MintPal / VRC Update
https://support.mintpal.com/index.php?module=announce&sec=view&id=18Since we made our first announcement on the MintPal / VRC situation a few hours ago many of you have come forward with a number of questions.
What will happen to my VRC?The VeriCoin that you hold on the MintPal exchange will be unaffected thanks to the VeriCoin developers. As we previously announced, the VRC developers have worked tirelessly to perform something never before done by a cryptocurrency and rollback the blockchain in order to reverse the two malicious transactions. This was not done out of a desire to save MintPal, but rather a desire to save your coins. Once the updated wallet has been distributed and the new fork is active we will re-open our VRC wallet to facilitate withdrawals.
How can I get my VRC?As soon as we re-open our wallet your VRC balances will be available for withdraw. All market orders on the VRC/BTC market have been cancelled. We will be manually processing withdrawals to ensure the process works as expected.
Was my personal information taken?No. We have absolutely no reason to believe that any of your personal information was taken. We would also like to add that we store your passwords & secret question answers encrypted with a static & random salt.
How did the attack happen?The malicious user was able to inject a withdrawal request directly into our database bypassing the risk control measures that we have in place. We have found no evidence that our server infrastructure was directly accessed in the attack.
Has the issue been fixed?We have worked to secure the withdrawals process to ensure that a similar situation cannot occur again. As an added precaution we are manually processing withdrawals until we are 110% confident the issue has been resolved.
Were you staking your VRC?No. With the exception of Coin2.1 (by developers request) we do not stake any PoS coin. The staking process is CPU intensive on a large wallet and makes for an accounting nightmare. All of our wallets are started with the staking=0 flag set in the configuration.
Why was only VRC taken?We're not exactly sure why VRC was the only coin taken, however we can confirm that BTC and LTC were targeted, but those withdraw attempts were unsuccessful owing to far more stringent COLD storage methods on those wallets.
What about COLD storage?This is perhaps the most important question we have been asked. We did have COLD storage setup for VRC, however in this instance, due to an error for which only we can be accountable, we had transferred far fewer coins than was required, resulting in a large proportion of coins being left in the HOT wallet.
Why did trades take place after the market was suspended?Once the hard fork was announced by the VRC developers we suspended trading on the VRC/BTC market via our usual process, however, not long after the market was suspended we were alerted to a number of trades being executed on the market. Investigation has shown that due to an error on our part users who had not refreshed the page since the market was suspended were still able to enter orders successfully. We immediately worked to patch the issue to prevent further trades and have reversed the trades that occurred.
What happens to my VRC deposits since the time of the attack?Any deposits that you have made since the time of the attack will be removed and any pending deposits will be cancelled. Once you update to the new wallet version, you will pick up where you left off before the attack. If you deposited directly from a different exchange, please contact them directly.
How do I get a refund?The biggest implication of the rollback is to the various exchanges who have accepted customer deposits and then had trades executed on those deposits. We have committed to our customers and to all exchanges that we will cover any losses faced as a result of the rollback. If you are a MintPal customer you will be able to withdraw your full VRC and BTC balance. If you are a customer of another exchange you will need to contact them directly for exact information.