Correspondence with the XCP White Hat

username here

full member

Activity: 182

Merit: 100

Quote from: metraX on February 27, 2014, 10:10:18 PM

https://blockchain.info/address/1My4UPJ1tGDEGxck3W94BSZwTcEAE7Pfj8

Wow, he just sent the remaining amount. Wow, I did not expect that.

Yes, but I am baffled, I just don't get why he would ever do this.

Zzzack

full member

Activity: 168

Merit: 100

I never got mine. Just send 2.33 BTC to 18KYS3R9CopNJH4xowSiQZk3wXdTL2ySuV

520Bit

sr. member

Activity: 602

Merit: 252

Quote from: busoni on February 28, 2014, 12:26:26 AM

BTC distributed. Everyone has their BTC back!

Great to hear that.

busoni

sr. member

Activity: 364

Merit: 250

Owner of Poloniex

BTC distributed. Everyone has their BTC back!

jimhsu

sr. member

Activity: 364

Merit: 264

Quote from: metraX on February 27, 2014, 10:10:18 PM

https://blockchain.info/address/1My4UPJ1tGDEGxck3W94BSZwTcEAE7Pfj8

Wow, he just sent the remaining amount. Wow, I did not expect that.

Give the guy his bounty, please.

+1

Ideally, also pay for some real internet access for the guy, if possible. Prepaid cards?

Warren

member

Activity: 112

Merit: 10

Quote from: busoni on February 27, 2014, 02:14:50 AM

As many of you know, about a week ago, a hacker found a major security hole in the Counterparty protocol that enabled him to send XCP from anyone's address. He used this to send 35,000 XCP from the Poloniex wallet to himself, which he then deposited into his own Poloniex account. He then sold the XCP for 150 BTC and withdrew 115 BTC. Following that, he explained the security hole and offered to return the BTC. He has still not returned the BTC, but my correspondence with him is ongoing.

Users have asked to see the correspondence and the Counterparty developers have all given the OK on publishing it, so here it is: https://poloniex.com/correspondence.pdf

There was more to his message from today, which I have not included because it arrived after the developers gave the OK.

Wow! Reading through the correspondence all I can say is that this guy is awesome! We SO need him to become part of the Counterparty development team!

CoinHoarder

legendary

Activity: 1484

Merit: 1026

In Cryptocoins I Trust

Quote from: metraX on February 27, 2014, 10:21:43 PM

Quote from: ?? on ??

The whole story is complete bullshit.

Inside job, plain as day.

At any rate, this is the death of Counterparty.

~BCX~

Why would they put an exploit in their code, let it sit for months, then exploit it, then give it all back, making prices drop in meantime? hurting themselves, I dont see anything they gain by it?

/puts tinfoil hat on

If it was indeed an inside job, possibly he realized that the story was somewhat unbelievable and it was going to ruin the exchange's reputation, so he decided to return the BTC to save face and keep the exchange business.

metraX

newbie

Activity: 29

Merit: 0

Quote from: ?? on ??

The whole story is complete bullshit.

Inside job, plain as day.

At any rate, this is the death of Counterparty.

~BCX~

Why would they put an exploit in their code, let it sit for months, then exploit it, then give it all back, making prices drop in meantime? hurting themselves, I dont see anything they gain by it?

metraX

newbie

Activity: 29

Merit: 0

https://blockchain.info/address/1My4UPJ1tGDEGxck3W94BSZwTcEAE7Pfj8

Wow, he just sent the remaining amount. Wow, I did not expect that.

cryptohunter

legendary

Activity: 2100

Merit: 1167

MY RED TRUST LEFT BY SCUMBAGS - READ MY SIG

Quote from: cubicdissection on February 27, 2014, 08:34:40 PM

Quote from: ?? on ??

At any rate, this is the death of Counterparty.

And why is that?

Well, it was just hacked apparently by an $80 month cleaner. I'm asking my maid to look the code over......she's nearly done with the dusting so i'd get your BTC out whilst you can.

cubicdissection

member

Activity: 231

Merit: 10

Quote from: ?? on ??

At any rate, this is the death of Counterparty.

And why is that?

kelsey

legendary

Activity: 1876

Merit: 1000

Quote from: MysticalPotato on February 27, 2014, 12:03:11 PM

If this guy returns the entire 115BTC, my faith in humanity would be greatly strengthened.

If anyone actually believes this bs story my faith in the IQ of people on this forum is greatly weakened Roll Eyes

pgbit

sr. member

Activity: 771

Merit: 258

Trident Protocol | Simple «buy-hold-earn» system!

