Bitcoinica lost customer database, has no up to date record of trading balances

https://bitcointalk.org/index.php?topic=81045.msg921245#msg921245

by Estragon • 14 years ago

110 125 14 years ago

bitcointalk.org

berberous• 14 years ago

Yikes.

jasveer2• 14 years ago

"It's my fault to not set up a offline backup schedule."

For fuck's sake.

LaSombra• 14 years ago

Looks like a bunch of accountants and wannabe bankers bought some developing books and start to "invest" in BitCoin. They are missing the basics.

beedogs• 14 years ago

They're not necessarily accountants and business school dropouts. Never underestimate the incompetence of the average IT worker.

sipefree• 14 years ago

According to the original thread (http://news.ycombinator.com/item?id=2973301), the creator is a 17/18 year old.

Cushman6• 14 years ago

Everybody fucks up their backups at least once. Of course most of us don't keep money on our servers...

drivebyacct24• 14 years ago

No fucking kidding. This, the Mtgox hack (and insecure storage of passwords) is amateurish idiotic nonsense.

jsprinkles13• 14 years ago

With all the disclosures and absolute failures of security and operations that we've seen coming out of the Bitcoin field, can we start to quell the attitude that the Bitcoin market as it stands today is a real currency market? The only people that seem to work on Bitcoin secondary trading mechanisms are people that just know how to write a Rails app, and most seem to lack security sense or reliability awareness. Personally, as a seasoned developer, even I know that I probably shouldn't write a currency trading platform alone. I'm aware of the ramifications and what can go wrong, and I'm smart enough to rule myself out.

I will never call Bitcoin a real currency until you see a platform that actually knows what it's doing. Really, I'm sorry, that's just how it is, and the Bitcoin fans that are about to show up and try to tell me otherwise are just as misled (and are inevitably going to be victims of being so myopic). If you want to call Bitcoin real money, it needs to be treated like real money. In software terms, that means it is a big deal.

There is a reason currency is regulated heavily. You are witnessing it.

Edit: Clarified that I'm not attacking Bitcoin itself.

jasveer2• 14 years ago

The currency and its audience are different.

jsprinkles13• 14 years ago

Not at all. These sites that are being repeatedly compromised and yet positioned as "the market" for Bitcoin are, for all intents and purposes, the currency. Compare to USD: banks, exchanges, conversion, speculation. Without them, USD is just me handing someone else some paper, and Bitcoin is just as useless without the "market" as defined by a few hobbyist Web devs, in this case.

Think about it. I can send a Bitcoin address some Bitcoins, which is equivalent to me handing someone else some cash. Anywhere you want to go from there requires an external market, and that includes:

    - Accepting Bitcoins online
    - Converting to Bitcoins
    - Speculating with Bitcoins

ALL of those things are a "secondary market" which, in turn, increase the value of the currency. Traditional currencies have extensive support structures built around them, and those structures are heavily regulated to avoid this exact scenario. So far, Bitcoin has some hobby Web sites without any real consequences for fucking up.

ubernostrum• 14 years ago

Bitcoin is the currency for people who've read John Locke but not Thomas Hobbes.

jl62• 14 years ago

Your comment sounds clever, but I have read neither. Could you please elaborate?

Cushman6• 14 years ago

Bitcoin has a lot of problems, but this one confuses me. People steal real money all the time; it's one of the things that makes it real money.

fusiongyro2• 14 years ago

Why don't we get these kinds of responses when there's large-scale credit card fraud? "Hey people, it's just money, this shit happens. Go make more and quit crying."

I'll posit it's because the system we inherited—fiat currency insured by governments, poorly secured and handled by credit card companies—works just fine. Nobody would build it this way from scratch, but looking at the endless stream of fiascos with bitcoin, it's obviously better than the alternative. Bitcoin is a bad solution to a non-problem.

smsm422• 14 years ago

That's why people with significant amount of real money usually store it in properly secured and insured banks and similar institutions, not in a locker rented from some guy they never met. Unless, of course, they can't go into a bank for some reason - like having problems with The Law.

javert7• 14 years ago

I could point out several fallacies in your post. The most obvious one is that some very, very smart people (including at least one professional Linux kernel hacker) are doing a good job working on the official bitcoin client, so it's not true that the only people working on Bitcoin stuff are Rails users.

