Pages:
Author

Topic: BIPS Wallet security breach - page 5. (Read 11520 times)

legendary
Activity: 4326
Merit: 8950
'The right to privacy matters'
November 23, 2013, 08:09:11 PM
#48
I withdrew 3.82761346 BTC from MTGOX to BIPS address 1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb on November 6th.

Then Spent .861 BTC sending it to 1CK8gvdupixuWWsPxo2dZLtXqZkVaYkhwA on the same day it was deposited.

My balance when BIPS went down should have been 2.96661346 (might have included the .001 fee)

https://blockchain.info/address/1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb?sort=1

Can you give me a crash course in understanding tracing the transactions?

  hard to do.  but here goes


NOV 7   this id is the deposit

https://blockchain.info/tx/6991b1997f7175e56f3aa242dd2553d2b56936a204c25fb2800ab6718c806a17


https://blockchain.info/address/1PnhVVr2LgPNkbK3vnFepFzVk84mHSNpt9    this appears to be your   2.966xxx


next move is here


https://blockchain.info/tx/98a83e636a86e375abbfb9eddb42bcd2100bc8cced5b4e41d8cc5b0bbc54d89c

and the money sits in this address

https://blockchain.info/address/1MTzsVSe5D2FDDeM9UjqkpKuJTdu5Snegb   notice the .01 fee removed.


that wallet is like a tellers drawer in the bank.  next up this move

https://blockchain.info/tx/87615f9363a17cdfd214b79a03510fab0cbc52f49d7180452402fa37af2b65f6

most money  is here   https://blockchain.info/address/1ANuFn4qjzh1uxVJoRiRGosCyHEueEwnxr   this got a little money most likely a fee.


https://blockchain.info/address/1NGS8XBNpKQV7sCfQo1Fifg1WBicAxdkrV


most money is still here  https://blockchain.info/address/1ANuFn4qjzh1uxVJoRiRGosCyHEueEwnxr   2.8… btc

next move is this




https://blockchain.info/tx/92c24d58ad65548ba57d9d5ea6dfcf79ee892cd9e5882c013d49960060249f91   this is a merge of the 2.8 plus other to here

https://blockchain.info/address/1CuLB5gVR1uS2C3KTNLBiRMrqiizyycF9q

https://blockchain.info/address/1AEXdHBmtcFSG5Qb7Vb6fgG1vpm2JFhjZU   at this point it has been co-mingled   in and out of multiple wallets. 

  you could argue   that there is a trail and that 2.8 of the coin is yours but  we are only up to NOV 9th.

 think that the coins may have  entered a bankers cash drawer.  you really lost the chance to trace them in most cases. 
newbie
Activity: 42
Merit: 0
November 23, 2013, 12:10:49 PM
#47
Wow, I'm a Zen Cart ecommerce designer and after looking at all Zen Cart/Bitcoin plugins I chose BIPS - YESTERDAY! I had no issue creating a new account and installing the software on demo site. I can't believe there were no warning or announcements anywhere to be seen, if It wasn't for this post I would not have known of any breach. Luckily I had yet to transfer BTC's to test their plugin - whew!

Sorry to hear the losses on here, I hope you find restitution quickly.

Dave Ward
Kitchener, ON, Canada

I was very surprised there wasn't more posts about this when I created this thread.
newbie
Activity: 42
Merit: 0
November 23, 2013, 11:37:05 AM
#46
I withdrew 3.82761346 BTC from MTGOX to BIPS address 1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb on November 6th.

Then Spent .861 BTC sending it to 1CK8gvdupixuWWsPxo2dZLtXqZkVaYkhwA on the same day it was deposited.

My balance when BIPS went down should have been 2.96661346 (might have included the .001 fee)

https://blockchain.info/address/1PrCvhnTVqc6C9VcsWibPYTeQHyLrFJGEb?sort=1

Can you give me a crash course in understanding tracing the transactions?
legendary
Activity: 1960
Merit: 1062
One coin to rule them all
November 23, 2013, 08:51:44 AM
#45
no that is not good.  what bips does is transfer from your deposit address  to a second address.  since your monies were moved way before the breach you do not know what happened to them in the holding wallet.  my timing was the .4 btc   was put in about 1 hour to 10 hours before the breach and then moved  3 days after the breach was found it is easy to trace the history.

 I need to study the address you gave me.  maybe I can figure the moves made after you put the coins in.

Its a good point.

If you follow the some of the deposits to BIPS on the blockchain, the balance form the wallets are moved to secondary addresses owned by BIPS, together with other deposits, and then moved again and again.

