an insurance claim? Or were they actually responsible enough to set enough profits aside in cold storage self-insure the total amount floating in the "hot" wallets? On that note, I wonder if profits and hot wallet demands scale proportionately or not, or if their margins are just at a scale where this is a non-issue?
- sneak 12y ago
  > does that mean they are just eating that loss out of their own profits, Yup.
  - jacquesm 12y ago
    So you are essentially claiming a profit to date >> $5.6M. There will be lots of parties interested in that information.
    - VienneseCPA 12y ago
      Doesn't just have to be retained earnings from past profitability, it could also be investor cash that would presumably be recuperated with future profitability.
    - martinko 12y ago
      It is probably much higher. If we take a conservative estimate of 10k btc traded per day, on average, and a trade commission of 0.008% (0.004 two ways), we get to $5.6m in little over half a year. Now yes, the have some operational costs etc, but they've been in business for several (?) years. tldr: back of the envelope calculations show that they must have made more in profit to-date.
kolev 12y ago
I think the conclusion from all this heists is that virtual money is much easier to steal. Next time you will see physical break-ins and so on. We've watched all those action movies where people risk their lives to get hold of $5M. Nowadays, you can do this remotely from the convenience of your home... but it will be easier for the old crooks to steal a key vs bags of cash, so, let's see how this goes forward.
- ObviousScience 12y ago
  The thing is, I can smear $5M across say 5 physical locations in a way I can't with actual money. With actual money, the best I could do is put $1M at each physical location. With bitcoin, I could put a portion of the key at each physical location, requiring that you break in to all 5 to get any money.
  - Mosteran 12y ago
    And also meaning that if you lose any one of the 5, you'll lose all your money.
- IkmoIkmo 12y ago
  It's trivially easy to secure bitcoin, it's just data after all, a private key, one you could write on a dollar bill if you wanted and secure no different from a dollar bill. The difference is securing bitcoins in high-risk environments: live automated servers. But that only goes for a small minority of bitcoins as only about 0.5% of bitcoins are traded on a daily basis, the rest can be in what is called cold-storage which is way, way easier to secure than a bunch of physical money, gold, diamonds, whatever. The 0.5% is a bit like the security of wallets in people's pockets: not very good and not comparable to bank-grade security of those same people's savings in a bank. Or comparable to lone ATMs which can be raided. Beyond that, bitcoins exist on an open ledger. While it may be hard to trace that now, we're seeing blockchain analysis tools develop all the time. Who knows what they might uncover later? I certainly wouldn't be excited as a criminal to leave a permanently recorded trace of every single transaction ever since the moment of the theft, with the prospect of decades of cheap supercomputers doing analysis of this open source data set which might reveal yourself. Bitcoin is great for pseudo-anonymity when buying por n online, but it probably won't stand the test of time in protecting you from every criminal investigation, a bit like a randomly generated pseudonymous email address gives a large extent of privacy, but not if you're a criminal.
polarix 12y ago
To me this marks a turning point in the maturity of bitcoin - major breaches may still be a cost of doing business, but end users can finally hope for some limited insulation from such failures.
- polarix 12y ago
  This was perhaps too optimistic: time will tell.
- IkmoIkmo 12y ago
  Perhaps not this particular event, but definitely this period was a turning point. Multi-sig is a great example. Here's a chart on the amount of bitcoin stored in multi-sig addresses: http://p2sh.info/p2sh-ratio http://p2sh.info/p2sh-ratio Nine months ago it was sub 0.1%. Three months ago it was sub 1%. Today it's over 6% and growing rapidly. Multi-signature is just one example of potentially radically improved security versus the single key methods we had before. We've also seen in the past 6 months 3 companies come out with proper insurance. Circle, Xapo, Coinbase. All at a sub 1% cost. (Coinbase and Circle free, Xapo I think 0.12% annually). Combined with multi-sig vault products from Coinbase, which has done a lot of interesting security stuff. (the basic 2fa stuff of course, but I think also things like finterprinting devices to detect stolen credentials from users.) And with that, we're also seeing enterprise-products come out which offer bitcoin management in a secure way. I wouldn't be surprised if such a company like BitGo starts marketing insured warm wallets to exchanges on a percentage cost basis, and let exchanges offer users to pay for the option of this insurance. And we've seen more steps taken regarding the bitcoin ETF on the NASDAQ, which settles manually twice a day and allows (industrial) trading and liquidity but gets rid of the issue that Bitstamp and everyone else has: running a warm wallet on a server that automates transactions. The vast majority of Bitstamp's coins were in cold storage, but if you want to run automated transactions you can't do it on cold storage. So this period has definitely been a turning point I think. Will be interesting to see things develop the next few years.
