Topic: crypsty hacked over 1.5 yrs ago. 13000 BTCs and 300,000 ltc (Read 6205 times)

I doubt they even had security. How in the hell can they lose all their coins?
It's make no sense such a company as cryptsy can lose so much coins.

I think their exchange was managed by schoolkids.
How can they run a operation worth 13k BTC and have this kind of security?

How anyone could allow a payout from a wallet without checking that there is a corresponding valid client order for a withdrawal in their database, is beyond me.

btw, I guess in the US, delayed filing of insolvency is considered a crime, too?

One of the biggest problems is people use exchangers as banks , there not banks people have to learn do there trades and then put there cryptos in there personal wallets not leave them laying around on exchanges , this just puts bulls eyes on the exchanger's for hackers!!

Cryptsy did put on their problem-solving hats...hiding the truth for maximum profits was the solution, it seems.   

Christ, it sounds like they did everything they could to keep the truth from their customers, and now all is fucked.

What we need are exchanges that are actually run by businessmen and not computer geeks and such.  Geeks have an important part in this, but these exchanges need people who know how to run an exchange, know what I mean?  It sounds like no one put on their problem-solving hats when they found out about the trojan.

lol and after all this support you gave them publicly....it was for nothing.  

So I guess it's true after all.

Cryptsy really does suck


~BCX~

So I guess it's true after all.

Cryptsy really does suck


~BCX~

Bitshares and Next are working. The problem is how to trade our beloved altcoins on those exchanges?? I don't think anyone has figured that out yet. Even then there would have to be some sort of centralization for fiat on and off ramps.

Florida

Surely the limited liability shield is void in the face of so much totally criminal activity, lying etc?

This talk of a company going bankrupt seems off the mark, since a company is just a fiction that counts for nothing against criminal negligence malfeasance fraud theft and so on?

-MarkM-

..and another one bites the dust.

Decentralized exchanges need to happen.  Instantdex or Etherex, whoever, hurry up

Only way is if root was running the wallet and other wallets were in the same machine.

Guys, just let's be honest.
If Cryptsy was your exchange and you got hacked and lost a lot of coins.
If you were struggling to keep the exchange open and notice a lot of traders are leaving the exchange.
Would you start a Prepaid Debit Card Program?
Personally I can't believe this. Even if you know it's a sinking ship, keeping the exchange open isn't a criminal offense. It could be seen as damage control.
But actually selling a product of which you know you can't deliver... IMO that's a crime. Why would they risk this?
Hence, I personally doubt about their explaination (and ofcourse added the fact they say they didn't inform the authorities).
Let's see where it ends.  

This is a poor move by cryptsy. For over 1.5 years, they have kept it secretly. They would have suspended their operations immediately once they realize the missing coins from their wallets. They wouldn't have lost when they did it like that. Silence is the killing factor for cryptsy for now. If they did suspended their operations earlier, many people would have got the original value of the coins back. For the past months, people tried to convert btc to other altcoins for much loss to withdraw. This is isn't acceptable.

cryptsy hacked themselfs over 1.5 yrs ago,  ••• missing 10M $

Cryptsy has failed to explain why they aren't returning the millions of alts still stored in its cold-storage coffers.

Why not return those coins to the rightful owners?

Only way is if root was running the wallet and other wallets were in the same machine.

The claimed way the attack was supposedly done makes no sense, even without using virtual machines no coin daemon running as one user would be able to access another running as another user unless someone deliberately forced passwords into the ps or top type readouts by putting them on commandlines, so even incompetents could hardly be expected to make the proposed attack method workable unless they really went out of their way to ensure such an attack would work, such as by running untrustable shitcoins as the same user as a real valuable coin, and on the same machine, or by deliberately passing passwords on the commandline so other users could see them on top and ps and such.

Basically you'd have to deliberately go out of your way to circumvent all the usual procedures everyone is always instructed to use even for just small personal wallets.

Such deliberate setting up of a situation intended to enable some pathetic excuse like "oh one daemon had a trojan in it" is surely at best criminal negligence and far more likely conspiracy to defraud and steal?

It is a pity really that there are so many regulations around this kind of app because all the perceived/expected additional expense imposed by red tape kind of makes the whole idea of running an exchange at all look way too expensive to the kinds of folks who might be competent to run one, whereas script-kiddies just wanting to set up a nice hackable environment so they can claim they were hacked can do so much cheaper / easier...

...Also come to think of it an IRC command-and-control on a cold-wallet machine would never be able to be commanded and controlled because cold means not on the net, right? Hmm...

-MarkM-

cryptsy hacked themselfs over 1.5 yrs ago,  ••• missing 10M $

This is a poor move by cryptsy. For over 1.5 years, they have kept it secretly. They would have suspended their operations immediately once they realize the missing coins from their wallets. They wouldn't have lost when they did it like that. Silence is the killing factor for cryptsy for now. If they did suspended their operations earlier, many people would have got the original value of the coins back. For the past months, people tried to convert btc to other altcoins for much loss to withdraw. This is isn't acceptable.

Cryptsy has failed to explain why they aren't returning the millions of alts still stored in its cold-storage coffers.

Why not return those coins to the rightful owners?

Cryptsy has failed to explain why they aren't returning the millions of alts still stored in its cold-storage coffers.

Why not return those coins to the rightful owners?

Doesn't look too good for Cryptsy. I remember the good old days when Cryptsy was the biggest altcoin exchange now they are just a shadow of the past.

Winner

..and another one bites the dust.

Decentralized exchanges need to happen.  Instantdex or Etherex, whoever, hurry up

Cryptsy has failed to explain why they aren't returning the millions of alts still stored in its cold-storage coffers.

Why not return those coins to the rightful owners?