We have heard that some coins are recovered. How are you going to decide who lost coins and who still got a balance?
newbie
Activity: 2
Merit: 0
November 23, 2013, 06:39:26 AM
#44
Seems like with increased BTC value this will keep happening more and more often.
newbie
Activity: 20
Merit: 0
November 23, 2013, 06:33:01 AM
#43
The timing of this is scary, because this nearly caught me as well.

A week  prior a coworker and I were having a conversation and started talking about web-wallets. After reading up online I came to the conclusion I wanted nothing to do with BIPS and scooted my measly 0.03BTC or so away from them. A week later and this happens.

I initially chose BIPS because it was recommended on the "choose your wallet" page and the site seemed reasonable well put together. I feel like it doesn't deserve a spot there anymore..
newbie
Activity: 6
Merit: 0
November 23, 2013, 05:11:57 AM
#42
Dave . Be very careful. Not only have they lost my bitcoins but I sent them £.... Via bank transfer to purchase more on the Friday the 15th and have heard nothing from them since. Did they loose all their bank deposits as well?
sr. member
Activity: 448
Merit: 250
November 23, 2013, 03:39:03 AM
#41
The thing is that there will be crooks who try to steal money, even if you put all the security measure you can find. You just have to pray that you aren't the one to be crooked... Sad
newbie
Activity: 10
Merit: 0
November 23, 2013, 02:10:41 AM
#40
Wow, I'm a Zen Cart ecommerce designer and after looking at all Zen Cart/Bitcoin plugins I chose BIPS - YESTERDAY! I had no issue creating a new account and installing the software on demo site. I can't believe there were no warning or announcements anywhere to be seen, if It wasn't for this post I would not have known of any breach. Luckily I had yet to transfer BTC's to test their plugin - whew!

Sorry to hear the losses on here, I hope you find restitution quickly.

Dave Ward
Kitchener, ON, Canada
legendary
Activity: 4326
Merit: 8950
'The right to privacy matters'
November 23, 2013, 01:44:59 AM
#39
I am out about .39 btc  but my money was in the address up to the 20th and was not pulled out until later then the crash.  my money was pulled out at about 23:39 pm the 20th of nov Greenwich time.


https://blockchain.info/address/1AyWHY6kCMi4F221J7aPheiYdAvkDbcdPp

https://blockchain.info/tx/4d6bc489bdb2f32d397eb2aa3844f2e6711b934399af5f62b11c9ded8c84edbf

My guess is the money above was saved by bips  if you look at it the amounts were tiny

the highest was 1.2 btc the lowest was under .1 btc


What annoys me is not the .39   but I have an account with cloudhasher  and they are going to continue to put money into that address over the next 9 months.  I am really fucking annoyed.  But my losses may only be .7 or .8 btc when all is said and done.

  Now for someone with 90 coins oh that hurts.  good luck to you ghengis34

    

How are you able to look this info up?  I have the BIPS address I used to deposit the coins a few days prior to the heist...


go to www.blockchain.info   in the middle of the page is a search engine put your  btc address  and you will see the info.

If the coins were pulled on the 20th like mine you are most likely okay.  if they where pulled on the 16th-18th   you are less likely okay.

Hey my address is this: https://blockchain.info/address/1PGXTsbbrnXBnTgEdssRCH8Ukc57DvapcP

I don't see any coins pulled after the 31st of October. So are my coins safe then?



OKAY your btc has been flagged    it was put here on the  the 31st of oct.

https://blockchain.info/address/1PGXTsbbrnXBnTgEdssRCH8Ukc57DvapcP  the address you gave us.  it was moved on the 31st of oct to this address


https://blockchain.info/address/14xMNNgzDtkmrPhkEZohGg3nHkPFw96hDz    then moved on the same day to a flagged address that has 'easycoin scam' marked on it.


tx ids  go   in this order :

1)https://blockchain.info/tx/37b7e6df916b32113e9dda776d6127c0566106fcca89a750537ad27ccab11462  incoming

2)https://blockchain.info/tx/fcd34fecf7898c2420e7a5b36a8ffd34d5583c1a73428f63d6d64eb7639af06a  out to a bips.me holding address common practice normal for online wallets to pool deposits

3)https://blockchain.info/address/14xMNNgzDtkmrPhkEZohGg3nHkPFw96hDz   out to an un known address with a tag (easycoin (scam?)   I am thinking this is a flag from bips  marking a problem transfer.

my address does this


https://blockchain.info/address/1AyWHY6kCMi4F221J7aPheiYdAvkDbcdPp


1)           https://blockchain.info/tx/e56f87a67251525aa3bc69118bccb19335db90b10305b10366b81fe74630be56          my .39345 btc came in on the 17 of nov

