Bitcoin Private has confirmed the allegations made by CoinMetrics, reported by CCN yesterday. Calling them “mathemetically accurate,” the development team says that no one on their team knows where the extra coins wound up. Again, CoinMetrics stated that at least 300,000 of them had already been moved through exchanges.
Due to the low take-up by the Bitcoin community of Bitcoin Private (in which users could essentially have claimed free coins on the BTCP blockchain), this is a significant portion of the overall actual supply of Bitcoin Private, or the supply that is in use.
Bitcoin Private has conducted a full audit of the situation and has determined that the blame is with a single developer. The developer is called airk42. He has not contributed to Bitcoin Private since claiming a bounty and completing an “issue” they had out, which was to tweak the import so that BTCP could “add arbitrary transactions as coinbase inputs at a given block height.”
The developer completes the issue, merges his own code, and is sent his reward. One line of code is missing which allows the fork mine to be exploited due to the nodes not properly verifying the falsified fork blocks. […] The missing line of code is as follows: || tx.vout.size() > 1. We determined this after the CoinMetrics report was released.
Bitcoin Private does not believe the developer in question exploited his own mistake. Instead, they believe an unidentified “bad actor” took advantage of the bug during the establishment of the BTCP blockchain.
During the publicly announced fork mine, a bad actor exploited this bug, creating 2 million coins. It went unnoticed by the contribution team until it was uncovered by CoinMetrics.
Reference: https://www.ccn.com/bitcoin-private-denies-fraud-allegations-and-calls-for-halt-to-btcp-trading/