7 ms·

Excoin exchange's Bitcoins stolen, will be shutting down

125 points by dewey 12y ago

th0br0 12y ago
"Excoin is still under DDOS attack which makes it very difficult to investigate the causes of these issues." This makes little sense to me.
- dublinben 12y ago
  It sounds like they have no physical access to their infrastructure, and cannot remove it from the network.
  - panhandlr 12y ago
    ... running a financial institution on servers you don't have physical access to, What is the worse that could happen? Isn't physical access security like OpSec 101?
    - ExpiredLink 12y ago
      Maybe it's all in the Cloud?
    - detaro 12y ago
      Yeah, but mostly focused on keeping bad guys out, not making sure the good guys can get in. (E.g. hving your servers in someone elses data center is probably more secure than trying to secure them physically in a startups office, but means getting to them is harder for you as well)
      - GoodIntentions 12y ago
        I could see an argument for colocating this type of enterprise in a secure data centre. There are places with 24/7 surveillance and 24/7 armed staff on site and they are going to do the security better than your average group of startup guys.
  - q3k 12y ago
    You don't have to have physical access to do this. Just reconfigure your network infrastructure. But yeah, they're probably using The Cloud, because that's web scale.
    - icebraining 12y ago
      Even in The Cloud, I'm struggling to see the problem. If it was running on, say, Digital Ocean, I'd just stop the instance, create a snapshot and then launch a new instance from that snapshot (and with a new IP). I'm sure other clouds have similar tools.
      - dogma1138 12y ago
        Not sure where they host, but they might host it in some shady datacentre which is located in a completely different region than they are with no OOB access to it other than the public IP interfaces which is bad to begin with, but not that uncommon.
- jakejake 12y ago
  I thought that sounded weird to me too, I could only guess that they're trying to keep their service online while they fix it - which is insane at this point.
akerl_ 12y ago
"We noticed the hot wallets dwindling but assuming it was members moving their funds off site during the DDOS, we loaded all the cold balances onto the site" I'm a bit shocked that their tracking of their transactions was so easily broken as to prevent them from seeing that all the funds were being pulled by so few users. Also, the part at the bottom where they basically post a wall of IPs and addresses seems like a weird way to move forward. Do they not plan on there being an official investigation?
- panhandlr 12y ago
  "Do they not plan on there being an official investigation?" How do you officially investigate someone stealing your monopoly money? Where is the FDIC insurance? Exactly what are they suppose to tell the police? The FBI? ... oh thats right, nothing, because they are not a bank, and the only thing "stolen" was some ones and zeroes off a hard-drive. Seriously though... where is the police report on this? Or any of the other hacked bitcoin exchanges for that matter?
  - akerl_ 12y ago
    It doesn't matter if you're storing bitcoins or roflcoins or pictures of kittens: in most places, maliciously accessing somebody else's computer system and stealing data is a crime. The government investigates stolen "ones and zeros" all the time. The FDIC provides protection for users, but the lack of FDIC doesn't mean that no laws apply.
    - panhandlr 12y ago
      What about the laws the operators of the exchange broke by running un-audited code to handle financial transactions?
      - akerl_ 12y ago
        Assuming such laws apply to them, and assuming they broke them, "so?". Their guilt or innocence does not have any connection with any investigation of somebody hacking into their systems.
cordite 12y ago
Seems like whoever writes financial code in the future should treat it more like NASA code than startup technical-debt code.
- ryan-allen 12y ago
  This is true if you intend on running an exchange properly and not being a highway robber posing as a travelling dentist.
  - panhandlr 12y ago
    Exactly... From my perspective, their plan worked perfectly. 1. Open an exchange. 2. Collect real money in exchange for fake money. 3. "Get hacked" losing all the fake money and keeping all the real money.
    - im2w1l 12y ago
      Yeah, "We noticed the hot wallets dwindling but assuming it was members moving their funds off site during the DDOS, we loaded all the cold balances onto the site" sounds extremely suspicious.
      - Mtinie 12y ago
        Possiblely, but in light of the protracted duration of the DDoS, it makes sense that people would be moving their holdings off-exchange when they could connect. If the withdrawal addresses were all different -- and from what Excoin posted on their site it looks like the party responsible used multiple BTC and NBT addresses to move the funds -- multiples of small to moderate amounts of coins being requested doesn't sound out of the question. In retrospect, it was a horrible decision not to research these transactions in depth as they happened, but the Excoin team was fighting a "bigger" fire at the time with the DDoS.
    - brighton36 12y ago
      Which one is the fake money, USD or btc?
nickysielicki 12y ago
The tinfoil hat in me has to wonder if there's some reason all these exchanges are failing so extravagantly.
- ent 12y ago
