Inputs.io hacked – 4100 BTC stolen

by citricsquid • 13 years ago

161 173 13 years ago

M4v3R5• 13 years ago

4100 BTC = 1.1 mil USD at current prices. These Bitcoins were stolen from website's "hot wallet" (every shared wallet has to operate one to process current withdrawals). This hot wallet was probably too hot though, as it seems that they had most of their coins online, and only about one third offline (other services claim to store 80-90% offline). According to postings on Bitcointalk.org forums people are getting back partial refunds. One person claimed to receive 37% of his balance back [1].

UPDATE: Correction - according to [4] it seems that almost all funds were stoled in the hot wallet, and the hacker was "nice" enough to not steal it all at once, presumably to stay undetected and come back for more. I'm not sure if I buy this argument though.

Also, according to the owners the hack occurred on 26th October [2]. It may be possible that if you deposited funds after that date you will receive full refund, as they should still be on their wallets. Unless hackers took that too.

UPDATE: Also according to [4] the funds that were being deposited after 26th were being withdrawn at the same time by other users. So they're as gone as the ones from before 26th. You will be refunded in full only if you deposited very recently.

This whole situation (and a bunch of previous ones) is also why at Bitalo [3], we are developing an exchange which will not have this problem, as we use multi-signature addressees to store the coins. This means that you need two signatures to spend funds - one from us, and second one from the user. We also never transmit users password over the wire, as we use SRP protocol for authentication.

In unrelated news, China just passed 1800 CNY per BTC :). I wonder how's the security status of chinese exchanges/wallets. Unfortunately I don't know the language, so can't test that.

[1] https://bitcointalk.org/index.php?topic=248803.msg3505884#ms...

[2] https://bitcointalk.org/index.php?topic=248803.msg3505966#ms...

[3] http://bitalo.com (in private beta, drop a message to martin@bitalo.com to receive an invite)

[4] https://bitcointalk.org/index.php?topic=248803.msg3506034#ms...

clarkmoody• 13 years ago

I see what you did there[3] ;-)

Also, it's a shame that this kind of breach happens, but it seems like it's been a while since a "$COMPANY hacked X BTC stolen" headline was out there[1]. There seem to have been more of those in the past and they appear with less frequency, which is a good thing, I guess.

[1] Silk Road doesn't count toward this recollection, since it falls under the "Bitcoin $COMPANY busted by the feds" headline, which will probably happen more often in the future.

M4v3R5• 13 years ago

It's probably because the market for such services is slowly saturating. Entry bar is quite high, and people are not willing to use newly released services as much anymore, as it was before. So yeah, it's good that the rate is decreasing, but unless we remove the source of this (i.e. move away from "hosted Bitcoin wallets" scheme) this will still happen in the future.

chii• 13 years ago

i m ok with the feds stamping out crime. But i m not ok with the feds stamping out something which also has use outside of crimes. I sincerely hope bitcoin transactions aren't associated with crime, so that its popularity can grow more mainstream.

b1z• 13 years ago

You're right. I think the last few big online wallet breaches were Instawallet, and MyBitcoin.

For anyone who wants to get their missing BTC out of inputs.io (who doesn't), I've written a blog post here: http://bitcoinreviewer.com/inputs-io-hacked-refund/

joelrunyon• 13 years ago

I know this doesn't mean much, but I'm sorry, and saying that I'm very sad that this happened is an understatement.

Um....I don't see how anyone is okay with this answer.

akinder• 13 years ago

Because bitcoin! Way of the future man!

No thanks, I'll stick with insured deposits. Imagine if your bank called you up and said "Your money is gone, but we're reeeeeally sorry."

grey-area8• 13 years ago

What sort of server is Bitalo hosted on?

smoyer• 13 years ago

When you're hacked, I hope someone posts a self-serving expose here.

artiface2• 13 years ago

Interesting I had missed where he claimed the hack occurred 10-26. Because he pointed[1] to this transaction https://blockchain.info/tx/9536feebe3a50b94f85ca27d56e669a72... as the blockchain evidence. That transaction was on 10-23

[1] https://bitcointalk.org/index.php?topic=248803.msg3509247#ms...

martin_• 13 years ago

From their website:

"Security + privacy The most secure wallet ever created."

raverbashing• 13 years ago

That's usually true... Until it isn't

yowza• 13 years ago

What happens when bitcoins are stolen? Can they be use again without being traced?

onedev• 13 years ago

From what I've been told, yes....they can be used when stolen; it's kinda the whole untraceable, distributed nature of it all.

yelnatz• 13 years ago

It's traceable...

