Bitcoinica MtGox account compromised - page 29.

jgarzik

legendary

Activity: 1596

Merit: 1100

Some of the reasons why I avoided bitcoinica with a ten foot pole, which were obvious right from the start:

The big one -- Zero hard evidence they actually had all the funds claimed, or could produce funds if outsized events (big selloff, big withdrawal, etc.) occur
Opaque ownership structure
Zero independent source code auditing or visibility
Zero proof of any experience at securing wealth from virtual and physical threats
Zero appearance of adhering to any regulatory structure

Therefore I was not surprised when bucket shops were mentioned.

Bro

full member

Activity: 218

Merit: 100

I LOL'ed when i saw this thread. Like last time and the time before that.

fatigue

full member

Activity: 196

Merit: 100

Bitcoin is a food group.

Quote from: iCEBREAKER on July 13, 2012, 01:16:45 PM

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 01:06:43 PM

if I knew there was a change of hands of ownership, I wouldn't have used bitcoinica.

I never trusted intersango with my money, I trusted zhou.

Trust? Feh.

Proof > Trust

Remember that? It's the conceptual breakthrough that enables Bitcoin to solve the long-standing crypto currency conundrum.

No, no I just solved 37 blocks guys. Trust me on thus one.

iCEBREAKER

legendary

Activity: 2156

Merit: 1072

Crypto is the separation of Power and State.

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 01:06:43 PM

if I knew there was a change of hands of ownership, I wouldn't have used bitcoinica.

I never trusted intersango with my money, I trusted zhou.

Trust? Feh.

Proof > Trust

Remember that? It's the conceptual breakthrough that enables Bitcoin to solve the long-standing crypto currency conundrum.

markm

legendary

Activity: 2940

Merit: 1090

Quote from: btcprophet on July 13, 2012, 01:09:34 PM

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 01:06:43 PM

I never trusted intersango with my money, I trusted zhou.

And Zhou sold that trust to the highest bidder. At least his mortgage is paid off!

Yeah that is wrong right there. He should have included the full amount of customer money in the sale price, paid the customers all their money and let them decide whether to put any of it back in given that the site had changed ownership.

I said that wrong, but basic idea is, other people's money is theirs to sell or not sell to new owners at their own discretion.

-MarkM-

btcprophet

newbie

Activity: 27

Merit: 0

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 01:06:43 PM

I never trusted intersango with my money, I trusted zhou.

And Zhou sold that trust to the highest bidder. At least his mortgage is paid off!

BadBitcoin (James Sutton)

donator

Activity: 452

Merit: 252

Quote from: aq on July 13, 2012, 01:01:06 PM

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 12:55:52 PM

Quote from: aq on July 13, 2012, 12:49:05 PM

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 12:25:35 PM

I read the entire TOS, I felt protected.

The level of personal security of each account was an order of magnitude higher than my banks, I had a 24 character password that was essentially a hash key, as well as a google authenticator with my smart phone, best part?
I was using bitcoinica as an exchange, I just deposited my money in my account and was planning on turning into btc that same day for an investment with starfish BCB, then the hack happened.

I did my due dilligence on the company, and the risk of the company becoming insolvent was low at that time, please don't get angry at me for believing personal security measures was enough.

So it was no issue for you that they had been hacked a few times before?
Slowly I am starting to understand why they still believe that they can continue running Bitcoinica in the future. In a year from now, everyone will say "yes, they got hacked some 20 times, but I feel that it wont happen again".

After the initial hack, I was extremely put off by bitcoinica and completely avoided them, however upon returning to their site I could see that they began (at least facetiously) taking security very seriously, and I

decided that they had a reputation to match mtgox (another hacked website, however is still widely traded on). I decided to use them for a wire transfer because they had an easier bank name to input at the

bank vs. mtgox's japanese bank, please stop harassing people that lost their shirt in a "semi reputable" business, I don't just throw my money around willy nilly, and your assumption that I do is insulting.

Sorry, did not want to insult anyone. Was just trying to understand how the site got that much trust, after being hacked and once it was public knowledge that it was run by a minor.

I put zhou in utmost regard, he may have been negligent in a hack, but he certainly would have paid us what is ours within the first WEEK of the hack, not sit around on his hands for 3 MONTHS like the intersango/consultancy guys had done, if I knew there was a change of hands of ownership, I wouldn't have used bitcoinica.

I never trusted intersango with my money, I trusted zhou.

kokjo

legendary

Activity: 1050

Merit: 1000

You are WRONG!

Quote from: Mt.Gox Support on July 13, 2012, 07:55:25 AM

As far as Mt.Gox is concerned and as Genjix explained, we did not suffer any breach or any hack, all other account are safe and the thief only targeted Bitconica's account. Mark (MagicalTux) has been in contact with many Bitcoin players since this announcement and offered any help we can give, but unfortunately all funds (USD & BTC) are no longer within our reach.

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Despite our effort on securing Mt.Gox and protecting everyone's asset I would like to remind everyone that it is also your responsibility to secure your account with a very strong password and use either a Yubikey or Google Auth (You can even use both at the same time).

Mt.Gox

-- EDIT --

We would like to stress that Mt.Gox Verified Bitconica as a Company and NOT as an Individual.

to what (bank-)account was the usd sent to? ie. where can we find the guy, and beat him?

aq

full member

Activity: 238

Merit: 100

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 12:55:52 PM

Quote from: aq on July 13, 2012, 12:49:05 PM

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 12:25:35 PM

I read the entire TOS, I felt protected.

The level of personal security of each account was an order of magnitude higher than my banks, I had a 24 character password that was essentially a hash key, as well as a google authenticator with my smart phone, best part?
I was using bitcoinica as an exchange, I just deposited my money in my account and was planning on turning into btc that same day for an investment with starfish BCB, then the hack happened.

I did my due dilligence on the company, and the risk of the company becoming insolvent was low at that time, please don't get angry at me for believing personal security measures was enough.

So it was no issue for you that they had been hacked a few times before?
Slowly I am starting to understand why they still believe that they can continue running Bitcoinica in the future. In a year from now, everyone will say "yes, they got hacked some 20 times, but I feel that it wont happen again".

After the initial hack, I was extremely put off by bitcoinica and completely avoided them, however upon returning to their site I could see that they began (at least facetiously) taking security very seriously, and I

decided that they had a reputation to match mtgox (another hacked website, however is still widely traded on). I decided to use them for a wire transfer because they had an easier bank name to input at the

bank vs. mtgox's japanese bank, please stop harassing people that lost their shirt in a "semi reputable" business, I don't just throw my money around willy nilly, and your assumption that I do is insulting.

Sorry, did not want to insult anyone. Was just trying to understand how the site got that much trust, after being hacked and once it was public knowledge that it was run by a minor.

kokjo

legendary

Activity: 1050

Merit: 1000

You are WRONG!

Quote from: iCEBREAKER on July 13, 2012, 12:51:31 PM

Quote from: Mt.Gox Support on July 13, 2012, 07:55:25 AM

As far as Mt.Gox is concerned and as Genjix explained, we did not suffer any breach or any hack, all other account are safe and the thief only targeted Bitconica's account. Mark (MagicalTux) has been in contact with many Bitcoin players since this announcement and offered any help we can give, but unfortunately all funds (USD & BTC) are no longer within our reach.

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Despite our effort on securing Mt.Gox and protecting everyone's asset I would like to remind everyone that it is also your responsibility to secure your account with a very strong password and use either a Yubikey or Google Auth (You can even use both at the same time).

Mt.Gox

-- EDIT --

We would like to stress that Mt.Gox Verified Bitconica as a Company and NOT as an Individual.

Good one!

BadBitcoin (James Sutton)

donator

Activity: 452

Merit: 252

Quote from: aq on July 13, 2012, 12:49:05 PM

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 12:25:35 PM

I read the entire TOS, I felt protected.

The level of personal security of each account was an order of magnitude higher than my banks, I had a 24 character password that was essentially a hash key, as well as a google authenticator with my smart phone, best part?
I was using bitcoinica as an exchange, I just deposited my money in my account and was planning on turning into btc that same day for an investment with starfish BCB, then the hack happened.

I did my due dilligence on the company, and the risk of the company becoming insolvent was low at that time, please don't get angry at me for believing personal security measures was enough.

So it was no issue for you that they had been hacked a few times before?
Slowly I am starting to understand why they still believe that they can continue running Bitcoinica in the future. In a year from now, everyone will say "yes, they got hacked some 20 times, but I feel that it wont happen again".

After the initial hack, I was extremely put off by bitcoinica and completely avoided them, however upon returning to their site I could see that they began (at least facetiously) taking security very seriously, and I

decided that they had a reputation to match mtgox (another hacked website, however is still widely traded on). I decided to use them for a wire transfer because they had an easier bank name to input at the

bank vs. mtgox's japanese bank, please stop harassing people that lost their shirt in a "semi reputable" business, I don't just throw my money around willy nilly, and your assumption that I do is insulting.

Phinnaeus Gage

legendary

Activity: 1918

Merit: 1570

Bitcoin: An Idea Worth Spending

Quote from: davout on July 13, 2012, 09:12:49 AM

Quote from: ?? on ??

You stupid mother fucker! I am so sorry that my oversized font fucks with you head, but the size of the font honestly reflects how I feel. Please forgive me, all, if it seems out of line. I wasn't doing it for kicks, but will keep it down now that it's been brought to my attention.

Yeah, please don't do that, additionnaly calling others names does nothing but make you look like an idiot.

You're right, bud. I just got back in to pick up where I left off. Please accept my humblest apologies, all.

~Bruno~

iCEBREAKER

legendary

Activity: 2156

Merit: 1072

Crypto is the separation of Power and State.

Quote from: Mt.Gox Support on July 13, 2012, 07:55:25 AM

As far as Mt.Gox is concerned and as Genjix explained, we did not suffer any breach or any hack, all other account are safe and the thief only targeted Bitconica's account. Mark (MagicalTux) has been in contact with many Bitcoin players since this announcement and offered any help we can give, but unfortunately all funds (USD & BTC) are no longer within our reach.

Once again, someone with a US IP succeed to get Bitcoinica's account credential which did not trigger any alarms since they were fully identified. Since Bitconica's account was a verified account the owner of this account asked (This happened when Zhou was still controlling Bitconica) to have his limits lifted to the maximum possible, giving the possibility to the thief to move Bitcoinica's assets to another external account (External to MtGox).

Despite our effort on securing Mt.Gox and protecting everyone's asset I would like to remind everyone that it is also your responsibility to secure your account with a very strong password and use either a Yubikey or Google Auth (You can even use both at the same time).

Mt.Gox

-- EDIT --

We would like to stress that Mt.Gox Verified Bitconica as a Company and NOT as an Individual.

cypherdoc

legendary

Activity: 1764

Merit: 1002

i'm so glad i avoided Bitcoinica like a plague as well. i spent 2 solid months late last yesterday grilling Zhou on his Bitcoinica threads and pointing out flaws in his trading algorithm. turns out his security skills were just as bad.

hazek

legendary

Activity: 1078

Merit: 1003

Quote from: ?? on ??

Quote from: tseale on July 13, 2012, 12:18:05 PM

The fund will be considering all legal options.

Uh oh

That's exactly what my reaction was.

aq

full member

Activity: 238

Merit: 100

Quote from: BadBitcoin (James Sutton) on July 13, 2012, 12:25:35 PM

I read the entire TOS, I felt protected.

The level of personal security of each account was an order of magnitude higher than my banks, I had a 24 character password that was essentially a hash key, as well as a google authenticator with my smart phone, best part?
I was using bitcoinica as an exchange, I just deposited my money in my account and was planning on turning into btc that same day for an investment with starfish BCB, then the hack happened.

I did my due dilligence on the company, and the risk of the company becoming insolvent was low at that time, please don't get angry at me for believing personal security measures was enough.

So it was no issue for you that they had been hacked a few times before?
Slowly I am starting to understand why they still believe that they can continue running Bitcoinica in the future. In a year from now, everyone will say "yes, they got hacked some 20 times, but I feel that it wont happen again".

caveden

legendary

Activity: 1106

Merit: 1004

Quote from: ?? on ??

Quote from: Maria on July 13, 2012, 09:39:20 AM

https://bitcointalksearch.org/topic/m.635291

I thought you needed a YUBIKEY to withdrawal that amount!

PLAN B

Doesn't this make the case right here? It was admitted they needed a YUBIKEY to make a withdrawal from MT Gox in that post.

The post says that they had two accounts, one with Yubikey, another without, and that they were trying to get the limits of the one without Yubikey raised...

defxor

hero member

Activity: 530

Merit: 500

Quote from: tseale on July 13, 2012, 12:18:05 PM

All credentials were encrypted by a reputable password management service. I claim no expertise to judge the security of the master password but it was very long. Its status as a master password and its use in all respects were fully understood by the Consultancy upon acceptance.

If the Consultancy deemed this password to be unfit for ongoing use, they certainly had the opportunity and the duty to change it.

Who created that account and configured it to use that particular master password?

If it was someone with basic security knowledge, it's a setup to be able to claim plausible deniability later.

If it wasn't, well, then it's just bad security practices not having changed it knowing its origin.

Luceo

sr. member

Activity: 350

Merit: 250

Per aspera ad astra!

So glad that I bypassed this nightmare of a service, personally.

I'm sorry to say that I foresee a long and bloody legal battle ahead for all those involved with Bitcoinica. I fully expect this to be the basis of the first Bitcoin class action lawsuit.

You do not handle a million dollars without insurance, lessons will be learned and the users should not be the ones paying for your gross negligence.

BadBitcoin (James Sutton)

donator

Activity: 452

Merit: 252

Topic: Bitcoinica MtGox account compromised - page 29. (Read 156012 times)