Bitfloor Hacked, $250,000 Missing

http://bitcoinmagazine.net/bitfloor-hacked-250000-missing/

43 50 14 years ago

david_shaw2• 14 years ago

And therein lies the problem with non-traceable, uninsured currency.

One of the benefits of using a major bank (in the United States, for this example), is that your money is federally insured. You'll always see little logos or blips of text advertising that the bank is a "member, FDIC."

People take this for granted -- after all, if your bank is robbed, why should it be your loss? It's a little harder when the currency is anonymous and completely uninsured.

Many bitcoin exchanges will do their best to dip into their profits to reimburse users after they were hacked. I know that several major exchanges have already dipped into their own coffers to reimburse their users. However, they need to pay for this completely out-of-pocket, and even then there's nothing that indicates that they have to do so.

I think that bitcoin is an interesting idea, and certainly has gained a lot of traction for more privacy-minded individuals. Those that want to active day-trade it, though, should stick to standard forex markets, in my opinion. In fact, there is nothing to guarantee that the organizers of an exchange won't simply steal your money and disappear -- there'd be no way to prove that it was them, short of seizing their machines and hoping an incriminating bitcoin wallet was sitting there.

lhnn• 14 years ago

It seems there is a market for an insurer of Bitcoin exchanges. Carry out extensive physical, procedural and offensive reviews against a set of standards, in exchange for certifying the exchange as "not easy to break", and insure its accounts up to a certain % of reserves.

blakdawg• 14 years ago

The problem is people don't want to pay a storage fee for leaving value on an exchange; they think they're getting ripped off because they're not earning interest like they would at a bank engaged in fractional reserve banking. Since the exchanges don't make money on deposits, it's tough for them to spend money to protect the deposits.

mdonahoe2• 14 years ago

Oh it is traceable, just unstoppable and ungoverned.

I assumed that "federally insured" was code for inflation, but the wikipedia article revealed that it is actually insurance: banks pay insurance fees to be in the FDIC.

tsotha• 14 years ago

Your sense of security is somewhat unfounded. In the US if someone breaks into your online bank account and steals all your money, legally you're on the hook for the loss unless you can prove the breach occurred on the bank's side.

david_shaw2• 14 years ago

  > if someone breaks into your online bank account and steals all
  > your money, legally you're on the hook unless you can prove the
  > breach occurred on the bank's side.

Right, but that's not a valid comparison to what happened.

If someone broke into your account, yes, you'd need to dispute the charges and prove that you did not drain the funds to your new Swiss bank account.

In this case, though, it's not an account that was broken into, but the exchange itself. If someone robs your bank at gunpoint or hacks into its backend servers, either way, you're not liable for the loss -- they're insured.

Individual security vs. organizational security are different in this respect. In fact, I'd argue that the individual security of bitcoin exchange accounts are even riskier than the exchange itself getting hacked: if your bitcoin wallet is compromised in any way, that money is gone forever. No one can do anything to get it back, and if the exchange wasn't compromised, they probably don't care about your terrible password (or malware-infested laptop, or compromised Internet connection, etc). If your bank account is hacked, and you report it, it's not your problem anymore.

tjoff2• 14 years ago

How is this a property of "non-traceable"/anonymity?

If someone physically robs the bank and gets away with a large amount of cash that is arguably even more anonymous and non-traceable than bitcoins.

The only problem ought to be that bitcoin exchanges are not being insured, by who or that the currency happened to be bitcoin doesn't matter (as long as the insurance covers it).

astrodust2• 14 years ago

Don't banks track the new money they receive by serial number range?

modarts• 14 years ago

"the attacker gained accesses to an unencrypted backup of the wallet keys"

What is with these bitcoin exchanges and their pathetic records on security? How is the currency ever supposed to go mainstream with these continual security lapses?

wmf3• 14 years ago

Hey man, they're just doing lean MVPs.

meepmorp• 14 years ago

I guess they just tend to use a somewhat different value for viable than I might.

jamescun• 14 years ago

Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure and STILL have the occasional lapse in security; how do you think a couple of guys in their spare time will fare?

wickedchicken• 14 years ago

> Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure

Those banks are often guarding a considerably larger amount of money, which is something to take into consideration. I think your point still stands though.

spamizbad• 14 years ago

A bank's software infrastructure and "attack surface" dwarfs these tiny bit coin exchanges. Banks also have byzantine processes and guidelines that encumber their technical teams so building their software is inherently costly regardless of security.