But no one's gonna stop them from using it, and if you're the receiver, you wouldn't care where it came from.

tiglionabbit• 13 years ago

But they are traceable. There is a public record of every wallet address the bitcoin has touched. If those who it was stolen from reveal their wallet addresses, it should be possible to track down the coins and find out who the thief was.

steveklabnik12• 13 years ago

untraceable

This is wrong. Every single transaction is saved, by everyone. It's the core of how the protocol works.

That doesn't mean there aren't ways to obscure who controls the wallets, but it's not untraceable, and 'distributed' has nothing to do with privacy.

steveklabnik12• 13 years ago

It depends on what you mean by 'traced.' All bitcoin transactions are 'traced,' but you can just set up a few thousand wallets, transfer some money to all of them, send them between each other, trade some away to other people for things... it's not clear simply from the transaction log who actually took them, and who is just receiving BTC from an anonymous buyer for some sort of service.

kevin_nisbet• 13 years ago

From my understanding of bitcoin, doing this would be trivially easy to track also. However, I haven't studied this in great detail, so what is said here may be incorrect.

*simplified view Wallet 1 stores 50 bitcoin for(i = 1; i < 100000; i++) { Transfer 1 bitcoin from Wallet i to Wallet i+1 }

At this point, wallet 100000 contains exactly 1 bitcoin, that every transaction can be traced back to wallet 0. I understand that you would include more wallets, varying values, etc. But the point is every one of those bitcoins can be traced back to the original wallet which has the stolen funds.

The only way to make this behavior viable that I can see, is to have intermediate services that mix up funds.

So you have 50BTC Stolen funds in Wallet A. I run Wallet B, that takes transactions from many people. You give me the 50BTC that is stolen. I send you 50 bitcoins in small increments randomly over a set period of time, but from the other transactions I have. I do the same for other people, using the 50BTC that you sent me.

As such, my service mixed the coins through a common point, which now makes tracking the chain very difficult. If I didn't mix this with other people's transactions, and gave you back you're own coin numbers, the coins would just track through me back to the original stolen wallet.

This would need a party to offer this type of service, with enough volume to obscure the source, and for that service to not keep records (or not be inspected through other means).

Again, I want to re-iterate, my knowledge of bitcoin is somewhat superficial, so don't take this as an authoritative post on the subject.

ge0rg• 13 years ago

Yes and no. You can trace every transaction back to day 0, so it is possible to know which other bitcoin wallet(s) the money was transferred to. If the thief however only uses the stolen BTC to pay for non-identifying services (i.e. internet hosting), it will be very hard to find them.

o2sd982• 13 years ago

Which begs the question, how can one determine the veracity of the security claims of website operators? Bitcoins are a convertible currency but are not regulated, insured or guaranteed by any authority. I guess even modern fiat currencies had their teething problems with theft and counterfeiting, so this is not too surprising.

steveklabnik12• 13 years ago

You cannot, just like you can't determine the claims of any other random server responding to port 80 somewhere on the 'net.

TheTaytay• 13 years ago

I wouldn't be surprised (or disappointed) if some enterprising company developed a security certification (a la PCI) for Bitcoin-related providers. You wouldn't _have_ to offer it, but the market might favor those that had subjected themselves to that scrutiny.

o2sd982• 13 years ago

It would be great to see a market solution to this. Bitcoin is a bit like the gold rush/wild west at the moment which is fine for those who understand this before diving in, but until these types of trust issues are resolved market participation will be limited, which presumably will eventually effect the liquidity of the market for btc.

elango• 13 years ago

Do bit coins have identity and hence be flagged as stolen somewhere ?.

steveklabnik12• 13 years ago

Each bitcoin goes into a wallet, which contains an address. There's no connection between a person and a wallet, though, and it's not a 1:1 mapping, either.

flagged as stolen

That would imply some sort of centralized authority to decide exactly what 'stolen' means. Even if a third-party service kept track, it'd be meaningless in short order, as mixers exist...

josephagoss2• 13 years ago

Also there is no connection between a wallet and an address except the wallet stores the address.