joeyspn 12y ago
He doesn't say in the post that they have ditched the previous PHP site in favour of Django/Python... Lesson learned? xD http://oi60.tinypic.com/20sj3b9.jpg http://oi60.tinypic.com/20sj3b9.jpg PS: Still wondering why they use Apache instead of Nginx which is more efficient/robust/secure
- unabridged 12y ago
  I'm wondering why you used tinypic instead of imgur.
- jerguismi 12y ago
  They have always been django/python and have never used PHP, please don't spread this kind of bullshit (unless you have solid facts to back it up. I remember checking the setup in 2012 and it was already django back then).
  - joeyspn 12y ago
    Ooops, I didn't know that. I guess I rely too much on wappalyzer (which showed PHP). Sorry for the confussion...
Animats 12y ago
The real question is whether Bitstamp is now insolvent. They lost $5 million. Did they get new funding to replace that, have enough capital of their own, or are they dipping into customer funds? Their statements have carefully avoided mentioning this issue. If a real stockbroker lost funds like that, and became insolvent (debts > assets), they would have to stop operations immediately. In some jurisdictions it is a felony for a broker to continue to accept funds once insolvent. They don't get to "fix it later". That's because, historically, the temptation to fix it by speculating with customer funds has been a big problem. Bitstamp now needs a full audit by an outside auditing firm.
- deleted 12y ago
  [deleted]
  - carbocation 12y ago
    That doesn't formally answer the question, though the fact that they will respect all withdrawals does suggest that they are unlikely to be insolvent. For example, they could be insolvent but allow withdrawals up to the last 19k bitcoins. I don't mean to suggest that they are not solvent; I am only pointing out that the language doesn't seem to perfectly answer the question.
  - hundt 12y ago
    As I read it, that's a promise to users, not a statement about their balance sheet. It does not preclude the situation 'Animats is talking about, where they currently have less BTC than they credit their customers with, but they plan to make it up somehow before it becomes a problem.
  - sillysaurus3 12y ago
    I appreciate that Bitstamp made a statement, but anyone who trusts this is a complete fool. Trusting Mt. Gox was precisely how I lost money in its demise. I was also called a complete fool by someone on HN just before I lost my money. The comment made me angry. Me, a fool? Yet it was true, and I should have listened. Run away, don't walk. They lost 5 million dollars. Let that sink in before deciding to trust them with any money you care about. 5 million dollars is about the same as a Series A round. They lost the equivalent of an entire company of programmers. You could employ 50 programmers for one year with that amount of cash. And it was precisely your money that they lost. For all you know, this could now be a game of "musical chairs" where the last person to withdraw money from bitstamp will be left wanting. Don't let that be you. Guard yourself. By the way, Mt. Gox lied through their teeth to me, all the way up until their service shut off. Leading up to the disaster, I was in constant communication with their support staff, and they were very reassuring. "No, of course no one will lose money. Withdraws will reopen soon." Too bad the support people were themselves being lied to by Mt. Gox management. So, no, a statement by a bitcoin service isn't worth the weight of the paper it's printed on. EDIT: It's distressing that HN downvoted the parent comment to the point where they felt like deleting it. Please try to downvote less in general. The parent comment was simply relaying Bitstamp's statement.
qznc 12y ago
Nice, they gave me good odds on fairlay. Betting 0.001BTC on 3.5 odds did not earn me much money, but It made Bitstamp drama more thrilling. :)
moe 12y ago
Is the address of the stolen wallet known? It would be interesting to watch where that money is moving and how the thief goes about anonymising it.
- FatalLogic 12y ago
  Yes, it's trackable, subject to the pseudonymous limitations and opportunities for obfuscation inherent in blockchain technology. http://blog.cryptocrumb.com/2015/01/bitstamp-theft-bitcoins-being-spent.html http://blog.cryptocrumb.com/2015/01/bitstamp-theft-bitcoins-... BTW, in that title, the word 'spent' is used in the formal sense for blockchain transactions. It doesn't mean the money is gone or ''used up'. It really just means 'moved'. After reading that, it looks like the person who stole this money is actually panicking and making a lot of dangerous mistakes. I guess they are in a state that's between terror and ecstasy. I doubt they had any sleep recently, and they're going to be looking over their shoulder for a very long time.

