CoinDash’s ICO Website Has Been Hacked

http://www.financemagnates.com/cryptocurrency/news/breaking-coindashs-token-sale-ico-website-hacked/

by seansoutpost • 9 years ago

209 232 9 years ago

So it was their website that got hacked, not their cryptocurrency widget (or whatever the appropriate term is)?

I mean, not unexpected: hit the softest part of the chain, which in this case seems to be a webserver rather than the crypto/contract. Just trying to make sure my understanding is correct.

proto-n• 9 years ago

The webserver, or you know, their wordpress website (at least according to reddit).

arcaster3• 9 years ago

This was bound to happen at some point... It'll be interesting to see how low the dip goes as a result of this ICO failure.

AsyncAwait• 9 years ago

This seems to be the same problem that many open-source projects have, where the md5 hash to verify your download is at a single, (often the same) location.

One possible solution would be to use Twitter pinned tweet to also announce the address, however it's questionable how many people would actually cross check.

ericfrederich2• 9 years ago

I always found that fascinating myself, serving the download and checksum from the same source.

Doesn't http have enough redundancy checks built in to make this pointless? The only time to really do a checksum isn't on a browser download, it's when you push it over some serial connection, or android adb or something else.

sjbase• 9 years ago

I suppose the "Here's the MD5 for your download" concept is useful if the file is being served from a different host than the website itself. Someone could tamper with the file server, but may not have access to the HTML rendering a link to that file server.

But you're right about serving the data & checksum from the same source. I don't see what extra layer of security or integrity it adds. Someone tampering with server file system, or the data transfer (MitM) inherently has the access they need to inject their own MD5 into the HTML.

simias6• 9 years ago

It's useful if you have already downloaded the file from somewhere else and want to check if it's the right one without downloading everything from scratch.

Furthermore it's very much possible to get corrupt data over HTTP if you have a poor connection and download a big file.

If you want a really secure "checksum" you best bet is probably a GPG signature file from a wildly distributed and trusted key.

Cshelton2• 9 years ago

I know given the thread this is in makes it ironic, but a public blockchain would actually serve as a pretty good place to keep a check sum ;p You would check the official blockchain address for a repository and know that the checksum there has not been modified. As long as the process of creating the transaction is done correctly.

urethrafranklin5• 9 years ago

If someone can MITM your download, in many scenarios they could MITM twitter as well.

dvcc2• 9 years ago

'Hacked' - or just stolen. Who could ever know in crypto-land? I am sure the ICO contract had something about lost coins in it as well.

dullgiulio2• 9 years ago

Neither. They hacked the webpage and wrote a different address to send money to. Similar to me sending you a letter that I am Oxfam, please send me money.

If only the crypto-currency world had laws and the institution of justice...

lightbyte• 9 years ago

If only the crypto-currency world had laws

A law isn't going to magic peoples coins back if they hit send to the wrong address.

greenshackle2• 9 years ago

I think he means CoinDash themselves could have altered the address and claimed it's a hack - which would make it straightforward theft, not a real hack.

mcherm• 9 years ago

Where does the amount in the title ("45k ether") come from? I didn't see that in the article.

EDIT: Apparently from https://etherscan.io/address/0x6a164122d5cf7c840D26e829b46dC... , which is something I don't have the depth of knowledge to assess for myself.

ericfrederich2• 9 years ago

wow... 6 minutes ago, 1 minute ago... people are still sending this address money?

forthefuture• 9 years ago

This sentiment is how normal people feel about all cryptocurrency.

JustAnotherPat• 9 years ago

Yes, it's not really being talked about anywhere because people like to keep this stuff hush hush, so crypto doesn't look bad.

urethrafranklin5• 9 years ago

A sucker is born every minute.

Moter8• 9 years ago

ETH Balance: 43,432.963 ...

is the important figure. At the bottom you can see the transactions coming in.

First incoming transaction seems to be from Jul-17-2017 01:01:21 PM. View all > last page.

mcjiggerlog• 9 years ago

Over €6,000,000 at current prices.

imron7• 9 years ago

'hacked'

dsun176• 9 years ago

Running a P2P-ICO over a centralised server. Good job coindash. That's exactly what you deserved.

detaro2• 9 years ago

Do other ICOs do a better job distributing instructions?

EDIT: so, apart from posting the address across as many channels as possible, and telling people to cross-check, what options are there? You could announce addresses way beforehand and have them send ETH to the final address once you release it, using that as a signal.

arcaster3• 9 years ago

Usually, companies conducting ICO's only release the block number in advance, the smart contract address is generally released last sometimes just hours before the ICO start time.

joosters4• 9 years ago

All ICOs are centralised. It's lots of people sending their money to one entity, never the other around.

albertgoeswoof2• 9 years ago

No problem, just hardfork and start again

dvcc2• 9 years ago

That only works when the money is tied to one of the core developers. Don't worry though, blockchains are immutable and safe from centralization.

542458• 9 years ago

Wait what? I'm not up to date on all the cryptocurrency going-ons. What's this referring to?

wyldfire• 9 years ago

Last time the problem was that a weakness in the contract's definition was exploited, right?

This time it's a "hack" where someone gained unauthorized access to a webpage and modified it somehow?

IMO if there were ever a case for hardforking around problems it should be for the latter and not the former. Maybe Ethereum could publicly declare itself to be a "not-too-centralized" consensus-audited-by-this-particular-committee-of-humans.

draw_down• 9 years ago

One of these times they'll get it! Never give up, y'all.

taytus2• 9 years ago

I'm learning about Ethereum and I just read about their previous hardfork. I won't touch this (as a developer) until this kind of shenanigans stop happening.

vkou2• 9 years ago

That one was the last time ever, pinky swear.

option_greek2• 9 years ago

I don't understand how any of these ICO companies are valued so high. If they had to raise this 12mil from VC/PE would they still be valued the same ?

sharemywin2• 9 years ago

Because it's not real money, most of it is just bitcoins that got converted to ethereum that got converted to coin dejur. Can you cash it out in small quantities sure, but unless something tangible comes of it you have nothing but worthless tokens.

hn_throwaway_99• 9 years ago

I think that is key. It's similar to the .com boom (and bust) in the early 2000s. You had lots of examples where super-inflated company A bought company B, and paid for it with their super inflated stock. While the "values" reported won and lost where in the billions (trillions?), the fact is that relatively little of it was actually converted back and forth to real dollars.

mhluongo7• 9 years ago

No. On top of that, the tokens aren't usually for equity

fokinsean2• 9 years ago

That's a bummer since Coindash appears to have an MVP and a reasonable funding cap of $12MM. I wouldn't wish this on anyone, but it's unfortunate it didn't happen to one of the scammy ICO's instead.

On a side note showcasing the ridiculousness of some of these ICOs, [1]"Useless Ether Token" (UET) raised around $45k and literally doesn't do anything.

[1] https://coinmarketcap.com/assets/useless-ethereum-token/

https://uetoken.com/

trophycase2• 9 years ago

You do realize that everyone knows UET is a joke right?

TeMPOraL• 9 years ago

DogeCoin was a joke too, right? I think it earned some people some money.

I actually like this about the Internet. A good joke deserves some profits.

fokinsean2• 9 years ago

Yeah totally. It's probably one of the most profitable jokes created if he cashes out.

nikolay2• 9 years ago

Where's the news?! Why do people continue to bang heads against the wall with this madness? Unless you're a thief, how is the craptocurrency thing better than my credit card that's insured from unauthorized use and gives me a cash back?! Yeah, you can't speculate with credit cards, and get rich quick, because $1 = $1 like forever, but isn't that what the real investment tools are for?

btown• 9 years ago

Everyone in cryptocurrency seems to have forgotten that the adage "the devil you know vs. the devil you don't" was a recommendation to prefer the former.

easytiger3• 9 years ago

Everyone in Crypto Currencies are besotted by the "we are in at ground level of a tech revolution" idea... namely they think they saw the kids of the 80s/90s get easy low qualification required tech jobs and one man shops making 100s/millions/dollars. They are the modern prospectors. Free gold on unclaimed land.

Like any decent business thinker you don't see the rough edges of your focus. Sometimes when you do it can cripple you. But then again most business fail.

mhluongo7• 9 years ago

What are you talking about? The dollar loses to inflation every year. A 1990 dollar is $1.87 in 2017 dollars.

sleepychu• 9 years ago

I think GP means that if you have $100 in your bank it'll still be there tomorrow, not randomly erradicated by volatile swings in the market or stolen with no way to get it back.

That said this is only true if you have faith in your government.

klodolph2• 9 years ago

Meanwhile, a June 2017 ethereum is 2 etherium in July 2017 ethereum…

aphextron• 9 years ago

What are you talking about? The dollar loses to inflation every year. A 1990 dollar is $1.87 in 2017 dollars.

Which is precisely why you don't leave money sitting in a 0% savings account. You invest it in equity, not a currency. Fiat is designed to lose value through inflation. Thats how the system works.

Expecting to hedge against inflation by dumping your money in another currency is insanity. The only way is through actual economic growth.

matt_wulfeck3• 9 years ago

Greed.

nikolay2• 9 years ago

Greedocurrency is a much better name, right!

rglover• 9 years ago

https://www.youtube.com/watch?v=M_3T-Af57Pg

davnicwil2• 9 years ago

Just to pick up on this one small point: as I understand it, the cashback you get with a credit card is more or less taken straight from the card processing fee charged to the vendor, which of course, raises prices overall and is therefore not really cashback at all. Without the fee, you would likely have just paid a lower price in the first place.

The only party benefitting from the cashback scheme is, of course, the middleman. By offering it, they give you an incentive to use the card more, which in turn gives the vendors more incentive to accept it. More card use equates directly to more money for them.

One of the hugely compelling benefits of cryptocurrencies is they entirely eliminate the necessity for such middlemen taking a cut and driving up costs for the parties actually partaking in the transaction.

seanalltogether• 9 years ago

One of the hugely compelling benefits of cryptocurrencies is they entirely eliminate the necessity for such middlemen taking a cut and driving up costs for the parties actually partaking in the transaction.

Don't all bitcoin transactions require a transaction fee in order to get processed these days?

vim_wannabe• 9 years ago

A bitcoin transaction costs me 2$.

A credit card transaction costs me 2$ (which is used to provide me great service, including insurance against unauthorized use): Somehow this is a bad thing?

simias6• 9 years ago

That's the definition of insurance. The problem with bitcoin, if you think that's a problem, is that there's no obvious way to implement this scheme. You'd have to insure your coins to a third party but then you'd probably have to give them some control over your wallet so that you can't just "steal" your own coins and make a claim.

But clearly people want this type of guarantee so I think the cryptopunk dream of having every human being owning a bitcoin wallet aligns poorly with what real world human beings want.

Everytime I read about long term adoption of cryptocurrency by the masses I always end up asking myself the same question: "Why would a random person for whom money is not a political statement care about any of that? What's the added value?" As far as I'm concerned I still haven't found a satisfactory answer to this question.

cyphar3• 9 years ago

I don't believe that's accurate, cash-banks are inter-bank processes, and I know several vendors who do actually see a reduction in their bank account when a cash-back occurs.

Yes, if the recieving bank won't honour a cash-back then it will come out of card processing fees, but that's more like insurance than anything else. I wouldn't say that insurance is without worth.

Also, BitCoin has transaction fees. Except rather than being used for insurance, they provide a (very poor) profit motive for miners to continue keeping the network hashing rate high. The reason it's clearly a poor profit motive is that the popular markets around BitCoin are secondary markets (selling graphics cards rather than doing the mining yourself).

root_axis7• 9 years ago

As someone who ran a gas station convenience store for six years, I can tell you that this is not a universal truth. We did require a minimum purchase amount to accept cards, but we most certainly did not raise our prices in response to credit card fees.

bsurmanski• 9 years ago

But do they eliminate the middleman? At least for Bitcoin, it takes an hour for any confidence that a transaction is truly valid. I'm not going to wait around for an hour just to grab my morning coffee.

So obviously there's going to need to be a credit backed middle man to guarantee your transaction so the seller doesn't get screwed by a double spend.

Eth is slightly better, but it still takes something on the order of 10m to confirm a transaction, and it doesn't look like it can get anywhere near the speed needed for a coffee purchase.

jonknee• 9 years ago

In this case the middleman actually provides a very valuable service--fraud protection.

gst2• 9 years ago

One of the hugely compelling benefits of cryptocurrencies is they entirely eliminate the necessity for such middlemen taking a cut and driving up costs for the parties actually partaking in the transaction.

Without more efficient means of off-chain transactions (such as payment channels) the cost of on-chain cryptocurrency transactions is typically much more expensive than credit card transactions (except for very large amounts, as credit card transactions charge a percentage, and cryptocurrency transactions have a fee not related to the amount transacted).

For some of the cryptocurrencies those fees are currently somewhat hidden, as you don't directly pay them as transaction fees, but as miners get a block reward that contributes to inflation. If you include the miner revenue a Bitcoin transactions currently costs about $20 in average: https://blockchain.info/charts/cost-per-transaction

jdmichal2• 9 years ago

Cash has transaction costs too. You have to store the cash in a local safe. You have to pay for counting and accounting of the cash. You have to pay for safe transport of cash from onsite to offsite. You have to pay for trust, because disappeared cash is generally unrecoverable.

As long as there is no difference between the cash price and card price, it's rational for a customer to use a card with rewards. And I have never seen anything outside of gas with differential pricing. And you know what? I just avoid those gas stations as much as possible, because I can pay a similar price at another station and get my cash back.

xur175• 9 years ago

Having the sender pay the fee seems like an obstacle for consumer adoption. I agree that consumers are never going to use cryptocurrency vs. credit cards to pay if:

1) It costs them money to use 2) No cashback

It would be interesting to test a cryptocurrency where the recipient payed the fee, and could optionally send cashback. I'm not exactly sure how this would work, but the incentive structure would more optimally aligned for everyone involved.

fma2• 9 years ago

That is correct. My wife runs a retail service that charges monthly. The percentage the business pays depends on cards. Cards like Amex, and those high end one with good rewards - charge a higher percentage in fees, and Square passes it on.

Right now she will only accept the first month payment by credit card. Cash, check, or ACH for recurring payments. ACH costs $.99. If everyone decides to pay credit card she will raise cost by $5 (almost 3% of the charge).

MicroBerto• 9 years ago

But at nearly every store, the price has been increased for everyone, even cash customers. So why not get my cash back if that's how it's going to be?

mikeash• 9 years ago

Seems to me that cash back is a way for card companies to compete on transaction costs. Directly adjusting the transaction costs wouldn't do it, because merchants won't pass the difference on to the buyer. By rebating part of the transaction cost to the cardholder, they effectively reduce the transaction cost, without having to get merchants to pass on savings.

The beneficiary of this scheme, as with most schemes to lower prices to undercut the competition, is me.

dragonwriter• 9 years ago

One of the hugely compelling benefits of cryptocurrencies is they entirely eliminate the necessity for such middlemen taking a cut and driving up costs for the parties actually partaking in the transaction.

Which is why so many of the business “accepting” cryptocurrency do so only through a middleman who converts it immediately back to national currency for the business, charging a fee for the service.

LeifCarrotson• 9 years ago

A few points:

1. The only party benefitting from the cashback scheme is, of course, the middleman. While prices will go up in the long term, consumers who use cash-back cards do benefit in the short term over those who don't. If you make a transaction in cash or with a debit card which you could have made with a cash-back card, you are leaving 3% on the table. I am extremely skeptical that an individual boycott will be effective. Maybe take your 3% and pool it to lobby for better banking regulations?

2. they entirely eliminate the necessity for such middlemen taking a cut - AFAIK, all cryptocurrency includes some sort of transaction fee.

ghostbrainalpha• 9 years ago

Slight adjustment... there is also a fair bit of wealth transfer between people who use cash, debit cards, or have credit cards but can't pay them off each month.

So its an extra little 3% tax on the poor, or at least the less financially literate.

unityByFreedom• 9 years ago

One of the hugely compelling benefits of cryptocurrencies is they entirely eliminate the necessity for such middlemen taking a cut

Only if you don't count the online exchanges as middle men. Right now I still pay 3-5% to convert fiat to digital money, depending on where my fiat comes from.

The theoretical future where nobody needs to convert between digital coin and fiat isn't here yet.

conceptme• 9 years ago

Unless you live in Venezuela http://www.businessinsider.com/venezuela-hyperinflation-char...

matt_wulfeck3• 9 years ago

Hyper deflation and hyper inflation are both extremely destructive to a functional economy.

root_axis7• 9 years ago

Cryptocurrency is not a solution for a fundamentally broken central government and this is especially true for countries like Venezuela where access to computers and reliable internet is not a given.

joosters4• 9 years ago

Where are the hordes of people wanting to sell their bitcoins and turn them into Venezuelan bolivars?

Without these people, how have Venezuelans got any chance of getting bitcoins in the first place?

simias6• 9 years ago

I'm not as negative as you are, I think this is all very interesting, from the outside looking in. It really helps understanding the pros and cons of our monetary system, the good and the bad. It's pretty educational I think.

Of course it's sad for people who invest money they can't afford to lose, but really "investing" in cryptocurrencies is more like playing roulette than anything else and they should've known better.

I really wonder what cryptocurrencies will look like 10 years from now. Will they still exist? Will they have taken over the world as some predict?

Given how easy it is to irrevocably lose your coins I really have a hard time imagining how this could become mainstream. At best I could imagine using bitcoin through some third party that would take care of your wallet for you. We'd call it a bank or something.

albertgoeswoof2• 9 years ago

I don't really know why this is being downvoted, BTC and cryptocurrencies are really interesting economically. Even if they have no direct impact on society as a whole it's valuable to see proposed alternatives to our banking and financial systems put forward and discussed in detail (e.g. it really exposes what a bank / government actually provides)

xyzzy4• 9 years ago

Why is gold worth $5 trillion market cap? If someone steals your gold, you can't even get it back easily.

easytiger3• 9 years ago

In computing there were relatively few mitigation against breach of physical security. Almost no one uses encrypted volumes, though that is growing rapidly. Even then it says nothing of on line connected access to the medium whilst the volume is mounted.

If someone steals your gold the logistical complexities are much more onerous to being caught. Again, a 3000 year problem almost entirely solved.

The risk of the medium of value is priced into the medium itself.

RegulatoryRoger• 9 years ago

It's better if you're buying heroin online

discombobulate5• 9 years ago

Good question! Why are some of the most sophisticated investors in the world investing in crypto?

If you took some time to figure out the answer, it may be valuable. Or not. You could be right.

because $1 = $1 like forever

Correct. What about compared to a basket of good?

usaphp• 9 years ago

From my understanding a lot of people use it to transfer money between countries, you buy some bitcoins, then transfer them to your bank account in a different country, and you won't have to explain to the bank where you got the money and where you are transferring them because you could just say that you mined those coins and now cashing out. Correct me if there is a flaw in my logic

jdmichal2• 9 years ago

AKA money laundering? I mean, I guess if you're into wildly illegal actions, sure.

dboreham2• 9 years ago

Flaw will be realized when you arrive for first day in prison.

methodin• 9 years ago

Well I imagine there's no interest fees in crypto?

QML4• 9 years ago

Well how did you get a credit card? Wasn't it by going to a financial institution and submitting some type of identification?

You understand not everyone has that privilege right? Not everybody has access, the capital, or the identification to a first-world bank.

urethrafranklin5• 9 years ago

Show me one instance of an underbanked person who achieved a line of credit thanks to cryptocurrency. Just one, please.

That's right, they don't exist, and this argument is bullshit.

pedja• 9 years ago

My view here is that crypto-currency doesn't have to be better, but it has to exist so that fiat currencies have something to compete against, and then the users have a choice. It should be guided by normal market laws as any two financial products, e.g. if your view of insurance proves a valuable market insight, I am sure that insurers will consider doing it for crypto.

News like this are common for any emerging markets and technologies. Same amount of volatility was probably present in the first years of dollar, and same amount of insecurity was present while banks and credit cards were still being established.

I wonder how much different the crypto-currency conversation would have been if they appeared around the time when dollar lost its gold convertibility.

problems• 9 years ago

It almost certainly never will replace your credit card. But there are other things it can replace or create. Like paying in cash for less-than-legal products or confirming, beyond a shadow of a doubt that you're not using a stolen card as a transaction can't be revoked or even as something comparable to gold as a store of value (which seems like a terrible idea as of now, but is a possible future use case). It may also provide a distributed, trustless or near-trustless way to control equity in some things, but that's yet to be proven in my opinion.

For just about everything else, cryptocurrencies are crap, just a worse version of something that already exists. They're not a panacea, you can't throw a blockchain at everything and make it better.

free_everybody2• 9 years ago

because $1 = $1 like forever

Take a look at the purchasing power of the US dollar over the last century. http://bit.ly/2ushyfu

I'm not suggesting crypto is a better store of value, but there are surely better alternatives than the U.S. dollar for long term investments.

Even for short term holdings intended to transact with, wouldn't it be nice to not rely on a bloated, corrupt, violent corporation (AKA the US Gov)?

ojr• 9 years ago

You can't issue more dollars, but you can issue more of your token, It would be better for an app to have hacked token addresses than hacked credit card information, these tokens are usually cheap initially and its a free market, investment are always a risk. Why start a restaurant isn't that what all the other restaurants are for?

randomThoughts9• 9 years ago

1. I see the the current batch of crypto-currencies as an experiment and their valuation more like a bet on which currency will manage to adapt to the future.

2. Not all properties are relevant or even desirable: For example, I could live without POW or a fixed cap.

3. That being said, let me give you an example of a currency that could realistically be adopted by a government: a centrally controlled currency (the central bank is the only miner) but the blocks are validated by the citizens.

Here you could have the inflation rate specified through a smart contract (e.g. 3%). The only way to print more money would be to to ask the nodes to vote on an amount that will be included in the next block.

thephyber2• 9 years ago

because $1 = $1 like forever

No. $1 during the gold standard was different than $1 after we left it. Now, our central bank (the "Federal Reserve") aims to inflate our currency at +2%, every year. After 80 years (roughly a US lifetime), $1 at birth is worth $0.20 at death. And central banks can't always keep monetary policy under control.[1]

We just hit $20 trillion in US federal debt. It's set to continue to grow as baby boomers continue retiring. Congress has no spine to make large cuts in spending (for defense, discretionary, or entitlement programs). There are a handful of very large states in the same condition. The debt will continue to grow reasonably fast while the GDP of our economy has lagged.

$1 USD may say "$1" on the front forever, but the purchasing power of a dollar isn't likely to stay as strong as some other currencies. It's worth even less if large, important international transactions (like for oil/gas/weapons) are done less and less with the US dollar (@see "Bretton Woods" and "petrodollar").

[1] https://en.wikipedia.org/wiki/Hyperinflation

aqsheehy• 9 years ago

Try buying contraband with your credit card

ty_a2• 9 years ago

For anyone wondering, 45k ETH is about 7.65M USD.

option_greek2• 9 years ago

I wonder what happens if someone wants to liquidate this amount to USD immediately. Has ether got enough liquidity to handle it :)

nashashmi• 9 years ago

I think there was a recent 20% crash in ether price. Probably a result of immediate dumping from this hack.

arcaster3• 9 years ago

Yep, there's more than enough liquidity. People clearing more than $70k USD worth of ETH are usually going through OTC channels, not through exchanges like Poloniex and Coinbase. OTC fees are generally higher than exchanges, but offer the advantage of legally guaranteed finality and no chance of slippage affecting your transaction (exactly what happened with GDAX when the price of ETH briefly dropped to $0.10).

When deals are large enough, sometimes they are even executed as a set of "tranches" (large set of smaller transactions over time) so the transfer isn't easily traceable and counter-parties remain largely unknown.

immad• 9 years ago

Yes, Ether has $1.5bn in trading volume for the last 24 hours [1].

1: http://coinmarketcap.com

ty_a2• 9 years ago

Coinbase could probably do it. If there was an investigation into the theft, that would probably be a terrible idea.

imron7• 9 years ago

Well, considering that this amount of ETH was worth double that 2 weeks ago, I don't put much faith in it being worth anywhere near that much if they tried to liquidate it immediately.

mnaei• 9 years ago

Check out my project, it should solve the problem you mentioned. The goal would be to stabilize the price of Ether on the blockchain so the Ether can be sold off slowly without moving the market.

Its essentially a cryptocurrency risk management system where one user takes on all the profit/loss of cryptocurrencies price change so that other user (fund) pegges their wealth to USD

https://medium.com/@mnaei/are-you-selling-50-of-your-cryptoc...

ganonm2• 9 years ago

Either the average blockchain startup is unbelievably amateurish re. security or this was an inside job. I suspect the latter but the former does not surprise me one bit.

kalleboo2• 9 years ago

Isn't most of the IT field unbelievably amateurish re. security? Just look at the bi-monthly releases of user lists from major companies.

This is why I think wide adoption of cryptocurrency is a bad idea. Complete computer security is nearly impossible (I want to say completely impossible but I'll end up in an endless debate about single use offline computers printing out paper wallets).

ganonm2• 9 years ago

I think this is a disingenuous argument. Yes the vast majority of the IT field are not experts but if you don't hire one of these experts to secure your system, a system which is aiming to raise $12m, then you shouldn't be surprised when you get hacked.

Also, just because you're not an expert does not mean that you have any excuse to be completely clueless and make stupid mistakes.

tuxxy• 9 years ago

I have seen the code of a Bitcoin startup. Believe me, security is the last thing on their minds.

Personally, I find it exceptionally naive that these startups think they can handle payment processing, payment storage, and their core product at the same time. If you're a startup, at least two of these will be ignored for favor of another. One of them makes you money/users, the others don't.

lloydde2• 9 years ago

CoinDash's Token Sale page was tempered...

Now reads "tampered", but "tempered [sic]" would seem to have been appropriate if really was the message sent to investors. Funny how the subheadline had the typo before as well.

LyndsySimon• 9 years ago

This is the sort of email you don't spend a lot of time spellchecking.

lloydde2• 9 years ago

Right, I was thinking more of the news site.

kin• 9 years ago

Does Ethereum not have an escrow like Bitcoin where a 3rd party can confirm a transaction first?

But also, if it's really as easy as replacing some arbitrary address with another I'm surprised Coindash wasn't more careful.

52-6F-622• 9 years ago

I believe that is entirely up to the contract programmer(s), and the potential buyers to vet.

DennisP• 9 years ago

That's a simple contract, but...

If the ICO implements that, there's no protection from someone replacing the ICO address.

If buyers use escrow contracts, they have to confirm their transactions before the ICO closes, so for typical hard-capped ICOs you don't have much time to verify things. When the crowdsale's website is displaying wrong information, there's no other source, and the sale is rapidly approaching a hard cap on contributions, there's not much you can do.

A better defense against this type of attack is to use the Ethereum Name Service, and publish the address well in advance. It would also help to use crowdsale structures that don't incentivize a mad rush, such as:

http://www.blunderingcode.com/fairtokensales/

sharemywin2• 9 years ago

I wonder if a block chain could certify websites:

1. someone writes a url to the chain

2. others post a (url/hash/date time) of the output of the url

3. then people could post an image with their face and a blockchain address. could be a form of ID.

52-6F-622• 9 years ago

There are various groups working toward a blockchain id system including Thomson Reuters[0], and a Microsoft/Phillips-backed company Tierion[1] -- both on the Ethereum public chain.

[0] https://blockoneid.thomsonreuters.com/

[1] https://tierion.com/

Cshelton2• 9 years ago

This is what the ENS (Ethereum Name System) will be doing. In face, if you see an ICO on the Ethereum platform that doesn't use the ENS, avoid it. The ENS is actually really cool.

Although, you should probably avoid all ICO's =p

discombobulate5• 9 years ago

Token sales are risky. What do people expect? Guaranteed thousands-of-percent returns.

At this point, it probably takes good judgement to make money in crypto. You can't just throw fiat at anything & expect to walk away rich.

One of the reasons criminals are all over crypto is because they're valuable.

When Willie Sutton was asked why he robbed banks he replied: 'Because that's where the money is'.

I'd say caveat emptor.

lin_lin• 9 years ago

The freedom of unregulated money!

SirensOfTitan• 9 years ago

The full title on the link is: "Breaking: CoinDash’s Token Sale (ICO) Website Has Been Hacked." This submission is disingenuous at best, as it implies the ICO contract was hacked: someone hacked the webpage and changed the token sending address.

Edit: Looks like the title was updated. :)

discombobulate5• 9 years ago

1) Watch out for the website. And here's another tip from Vitalik,

'Reminder: if someone makes a token sale that gives discounts to large buyers, this can be circumvented via collective-buying smart contract.'[0]

I think people are going to start understanding how to navigate the new investment waters. It's going to take time. I still don't have as many sources of info in the area as I'd like. That too -- if the market continues to develop -- will change in time.

[0] https://twitter.com/VitalikButerin/status/886191450727297024

joosters4• 9 years ago

The 'tip' can be summarised to just 'avoid token sales, you mug'

imron7• 9 years ago

I should launch an ICO.

eugeneionesco• 9 years ago

Yep

https://motherboard.vice.com/en_us/article/evd5je/an-ethereu...

icoicoico• 9 years ago

Waiting for their announcement, but this would be a great way to pull a quick scam. Make a decent looking site promising a random piece of software that seems legit, promote an ICO, setup a fake wallet, then when the ICO goes live claim your site was "hacked" and points to a fake wallet you control. Grab a few million and never have to actually write said piece of software.

justusw• 9 years ago

Could HTTP public key pinning have prevented this at least partially?

williamscales• 9 years ago

Not necessarily, because the issue here is that the website containing the address itself was altered. If an attacker can get access to the web server then HTTP public key pinning does nothing to protect you.

What would have worked, however, would have been to pin the ICO address to the blockchain in advance. Same concept.

buryat• 9 years ago

I tend to believe that it was a scam because they refused to disclose the contract beforehand and there were some people claiming that it's a scam few months before [1].

[1] https://bitcointalk.org/index.php?topic=1905500.0

Obi_Juan_Kenobi2• 9 years ago

I say this without an ounce of hyperbole: I assume all ICOs are a scam until convinced otherwise.

The majority aren't outright scams (willful intent to defraud), but most are capital grabs with virtually no chance of being successful businesses.

jamespitts• 9 years ago

Important information related to this incident:

1. CoinDash did not publish the address of the contract in advance of the ICO:

https://www.reddit.com/r/ethereum/comments/6nsy6x/coindash_w...

2. Allegedly, CoinDash ignored issues brought up by a software contractor / code reviewer:

https://www.reddit.com/r/ethtrader/comments/6nrxk5/never_mis...

In reviewing their crowdsale code, I found multiple bugs and many errors. I've been ignored since I brought up the problems with the CoinDash team three days ago.

_jtrig2• 9 years ago

The entire point of Cryptocurrency is to step away from institutional trust, not dive head-first into it.

Bitcoin succeeds as a scarce and sovereign wealth management tool but once you give away the private keys, you lose those advantages.

nosuchthing2• 9 years ago

Bitcoin is only scarce for late adopters, by design early adopters of BTC software generated thousands of "coins" per week for running a mining-computation node of a normal 2-3GHz CPU.

BTC's network protocol service is not unique, and thus not scarce in the least. I.E. other protocols/network designs/token-ledgers offer the same service as BTC in addition to fixing the vulnerability to BTC's hashing algorithm which has led to the ASIC attacks on the Bitcoin network which just lead to centralization by the hardware producers.

sna1l• 9 years ago

This underscores the need for legitimacy and best practices around ICOs. I think CoinList (angellist company) will end up killing it in this space.

free_everybody2• 9 years ago

Please please PLEASE do not buy into these ICO's. Nothing but vapor, I promise you. Crypto is going to crash SO hard if people keep giving these ICO scammers millions of dollars for each slick marketing campaign they can spin up.

handzhiev• 9 years ago

Has anyone here played with "HYIPs" few years ago? Stories with many ICO are so similar.

Dolores12• 9 years ago

So you just got robbed. What law enforcement agency will you complain? Gold rush & Wild wild west.

CoinDash’s ICO Website Has Been Hacked

Related Stories