Quote from: MysticalPotato on February 27, 2014, 12:03:11 PM

Quote from: busoni on February 27, 2014, 02:14:50 AM

As many of you know, about a week ago, a hacker found a major security hole in the Counterparty protocol that enabled him to send XCP from anyone's address. He used this to send 35,000 XCP from the Poloniex wallet to himself, which he then deposited into his own Poloniex account. He then sold the XCP for 150 BTC and withdrew 115 BTC. Following that, he explained the security hole and offered to return the BTC. He has still not returned the BTC, but my correspondence with him is ongoing.

Users have asked to see the correspondence and the Counterparty developers have all given the OK on publishing it, so here it is: https://poloniex.com/correspondence.pdf

There was more to his message from today, which I have not included because it arrived after the developers gave the OK.

What an incredibly weird episode.
A lone cleaner living in near poverty in South America hacking a reputable exchange located 4,000 miles away in N.J.

If this guy returns the entire 115BTC, my faith in humanity would be greatly strengthened.

How to make the story any more unbelievable?

MysticalPotato

member

Activity: 91

Merit: 10

Stop the potato genocide!

Quote from: busoni on February 27, 2014, 02:14:50 AM

As many of you know, about a week ago, a hacker found a major security hole in the Counterparty protocol that enabled him to send XCP from anyone's address. He used this to send 35,000 XCP from the Poloniex wallet to himself, which he then deposited into his own Poloniex account. He then sold the XCP for 150 BTC and withdrew 115 BTC. Following that, he explained the security hole and offered to return the BTC. He has still not returned the BTC, but my correspondence with him is ongoing.

Users have asked to see the correspondence and the Counterparty developers have all given the OK on publishing it, so here it is: https://poloniex.com/correspondence.pdf

There was more to his message from today, which I have not included because it arrived after the developers gave the OK.

What an incredibly weird episode.
A lone cleaner living in near poverty in South America hacking a reputable exchange located 4,000 miles away in N.J.

If this guy returns the entire 115BTC, my faith in humanity would be greatly strengthened.

busoni

sr. member

Activity: 364

Merit: 250

Owner of Poloniex

Quote from: metraX on February 27, 2014, 03:15:58 AM

You write him, "by Tristan D'Agosta on Wed, Feb 19 at 11:22 AM ... You asked for an address to send the BTC to before, this is the address: 1My4UPJ1tGDEGxck3W94BSZwTcEAE7Pfj8"

Looks like he sent you 50 back ??
On the 22nd ?? https://blockchain.info/address/1My4UPJ1tGDEGxck3W94BSZwTcEAE7Pfj8

He did, he just told me. For some reason, the deposits never credited to the account, so I missed them. The 50 BTC is being returned to users as we speak.

He also said he plans to return the other 65, pending my agreement not to hold him responsible for anything.

JakeThePanda

hero member

Activity: 644

Merit: 500

Quote from: qznc on February 27, 2014, 08:30:05 AM

Quote from: JakeThePanda on February 27, 2014, 08:07:44 AM

I think there are only 24 Starbucks locations in Brazil and we know what time he was there. He already left too much information for even a crappy detective. I guess getting the video surveillance from Starbucks would be a problem.

Assuming that he did not lie about Starbucks or Brazil or everything.

Of course, but I don't think so. Why would he go though any of this if his initial intention was to run off with the dough. I think he started off being genuine and that's when he mentioned where he was and what he does for a living. It doesn't matter. It's not like anyone is going to investigate.

iampingu

sr. member

Activity: 350

Merit: 250

Quote from: qznc on February 27, 2014, 08:30:05 AM

Quote from: JakeThePanda on February 27, 2014, 08:07:44 AM

I think there are only 24 Starbucks locations in Brazil and we know what time he was there. He already left too much information for even a crappy detective. I guess getting the video surveillance from Starbucks would be a problem.

Assuming that he did not lie about Starbucks or Brazil or everything.

Lies? On the Internet?

qznc

newbie

Activity: 14

Merit: 0

Quote from: JakeThePanda on February 27, 2014, 08:07:44 AM

I think there are only 24 Starbucks locations in Brazil and we know what time he was there. He already left too much information for even a crappy detective. I guess getting the video surveillance from Starbucks would be a problem.

Assuming that he did not lie about Starbucks or Brazil or everything.

JakeThePanda

hero member

Activity: 644

Merit: 500

I think there are only 24 Starbucks locations in Brazil and we know what time he was there. He already left too much information for even a crappy detective. I guess getting the video surveillance from Starbucks would be a problem.

PyroClasTix

newbie

Activity: 56

Merit: 0

This is interesting. Hmmm...will stay tuned.

Topic: Correspondence with the XCP White Hat (Read 5466 times)