I had a similar problem in February. Someone from tor bought 100 BTC over my account from the open market at shit prices. Coins were still in my account (you need an email-Confirmation to withdraw). After some discussing with the admin, he did a rollback and I had most of my money back. Still, shocking to see that he kept the problem and hoped for the best instead of either banning tor or at least examining how someone got my password. Just fyi, I am running a custom built gentoo box, so don't ask me if I upgraded my virus scanner often enough. API was and still is disabled.
Thank you for that information. Now we have confirmation that the anomalies shown on the EUR graph from bitcoincharts are the exact same issue. It can safely be assumed that all 17 outliersin the beginning of february are examples of the same problem. This means it has happened in total at least to 20 people, and the administrator has been aware of the risk for over two months. That
is shocking.
I really hope more of these people will chime in.
And to this day he has not said anything publicly. Now, he has all but disappeared.
My personal guess is that some once had access to the database in the past and got the (probably) MD5 hashes, did a scan against one of the many rainbow table servers and found a hit or two. Unlikely since my pass then was a 6 letter word, a number and a unicode symbol, but it might explain why he re-salted the password database (thereby fucking up everyone's records so that you had to request a new pass via email...) some weeks later.
He did re-salt the passwords, I remember that now. I have a strong 32 character password though, and I never use the same one twice. I'm not so sure it could have happened that way.
Was your bitcoins sold via the api?
Personally, I don't suspect malevolence behind these incidents, including yours, mostly because Simon is somewhat traceable. I have no clear answer on how he makes his money, but if I had to guess: Place an order and wonder about the one bot that modifies its orders faster than you can hit F5 and the fact that the trading volume shown in bitcoincharts is about 5-10x of what gets moved over the one (why?) payout address he has (shown above).
Yes, I have wondered about how that bot can be so quick...
But the trading volume is not really related to what people withdraw. Especially on a trading friendly (free) exchange like btc24. The same money can be traded over and over again.