Topic: Instawallet claim process - page 43. (Read 79284 times)

Thanks - lets stay in touch if this needs to be taken further.

If you check street view for that address it doesn't look like much more than apartments. Like I said before I would be happy to take a trip to Paris along with any other forum members if they wanted to come.

All donations from US members to go toward the trip would be repaid in full when I get my coins back.

Obviously if anyone knows of a forum member already in Paris that would make it easier but I think I can get there for about 2.5-3 btc

This is true, and is a good point.  In that case I would expect the lawyer to draft the response or at the very least to give verifiable evidence that the matter is being perused with the utmost professionalism and in a way that would be most likely to result in a resolution which is favorable to the effected parties.  Failing that, it is completely reasonable to expect at some fraction of effected customers will do everything in their power to achieve an outcome which is in their best interests, and in doing so could add inefficiency to what could otherwise be a more smooth process.

As thoughtful as this letter is- it might not be possible for them to answer. Even if there had been no funny-business any legitimate company would hire a lawyer that would advise answering none of these questions. What if they were to answer you wrongly about one of these questions? Perhaps just from not 100% understanding the situation? You or someone else would turn around and go after them about that later.

It's a legitimate letter, but I think any lawyer would advise "no comment". It's just too risky to tell you the truth- innocent or not. Indeed, perhaps the things you point out in your letter about their "50BTC" limit, or "first come first serve" might be the result of them trying to come up with a clear, concise, and honest communication to the community, as quick as possible, the only result of which is more accusations and mistrust.

pyedpyper: I thank you for putting into words exactly how I also feel about this affair, I am sure that many of us could not have penned such a letter any better.  Boussac for your information please also consider me a signatory to this letter which has my support too.

Time for a little of the infamous Phinnaeus Gage Google-fu?  Do some good work and I have a feeling that your BTC stash will start to re-builld itself.

Has the process started already?
It's gotta be rather simple form why it takes so long.

Thank you, pyedpyper. Very well-written letter.

The more I look into Paymium, the more contrived the information of all the principles seems to me. I'm seeing a lot of crossing linking to each others names, with not much linking to prior entities. I honestly don't feel good about this situation.

Perhaps, at least, a police report would put some ease on the situation.

pyedpyper,

Your letter was well written and captured my own posture on the matter very closely.  I found almost all of the questions asked to be fair and realistic.

My losses are not great and not as great as yours.  In my case, they are a small fraction of my BTC holdings, and partially out of a desire to promote the general health of the Bitcoin network which defines the value of my main stash it would be worthwhile to me to see attacks on the system resolved as thoroughly and professionally as possible.  Thus, I feel inclined to join you in any formal and well thought out efforts to proceed on this adventure if necessary and if my participation may be helpful.  Hopefully the organization responsible for Instawallet will demonstrate professionalism in reaching the best resolution possible and nothing very onerous or expensive will be necessary.

While I always considered the funds I had with Instawallet to be disposable, the fact that it was associated with an organization which appeared to be on a healthy business trajectory played a part in my decisions about how much to keep there.  Further, the fact that 'Paymium family' choose to continue to operate Instawallet with their name on it was, to me, a valid reason to believe that they considered it security hardened enough to withstand attack.

Please feel free to PM me if need be.  I'm an American citizen BTW.

Dear Boussac,

Firstly, thank you for starting an open process of communication with Instawallet users. This is a very good start.

However, there is still much to be desired in your communication in terms of completeness and transparency.

To state upfront: I am an Instawallet user with slightly less than 100 BTC across two Instawallets – not a fortune, but neither a trivial amount, and one I have no intention of losing.

So I will be addressing you from my personal perspective, but I am also writing in support of all the other Instawallet users that have been inconvenienced by this recent alleged hack. And I say “alleged” as no-one yet knows the full truth of it.

I would like to believe that you and your company are honest, and the facts stated thus far are correct. However your less than transparent and forthcoming communication to date points to something not right, and in my opinion creates the perception of dishonesty.

I wish to give you the opportunity to correct (this hopefully incorrect) perception by making a full and transparent disclosure related to the questions I will be proposing to you below. None of these questions are of the kind that it would not be appropriate to be forthcoming about.

If you choose to not answer them then I will read that as a deliberate decision to deceive or to hide, and I will take that as a sign of something fraudulent going on. The logical outcome of that is that I will be contacting both the French Embassy in my country and the Embassy of my country in France and initiating a discussion with both of them about how to open a criminal enquiry against Paymium.

If you feel that any of my questions should, for good reasons, not be answered, then you may provide that reason and I will consider it on its merits. I am a very reasonable man, as I am sure are your other Instawallet account holders. However I think you underestimate the backlash you will suffer from these many reasonable people if you do not deal with this situation professionally, ethically and perfectly honestly. Please do not make the mistake of thinking you are dealing with a bunch of kids who will just roll over in the face of something that reveals itself to be bullshit. That would be a costly error of judgement in my opinion.

All that being said I am proceeding in good faith and in the belief that Paymium is an honest company, that your communications have been truthful, and that you have a genuine desire to make right on this situation. So please answer the following questions:

1. Please state your full real name and your current position with Paymium (and whether you are a shareholder, director or employee).

2. Please confirm that you have formal authorisation from the board of Paymium to be communicating on behalf of the company on this forum.

3. Please provide the case number and filing date of the report you state Paymium has filed with the police.

4. Please provide Paymium’s formal contact details: office address and telephone number.

5. Please state whether the alleged hack resulted in the loss of coins under Paymium’s control. A simple YES or NO is adequate at this point. If you wish to elaborate you may, but I am not requesting that.

6. If coins were lost please state if these happened by (A) the hacker accessing Instawallet accounts directly via their URLs, or (B) by accessing other “internal” wallets controlled by Paymium, or (C) by some other method.

7. Your comments thus far suggest that the alleged hacker has acquired some or all of the URLs for accessing Instawallet user wallets. Please confirm whether this is the case or not.

8. If the answer to (7) is YES, then please state if these URLs were stored in encrypted form or not.

9. If the answer to (7) is NO, then please state why there needs to be a claims process at all.

10. Your stated claims process on the Instawallets site states: “If several claims have been filed for the same url, we will process those claims on a case by case basis, under the presumption that the claim we received first belongs to the legitimate balance holder.”. Please will you describe the logic of that? If a hacker has the URLs then surely he can file a claim as quickly as any legitimate account holder? And if you’re assuming that the first claim is likely to be the more “legitimate” one then why wait 90 days? Your logical methodology makes little sense and I would appreciate clarification.

11. You also state that “Claims for wallets that hold a balance greater than 50 BTC will be processed on a case by case and best efforts basis.” Please clarify why the “arbitrary” figure of 50 BTC has been chosen. This comment suggests that you have lost a certain number of coins and need to limit your total payout to what you have left. Please confirm if this is how it is, or if there is another reason for this figure?

12. From your communications it is clear that Paymium’s servers were hacked and this affected all your services – Instawallet, Paytunia and Bitcoin Central. It also seems evident that you suffered financial loss of some kind. Please explain how that loss directly affects Instawallet clients and not Paytunia and Bitcoin Central clients.

Your direct address to these questions will be a clear indication of your bona fides and intentions of good faith - and will do a lot to restore the faith in your clients that has been shaken by your less than ideal communications. I think it is reasonable to give you until midday UTC on Thursday 11 April to respond. I am posting this here in the forum, will be sending to you by PM, and also emailing to your company email account. Consider this letter open therefore. It may be posted elsewhere and will also be made available to the relevant authorities as required.

Please understand that I wish to do this in an amicable way, and I hope that you receive this communication as such. As I feel that you have dealt with this incident (at least from a communications point of view) in a somewhat cavalier fashion, I feel it incumbent on me to call you out and demand your professionalism and fuller response – which I look forward to – as I’m sure do many others.

Sincerely,

PyedPyper

no need selling a house. We know for sure that they have over 14000 BTC not stolen.

Note also that instawallet has been around for years, since the time BTC was under 1$.
People were losing their wallets URL  during all this time. So lots of wallets with large amounts of BTC are not going to be claimed by legitimate owners.
There are many unknowns here:  how much wallets were "lost" this way, how much money was stolen,
how much info the hacker was able to get... but from my guesstimante, the instawallet owners will have enough funds to pay to all legitimate owners that still have their wallet URLs.

I wrote to insta a letter a few minutes after I saw my money dissappear before my eyes! Never received a reply.

There will be no refunds, I don't believe in it, because I don't think all those who learnt a lesson are going to use any of these services again.

That's it, the money is "stolen" and I don't think owner is selling his house not because he is moving to Mexico, but because he wants to pay us back. lol.

Hi steelboy, I can't speak for the Instawallet/Paymium/Paytunia people but I was under the impression that they were bundling up transactions rather than send each one onto the network as an individual broadcast, probably to save on fees and have them processed faster overall.  I'm wondering if your transaction in question was queued up to be in a bundle that never occurred as their BTC movements must have switched off partway through some people's transactions.

Actually just thinking about this that still seems wrong. After sending the money out of my wallet i am met with a message saying the bitcoins have been sent and the total in the wallet is 0btc.

This transaction should have been completed. I received coins to the same wallet AFTER this transaction from another wallet. I think there is no doubt as to the fact that I am due these coins.

Boussac, I appreciate you must be busy and you have a lot to deal with however I feel this should be completed as soon as possible.

I would do this privately with PMs but so far the responses from paymium/instawallet have been unsatisfactory to say the least.

Look forward to your response

I doubt this would apply even if the law holds where Instawallet is based.  The money in the accounts wasn't being "borrowed" by Instawallet, so depositors aren't strictly creditors any more than if I left a dog at a boarding kennel while I go on vacation that I'm a creditor to the kennel.

A simplistic method of scripting this would likely lead to detection.

Depending on how much info they have, I would suspect that the attackers will have chosen the higher valued wallets and will have actual humans lined up to make fraudulent claims from various innocuous IP addresses.  Maybe even the legitimate user's normal network if they have the access logs and a decent collection of compromised machines at their disposal.

The CAPTCHA idea is a good one though.  Certainly won't hurt anything (though I myself have a bitch of a time with them as often as not.)

Can I please request that a very tough CAPTCHA is included on the claim form, so that the legitimate owners at least have a small chance to get their claims in first before the original attacker?

I can imagine the attacker is crafting the beginnings of a script right now to automate their illegitimate claims.

True.  It seems like it would be more professional to either produce the requested info or explain why it is not a good idea to do so.  Ignoring the request completely is not very promising behavior.

Now it is the case, in the US at least, that there can be gag orders and legitimate advice from attorneys to be quite about certain things, but these guys have already publicly claimed that they have instigated and investigation with law enforcement.  Naturally effected people are going to want some independent verification of this.  It's just common sense.

I guess it's safe to assume that since he was online for a while and read everything related to their enterprises, he simply opted to not respond to a fairly simple request: Please give us a police report number.