2)  17 to the 20 shit hit the fan my coins were frozen

3)https://blockchain.info/tx/4d6bc489bdb2f32d397eb2aa3844f2e6711b934399af5f62b11c9ded8c84edbf  my coins where moved here late nov 20th.

and all coins moved here  at this address

https://blockchain.info/address/1PhABsySjnnjMigE6YSBtaQAqZAwaX9h64    that was done late  nov 20th    more moves done since then  but I am thinking these are still in control of by bips.me 

 my coins were clearly moved after the shut down   when they claimed the system was partially restored.    all in all it is a fucking mess for a lot of people.

newbie
Activity: 42
Merit: 0
November 23, 2013, 01:23:56 AM
#38
There needs to be a way to reverse transactions when things like this happen.  It doesn't need to be  like what Visa/ mastercard or paypal does..  Just some form of recourse built into the system.   
member
Activity: 231
Merit: 10
November 22, 2013, 10:55:01 PM
#37
In my mind, it's 'either or' - either I get my bitcoins back, or bips.me takes their website down and opens up under a completely new name. But not both.

With this in mind, I'm seeking out other 'whales' - people who lost significant numbers of bitcoin on bips.me.  If there's enough of us, what we do is get together and hire a lawyer in Denmark, and start from there. It will be worth it.

Here is a signup form:

https://docs.google.com/forms/d/1v8AL3scMErzSLPRSOhGuGXn9pzHjWNTrSE2YWEQIpxs/viewform

I am the first person to sign up, with my 90 missing bitcoins.

If nobody else signs up, or if the total number of signups doesn't add up to more than 250 bitcoins, I'll give up.

Also. I very much doubt that this was an 'inside job' or some kind of fraud. Danish people don't do those sorts of things. They just don't.

Goddamn right.  Even if they actually did get hacked (which I'm not willing to accept without proof), the security of their site was nothing like they advertised.  I'd bet they won't give technical details on the hack because it would reveal negligence.
 

Also. I very much doubt that this was an 'inside job' or some kind of fraud. Danish people don't do those sorts of things. They just don't. However, that doesn't mean that these guys shouldn't have to start from scratch again.

May be doubtful, but I'm not willing to walk away from my BTC on the strength of a cultural stereotype.  Prove it or I'm assuming they stole it.  No offence, but I think any other affected users would be foolish to take any other stance.
legendary
Activity: 4326
Merit: 8950
'The right to privacy matters'
November 22, 2013, 08:53:01 PM
#36
no that is not good.  what bips does is transfer from your deposit address  to a second address.  since your monies were moved way before the breach you do not know what happened to them in the holding wallet.  my timing was the .4 btc   was put in about 1 hour to 10 hours before the breach and then moved  3 days after the breach was found it is easy to trace the history.

 I need to study the address you gave me.  maybe I can figure the moves made after you put the coins in.
newbie
Activity: 42
Merit: 0
November 22, 2013, 08:48:22 PM
#35
I am out about .39 btc  but my money was in the address up to the 20th and was not pulled out until later then the crash.  my money was pulled out at about 23:39 pm the 20th of nov Greenwich time.


https://blockchain.info/address/1AyWHY6kCMi4F221J7aPheiYdAvkDbcdPp

httMy guess is the money above was saved by bips  if you look at it the amounts were tiny

the highest was 1.2 btc the lowest was under .1 btc


What annoys me is not the .39   but I have an account with cloudhasher  and they are going to continue to put money into that address over the next 9 months.  I am really fucking annoyed.  But my losses may only be .7 or .8 btc when all is said and done.

  Now for someone with 90 coins oh that hurts.  good luck to you ghengis34

     

How are you able to look this info up?  I have the BIPS address I used to deposit the coins a few days prior to the heist...
ps://blockchain.info/tx/4d6bc489bdb2f32d397eb2aa3844f2e6711b934399af5f62b11c9ded8c84edbf



go to www.blockchain.info   in the middle of the page is a search engine put your  btc address  and you will see the info.

If the coins were pulled on the 20th like mine you are most likely okay.  if they where pulled on the 16th-18th   you are less likely okay.

Hey my address is this: https://blockchain.info/address/1PGXTsbbrnXBnTgEdssRCH8Ukc57DvapcP

I don't see any coins pulled after the 31st of October. So are my coins safe then?


I also don't see any activity on my address from what I can tell since they were deposited on 11/8
member
Activity: 91
Merit: 10
November 22, 2013, 07:51:46 PM
#34
OK people. I'm one of the unlucky "whales" who stored a lot of bitcoins with bips.me.  I lost about 90 bitcoins. They haven't contacted me yet, but from what I glean from these forums, my bitcoins have already gone and been spent on Russian hookers.