When the client sends the address the change is returned to a new change address, and the wallets are being designed now to never reuse addresses.

So it would become very hard to determine which of the outputs are change addresses and in the same wallet.

qnr2• 13 years ago

In theory, each coin (called transaction output in bitcoin lingo) can be traced through a chain of transactions to its originating block. In practice, this is useless because there is no correspondence between bitcoin addresses and individuals (except in certain points like exchanges that require your ID)

In other words, each time a coin changes addresses there is a plausible deniability for the owner of the receiving address that s/he received the coin as a result of a legitimate transaction (sale of goods/services, donation, whatever)

artiface2• 13 years ago

This is the wallet that the owner of Inputs.IO has claimed[1] is where the stolen funds were transferred:http://blockchain.info/fb/1emztw

Blockchain.info has tagged it as inputs.io hack. And a couple users have tagged it as well with public messages. But besides that, as far as I know, all anyone can do is watch it get drained.

[1] https://bitcointalk.org/index.php?topic=248803.msg3509247#ms...

verroq• 13 years ago

How do we know it's not the owner of input.io cashing out?

steveklabnik12• 13 years ago

You don't! This is the risk of transferring your money to someone without any sort of regulations whatsoever.

citricsquid• 13 years ago

Here is his proof that it is not an inside job: https://bitcointalk.org/index.php?topic=283756.msg3505394#ms...

lopatin• 13 years ago

I'm curious, how would someone go about proving this wasn't an inside job. Is that possible?

josephagoss2• 13 years ago

I had hundreds of Bitcoin on Coinlenders up until very recently when they switched to a "demo" legal-workaround that was legally terrible and childish.

Coinlenders is a sister site to Inputs that share the same wallets. Coinlenders funds are being re-distributed to Inputs wallets. I obviously made a good decision to leave Coinlenders when I did as Coinlenders users are going to get perhaps 40% of their invested amounts back.

What really should happen is the owner (Tradefortress on BitcoinTalk) Should use his own massive stash of Bitcoins to compensate all his users.

nwh3• 13 years ago

Looks like they are - https://blockchain.info/address/1GLadosEkeAsLReqS3yQ51E1R3wV...

tempestn3• 13 years ago

I don't know, $1.1M is a lot of money. If someone stole a million dollars from my company, I don't know if I'd be rushing to reimburse it with personal funds (assuming I even could), however bad I felt for the users.

That said, if I recall correctly, one case where the corporate veil can potentially be pierced in a lawsuit is negligence. IANAL, but maybe users would have a legitimate case against personal funds, assuming keeping a large percentage of deposits online was found to be negligent. It'd obviously be an incredibly complicated and expensive class action suit if it were to happen though. Also it would probably mean trying to bankrupt a guy who just got hacked and lost his company...

prophetx102• 13 years ago

And there you have it... if you were registered with a regulator you would have insurance and have had put up a multimillion dollar bond in some cases for a scenario were YOU screw up.

makomk2• 13 years ago

Well, the site owner apparently promised to reimburse any deposit losses with his own funds back when he was trying to convince people to deposit money on the site: https://bitcointalk.org/index.php?topic=283756.msg3505423#ms...

albertyw• 13 years ago

Anybody wondering how long it will take for Bitcoin to gain enough respectability for the FBI or Secret Service to get involved after hacks like this? If the same amount of money was stolen from a normal bank, it'd likely be covered by every news outlet.

ChuckMcM• 13 years ago

I don't think it is the FBI a BitCoin thief needs to fear.

