I have unfortunate news for the community regarding our IRC Tipbot Cannatip.
On December 17th, a few members on IRC managed to exploit an attack vector in the tipbot that allowed them to tip/withdraw funds that were not associated to their username. We have several logs of the event along with usernames in question. Also we have an exact address where the stolen funds are sitting today which was moved Dec 23rd.
https://chainz.cryptoid.info/ccn/address.dws?CWKEo6Mz3g8As7ooPh1gQVwfqjcpfcQpob.htmThe usernames so far that we have associated to the attacks are:
Jellyas, Oleenka, Kentrosig, Sapdown, Ashstyle, Bloguarter, Songa04:39 oleenka has joined (uid56921@gateway/web/irccloud.com/x-qyksmurciebtrocl)
05:23 jellyas has joined (uid55995@gateway/web/irccloud.com/x-kvalwolmrlqrjoux)
05:45 bloguarter has joined (uid55997@gateway/web/irccloud.com/x-mxeadjaxikhotxfb)
06:02 ashstyle has joined (uid56002@gateway/web/irccloud.com/x-mzzdmvdnvaslhnyy)
06:07 sapdown has joined (uid56004@gateway/web/irccloud.com/x-ohofviygumfqacpa)
06:14 kentrosig has joined (uid56143@gateway/web/irccloud.com/x-nhuqdvfazamdmnld)
06:59 songa has joined (uid55835@gateway/web/irccloud.com/x-wjyritnosydcfsji)
If you are are aware of who this might be contact the CCN Team immediately.
The vector was first reported on Dec 23rd,
https://github.com/unek/node-tip-bot/issues/17 and since has been fixed. Like I mentioned earlier, we have logs for the entire event and are still investigating the issue to determine who the attackers may be. The team and I are working to recoup the funds lost as the only good news is that we have logs of each user accounts and the balances associated with them to ensure that each and every individual gets their funds returned. The total loss of coins is ~35k CCN with roughly 15k of those coming from IRC users directly and the remainder was part of the CCN Dev funds recent donations.
The attack vector up until this point was not obvious however many other coins/communities using the unek-node tipbot platform were vulnerable. Thanks to the open source nature a report of the problem and a quick turnaround for a solution was available and should fix the threat of the attack vector in the future.
While this is never easy news, we feel its important to make this information public so that everyone is aware and while other communities may still be at risk. We will be releasing additional information as we investigate further.
If the attackers are somehow reading this, we would appreciate it if you would contact us and return the funds. We will make sure they are returned the respected owners and are willing to pay a BTC bounty for the honesty.
-SubCreative