84 points by jvoorhis 12y ago

> On January 4th, some of Bitstamp’s operational wallets were compromised, resulting in a loss of less than 19,000 BTC. That's a nice way of saying "we're out five and a half million USD"...

rnhmjoj 12y ago
The "less than" is ridiculous.
- sneak 12y ago
  It's relative. The loss is a single-digit percentage of total bitcoin deposits held by Bitstamp. They're eating it.
joeyspn 12y ago
Apparently they were the ones moving the famous transaction of 200k bitcoins. So, yes, for them this breach could look like: "Meh, we've lost some pennies". http://www.coindesk.com/194993-btc-transaction-147m-mystery-and-speculation/ http://www.coindesk.com/194993-btc-transaction-147m-mystery-...
- martinko 12y ago
  Those are all (vast majority) client funds. 5 million is coming out of their pocket.
  - jerguismi 12y ago
    Who knows if it comes from their own pocket, or from the customer funds? It is just their internal accounting in the end. The same way the banks work.
carbocation 12y ago
I think it is phrased that way to set an upper bound without being overly precise.

im2w1l 12y ago

Wow they have multi-sig support now, that is pretty amazing. Would easily be worthy of its own article in other circumstances. If I understand it correctly it means money can not be withdrawn without both the account holder and bitstamp signing the transaction. This means that neither can the money be stolen by hackers, nor could bitstamp run off with it. There are actually some bitcoins in the real blockchain "with your name on it", as opposed to you just having a claim on bitstamp.

zaroth 12y ago
How would they turn on such a feature without each account holder generating keys specifically for those TxOuts and moving the funds into appropriate P2SH addresses? It sounds more like, it means it's possible given the necessary end-user configuration to enable multi-sig, not that all coins are already benefitting from that level of protection.
goldmouth 12y ago
Multi-sig transactions work as you describe but many darknet markets have had that option for some time. It's actually recommended you use multi-sig for every darknet purchase.
jvoorhis 12y ago
Not necessarily. Bitgo uses a 2-of-3 scheme, where they provide retail account holders with a primary key, and a backup key. In the usual flow, you and Bitgo sign a transaction. If you need to recover, you can use your backup key. Source: I am a Bitgo retail customer, but I don't have access to an enterprise account and cannot comment on their Bitstamp integration.
nadaviv 12y ago
I doubt that. Having the funds jointly controlled by the exchange and the user, and outside the full control of the exchange, would require each fund transfer to be represented as a transaction on the Bitcoin network, which is simply impossible - the volume of transactions on an exchange is a few magnitudes larger than what Bitcoin can currently handle. To keep up with that volume, exchanges must use an internal off-chain accounting system, which precludes the use of multi-signature (or any other smart contract based on Bitcoin scripting). In addition, this would require the user to be online and actively sign transactions when a matching order is found. I think that they most likely meant that they're using multisig internally to protect their funds, in a setup where all the keys are controlled by them.

zaroth 12y ago

Have they figured out how the attackers got in? Have they competed the forensic analysis to determine they can't get back in through the same or similar vectors? There's nothing really here about what happened or how they have mitigated it. Perhaps it's too early and they don't really know, but then isn't going back live fairly risky? Aside from a persistent firmware threat, which has nothing to do with the attack vector, I don't see why "yay we're on AWS now" is any different unless they know the compromise was due to a specific piece of infra which is no longer present. Isn't it much more likely to be a bug in their software logic which would certainly not be fixed by restoring a backup...

sneak 12y ago
I'm managing the incident response. The investigation continues in parallel. First priority was safety, which meant shutting everything down to prevent any additional issues or destruction of evidence. Second was giving people the ability to access their funds and to trade - a complete redeploy of the infrastructure which took us working 22/7 since Monday until just now. An investigation is underway and we have some internal speculation from the first bits of information - the real statements will come after we aren't guessing. This is the first minute we've had to breathe this week.
- im2w1l 12y ago
  So eh, are you sure they couldn't get back in?
  - sneak 12y ago
    Yes.
- andyrj 12y ago
  This is obviously the second stage of NORK's sophisticated cyber attacks.
- IkmoIkmo 12y ago
  Could you talk a little about how you covered the first priority, safety? A restart on a fresh server doesn't really inspire the notion that whatever exploit they used can't be used again? i.e. why did you decide to restart when you haven't determined what caused the safety issue?