But what's the point in pointing out this and other fallacies in your post when you already stated that I am misled and that you're not willing to listen to me?

This kind of comment does not belong on HN. I don't care if you're PG, I would still say the same thing.

EDIT: Also, I really strong resent that you're trying to stop me from doing what I want with my time and money, which is what you're doing when you insist that bitcoin needs to be regulated. You have no right to tell me how to spend my money. Fuck off, man.

EDIT AGAIN: OP edited his comment after reading this comment, so this comment probably looks too harsh (but it wasn't originally).

jsprinkles13• 14 years ago

By "Bitcoin stuff", I mean the secondary markets that have arisen around it. That was probably a poor choice of phrase, and I'll update accordingly. I agree that Bitcoin itself is probably cryptographically strong and mostly well-designed.

To respond to your edit, regulation does not tell you how to spend your money. Regulation ensures that the systems accepting your money are designed against and proactively secured against failures such as this one, so you don't lose. FDIC insurance at your bank is an example of regulation designed to protect you. I have no interest in telling you how to spend your money; I do have an interest in the systems processing that money being reliable and safe.

I will ignore the rest of your needless incendiary comment, as it has no place on HN. You also don't need to inform everyone that I've edited my comment, as I did that for you at the base of it.

mdonahoe3• 14 years ago

This incident was a bank robbery. Cash has the same problem.

It's not like the thief subverted a flaw in bitcoin security. He ruined a crappy centralized service built on top of a decentralized system.

jsprinkles13• 14 years ago

More like a bank designed with an overly weak vault, because nobody at the bank spent a lot of time designing a very secure vault.

namidark• 14 years ago

Except banks are FDIC insured.

rasengan3• 14 years ago

I think this is awesome. We'll see technological evolution in its truest and rawest form happen at light speed. With every mistake and error comes a fix.

When someone crashed into the highway-wall when you are getting off the highway on a ramp the first time, they learned they needed to put barrels filled with water to cushion the impact.

I can't wait to see what awesome, hardened code comes out of this. :D

jsprinkles13• 14 years ago

"Innovate quickly and break things" is a strategy for social networks and games, not financial platforms nor life support systems. I hate that on one hand, we have people saying "Bitcoin is a totally real currency" and accepting payments, and on the other we have sites falling like flies to vulnerabilities and the defense being "we're just learning".

zyb09• 14 years ago

Bitcoin is very alive and kickin right now. The bitter truth is Bitcoin is now the de facto standard method of payment for all kinds of shady, criminal & laundering services on the net. What you got is a lawless currency, with no regulations what so ever, and no (assumed * ) oversight of trade. There so much hacking, fraud and insider scams going on, that trusting an online wallet like Bitconica is just waiting for your money to be stolen. Very hostile environment. No, this is not like "real money" at all, but it still holds value.

* it is assumed gov. institutions are monitoring large transactions now

bigphishy2• 14 years ago

What is the difference between bitconica and the most reputable bitcoin selling site? And what do you mean online wallet site like bitconica?

Frozenlock• 14 years ago

"What you got is a lawless currency" Laws are for people, not currency. Property and contract laws still apply even with different currencies. The fact that the surrounding infrastructure is still being built can be frowned upon, but this has nothing to do with laws.

And yes, it is like real money. In fact it's even more like real money then what most people use daily. Bitcoin properties are almost the same as precious metals, making it much more money-like than a fiat currency. (On which we build our bank accounts and, as yet another layer, various credit tools. At the end of the day, you start to be quite far away from "real money".) Now, if such a thing is desirable is another question entirely. Nevertheless, Bitcoin is money.

drivebyacct24• 14 years ago

There is no bitcoin market because some of the trading platforms that also work as banks have a hard timing doing a good job?

Pssh, what a lame argument.

jsprinkles13• 14 years ago

Care to refute it in any way, or are you just going to post pointless noise?

fl3tch• 14 years ago

It's a real currency market, it's just at the Bonnie and Clyde stage of its evolution. Consider how lax bank security was in the 1930s that a single couple could rob banks for years with a fraction of the sophistication of modern day bank robbers.

You couldn't get away with it today, not for that long, but it was possible with "real" money, "real" banks, all government backed, at one time. And that had centralization and identity built into it. The bitcoin community isn't big enough to have serious security professionals yet, but that doesn't disqualify it as a currency market.

jsprinkles13• 14 years ago

Which is why my comment has said, from the beginning, "as it stands today". Those interested in Bitcoin should seriously learn from those very mistakes that you're discussing, rather than re-learning them all over again.

rasengan3• 14 years ago

The "real" banks need to increase their securities too, but luckily with every mistake like this:

http://www.theinquirer.net/inquirer/news/2079431/citibank-ha...

They get stronger.

joe_the_user2• 14 years ago

You should be attacking Bitcoin itself.

Let's see. Real security people will tell you it's a disaster. Real economists will tell you it's a disaster. What else do you want?

Animus7• 14 years ago

> Real security people will tell you it's a disaster.

No, they won't. Bitcoin is built upon decades of battle-hardened industry-standard cryptography. The day someone cracks SHA you'll have a lot more to worry about than your Bitcoin wallet.

The only security problem with Bitcoin is people building insecure systems around it. Which of course has nothing to do with Bitcoin.

bestes• 14 years ago

Jeez, I sure hope Uncle Sam comes to protect us all from these big, mean hackers and these over-confident programmers.

That is the only way we will ever be safe. I would put a </sarcasm> but I can't turn it off that quickly.

smsm422• 14 years ago

This has very little to do with currency regulation, more with banking and security. It's like some guy opening a bank in an old garage with thin plaster walls, simple pin tumbler locks on the doors and regular metal closet as storage for money. One has to be really careless to put one's savings into such bank, and only reason I can imagine why people did that because it was not apparent to them.

Building secure publicly accessible website that can store bitcoins is very hard. Almost all common software has multiple vulnerabilities, and the fact that stealing bitcoins once system is compromised is trivial, and, as I understand, irreversible (unlike breaking into bank website, for example, but like breaking into bank vault with cash) - this makes such task super-hard. I would be very suspicious about any professional that is not properly intimidated by such task. I'm not saying it's not doable at all - probably can be done, but if somebody claimed he did it I'd ask for a lot of proof before I give him my money.

dublinclontarf2• 14 years ago

One of the things that makes a public website that deals with bitcoins secure is that it SHOULDN'T store them, or at least not an amount worth stealing.

Bitcoinica lost a huge amount of coins in March (more than this time) because they stored their wallet online, you shouldn't do this, use cold storage.

OK, Bitcionica do use cold storage, just that their hot wallet was pretty bloody big.

godDLL• 14 years ago

Wait, is this going to happen to all of them trading sites, in turn?! Is it something to say about the kind of people that are attracted to fast and furious trading, or is it just random negligence hiveminding?

citricsquid• 14 years ago

This seems to be the... 4th problem bitcoinica has had? 5th? Maybe event the 6th, why do people still use this site? Surely it has been shown on multiple occasions they can't be trusted with security.

Cushman6• 14 years ago

Their database was deleted and their site has been replaced with a form asking former users how much money they remember having.

I doubt very much that anyone is still using the site.

micahgoulart• 14 years ago

Imagine putting your money in a bank where every day, hundreds of burglars attempt to anonymously get in and steal money that cannot be traced back to you for you to recover it.

Sounds like a great place to put money in.

navyrain• 14 years ago

I'd like to think that this was some sort of nefarious action from an old-guard finance company who was threatened by Bitcoin enough to resort to the enlistment of some hackers.

In reality, this was plain amateur security practice, and if this sort of sloppiness continues, the bitcoin brand will be trampled so badly it will never get off the ground.

Estragon• 14 years ago

It's already well and truly off the ground.

uptown• 14 years ago

What problem does bitcoin solve? I've tried to understand the need for it, but just don't get it.

mynameishere• 14 years ago

All the paranoia that feeds goldbugs? Take that, and mix it with a total, naked vulnerability to 2-bit hackers.

Seriously, if you hate modern currencies, buy gold or silver or 20 year old scotch, hide it away...problem solved. Bitcoin was nonsense from conception.

javert7• 14 years ago

Here are some features that make it appealing.

(1) Fixed total supply, so it can't be manipulated by central banks.

(2) Fast online transactions (e.g. Paypal, without the problems of Paypal); ease of developing all kind of Web services around this.

(3) Anonymous transactions are possible, which can be beneficial in many ways (for example, not getting taxed...)

Steko• 14 years ago

(1) is only a selling point to people well outside the mainstream. Most people would consider this a huge negative.

(2) meanwhile I can buy things with one click using dollars.

(3) tax evasion, drug dealing and money laundering are not things that society generally wants to facilitate

iwwr• 14 years ago

For (1) you don't need fixed supply, just lack of central bank interference.

You can design bitcoin with a slowly increasing bounty each year, as long as the protocol is there, no central institution can control it.

(as a matter a fact, if the 50 BTC bounty were to continue indefinitely, the rate of money expansion would decrease over time)

pbhjpbhj2• 14 years ago

>(3) Anonymous transactions are possible, which can be beneficial in many ways (for example, not getting taxed...) //

Certainly where I am you'd still be taxed you're just avoiding paying the tax by hiding your identity. Tax here (UK) is still due if you choose to barter for goods/services so I can't imagine using an unofficial currency would make the slightest difference.

Devilboy2• 14 years ago

Anonymous cash on the internet. Nobody knows who owns each bitcoin account so you can do all sorts of things you could not otherwise. It's very similar to (for example) Pecunix, although unlike Pecunix it's not backed by gold and it's distributed which makes it hard to take down. Anything black or greymarket is suitable for bitcoin.

100% legitimate uses? Well you could use it instead of Paypal and save a couple of bucks in fees but it's a lot harder than just using Paypal and there's no recourse if something goes wrong.

SkyMarshal5• 14 years ago

It's actually easier than using PayPal, in my experience. Just open your client, copy-paste the recipient's address, hit Send, and voila, done.

You don't have to create an account, add credit/debit cards and bank accounts, get verified, etc.

Definitely no recourse if things go wrong, but also no way for black hats to game direct P2P BTC payments either, like they can with PayPal's resolution and chargeback system.

jnbiche2• 14 years ago

Clearly, you've never been paid for goods or services by someone overseas. Even in this day of highly-networked banks, I have to wait 4-5 days for an international wire payment, and I get charged $12. My counterpart overseas pays $20 for the transaction, and would love to pass that cost on to me (but I refuse to pay it). Many banks charge $20 or more for incoming international wire transfers. So it can cost anywhere from $25 to $40 USD to make an international wire payment.

However, if my clients used Bitcoins, I would receive the money in an hour or less, and pay like a $0.10 charge. Any no one would have the power to suddenly say, "oh wait, we're going to have to raise our fees".

Thousands of freelance writers, translators, programmers do a significant portion of their work with international clients. But the banking system rules out doing any job worth less than several hundred dollars, unless you want to lose 1/4 or 1/5 of your income to fees. I routinely turn down jobs that I could do in 30 minutes and make $150 because it's not worth the hassle of arranging an international wire transfer.

Do you understand now the legitimate need for this kind of currency?

mdonahoe3• 14 years ago

I hope people stop making services like this. Bitcoin is distributed for a reason

dublinclontarf2• 14 years ago

It is rather hard to distribute a market, centralisation be it's key strength.

Symmetry• 14 years ago

Not really. I mean, there's nothing centralized about dollar bills. As long as people publicly list their prices in bitcoins, everything will work out fine.

People will always need bitcoin exchanges to convert between bitcoin and other currencies, but those don't need to be storing other people bitcoins.

apsec112• 14 years ago

From HN thread announcing Bitcoinica's launch, some months ago (http://news.ycombinator.com/item?id=2973301):

"I'm going to pitch a different take than a few others: Yes, great initiative, please keep trying things and building things, but end this project now. There are no probable outcomes where you do not end up having to explain where thousands of dollars of other people's money went to some angry people. There's also very nontrivial odds of being on the wrong end of armed Federal agents, based on some of the other comments you've made here. This is a horrible, horrible first-project sort of project."

"Doing your best probably isn't enough. To have any hope you'll have to hire expensive security people and buy lots of insurance.

All you need in order to be exploited is to be using software with 0day exploits. Many known exploits are not public. In a very real sense, you are only protected to the extent that you are a small target.

As the potential payoff of a hacker approaches $1 million, the likelihood of being hacked approaches 90%. Software really is THAT insecure and bitcoin thefts are not prosecuted making it basically risk-free to steal bitcoins."