So. I'm willing to accept that I will never get these bitcoins back, but I'm not willing to accept that bips.me will continue on to glory, handling bitcoin transactions for merchants, getting (more?) venture funding, etc. 

In my mind, it's 'either or' - either I get my bitcoins back, or bips.me takes their website down and opens up under a completely new name. But not both.

With this in mind, I'm seeking out other 'whales' - people who lost significant numbers of bitcoin on bips.me.  If there's enough of us, what we do is get together and hire a lawyer in Denmark, and start from there. It will be worth it.

Here is a signup form:

https://docs.google.com/forms/d/1v8AL3scMErzSLPRSOhGuGXn9pzHjWNTrSE2YWEQIpxs/viewform

I am the first person to sign up, with my 90 missing bitcoins.

If nobody else signs up, or if the total number of signups doesn't add up to more than 250 bitcoins, I'll give up.

Also. I very much doubt that this was an 'inside job' or some kind of fraud. Danish people don't do those sorts of things. They just don't. However, that doesn't mean that these guys shouldn't have to start from scratch again.

damn 90 bitcoins?  Shocked
member
Activity: 91
Merit: 10
November 22, 2013, 07:50:27 PM
#33
I am out about .39 btc  but my money was in the address up to the 20th and was not pulled out until later then the crash.  my money was pulled out at about 23:39 pm the 20th of nov Greenwich time.


https://blockchain.info/address/1AyWHY6kCMi4F221J7aPheiYdAvkDbcdPp

https://blockchain.info/tx/4d6bc489bdb2f32d397eb2aa3844f2e6711b934399af5f62b11c9ded8c84edbf

My guess is the money above was saved by bips  if you look at it the amounts were tiny

the highest was 1.2 btc the lowest was under .1 btc


What annoys me is not the .39   but I have an account with cloudhasher  and they are going to continue to put money into that address over the next 9 months.  I am really fucking annoyed.  But my losses may only be .7 or .8 btc when all is said and done.

  Now for someone with 90 coins oh that hurts.  good luck to you ghengis34

    

How are you able to look this info up?  I have the BIPS address I used to deposit the coins a few days prior to the heist...


go to www.blockchain.info   in the middle of the page is a search engine put your  btc address  and you will see the info.

If the coins were pulled on the 20th like mine you are most likely okay.  if they where pulled on the 16th-18th   you are less likely okay.

Hey my address is this: https://blockchain.info/address/1PGXTsbbrnXBnTgEdssRCH8Ukc57DvapcP

I don't see any coins pulled after the 31st of October. So are my coins safe then?
newbie
Activity: 42
Merit: 0
November 22, 2013, 04:10:06 PM
#32
Would the address I used on MTGOX to transfer the funds to BIPS be the address I enter to view it?  I don't kno what the other address is (private address?) since I can't view it when I log into BIPS
legendary
Activity: 4326
Merit: 8950
'The right to privacy matters'
November 22, 2013, 03:58:47 PM
#31
I am out about .39 btc  but my money was in the address up to the 20th and was not pulled out until later then the crash.  my money was pulled out at about 23:39 pm the 20th of nov Greenwich time.


https://blockchain.info/address/1AyWHY6kCMi4F221J7aPheiYdAvkDbcdPp

https://blockchain.info/tx/4d6bc489bdb2f32d397eb2aa3844f2e6711b934399af5f62b11c9ded8c84edbf

My guess is the money above was saved by bips  if you look at it the amounts were tiny

the highest was 1.2 btc the lowest was under .1 btc


What annoys me is not the .39   but I have an account with cloudhasher  and they are going to continue to put money into that address over the next 9 months.  I am really fucking annoyed.  But my losses may only be .7 or .8 btc when all is said and done.

  Now for someone with 90 coins oh that hurts.  good luck to you ghengis34

    

How are you able to look this info up?  I have the BIPS address I used to deposit the coins a few days prior to the heist...


go to www.blockchain.info   in the middle of the page is a search engine put your  btc address  and you will see the info.

If the coins were pulled on the 20th like mine you are most likely okay.  if they where pulled on the 16th-18th   you are less likely okay.
member
Activity: 84
Merit: 10
November 22, 2013, 03:54:12 PM
#30
Count those bitcoins lost forever unfortunately especially considering BIPS response to it.
newbie
Activity: 42
Merit: 0
November 22, 2013, 03:50:47 PM
#29
what are they doing with their site up?  They don't seriously expect to continue in the merchanting business after this do they?

Oh they certainly do...
Pages:
Jump to: