I've actually followed the money a bit, and the way that address
16oP8up3f8ePer1vfBPhypRqkUnsA9ZfYM makes hundreds of transfers to a large string of addresses to hide the final owner of that money is highly suspect, indicative of deliberate obfuscation.
If our private keys were intercepted, there is a very limited amount of ways it could have been done.
-Our addresses were created through
https://bitcoinvanity.appspot.com/-We used an online wallet hosted by
https://blockchain.info/-We communicated with blockchain through their RPC API
http://blockchain.info/api/json_rpc_api-Our website hosting provider is
http://www.orangewebsite.com/ and was paid for in
BTCThe security flaw is almost certainly in one of the above points. Those addresses were not used for anything else and no other online wallet, website, or org has access to the private keys.
My suspicion is still that this was the blockchain.info RNG security flaw that some people have mentioned, but I don't discard any possible suspects. Hell, maybe the vanitygen website is a scam and keeps the private keys of every address that they generate... who knows..
On the blockchain.info security flaw, more here:
https://bitcointalksearch.org/topic/blockchaininfo-security-funds-stolen-277595 I've also sent a message in a new transaction to
brand the hacker's address:
Public Note: WARNING HACKER! The receiving address belongs to a Hacker who stole over 4BTC from us. See CoinGames Hacked.
Hopefully at some point in the future it will help to track stolen funds and taint all addresses associated with this one. At the very least it will force the thief to go through a mixer..