Also there is an issue reporting the backdoor in Lucky7 in March.

https://github.com/alerj78/lucky7coin/issues/1

And no mention of it anywhere else I can see.

Some may ask why we didn’t report this to the authorities when this occurred, and the answer is that we just didn’t know what happened, didn’t want to cause panic, and were unsure who exactly we should be contacting.   At one time we had a open communication with Secret Service Agent Shaun Bridges on an unrelated matter, but I think we all know what happened with him – so he was no longer somebody we could report this to.    Recently I attempted to contact the Miami FBI office to report this, but they instead directed me to report it on the I3C website.  I’ve not heard anything from them.

Shilling where it doesn't belong is why nobody gives a shit

Shilling where it doesn't belong is why nobody gives a shit

I wonder how many times people will have to get Goxxed before they start using decentralized solutions such as Bitshares, Nxt/Supernet MultiGateway/InstantDex, Nushares/Nubits, or B&C Exchange?

Disclaimer: I am an investor in all of the above projects.... because I can tell the future.  

                                                                                                                                               
I am sure most everyone saw this coming! Will the new one in China be NEXT?

it already happened... nxt asset exchange using supernet's multigateway. its just missing the marketing strength it needs.

..and another one bites the dust.

Decentralized exchanges need to happen.  Instantdex or Etherex, whoever, hurry up

..and another one bites the dust.

Decentralized exchanges need to happen.  Instantdex or Etherex, whoever, hurry up

..and another one bites the dust.

Decentralized exchanges need to happen.  Instantdex or Etherex, whoever, hurry up

Announcement
Cryptsy has had problems for some time now and it’s time to let everybody know exactly why.  These problems were NOT because of any recent phishing attacks, or even a ddos attack, nor does it have anything to do with me personally.
About a year and a half ago, we were alerted in the early AM of a reduction in our safe/cold wallet balances of Bitcoin and Litecoin, as well as a couple other smaller cryptocurrencies.   After a period of time of investigation it was found that the developer of Lucky7Coin had placed an IRC backdoor into the code of wallet, which allowed it to act as a sort of a Trojan, or command and control unit.   This Trojan had likely been there for months before it was able to collect enough information to perform the attack.  It does not appear that this was the original developer for LK7, as on 5/22/2014, we received this message from the new developer who wanted to maintain the codebase:
—
Hello,
Lucky7Coin is not maintained and I would like to take care of it. I have announced that on bitcointalk.org in Lucky7Coin thread. You’re the only exchange for this coin and I hope you will let me take care of it. I’m responsible. You don’t have to be afraid of errors or forks. I’m developing multipool and I know bitcoin internals and protocol.
https://bitcointalksearch.org/topic/m.6861797
For a start I’ve changed irc network, so clients could synchronize blockchain. Please upgrade as soon as you can.
Github repo:
https://github.com/alerj78/lucky7coin
Branch “master” will always be for stable version, branch “devel” could be dirty. In a 2-3 weeks I’ll release new version with p2pool support and checkpoints. Before that I’ll contact you to check few blocks hashes for checkpoints and make sure there is no fork.
I hope we can cooperate and make this coin live again!
Jack
—
These are the approximate figures taken:
Bitcoin:  13,000 BTC
Litecoin:  300,000 LTC
This of course was a critical event for Cryptsy, however at the time the website was earning more than it was spending and we still have some reserves of those cryptocurrencies on hand.   The decision was made to pull from our profits to fill these wallets back up over time, thus attempting to avert complete closure of the website at that time.   This worked fine for awhile, as profits decreased due to low volume and low Bitcoin prices, we would adjust our spending accordingly.  It wasn’t until an article from Coinfire came out that contained many false accusations that things began to crumble.   The article basically caused a bank-run, and since we only had so much in reserves for those currencies problems began. 
Our current customer liabilities for BTC is around 10,000 BTC, so as you can see we would like to see the Bitcoins returned for both our users and for ourselves.
Here are the transaction details from the Bitcoin wallet:
https://www.walletexplorer.com/wallet/0c07e0bec1002bd2
As you can see,  2014-07-29 13:17:36 is when the event occurred.   A very interesting fact here, however, is that those Bitcoins have not moved once since this happened.    This gives rise to the possibility they can be recovered.   In fact, I’m offering a bounty of 1000 BTC for information which leads to the recovery of the stolen coins.
If you happen to be the perpetrator of this crime, and want to send the coins back no questions asked, then you can simply send them to this address: 
1KNi4E4MTsF7gfuPKPNAbrZWQvtdQBTAAa
If they are returned, then we will assume that no harm was meant and will not take any action to reveal who you are.  If not, well, then I suppose the entire community will be looking for you.
Some may ask why we didn’t report this to the authorities when this occurred, and the answer is that we just didn’t know what happened, didn’t want to cause panic, and were unsure who exactly we should be contacting.   At one time we had a open communication with Secret Service Agent Shaun Bridges on an unrelated matter, but I think we all know what happened with him – so he was no longer somebody we could report this to.    Recently I attempted to contact the Miami FBI office to report this, but they instead directed me to report it on the I3C website.  I’ve not heard anything from them.
I think the only real people who can assist with this are the people of the Bitcoin community itself.
Trades and withdrawals will be suspended on the site indefinately until some sort of resolution can be made.
Here are our options:
1.   We shut down the website and file bankruptcy, letting users file claims via the bankruptcy process and letting the court make the disbursements.
-   or –
2.   Somebody else comes in to purchase and run Cryptsy while also making good on requested withdrawals.
-   or –
3.   If somehow we are able to re-aquire the stolen funds, then we allow all withdrawal requests to process.
I’m obviously open to any other ideas people may have on this.