That said, it is fascinating to watch people getting caught out when they have a "few dollars" in BitCoin and now its "a few hundred thousand dollars" suddenly the security requirements change dramatically. One would hope that would be bitcoin wallet holders are taking notes and things like daily security audits are the new normal.

jzwinck• 13 years ago

The BBC, Ars Technica, and others covered a theft one year ago of about one-quarter this much value (when converted to USD at the time). And the FBI was involved (not that they recovered the funds or anything): http://www.bbc.co.uk/news/technology-19633980

at-fates-hands• 13 years ago

Not sure about that. Also, I read somewhere that the going rate of solving bank robberies is around 75-80% and many robbers are only caught because a) they do something stupid like not wear a mask or do anything to conceal their identity, or b) continuing robbing banks until their caught.

Considering hacks like this take time and a fairly high level of sophistication, not sure the FBI would want to employ the amount of long term resources needed to hunt these guys down.

mrb4• 13 years ago

The inputs.io hack required zero sophistication. Did you read TradeFortress' explanation? The hacker merely used the password reset feature on an email account, and then reset the Linode Manager password from the email.

patio112• 13 years ago

Banks losing $1 million to hackers are not exactly science fiction. Typical outcomes including authorities not catching the thief, insurance paying out or the bank self-insuring, reiterating NDAs to employees who became aware of the theft, and absolutely no media coverage.

[Edit to add: For avoidance of ambiguity, I'm really, really, REALLY not suggesting that "Since banks are equally insecure, bitcoins are a great idea." Of greatest interest to HN readers, if your bank has a security fumble and your account is debited $25,000 as a result of this, you will almost certainly be reimbursed for every penny of that post-haste.]

rodgerd3• 13 years ago

I'm really, really, REALLY not suggesting that "Since banks are equally insecure

That's just as well, because otherwise I'd have to mock you. Banks are not equally insecure. I work for one, and we typically spend 10-20% of the cost of development for apps on security reviews and testing, and not from numptys from accounting firms, but actual, well-known, well-respected white hats who review our designs and run hacks against us.

We aren't perfect, of course. But these monkeys are barely on the same planet, never mind in the ballpark.

nnoitra• 13 years ago

This is exactly why not everyone should learn how to code and be a developer.

coralreef• 13 years ago

No it isn't. Its why you shouldn't keep your money in places that aren't secure.

aegiso• 13 years ago

I think it's exactly why they should.

If these unfortunate folk knew their internet security they would know better than to pump their money into random internet wallets, despite claims that it's the "most secure wallet ever created".

pera2• 13 years ago

This is exactly why everyone SHOULD learn how to code and be a developer. They were negligent.

prophetx102• 13 years ago

Who will bake my bread and pump my gas?

justin• 13 years ago

Just like Mein Kampf is evidence not everyone should learn to read and write.

kennywinker• 13 years ago

Godwin's law http://en.wikipedia.org/wiki/Godwin's_law

Helianthus6• 13 years ago

I don't know what you expected, Bitcoin enthusiasts.

You bought into a system where coins could be permanently lost because you forgot a password.

You bought into a system where the government cheerfully gained control of a large share of the market by simple confiscation.

You have recreated money. But you aren't even good at it! You still think that simple cryptography will excuse you from the fact that you're greedy bastards.

The reason I hate Bitcoin is that it intentionally promotes a counter-establishment treatise, and you have the batshit insane gall to claim that it is different.

I'm venting.

drstewart• 13 years ago

You bought into a system where coins could be permanently lost because you forgot a password.

As opposed to a system where coins can be permanently lost because you have a hole in your pocket?

jamesaguilar4• 13 years ago

Would have to be a rather large hole to lose a million dollars through it. Would have to be about 43" wide.

asciimo• 13 years ago

Are you referring to the 144,000 BTC confiscated in the Silk Road bust? There are almost 12,000,000 BTC in circulation. The Silk Road share accounts for about 1.2% Compare that with any government currency that is 100% government-controlled.

It's easy to permanently lose cash, too.

Helianthus6• 13 years ago

Yeah, it's easy to lose cash if you're on Wall Street, but no one lauds that.

You're stuck in a place where you're trying to differentiate yourself from Wall Street and you are exactly like Wall Street.

And then you compare the total BTC in circulation and its equivalence in USD... and...