  No tinfoil needed for the explanation: they're pretty fat targets with code security at the level of normal startups. It would be interesting to see how much they get targetted in comparison to startups that can at most spill some personal user info and cc numbers.
  - detaro 12y ago
    They even proudly announced that it was build "Built on Golang from the ground up." http://www.reddit.com/r/Bitcoin/comments/2loray/a_new_bitcoin_exchange_has_opened_up_excoin_is/ http://www.reddit.com/r/Bitcoin/comments/2loray/a_new_bitcoi...
    - juliangregorian 12y ago
      Is Go a particularly safe language (moreso than, say Python or Java)?
      - _wdh 12y ago
        The language itself is probably fine but the fact that they are starting from scratch with what appears to be no input from security or financial professionals is a clear sign that there will be security holes
- Johnie 12y ago
  Yeah, people without experience writing secure financial code and not understanding financial risk management are opening bitcoin exchanges. Even the way they handled this breach is amateur hour. From the post, it doesn't look like they've involved any authorities or sought out legal counsel to protect themselves. Imagine if your citibank or chase account doing this. People would be in an uproar.
jcfrei 12y ago
I wonder if this is related to the loss at http://bter.com/ http://bter.com/ ?
- Mtinie 12y ago
  Different exchanges and principals, so it's unlikely. I don't know what BTER uses on the back-end, but unless it is written in Go, I find the likelihood of a connection to be very small (due to a common vulnerability). On the other hand, if there is a shared vulnerability, it may be in a commonly used library lower in the stack. There is one possible tangential relationship, however. As I've been researching the transactions, early indications point to a portion of the stolen BTC and NBT from Excoin being placed on BTER prior to BTER's announcement. If this is the case, the parties responsble for the Excoin theft may have inadvertently deposited their coins into an exchange that was subsequently pillaged... (Disclosure: I'm a member of the Nu development team, so Excoin's and BTER's exchange problems affect our community)
rayiner 12y ago
I don't see the outrage over this. Bitcoins are just sequences of ones and zeros. How can anyone "own" information? And how do you "steal" a bitcoin? Doesn't the exchange still have its copy of the bits?
- deleted 12y ago
  [deleted]
- sp332 12y ago
  Bitcoins are not sequences of bits. There is a global blockchain that keeps track of transactions in the network. Each block contains transactions. Since a transaction is the fundamental unit, if you want to know the balance of a particular address, you have to look at every transaction since the beginning of time and add up all the ones that involve that address. You can't just edit the books to say that an address has more or less money. And to add a new transaction to the chain, whoever has the private key for the originating address has to sign the transaction, then the transaction is checked by a miner and added to the global chain. So to get the money back, you would have to get the private key for the address where it all ended up. Our have the owners of the majority of mining power commit fraud on your behalf, that could work too.
  - mlvljr 12y ago
    So what was stolen, exactly?
    - vertex-four 12y ago
      Somebody managed to trick the exchange into signing a message saying "move this amount of money from this address to this other address" (signed by the private key associated with the first address, with the second address being owned by the attacker) and submitting it to be added to the blockchain by a miner. The blockchain is the only record of who owns what money, and transactions on it can't be reverted. Therefore, the attacker stole money by causing a transaction that shouldn't have happened.
    - sp332 12y ago
JSno 12y ago
using women coder to write/lead team to write critical code. This is the result.
yc1010 12y ago
1. Create exchange 2. Realize its not going anywhere 3. Close citing a hack 4. Profit! go laughing all the way to the bank with the "stolen" ahem ahem bitcoins
- smoyer 12y ago
  I was thinking of that old Slashdot trope too ... someone has finally filled in the step(s) before profit!
  - yc1010 12y ago
    I must be onto something true since my earlier comment got downvoted to -2 As a bitcoiner who uses bitcoin daily its sad seeing this happen
  - letstryagain 12y ago
    It's not a slashdot trope - it's from South Park - Underpants Gnomes 1) Collect underpants 2) ... 3) Profit http://upload.wikimedia.org/wikipedia/en/d/dd/Gnomes_plan.png http://upload.wikimedia.org/wikipedia/en/d/dd/Gnomes_plan.pn...
ogig 12y ago
"...We fixed the caching issues with the trades and moved forward" Caching trade info sound like a bad idea. Atomic and transactional operations directly to the ledger so integrity is easier to achieve sounds like the way to go. A caching layer gives basically speed at the cost of simplicity, not sure if I'd like that when running a btc exchange. Am i wrong? Of course we don't know the exact nature of those "caching issues" so my comment is highly especulative regarding the nature of that cache.
jimrandomh 12y ago