"-- spectacular failure is your destiny if you don't work very hard to prevent it

-- spectacular failure may be your destiny even if you do work very hard to prevent it"

mtjl79• 14 years ago

Wow, that gave me chills down my spine as I read the old thread.

joe_the_user2• 14 years ago

The problem is that the only kind of person who would start such a project would be a person who would be immune to these warnings...

RKearney• 14 years ago

This isn't so much a problem with Bitcoin as much as it's a problem with under-qualified people trying to set up "banks" online.

maeon3• 14 years ago

Protecting physical gold is just as hard a problem. Placing the gold inside a steel and concrete Box where only one person can open it still isn't secure. The problem is that without laws to punish people who steal, they will eventually break all of your security layers.

Perhaps we can design a new currency that goes back to basics. Money is just a contract between two humans, goods or services now are traded for claims on future human labor. Instead of using numbers or possession of objects, use something that can't be stolen. A system that streamlines the ancient bartering system. Trade you 100 gallons of milk for a new transmission. But instead of holding money, you perform the transaction real time. Instead of being paid in money, you get paid in receipts for goods/services performed which can be traded.

runako• 14 years ago

>> Placing the gold inside a steel and concrete Box where only one person can open it still isn't secure.

Nothing is really secure. But typically a gold vault is accompanied by a person with a gun who will shoot you if you try to take gold. There is no danger of physical harm in trying to steal Bitcoins. This is a fundamental difference.

SkyMarshal5• 14 years ago

Adam Smith actually wrote about just such a system, which later came to be called Real Bills.

http://www.safehaven.com/article/17603/real-bills-revisited

TLDR: When a merchant buys, say, a dress, from a producer, the merchant pays the producer with a note that gives the note's recipient the right to x% of the eventual sale price of the dress.

The producer can then use notes like that as a form of collateral for their own notes, which they can use like cash to pay upstream suppliers with it (fabric, thread, dye, sewing machines, etc).

Items tend to sell, or clear, within 91 days, so that is the term of the note. Eg, the note is 'self-clearing' within 91 days.

Eventually the dress will sell, and the cash/gold proceeds will remit up the chain, from merchant -> producer -> upstream suppliers, until all the notes and their derivatives are redeemed.

It's basically an alternative to bank credit that's backed by sales of real goods.

paulhauggis• 14 years ago

I don't even run anything close to something as important as Bitcoinica and I have daily database backups. What were they thinking??

eli• 14 years ago

Are your daily backups set up in a way that they are impossible to delete if your server is 0wned (either offline or using some kind of write-only scheme)? If so, I think you're ahead of most people...

DiabloD3• 14 years ago

I'm still offering a deal to people bit by the Bitcoinica failure to rebuild their investment portfolios: https://bitcointalk.org/index.php?topic=77469.msg901042#msg9...

Basically, I'll trade bonds in GLBSE listed mining companies for shares in DMC: ~2/3rds of a BTC worth of bonds for 1 BTC worth of DMC.

Bitcoinica royally screwed a large number of investors, and I want people to know and understand that not all of us are people out to steal their money. Some of us really are completely honest businessmen.

jimrandomh• 14 years ago

genjix wrote in https://bitcointalk.org/index.php?topic=81045.msg920554#msg9...

  > To the person above, here's what happened: 
  > - Bitcoinica has an internet mailing list called info@bitcoinica.com  
  > - It was the email for the website and all sensitive accounts.  
  > - You could request a password for that email. In a production system, that
  > should never be possible.  
  > - Several people had access to this mailing list (non-admins and business
  > people included).  
  > - Patrick got added.  
  > - His personal email was compromised. Normally this shouldn't be a big deal; I
  > use my personal email at internet cafes and public computers.  
  > - Attacker was able to request a new password and login to rackspace.  
  >   
  > The assumption here was that info@bitcoinica.com did not have access to 
  > critical infrastructure.
  >
  > Lastly, it was my fault Patrick's email server got compromised. I had a VPS
  > for programming and development which many people had access to - randoms from
  > #c++ IRC, people from this forum, beginners I was teaching .etc It's a
  > public VPS for development. The SSH key on there was added to Patrick's server
  > because we were developing the bitcoinconsultancy.com website on there (that's
  > why it's now down). My SSH key was stolen and he ssh'ed into the box.
  > Then had access to his emails.