EvanDotPro 12y ago

> We can assure customers that any bitcoins held with us prior to temporary suspension of services on January 5th at 9am UTC are completely safe and will be fully honored. I, for one, am glad to see a Bitcoin story turn out with a somewhat positive outcome, at least from the users' perspective. That said, the article says a breach resulted in the loss of ~19,000 BTC, or around $5.6 million. If they're honoring all user funds, does that mean they are just eating that loss out of their own profits, and perhaps try to file an insurance claim? Or were they actually responsible enough to set enough profits aside in cold storage self-insure the total amount floating in the "hot" wallets? On that note, I wonder if profits and hot wallet demands scale proportionately or not, or if their margins are just at a scale where this is a non-issue?

sneak 12y ago
> does that mean they are just eating that loss out of their own profits, Yup.
- jacquesm 12y ago
  So you are essentially claiming a profit to date >> $5.6M. There will be lots of parties interested in that information.
  - VienneseCPA 12y ago
    Doesn't just have to be retained earnings from past profitability, it could also be investor cash that would presumably be recuperated with future profitability.
  - martinko 12y ago
    It is probably much higher. If we take a conservative estimate of 10k btc traded per day, on average, and a trade commission of 0.008% (0.004 two ways), we get to $5.6m in little over half a year. Now yes, the have some operational costs etc, but they've been in business for several (?) years. tldr: back of the envelope calculations show that they must have made more in profit to-date.

kolev 12y ago

I think the conclusion from all this heists is that virtual money is much easier to steal. Next time you will see physical break-ins and so on. We've watched all those action movies where people risk their lives to get hold of $5M. Nowadays, you can do this remotely from the convenience of your home... but it will be easier for the old crooks to steal a key vs bags of cash, so, let's see how this goes forward.

ObviousScience 12y ago
The thing is, I can smear $5M across say 5 physical locations in a way I can't with actual money. With actual money, the best I could do is put $1M at each physical location. With bitcoin, I could put a portion of the key at each physical location, requiring that you break in to all 5 to get any money.
- Mosteran 12y ago
  And also meaning that if you lose any one of the 5, you'll lose all your money.
IkmoIkmo 12y ago
It's trivially easy to secure bitcoin, it's just data after all, a private key, one you could write on a dollar bill if you wanted and secure no different from a dollar bill. The difference is securing bitcoins in high-risk environments: live automated servers. But that only goes for a small minority of bitcoins as only about 0.5% of bitcoins are traded on a daily basis, the rest can be in what is called cold-storage which is way, way easier to secure than a bunch of physical money, gold, diamonds, whatever. The 0.5% is a bit like the security of wallets in people's pockets: not very good and not comparable to bank-grade security of those same people's savings in a bank. Or comparable to lone ATMs which can be raided. Beyond that, bitcoins exist on an open ledger. While it may be hard to trace that now, we're seeing blockchain analysis tools develop all the time. Who knows what they might uncover later? I certainly wouldn't be excited as a criminal to leave a permanently recorded trace of every single transaction ever since the moment of the theft, with the prospect of decades of cheap supercomputers doing analysis of this open source data set which might reveal yourself. Bitcoin is great for pseudo-anonymity when buying por n online, but it probably won't stand the test of time in protecting you from every criminal investigation, a bit like a randomly generated pseudonymous email address gives a large extent of privacy, but not if you're a criminal.

polarix 12y ago

To me this marks a turning point in the maturity of bitcoin - major breaches may still be a cost of doing business, but end users can finally hope for some limited insulation from such failures.

polarix 12y ago
This was perhaps too optimistic: time will tell.
IkmoIkmo 12y ago
Perhaps not this particular event, but definitely this period was a turning point. Multi-sig is a great example. Here's a chart on the amount of bitcoin stored in multi-sig addresses: http://p2sh.info/p2sh-ratio http://p2sh.info/p2sh-ratio Nine months ago it was sub 0.1%. Three months ago it was sub 1%. Today it's over 6% and growing rapidly. Multi-signature is just one example of potentially radically improved security versus the single key methods we had before. We've also seen in the past 6 months 3 companies come out with proper insurance. Circle, Xapo, Coinbase. All at a sub 1% cost. (Coinbase and Circle free, Xapo I think 0.12% annually). Combined with multi-sig vault products from Coinbase, which has done a lot of interesting security stuff. (the basic 2fa stuff of course, but I think also things like finterprinting devices to detect stolen credentials from users.) And with that, we're also seeing enterprise-products come out which offer bitcoin management in a secure way. I wouldn't be surprised if such a company like BitGo starts marketing insured warm wallets to exchanges on a percentage cost basis, and let exchanges offer users to pay for the option of this insurance. And we've seen more steps taken regarding the bitcoin ETF on the NASDAQ, which settles manually twice a day and allows (industrial) trading and liquidity but gets rid of the issue that Bitstamp and everyone else has: running a warm wallet on a server that automates transactions. The vast majority of Bitstamp's coins were in cold storage, but if you want to run automated transactions you can't do it on cold storage. So this period has definitely been a turning point I think. Will be interesting to see things develop the next few years.