> Users are now able to withdraw their remaining funds from Exco.in with new deposits having been disabled. If you have any issues withdrawing, please contact support we will assist you as soon as possible. In case the administrators of exco.in happen to be reading this - You fools, what the hell are you doing leaving automated withdrawals turned on after you know you've been hacked? That'll just lose you even more money. The first thing you need to do is get the coins, databases and log files into secure offline storage. The second thing you need to do is get qualified professionals to investigate. Only after the investigation is complete can you safely return funds.
- toomuchtodo 12y ago
  > The first thing you need to do is get the coins, databases and log files into secure offline storage. All logging and auditing data should be sent in real time to a write once medium, whether that's an S3 account with append (no overwrite/delete permissions) access, local DVD/Bluray, or even a dotmatrix printer if your volume is low enough.
puranjay 12y ago
I swear Dick Cheney could run for President right now and have more credibility than any Bitcoin exchange. I know there are a lot of BTC champions here, but as a former investor, the writing is on the wall: BTC is dead. The coin will die, the concept will live on. Which was Bitcoin's true power anyway.
- kleer001 12y ago
  What other predictions do you have about the financial world? I bet you could make a mint!
- grubles 12y ago
  People can whine all day long about exchanges being hacked but until there is a significant vulnerability within bitcoin itself, it isn't dead. If you were around when everyone was excited about the technology of bitcoin and not excited about making "mad profitz", this would be clear.
- paulhauggis 12y ago
  It's not dead, but it does show the reasons why we have centralized banks: User trust and security through regulation. Before we had this, banks were robbed all the time..just like the Bitcoin exchanges. The only reason the government hasn't completely regulated it yet, is because the average person it's investing in it.
x0n 12y ago
"We noticed the hot wallets dwindling but assuming it was members moving their funds off site during the DDOS, we loaded all the cold balances onto the site so that users would not have withdrawals interrupted during our periods of up time.This fatal mistake allowed Ambiorx to continue to drain the site." -- World's stupidest bitcoin exchange admins, or some of the ballsiest? Inside job?
- Lazare 12y ago
  I wonder if any Excoin admins could explain why hot wallets and cold storage exist? "World's stupidest bitcoin exchange admins, or some of the ballsiest? Inside job?" That's always the question, isn't it?
- bhouston 12y ago
  One person on the inside to convince the team too do these stupid moves seems reasonabke but some people are dumb, so who knows.
- Animats 12y ago
  As I pointed out the previous three times this happened to a Bitcoin exchange, these operators seem to be totally clueless about basic bookkeeping and financial controls. Consider a typical large supermarket. Cash, credit cards, coupons, and merchandise are being handled. There are multiple cashiers, usually more than one shift of staff, cash drawers, safes, cash pickups from an armored car service. That's a lot going on. If there's a $10 bill missing, it will noticed within hours. Where it went will probably be figured out the same day. If someone is stealing, management will usually find out who, how much, and when. The Bitcoin crowd has a much simpler problem. They're all online, they don't have a staff of people handling money, and they don't have as many special cases as a supermarket does. (Travelers checks, returns, check cashing, etc - Bitcoin exchanges don't have to deal with that.) Most Bitcoin exchanges are doing a few transactions a minute. Bigger supermarkets do more than that. Yet the Bitcoin crowd consistently botches it. The Bitcoin crowd needs to get some people who have passed Internal Financial Controls 101 at a 2-year business college.[1] This isn't rocket science. [1] http://www.georgiacenter.uga.edu/courses/governmental-training/internal-controls-payable http://www.georgiacenter.uga.edu/courses/governmental-traini...
whizzkid 12y ago
I am now comparing the bitcoin holders to regular banks' online systems in my mind and I wonder why bitcoin systems are constantly getting hacked while regular banks' are functioning properly. I am not really sure which one of these reasons are true; - Code that is written for bitcoin banking is fairly new comparing the real banks' code which contains lots of vulnerabilities. - These guys hold huge amount of money from other people which becomes very tempting so that some insiders decide to take it and make it look like they are hacked - Law enforcements are not as high as comparing to stealing dollars to bitcoins which makes hackers to focus on bitcoin. Not really sure and i am really not an expert on bitcoin systems, i just wonder.
- atmosx 12y ago
  http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html?_r=0 http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-m...
- icebraining 12y ago
  Are banks functioning properly? Just today we heard that online attackers stole hundreds of millions of dollars from them.
  - whizzkid 12y ago
    That is true actually, I guess I meant i don't see for example HSBC(just an example) shutting whole company down because of they are getting hacked while bitcoin systems are are either on or off, isn't it?
    - skybrian 12y ago
      Most bank transactions are reversible. ATM withdrawals aren't, but they have limits. Lots of attacks use ATMs so it's not enough to shut down a bank.
  - glesica 12y ago