What the fuck do you think you're doing?

Do you think you're toying with trillions of dollars?

The banking machine is ignoring you. It simply doesn't care.

mrb4• 13 years ago

You fail to point out that cash has all the same drawbacks:

You can permanently lose cash if destroyed in a fire.

Your cash or bank account can be confiscated easily by the government.

Etc.

Of course, unlike cash, Bitcoin has advantages because it offers the option to prevent these losses: you can back up a Bitcoin wallet. You can avoid government confiscation (password-protected wallet). Etc.

Helianthus6• 13 years ago

grey-area8• 13 years ago

I'm always astounded by comparisons of bitcoin to paper cash - in 10 years we probably won't even be using paper cash and it is hardly ever used for large transactions now in advanced countries - paper cash is history. I think I've done about 5% at most of my spending in paper in the last month.

How about digital cash?

Also, Bitcoin can be confiscated by the government, along with the computer/server it sits on (see silk road). A $5 wrench or a jail cell will deal with your encryption. You can also permanently lose it if someone copies your wallet/backup and then spends it particularly while it is on one of these exchanges - that's because transactions are not reversible or traceable to a verified identity.

Technically, I think Bitcoin sounds really substantial and love the idea of creating/spending keys which avoid government inflation, but the axioms on which the usage is based are all wrong -

I've never lost money in a fire, and never will. I don't want to avoid government confiscation by technical means (which fail), I want to avoid it by law. I don't want to be able to launder money (or for others to). I don't want my transactions to be anonymous and to have no central authority and no accountability when theft/fraud happens.

pera2• 13 years ago

Instead of hating something you should try to understand it first:

permanently lost because you forgot a password

You don't have to encrypt your wallet, that's up to you. If you believe that not even knowing the password of an encrypted wallet you should be able to recover your bitcoins your problem is actually with cryptography in general.

the government cheerfully gained control of a large share

Powerful entities have power, welcome to the real world.

the fact that you're greedy bastards

huh? can you expand on this?

it intentionally promotes a counter-establishment treatise

Nop, Bitcoin is a technology, and neither the paper nor the Bitcoin Foundation is "counter-establishment". Actually the last one is trying really hard to make Bitcoin "pro" establishment.

Sorry I don't wanna be rude but your post is absurd.

psionski4• 13 years ago

Nobody is forcing you to use it OR help its development. Why do you even care?

lmm5• 13 years ago

I care because the stories are spamming up HN. You can't downvote stories, and flagging them would probably be considered inappropriate.

dasil003• 13 years ago

I'm not an enthusiast, I don't own and have never owned any Bitcoin.

However I think your dismissal of Bitcoin is wrong. Not because it doesn't have flaws, and not even because it's guaranteed to succeed—there's no telling when a crypto breakthrough could cause Bitcoin to crash and burn faster than tulip bulbs—but rather because Bitcoin is the most interesting development in currency of the past millennium. There's simply no denying it has unique properties of considerable interest, regardless of ideology or affiliation.

SkyMarshal2• 13 years ago

I'm not particularly invested in BTC either (own like 0.000001 or something), but I find it fascinating for similar reasons.

Imho it represents and inflection point in human history, by virtue of solving a previously unsolvable algorithmic problem (distributed consensus), at least in the context of digital currency.

BTC's solution wasn't even technically possible until two other major innovations - the construction of the internet, and the invention of the Bittorrent protocol. And 'Satoshi's' insight that a simple time delay via proof-of-work finally tied it all together and made possible the first (technically) viable distributed currency.

All the remaining problems are minor by comparison and will eventually get solved, in the same way the modern banking system eventually solved problems of bank robberies and fraud - not so much completely solving them, but by making them extremely difficult to pull off and/or get away with, reducing the odds and risk to levels acceptable for the general public. Same will happen with BTC and its infrastructure over time as well.

2810• 13 years ago

is a trend.. start up a legit Bitcoin service. Run it well with high aims, etc, etc to make an impression to the public. Consciously create a loop hole and hack your own Bitcoin service and close it down.