So there you have it: it was one of those damn "Forgot Password" buttons, combined with mishandling email. The security of a server can't be better than the security of the least-secure computer with administrative access, and it looks like in this case, that was spread a little further than it should've been. This attack might've been prevented by introducing a delay: send an email saying that a password reset was requested, with a cancelable reset after several hours. But as far as I know, no one does that.

jamesaguilar• 14 years ago

Amusing. Seems like these guys should be engaging a consultancy for help, not trying to start one.

obilgic• 14 years ago

Specifically this[1] is the page that is used in this hacking operation.

[1] https://manage.rackspacecloud.com/pages/Login.jsp

mbreese• 14 years ago

It looks to me like the root cause was reusing an SSH key on a secure system and a public system. If the SSH key was compromised, that would lead me to believe that the private key was on the public/insecure system. That is a big security no-no as well.

zhoutong• 14 years ago

And the worse thing is, you can even re-use a password reset link for Rackspace Cloud even when it has already been used. Changing passwords won't log out existing sessions either.

noarchy• 14 years ago

This is nothing compared to the amounts of money involved in the botched Facebook IPO. If this incident proves that Bitcoin is in trouble, then by all mean extend this reasoning to NASDAQ, and other institutions with major incidents.

meatpopsicle• 14 years ago

This is what a market debasement looks like, ladies and gentlemen. If you can pay someone to keep Bitcoin performing poorly, you can mitigate the loss from your own failing currencies.

Perhaps I'm the only one that feels this way (I almost hope I am), but this news is making me want to put all of my money in bitcoin. it's a good time to get in on the action.

SkyMarshal5• 14 years ago

If your implication is correct, and someone is paying black hats to debase bitcoin, and nobody has any idea who is behind it so that those efforts will likely continue, then how does it follow that now is a good time to get in on the action and put all your money into BTC?

bigphishy2• 14 years ago

Phew, good thing I haven't been investing in bitcoins..

sgornick2• 14 years ago

Comically, many of Bitcoinica's customers were those who sent funds to the service to be able to go short (bet against) bitcoins.

But those "investing in bitcoins" wouldn't have lost from this unless they also happen to have been speculating at Bitcoinica with them. Bitcoinica is a service where a financial product called a contract for difference (CFD) is traded.

pbhjpbhj2• 14 years ago

So basically they used a server that could be deleted online by getting a single password (which was acquired via an SSH key for the bitcoin server being left lying around).

They didn't make offsite backups (sounds like they used to but stopped).

When the server was compromised they didn't realise that it could be deleted by the cracker.

One thing I don't understand, as these appear to have been real servers on Rackspace (you wouldn't exactly use a shared VPS, surely not?!?) couldn't they be recovered after the online "delete server" button was pressed? The top comment on the linked thread says that Rackspace had the server locked down with the only available option for the cracker to delete (which sounds very strange).

muyuu2• 14 years ago

It was a cheapo cloud VPS server, I shit you not. After getting their ass stolen for that very reason at Linode.

This site had a massive running profit and still went for the very cheapest option. Rackspace even offers financial services grade servers. I bet these aren't cheap though.

gosub• 14 years ago

This comment thread is full of people saying that incidents like this are mining the viability of a bitcoin currency. What many don't see is that bitcoin is an algorithmic solution to a problem a lot of people have (decentralized, untraceable money transactions). The implication of being algorithmic is that you don't have to trust people anymore, just the math. Even if this currency fails, the solution remains and will continue to be implemented.

For example, geometry was literally invented to measure land. I'm sure that when the Pythagorean theorem was discovered, some of the first "geometers" did screw up and made a wrong land measurment. Maybe some of the reaction at the time were: "Well this geometry thing is too dangerous, if one small calculus error could make me lose half my land. It will never catch on."

jsprinkles13• 14 years ago

I'm not following. You're saying that Bitcoin's discovery is equivalent to the discovery of a new field of mathematics?

z92• 14 years ago

When its founder declared this on HN 8 months back:

"I'm the creator of Bitcoinica. I'm not so established here. To be honest, I'm only 17."

http://news.ycombinator.com/item?id=2973313

I was waiting since then to see how bad can things possibly go.

Unlike other sites where people hack for fun, bitcoin offers hackers the opportunity to get some real money.

Bitcoinica lost customer database, has no up to date record of trading balances

Related Stories