    But how many depositors lost money because of that? My guess is zero.
smoyer 12y ago
"I will be resigning from Blackwave Labs and looking for regular full time employment to help pay back the lost funds. I will also ask drunkonsound to help cover my loses with Blackwave Labs holdings as well." They may not have been good at security but I still have to admire someone who is willing to take responsibility for their mistakes. Where's Mark Karpeles?
- Johnie 12y ago
  This guy needs to get a lawyer immediately. He's extremely naive in thinking he can 'fix' this. In addition, he's exposing his personal asset and future liability to all of these creditors. As I said, amateur hour.
  - SuddsMcDuff 12y ago
    It's a woman
sek 12y ago
I think a trustworthy Bitcoin exchange requires the software development capabilities/requirements similar to a real bank. The amount of money at stake is probably not he same, but the anonymity of Bitcoin makes up for attractiveness as a target. AFAIK most smaller banks use third party software/services. Maybe there is a need for a bitcoin exchange software provider that takes care of the critical parts and you build your interface/business on top.
AshleysBrain 12y ago
From the announcement: "during the DDOS two separate trades spiraled out of control either due to a bug or an exploit and transferred a very large number of small Bitcoin transactions to Ambiorx's account." Note "either due to a bug or an exploit". Then: "Ambiorx used the fraudulently obtained Bitcoins..." If the cause was a bug in your own code, that's not fraudulent is it? Isn't that the exchange's fault? That line seems to assume exploitation, when they already said it was possible it was a bug.
- dogma1138 12y ago
  If tomorrow you wake up and find 10000000$ in your account and then go on a spending rampage what do you think will happen? The bank will notice it, revoke the funds and then at best you will end up with a pile of debt and at worse will be charged with some financial fraud or another. It's time that exchanges will develop the ability to reverse bitcoin transactions by extending the chain or by building their own transaction protocol on top of the current BTC chain. It's also about time that these establishments will get some private insurance if they want to play around as they were some private banks for oligarchs which are not tied directly to the central bank or insured by it. With how BTC transactions work in general, and how exchanges seem to operate these days im amazed that people still use them.
  - jamestnz 12y ago
    >If tomorrow you wake up and find 10000000$ in your account and then go on a spending rampage what do you think will happen? Something pretty similar to this happened here in NZ in recent years. A couple who ran a BP franchise had applied to a bank for a $100k line of credit. They were accidentally given $10m instead. They decided to rapidly transfer the money offshore, where they then fled. The woman eventually returned voluntarily, the man was extradited. He received jail, she a home detention sentence and reparation. http://www.stuff.co.nz/national/crime/2428243/Couple-missing-after-10m-bank-bungle http://www.stuff.co.nz/national/crime/2428243/Couple-missing... Sentencing: http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10829144 http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objecti...
photorized 12y ago
Does anyone have an estimate of their volume, or how much was 'lost'?
- jakejake 12y ago
  The site has only been open for 3 months and looking around at some forum posts it seems to not have ramped up yet to a huge amount of users. I have no idea but I'm gonna guess low 5 figures.
- nextw33k 12y ago
  28th Dec: "Exco.in surpassed 60 BTC 24H Volume" https://blackwavelabs.com/ https://blackwavelabs.com/ It seems to have happened over a 5 day period. So a back of the packet calculation: 60 x 230 * 5 = $69,000 Of course that doesn't tell us anything about if people had larger amounts stored, just that the hot wallet should have contained around that amount before they needed to refill it.
cbeach 12y ago
As long as centralised Bitcoin exchanges exist, this will happen. It's why I built CoinTouch, which finds friends of friends that trade Bitcoins (FB / G+). Post buy/sell orders, priced at a spread to market rates: https://www.cointouch.com/ https://www.cointouch.com/
dredmorbius 12y ago
Of that IP set: Host ASN CIDR 104.131.204.15 62567 104.131.192.0/19 104.131.213.10 62567 104.131.192.0/19 104.154.38.52 15169 104.154.0.0/15 107.170.150.138 62567 107.170.128.0/19 130.211.185.192 15169 130.211.0.0/16 146.148.40.57 15169 146.148.0.0/17 172.245.55.112 55286 172.245.48.0/21 184.172.15.235 36351 184.172.0.0/18 50.97.173.18 36351 50.97.128.0/18 5.255.253.51 13238 5.255.253.0/24 66.249.69.136 15169 66.249.69.0/24 66.249.69.88 15169 66.249.69.0/24 66.249.75.104 15169 66.249.75.0/24 66.249.75.184 15169 66.249.75.0/24 66.249.75.216 15169 66.249.75.0/24 66.249.75.88 15169 66.249.75.0/24 66.249.79.111 15169 66.249.79.0/24 66.249.79.119 15169 66.249.79.0/24 66.249.79.127 15169 66.249.79.0/24 66.249.79.135 15169 66.249.79.0/24 66.249.79.4 15169 66.249.79.0/24 Distinct ASNs: 14 15169 GOOGLE 3 62567 DIGITALOCEAN-ASN-NY2 2 36351 SOFTLAYER 1 13238 Yandex 1 55286 SERVER-MANIA So ... yeah, these jokers got themselved "DoS'd" by a couple of search engines and couldn't even figure that out. But they might want to look at Digital Ocean, SoftLayer, and ServerMania. Or figure out where the traffic was actually coming from.

125 points by dewey 12y ago

"Excoin is still under DDOS attack which makes it very difficult to investigate the causes of these issues." This makes little sense to me.

dublinben 12y ago
It sounds like they have no physical access to their infrastructure, and cannot remove it from the network.
- panhandlr 12y ago
  ... running a financial institution on servers you don't have physical access to, What is the worse that could happen? Isn't physical access security like OpSec 101?
  - ExpiredLink 12y ago
    Maybe it's all in the Cloud?
  - detaro 12y ago
    Yeah, but mostly focused on keeping bad guys out, not making sure the good guys can get in. (E.g. hving your servers in someone elses data center is probably more secure than trying to secure them physically in a startups office, but means getting to them is harder for you as well)
    - GoodIntentions 12y ago
      I could see an argument for colocating this type of enterprise in a secure data centre. There are places with 24/7 surveillance and 24/7 armed staff on site and they are going to do the security better than your average group of startup guys.
- q3k 12y ago
  You don't have to have physical access to do this. Just reconfigure your network infrastructure. But yeah, they're probably using The Cloud, because that's web scale.
  - icebraining 12y ago
    Even in The Cloud, I'm struggling to see the problem. If it was running on, say, Digital Ocean, I'd just stop the instance, create a snapshot and then launch a new instance from that snapshot (and with a new IP). I'm sure other clouds have similar tools.
    - dogma1138 12y ago
      Not sure where they host, but they might host it in some shady datacentre which is located in a completely different region than they are with no OOB access to it other than the public IP interfaces which is bad to begin with, but not that uncommon.
jakejake 12y ago
I thought that sounded weird to me too, I could only guess that they're trying to keep their service online while they fix it - which is insane at this point.

akerl_ 12y ago

"We noticed the hot wallets dwindling but assuming it was members moving their funds off site during the DDOS, we loaded all the cold balances onto the site" I'm a bit shocked that their tracking of their transactions was so easily broken as to prevent them from seeing that all the funds were being pulled by so few users. Also, the part at the bottom where they basically post a wall of IPs and addresses seems like a weird way to move forward. Do they not plan on there being an official investigation?

panhandlr 12y ago
"Do they not plan on there being an official investigation?" How do you officially investigate someone stealing your monopoly money? Where is the FDIC insurance? Exactly what are they suppose to tell the police? The FBI? ... oh thats right, nothing, because they are not a bank, and the only thing "stolen" was some ones and zeroes off a hard-drive. Seriously though... where is the police report on this? Or any of the other hacked bitcoin exchanges for that matter?
- akerl_ 12y ago
  It doesn't matter if you're storing bitcoins or roflcoins or pictures of kittens: in most places, maliciously accessing somebody else's computer system and stealing data is a crime. The government investigates stolen "ones and zeros" all the time. The FDIC provides protection for users, but the lack of FDIC doesn't mean that no laws apply.
  - panhandlr 12y ago
    What about the laws the operators of the exchange broke by running un-audited code to handle financial transactions?
    - akerl_ 12y ago
      Assuming such laws apply to them, and assuming they broke them, "so?". Their guilt or innocence does not have any connection with any investigation of somebody hacking into their systems.

cordite 12y ago

Seems like whoever writes financial code in the future should treat it more like NASA code than startup technical-debt code.

ryan-allen 12y ago
This is true if you intend on running an exchange properly and not being a highway robber posing as a travelling dentist.
- panhandlr 12y ago
  Exactly... From my perspective, their plan worked perfectly. 1. Open an exchange. 2. Collect real money in exchange for fake money. 3. "Get hacked" losing all the fake money and keeping all the real money.
  - im2w1l 12y ago
    Yeah, "We noticed the hot wallets dwindling but assuming it was members moving their funds off site during the DDOS, we loaded all the cold balances onto the site" sounds extremely suspicious.
    - Mtinie 12y ago
      Possiblely, but in light of the protracted duration of the DDoS, it makes sense that people would be moving their holdings off-exchange when they could connect. If the withdrawal addresses were all different -- and from what Excoin posted on their site it looks like the party responsible used multiple BTC and NBT addresses to move the funds -- multiples of small to moderate amounts of coins being requested doesn't sound out of the question. In retrospect, it was a horrible decision not to research these transactions in depth as they happened, but the Excoin team was fighting a "bigger" fire at the time with the DDoS.
  - brighton36 12y ago
    Which one is the fake money, USD or btc?

nickysielicki 12y ago

The tinfoil hat in me has to wonder if there's some reason all these exchanges are failing so extravagantly.

ent 12y ago
No tinfoil needed for the explanation: they're pretty fat targets with code security at the level of normal startups. It would be interesting to see how much they get targetted in comparison to startups that can at most spill some personal user info and cc numbers.
- detaro 12y ago
  They even proudly announced that it was build "Built on Golang from the ground up." http://www.reddit.com/r/Bitcoin/comments/2loray/a_new_bitcoin_exchange_has_opened_up_excoin_is/ http://www.reddit.com/r/Bitcoin/comments/2loray/a_new_bitcoi...
  - juliangregorian 12y ago
    Is Go a particularly safe language (moreso than, say Python or Java)?
    - _wdh 12y ago
      The language itself is probably fine but the fact that they are starting from scratch with what appears to be no input from security or financial professionals is a clear sign that there will be security holes
Johnie 12y ago
Yeah, people without experience writing secure financial code and not understanding financial risk management are opening bitcoin exchanges. Even the way they handled this breach is amateur hour. From the post, it doesn't look like they've involved any authorities or sought out legal counsel to protect themselves. Imagine if your citibank or chase account doing this. People would be in an uproar.

jcfrei 12y ago

I wonder if this is related to the loss at http://bter.com/ http://bter.com/ ?

Mtinie 12y ago
Different exchanges and principals, so it's unlikely. I don't know what BTER uses on the back-end, but unless it is written in Go, I find the likelihood of a connection to be very small (due to a common vulnerability). On the other hand, if there is a shared vulnerability, it may be in a commonly used library lower in the stack. There is one possible tangential relationship, however. As I've been researching the transactions, early indications point to a portion of the stolen BTC and NBT from Excoin being placed on BTER prior to BTER's announcement. If this is the case, the parties responsble for the Excoin theft may have inadvertently deposited their coins into an exchange that was subsequently pillaged... (Disclosure: I'm a member of the Nu development team, so Excoin's and BTER's exchange problems affect our community)

rayiner 12y ago

I don't see the outrage over this. Bitcoins are just sequences of ones and zeros. How can anyone "own" information? And how do you "steal" a bitcoin? Doesn't the exchange still have its copy of the bits?

deleted 12y ago
[deleted]
sp332 12y ago
Bitcoins are not sequences of bits. There is a global blockchain that keeps track of transactions in the network. Each block contains transactions. Since a transaction is the fundamental unit, if you want to know the balance of a particular address, you have to look at every transaction since the beginning of time and add up all the ones that involve that address. You can't just edit the books to say that an address has more or less money. And to add a new transaction to the chain, whoever has the private key for the originating address has to sign the transaction, then the transaction is checked by a miner and added to the global chain. So to get the money back, you would have to get the private key for the address where it all ended up. Our have the owners of the majority of mining power commit fraud on your behalf, that could work too.
- mlvljr 12y ago
  So what was stolen, exactly?
  - vertex-four 12y ago
    Somebody managed to trick the exchange into signing a message saying "move this amount of money from this address to this other address" (signed by the private key associated with the first address, with the second address being owned by the attacker) and submitting it to be added to the blockchain by a miner. The blockchain is the only record of who owns what money, and transactions on it can't be reverted. Therefore, the attacker stole money by causing a transaction that shouldn't have happened.
  - sp332 12y ago

JSno 12y ago

using women coder to write/lead team to write critical code. This is the result.

yc1010 12y ago

1. Create exchange 2. Realize its not going anywhere 3. Close citing a hack 4. Profit! go laughing all the way to the bank with the "stolen" ahem ahem bitcoins

smoyer 12y ago
I was thinking of that old Slashdot trope too ... someone has finally filled in the step(s) before profit!
- yc1010 12y ago
  I must be onto something true since my earlier comment got downvoted to -2 As a bitcoiner who uses bitcoin daily its sad seeing this happen
- letstryagain 12y ago
  It's not a slashdot trope - it's from South Park - Underpants Gnomes 1) Collect underpants 2) ... 3) Profit http://upload.wikimedia.org/wikipedia/en/d/dd/Gnomes_plan.png http://upload.wikimedia.org/wikipedia/en/d/dd/Gnomes_plan.pn...

ogig 12y ago

"...We fixed the caching issues with the trades and moved forward" Caching trade info sound like a bad idea. Atomic and transactional operations directly to the ledger so integrity is easier to achieve sounds like the way to go. A caching layer gives basically speed at the cost of simplicity, not sure if I'd like that when running a btc exchange. Am i wrong? Of course we don't know the exact nature of those "caching issues" so my comment is highly especulative regarding the nature of that cache.

jimrandomh 12y ago

> Users are now able to withdraw their remaining funds from Exco.in with new deposits having been disabled. If you have any issues withdrawing, please contact support we will assist you as soon as possible. In case the administrators of exco.in happen to be reading this - You fools, what the hell are you doing leaving automated withdrawals turned on after you know you've been hacked? That'll just lose you even more money. The first thing you need to do is get the coins, databases and log files into secure offline storage. The second thing you need to do is get qualified professionals to investigate. Only after the investigation is complete can you safely return funds.

toomuchtodo 12y ago
> The first thing you need to do is get the coins, databases and log files into secure offline storage. All logging and auditing data should be sent in real time to a write once medium, whether that's an S3 account with append (no overwrite/delete permissions) access, local DVD/Bluray, or even a dotmatrix printer if your volume is low enough.

puranjay 12y ago

I swear Dick Cheney could run for President right now and have more credibility than any Bitcoin exchange. I know there are a lot of BTC champions here, but as a former investor, the writing is on the wall: BTC is dead. The coin will die, the concept will live on. Which was Bitcoin's true power anyway.

kleer001 12y ago
What other predictions do you have about the financial world? I bet you could make a mint!
grubles 12y ago
People can whine all day long about exchanges being hacked but until there is a significant vulnerability within bitcoin itself, it isn't dead. If you were around when everyone was excited about the technology of bitcoin and not excited about making "mad profitz", this would be clear.
paulhauggis 12y ago
It's not dead, but it does show the reasons why we have centralized banks: User trust and security through regulation. Before we had this, banks were robbed all the time..just like the Bitcoin exchanges. The only reason the government hasn't completely regulated it yet, is because the average person it's investing in it.

x0n 12y ago

"We noticed the hot wallets dwindling but assuming it was members moving their funds off site during the DDOS, we loaded all the cold balances onto the site so that users would not have withdrawals interrupted during our periods of up time.This fatal mistake allowed Ambiorx to continue to drain the site." -- World's stupidest bitcoin exchange admins, or some of the ballsiest? Inside job?

Lazare 12y ago
I wonder if any Excoin admins could explain why hot wallets and cold storage exist? "World's stupidest bitcoin exchange admins, or some of the ballsiest? Inside job?" That's always the question, isn't it?
bhouston 12y ago
One person on the inside to convince the team too do these stupid moves seems reasonabke but some people are dumb, so who knows.
Animats 12y ago
As I pointed out the previous three times this happened to a Bitcoin exchange, these operators seem to be totally clueless about basic bookkeeping and financial controls. Consider a typical large supermarket. Cash, credit cards, coupons, and merchandise are being handled. There are multiple cashiers, usually more than one shift of staff, cash drawers, safes, cash pickups from an armored car service. That's a lot going on. If there's a $10 bill missing, it will noticed within hours. Where it went will probably be figured out the same day. If someone is stealing, management will usually find out who, how much, and when. The Bitcoin crowd has a much simpler problem. They're all online, they don't have a staff of people handling money, and they don't have as many special cases as a supermarket does. (Travelers checks, returns, check cashing, etc - Bitcoin exchanges don't have to deal with that.) Most Bitcoin exchanges are doing a few transactions a minute. Bigger supermarkets do more than that. Yet the Bitcoin crowd consistently botches it. The Bitcoin crowd needs to get some people who have passed Internal Financial Controls 101 at a 2-year business college.[1] This isn't rocket science. [1] http://www.georgiacenter.uga.edu/courses/governmental-training/internal-controls-payable http://www.georgiacenter.uga.edu/courses/governmental-traini...

whizzkid 12y ago

I am now comparing the bitcoin holders to regular banks' online systems in my mind and I wonder why bitcoin systems are constantly getting hacked while regular banks' are functioning properly. I am not really sure which one of these reasons are true; - Code that is written for bitcoin banking is fairly new comparing the real banks' code which contains lots of vulnerabilities. - These guys hold huge amount of money from other people which becomes very tempting so that some insiders decide to take it and make it look like they are hacked - Law enforcements are not as high as comparing to stealing dollars to bitcoins which makes hackers to focus on bitcoin. Not really sure and i am really not an expert on bitcoin systems, i just wonder.

atmosx 12y ago
http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html?_r=0 http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-m...
icebraining 12y ago
Are banks functioning properly? Just today we heard that online attackers stole hundreds of millions of dollars from them.
- whizzkid 12y ago
  That is true actually, I guess I meant i don't see for example HSBC(just an example) shutting whole company down because of they are getting hacked while bitcoin systems are are either on or off, isn't it?
  - skybrian 12y ago
    Most bank transactions are reversible. ATM withdrawals aren't, but they have limits. Lots of attacks use ATMs so it's not enough to shut down a bank.
- glesica 12y ago
  But how many depositors lost money because of that? My guess is zero.

smoyer 12y ago

"I will be resigning from Blackwave Labs and looking for regular full time employment to help pay back the lost funds. I will also ask drunkonsound to help cover my loses with Blackwave Labs holdings as well." They may not have been good at security but I still have to admire someone who is willing to take responsibility for their mistakes. Where's Mark Karpeles?

Johnie 12y ago
This guy needs to get a lawyer immediately. He's extremely naive in thinking he can 'fix' this. In addition, he's exposing his personal asset and future liability to all of these creditors. As I said, amateur hour.
- SuddsMcDuff 12y ago
  It's a woman

sek 12y ago

I think a trustworthy Bitcoin exchange requires the software development capabilities/requirements similar to a real bank. The amount of money at stake is probably not he same, but the anonymity of Bitcoin makes up for attractiveness as a target. AFAIK most smaller banks use third party software/services. Maybe there is a need for a bitcoin exchange software provider that takes care of the critical parts and you build your interface/business on top.

AshleysBrain 12y ago

From the announcement: "during the DDOS two separate trades spiraled out of control either due to a bug or an exploit and transferred a very large number of small Bitcoin transactions to Ambiorx's account." Note "either due to a bug or an exploit". Then: "Ambiorx used the fraudulently obtained Bitcoins..." If the cause was a bug in your own code, that's not fraudulent is it? Isn't that the exchange's fault? That line seems to assume exploitation, when they already said it was possible it was a bug.

dogma1138 12y ago
If tomorrow you wake up and find 10000000$ in your account and then go on a spending rampage what do you think will happen? The bank will notice it, revoke the funds and then at best you will end up with a pile of debt and at worse will be charged with some financial fraud or another. It's time that exchanges will develop the ability to reverse bitcoin transactions by extending the chain or by building their own transaction protocol on top of the current BTC chain. It's also about time that these establishments will get some private insurance if they want to play around as they were some private banks for oligarchs which are not tied directly to the central bank or insured by it. With how BTC transactions work in general, and how exchanges seem to operate these days im amazed that people still use them.
- jamestnz 12y ago
  >If tomorrow you wake up and find 10000000$ in your account and then go on a spending rampage what do you think will happen? Something pretty similar to this happened here in NZ in recent years. A couple who ran a BP franchise had applied to a bank for a $100k line of credit. They were accidentally given $10m instead. They decided to rapidly transfer the money offshore, where they then fled. The woman eventually returned voluntarily, the man was extradited. He received jail, she a home detention sentence and reparation. http://www.stuff.co.nz/national/crime/2428243/Couple-missing-after-10m-bank-bungle http://www.stuff.co.nz/national/crime/2428243/Couple-missing... Sentencing: http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10829144 http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objecti...

photorized 12y ago

Does anyone have an estimate of their volume, or how much was 'lost'?

jakejake 12y ago
The site has only been open for 3 months and looking around at some forum posts it seems to not have ramped up yet to a huge amount of users. I have no idea but I'm gonna guess low 5 figures.
nextw33k 12y ago
28th Dec: "Exco.in surpassed 60 BTC 24H Volume" https://blackwavelabs.com/ https://blackwavelabs.com/ It seems to have happened over a 5 day period. So a back of the packet calculation: 60 x 230 * 5 = $69,000 Of course that doesn't tell us anything about if people had larger amounts stored, just that the hot wallet should have contained around that amount before they needed to refill it.

cbeach 12y ago

As long as centralised Bitcoin exchanges exist, this will happen. It's why I built CoinTouch, which finds friends of friends that trade Bitcoins (FB / G+). Post buy/sell orders, priced at a spread to market rates: https://www.cointouch.com/ https://www.cointouch.com/

dredmorbius 12y ago

Of that IP set: Host ASN CIDR 104.131.204.15 62567 104.131.192.0/19 104.131.213.10 62567 104.131.192.0/19 104.154.38.52 15169 104.154.0.0/15 107.170.150.138 62567 107.170.128.0/19 130.211.185.192 15169 130.211.0.0/16 146.148.40.57 15169 146.148.0.0/17 172.245.55.112 55286 172.245.48.0/21 184.172.15.235 36351 184.172.0.0/18 50.97.173.18 36351 50.97.128.0/18 5.255.253.51 13238 5.255.253.0/24 66.249.69.136 15169 66.249.69.0/24 66.249.69.88 15169 66.249.69.0/24 66.249.75.104 15169 66.249.75.0/24 66.249.75.184 15169 66.249.75.0/24 66.249.75.216 15169 66.249.75.0/24 66.249.75.88 15169 66.249.75.0/24 66.249.79.111 15169 66.249.79.0/24 66.249.79.119 15169 66.249.79.0/24 66.249.79.127 15169 66.249.79.0/24 66.249.79.135 15169 66.249.79.0/24 66.249.79.4 15169 66.249.79.0/24 Distinct ASNs: 14 15169 GOOGLE 3 62567 DIGITALOCEAN-ASN-NY2 2 36351 SOFTLAYER 1 13238 Yandex 1 55286 SERVER-MANIA So ... yeah, these jokers got themselved "DoS'd" by a couple of search engines and couldn't even figure that out. But they might want to look at Digital Ocean, SoftLayer, and ServerMania. Or figure out where the traffic was actually coming from.