joeyspn 12y ago

He doesn't say in the post that they have ditched the previous PHP site in favour of Django/Python... Lesson learned? xD http://oi60.tinypic.com/20sj3b9.jpg http://oi60.tinypic.com/20sj3b9.jpg PS: Still wondering why they use Apache instead of Nginx which is more efficient/robust/secure

unabridged 12y ago
I'm wondering why you used tinypic instead of imgur.
jerguismi 12y ago
They have always been django/python and have never used PHP, please don't spread this kind of bullshit (unless you have solid facts to back it up. I remember checking the setup in 2012 and it was already django back then).
- joeyspn 12y ago
  Ooops, I didn't know that. I guess I rely too much on wappalyzer (which showed PHP). Sorry for the confussion...

Animats 12y ago

The real question is whether Bitstamp is now insolvent. They lost $5 million. Did they get new funding to replace that, have enough capital of their own, or are they dipping into customer funds? Their statements have carefully avoided mentioning this issue. If a real stockbroker lost funds like that, and became insolvent (debts > assets), they would have to stop operations immediately. In some jurisdictions it is a felony for a broker to continue to accept funds once insolvent. They don't get to "fix it later". That's because, historically, the temptation to fix it by speculating with customer funds has been a big problem. Bitstamp now needs a full audit by an outside auditing firm.

deleted 12y ago
[deleted]
- carbocation 12y ago
  That doesn't formally answer the question, though the fact that they will respect all withdrawals does suggest that they are unlikely to be insolvent. For example, they could be insolvent but allow withdrawals up to the last 19k bitcoins. I don't mean to suggest that they are not solvent; I am only pointing out that the language doesn't seem to perfectly answer the question.
- hundt 12y ago
  As I read it, that's a promise to users, not a statement about their balance sheet. It does not preclude the situation 'Animats is talking about, where they currently have less BTC than they credit their customers with, but they plan to make it up somehow before it becomes a problem.
- sillysaurus3 12y ago
  I appreciate that Bitstamp made a statement, but anyone who trusts this is a complete fool. Trusting Mt. Gox was precisely how I lost money in its demise. I was also called a complete fool by someone on HN just before I lost my money. The comment made me angry. Me, a fool? Yet it was true, and I should have listened. Run away, don't walk. They lost 5 million dollars. Let that sink in before deciding to trust them with any money you care about. 5 million dollars is about the same as a Series A round. They lost the equivalent of an entire company of programmers. You could employ 50 programmers for one year with that amount of cash. And it was precisely your money that they lost. For all you know, this could now be a game of "musical chairs" where the last person to withdraw money from bitstamp will be left wanting. Don't let that be you. Guard yourself. By the way, Mt. Gox lied through their teeth to me, all the way up until their service shut off. Leading up to the disaster, I was in constant communication with their support staff, and they were very reassuring. "No, of course no one will lose money. Withdraws will reopen soon." Too bad the support people were themselves being lied to by Mt. Gox management. So, no, a statement by a bitcoin service isn't worth the weight of the paper it's printed on. EDIT: It's distressing that HN downvoted the parent comment to the point where they felt like deleting it. Please try to downvote less in general. The parent comment was simply relaying Bitstamp's statement.

qznc 12y ago

Nice, they gave me good odds on fairlay. Betting 0.001BTC on 3.5 odds did not earn me much money, but It made Bitstamp drama more thrilling. :)

moe 12y ago

Is the address of the stolen wallet known? It would be interesting to watch where that money is moving and how the thief goes about anonymising it.

FatalLogic 12y ago
Yes, it's trackable, subject to the pseudonymous limitations and opportunities for obfuscation inherent in blockchain technology. http://blog.cryptocrumb.com/2015/01/bitstamp-theft-bitcoins-being-spent.html http://blog.cryptocrumb.com/2015/01/bitstamp-theft-bitcoins-... BTW, in that title, the word 'spent' is used in the formal sense for blockchain transactions. It doesn't mean the money is gone or ''used up'. It really just means 'moved'. After reading that, it looks like the person who stole this money is actually panicking and making a lot of dangerous mistakes. I guess they are in a state that's between terror and ecstasy. I doubt they had any sleep recently, and they're going to be looking over their shoulder for a very long time.