Meanwhile unregulated, nimble BitCoin exchanges struggle with the OWASP top 10.

genwin2• 14 years ago

The quote makes sense if you want some plausible deniability for an inside job.

dclusin• 14 years ago

I work for a finance related technology provider and as a consequence get to see the technology practices of many brokers and other market makers. Often times their security is just as bad. The key difference is that trade settlement (a.k.a clearing) is a separate process (usually also separate company from exchange). This adds a layer of security because compromising the exchange doesn't always get you access to the clearing details. Clearing details are usually things like "Depoist X million dollars in bank account A, I will deposit x million euros in your bank account B." With Bitcoin quoting, trading, and clearing are all rolled into one.

fusiongyro• 14 years ago

Moreover, how is it going to go mainstream without mainstream exchanges? If these bitcoin thefts continue putting exchanges out of business, the thieves will wind up with a big pile of currency nobody is willing to convert back into dollars.

JulianMorrison• 14 years ago

It's hacker attitude. Build what seems like it will work, and launch.

The true flaw of hacker attitude is underestimation of the job by focusing on the part that looks straightforward, namely the part in code.

A bitcoin bank is the application. The bit that's written in code is just a part of it. The actual spec is: under all circumstances, this will either work as a bitcoin bank, or fail safe, or in the worst possible case fail with data loss. That spec requires you to examine the behaviors of the system as a system - you may be sure your opponents see it as such.

shuw2• 14 years ago

A problem with an untraceable currency is that it's also very easy for an exchange to collaborate with a hacker and vanish (or declare banckrupcy). Not saying that is what happened here, but that would be my fear.

genwin2• 14 years ago

Yep. Exploring that risk, they might say something like "the attacker gained accesses to an unencrypted backup of the wallet keys", then say they'll consider making everyone whole, then go bankrupt.

javert6• 14 years ago

Those kinds of trust issues are present in some form in many kinds of commercial transactions, and there are many ways of dealing with them (insurance, lawsuits, interact with companies you can trust and avoid ones you can't, etc.).

shuw2• 14 years ago

Bitcoin provides plausible deniability, which makes lawsuits difficult. In contrast to centralized banking systems which leave a paper trail.

And insuring bitcoins has its own logistical challenges that will probably scare an actuary.

Trust is a hard one as I'm sure the people who used bitfloor had trusted it until today.

pixie_2• 14 years ago

'hacked' ... Anyways, here's my question - why aren't private keys for these centralized wallets encrypted with a password the user has to put in when they do a transaction. That way private keys aren't stored on disk, but only temporarily in memory. Also if the encrypted keys get stolen, there's time for people to move their money to new wallets before the encryption is broken.

witten• 14 years ago

Transactions are often automatic and unattended. For instance, you put in a buy or sell order that may or may not be automatically fulfilled sometime in the next day.

pixie_2• 14 years ago

Answered my own question - https://blockchain.info has an online wallet that works just like this.

nvmc2• 14 years ago

I lost a lot back when they were ~$20 a pop and you could still crunch them. I lost enough to put me off completely. Nice to know my caution isn't entirely paranoia induced.

brador• 14 years ago

When you day lost, how exctly? Hacked trading? other?

nvmc2• 14 years ago

I had some in an exchange which was hacked.

drivebyacct2• 14 years ago

Why do people leave any amount of money in the wallets at these places?

wmf3• 14 years ago

Do you mean the exchange or the customers? The customers have to deposit BTC before they can place any sell order, and the BTC has to be held in escrow by the exchange as long as that order stays on the books. As others have said though, the exchange shouldn't be keeping much money in a hot wallet; that's probably just lazy programming.

bdcravens• 14 years ago

Read the thread referenced in the article: https://bitcointalk.org/index.php?topic=105818.0e

Bitfloor admits to earning about $2100 a month. So it's a totally unregulated market, and it'd be easy to increase your earnings by 100x this month. During the time the wallet was left in an unencrypted location, just happened to get hacked.

I can't call the Bitfloor owner a thief, but reading his posts about looking to the future, and not to the past, no claim of a police report being filed, and the generic term "We got hacked!" make for some obvious conclusions.

javert6• 14 years ago

I seriously doubt they stole the money, because they've exhibited an extremely high level of professionalism in the past.

(Even when not comparing them to other bitcoin ventures, which tend to set a very low bar.)

Another reason I doubt they would steal it is because "cashing out" now would be like Zuckerburg cashing out a year after starting Facebook. At least, from the perspective of someone who believes in bitcoin.

gst2• 14 years ago

The best thing about this is that the conversion rate of Bitcoins is relatively unaffected. And that's good, because this is not a failure of Bitcoin, but of a single service provider.

mdonahoe2• 14 years ago

Since all bitcoin transactions are traceable, it will be interesting to see how this money gets laundered.

astrodust2• 14 years ago

"Follow the money" has turned into "follow the chain".

gst2• 14 years ago

1) Setup free Bitcoin mixer service where people can "launder" their own Bitcoins for improved anonymity (Hint: those services already exist)

2) Feed your stolen coins into the service and make sure that the rate of this isn't too high

3) Profit (if someone asks you have the perfect excuse)

And in case you argue "using money from such a mixer service is suspicious": It doesn't have to be a mixer service. Use one of the numerous Bitcoin casinos. With the right games you can expect to win around 90% or more of the money that you've invested. And if you're lucky the coins that you get from the casino are different than the ones you paid them.

tlrobinson2• 14 years ago

1. Start a Bitcoin exchange

2. Announce you were "hacked"

3. Profit!

tlrobinson2• 14 years ago

Are there tools/databases out that keep track of stolen Bitcoins and where they end up? It seems like it would be in the interest of the exchanges to share this information and blacklist coins originating from a theft.

They should also allow users to check incoming transactions against this blacklist and reject them if they choose. I suppose you'd end up with a black market of tainted Bitcoin, but that's better than just allowing thieves to immediately exchange stolen coins for another currency or legitimate services/products.

javert6• 14 years ago

To answer your first question: It's pretty easy to track where bitcoins go. People have tools that visualize this (I've seen them). I don't know of one off the top of my head I can point you to, though.

To answer your second question: This idea has been discussed at length on bitcointalk.org by a lot of people. The idea is known as "tainting." There are a lot of problems with making it work in practice, so the concensus seems to be "don't go there."

To give you a sample of the (IMHO valid) objections: For one thing, it's difficult to verify which coins really should be tainted. (How do you know someone claiming certain coins should be tainted is trustworthy?) For another thing, tainting creates two "competing" bitcoin currencies, black coins and white coins. Finally, there is no central authority, so it would be challenging (though perhaps not impossible) to come to a "general concensus" on who should be in charge of declaring coins tainted.

rb2k_• 14 years ago

Yet another Bitcoin exchange on Linode being hacked through the service console (I can't find the post where he mentioned it, but I remember reading it yesterday. He mentioned that the machine wasn't reachable on an external IP.).

I'm currently not sure about weather this is partially to blame or not. Would a dedicated server have made it harder to access the machine?

campbx• 14 years ago

Sorry to hear that a lot of people's bitcoin deposits were lost in the BitFloor hack.

CampBX has been in operation for over a year, is based in Atlanta, and has successfully cleared multiple independent Pen-tests and security audits.

Give us a try! www.CampBX.com

Bitfloor Hacked, $250,000 Missing

Related Stories