Topic: [ANN] Zipcoin [ZIPC]- X13 PoW/PoS - NO Premine - 7 days PoW - Ninja - page 5. (Read 42960 times)

Don't worry this coin wont last long. They never do.. but if it does then good luck with it.

Yeah Dude oreoeater is a noob so I uploaded the file that I hadn't emptied from the recycle bin so people could run it on a virtual machine and see how the trojan worked...if anything I hope some coder can figure it out so we can prepare ourselves for future etc...

Hey, someone with a brain..

That's not the file in question. As far as I can tell, that file seems clean (but again, unless it's compiled via Gitian, it's very hard to tell).

The file in question was allegedly originally available here, but as I said has since been remove: https://mega.co.nz/#!JAoyiajC!0ND16g-6qVDRGVuxnNBZmd-NInXzpbdaW9Pe9dDlDUo

The suspicious file, which as far as I can tell was first referenced by user oreoeater in this post: https://bitcointalksearch.org/topic/m.8198136  is still available here: https://mega.co.nz/#!L1IBwTzB!sHUsuf3fLQ-PJrtScL7IZaT99DPNesSSrUfJ_ehFjkg. It's definitely malware, see here: https://bitcointalksearch.org/topic/m.8201918. I think oreoeater may have uploaded at the request of others looking to investigate it, but I haven't read the whole thread so I'm not sure.


Or did the admin simply copy and paste the link from somewhere else? Those are the questions, and I hope the admin will respond (over here).

I dont know if this can qualify as proof but it is evidence...so here is the post I made in the vertcoin reddit as soon as I noticed that my coins were gone. The post was made when I had NO CLUE about the trojan at all...

http://www.reddit.com/r/vertcoin/comments/2cik3k/so_i_think_i_lost_all_my_verts/

People weren't claiming to be losing ZIPcoins.  They are losing other altcoins on their same computer.  The exchange and the prices have been fine with the coin, that is not what people are talking about. 

Did you notice that the ZIP dev posted the same snarky comment with winky face in every thread of coins that came out over the weekend right at the same time people were realizing he had bundled a trojan with the wallet?  This isn't FUD.  I dont even have any of this coin anymore and I don't plan on buying any.

Even if the current wallet is clean we still need to make people that downloaded and ran the malicious wallet aware that they might need to take steps to protecting their data.

looks like my coins are still here and to all investors out there if u are using an exchange don't worry your good

I uploaded the file in question (https://mega.co.nz/#!6cAxzBjT!KVntyW_y8j4QVwobEHROrRhpuKnX_2uxd-KML_S4ips) to virustotal.com and noticed that other people have also uploaded it there on August 2nd. It came out clean. Both the OP and the supposed archive page on BitcoinTa.lk have the same file linked to. I'm not sure what to make of this, but can the people who claim their money was stolen please provide evidence of some kind of transfer from their address to the attacker's address? If enough people show that their money was sent to one address, perhaps we can expose the attacker. If there isn't any evidence, then perhaps it's all just FUD. It's not completely infallible, but having multiple people posting transaction data from before my post was made requesting it, should surely help to prove things beyond a reasonable doubt.

Things to consider:

1.) Virus Total first analyzed the file listed in the OP and the BitcoinTa.lk forum (same file) on August 2nd.
2.) FUD about ZIPCoin wasn't even started by August 4th, meaning time zones are irrelevant.
3.) FUDsters are claiming the file in the OP is different from the one on BitcoinTa.lk citing it as an archived version of the OP. Both files are the same. (Was the other one updated too?)
4.) If the OP had a different file originally, then why didn't anyone mention the stolen coins right away? How was the clean file uploaded to VirusTotal on August 2nd when it wasn't available yet? (Did the dev upload it first as a makeshift insurance policy? Was the scam tactic unnoticeable even with the suggested wallet.dat ->voot.dat for all other coins? Did anyone open their wallets for the other coins before the FUD started?)

Most of these suggest that the coin is legit, but there are some things that could be smoke and mirrors.


The link cited doesn't exist. (Was it removed as it was a virus?) The CryptoCoinTalk.com forum post is by Admin. It's a popular Bitcoin Forum, so they have a reputation to keep. I think they posted it on the ZIPCoin dev's behalf. Did someone have a vendetta against ZIPCoin or did someone hack the forum or Admin account?

haha i don't hate, i got in and out yesterday, good luck guys

It another PnD coin, no further plans , and the German scumbag team rip our hot wallets,

well if you don't like this coin u can see your way out

I can't believe how dumb some of you are, several people come forward with stolen coins and you IDIOTS brush it off as fud, I will sit back with my popcorn now and watch you all cry scam in a day or two and blame bittrex for this.

Not entirely... where did the virus-version come from, and was it created by the same author of Zipcoin?

As far as I can tell, this link has been claimed to be the link where the virus version originally came from (although its content has since been removed): https://mega.co.nz/#!JAoyiajC!0ND16g-6qVDRGVuxnNBZmd-NInXzpbdaW9Pe9dDlDUo

The first reference I can find of that link is over in this forum by an admin, so I doubt it was created by them: https://cryptocointalk.com/topic/13908-zipcoin-zip-information/?p=116755

I posted a question asking where the link came from, we'll see if there's any reply.

There definitely is a version which contains a virus. What hasn't been decided is where that version came from, and if it was created by the author of the official Zipcoin wallet. So far, the currently posted version has not been found to contain any malware, but since any semblance of Gitian has been ripped out of it, it's very difficult to know for sure. (Gitian is what allows people to compile the software from source and see if the .exe is exactly the same as what's posted.)

As of right now, I honestly don't know, but I'd err on the safe side if I were you.

can we decide for good now, please --

Virus or no Virus

In the wallet Trojan steals coins - ztor.exe !!!

I just checked the archived original post at Bitcointa.lk:

https://bitcointa.lk/threads/ann-zipcoin-x13-pow-pos-no-premine-7-days-pow-ninja.350313/

The link under the "Wallet" category that the Windows .png is the anchor for, happens to be:

https://mega.co.nz/#!6cAxzBjT!KVntyW_y8j4QVwobEHROrRhpuKnX_2uxd-KML_S4ips

You can check it yourself by going to the Bitcointa.lk thread and using "Copy Shortcut" yourself. Bitcointa.lk automatically archives Bitcointalk threads, but does not change them to reflect after-the-fact edits. It also archives posts from self-modded threads that are later deleted, which does make it useful in certain cases.  


I hope this clears things up.

I downloaded it from the ANN post here.

edit: not sure of time.  It wasn't immediately though. Several hours at least after the mining had began

Or do like me and have a dedicated PC for mining, transferring coins to a cold wallet PC as you mine, then finally usually a few days later to a hot wallet PC etc. It's because of this all they got from me was empty wallets.

What's scary is that virustotal doesn't flag the file. It has to be run and then the extracted files are then seen as malware but quite a few scanners seemed to miss it judging by other posts. What I do above is really the best way but I understand not everyone can have a pc for each stage. People just need to be aware that it can happen.

where did u download your file from?