Taylorious• 13 years ago

So I have seen several of these stories pop up and I am still kind of confused by them. Are these hackers actually getting "real" money at some point? Are they able to cash out these bitcoins to USD or something else in a reasonable time-frame, or do they simply have a large amount of "fake" money that they can use for very specific goods and services?

bdcravens• 13 years ago

They're likely moving the Bitcoins to their own cryptowallet. At that point they could spend on sources that accept Bitcoin for payment (Silk Road and the like, Reddit Gold, the small but growing set of real-world places that take Bitcoin, etc) or could transfer to an exchange to cash out.

tl;dr - both.

hvidgaard4• 13 years ago

Problem is that the coins can be traced, so they need to spend them anonymously.

jamesaguilar4• 13 years ago

They can sell the coins on any exchange that allows them to convert it to real money. Not sure how deep the order book is so they may not be able to convert it all at once.

RyanZAG• 13 years ago

They can certainly cash it out using a number of bitcoin to currency services. So the hacker has done the equivalent of stealing $1mil out of a bank, except a bank is very easy to trace while stealing BTC means the thief is home free.

  https://www.bitcoin.de/en?cr=1
  https://www.bitstamp.net/
  https://btc-e.com/
  https://www.bitfinex.com/
  https://localbitcoins.com/

meowface• 13 years ago

They may very well hang onto them for a while, and in the event the price goes up even more in the coming months, they may make out with quite a bit more than $1M.

JeremyBanks• 13 years ago

BitCoins are difficult to anonymize. If you take your stolen coins directly to an exchange, the exchange would be able to identify you if law enforcement asked.

venomsnake2• 13 years ago

It is possible ... but you need some specific conditions - someone willing to convert bitcoin for real money in a jurisdiction that has lax money laundering laws, then he must somehow launder them.

superuser2• 13 years ago

Is there anything to stop the community from creating a database of known-stolen Bitcoins which participants can choose to reject? I guess all it takes is one non-participating exchange, but it seems like you could make it much less convenient to cash out.

patio112• 13 years ago

Many members of the community have reacted quite loudly and negatively to the suggestion that a central authority should be able to declare certain bitcoins tainted. This effectively introduces an external-to-the-blockchain way to essentially remove their bitcoins from their control, which they (currently) believe is impossible in bitcoin, and which they believe would devalue their bitcoins if it were known to be possible.

tempestn3• 13 years ago

I wonder if this is a problem that could be solved with an evolution of the technology. Meaning bitcoin (or a future crypto-currency) policing itself in a distributed manner, without requiring a central authority. Perhaps some way to hold referendums as to whether specific coins should be considered stolen. And if passed, some predetermined resolution mechanism would come into play, whereby the stolen coins would no longer be valid anywhere, and new coins would become available - either returned to the theft victim, or added to the mining pool, or something.

ronaldx• 13 years ago

I gather that it would be straightforward for individual bitcoin users to refuse to handle known-stolen bitcoins.

Perhaps this is illegal already - under local handling of stolen goods laws. People would likely be inclined to take up this policy were there a single case of legal enforcement.

I believe this would lead to a stable situation where those known-stolen bitcoins were worth far less than regular bitcoins.

The present loud reaction would become irrelevant. What's more, I believe it would benefit bitcoin to remove some of the danger of (irreversible) theft.

clarkm• 13 years ago

But they can always just run them through mixing services.

ninjin• 13 years ago

Well, one attack that I can come up with immediately is to just create a new wallet, transfer the bitcoins from the flagged wallet, then cash out from the new wallet. Your obvious retort would then be "Aha! But how about we just track any transactions from the flagged wallet and flag those wallets too!", sure, but then you open up for an alternative attack where you could get your wallet flagged and then send a minimal amount of bitcoins to some prominent wallet to have it automatically flagged (say the hot wallet of a major exchange), extortion anyone? To solve this we would need whitelists and the arms race goes on and on...

hvidgaard4• 13 years ago

You can track the individual transactions. So if I have some tainted coins and I really do not like you. I know your main wallet and transfer 1$ worth of tainted coins to you. You can just transfer the tainted coins out of the wallet and that is it - the rest of the coins in your wallet are perfectly fine.

That said, tainting is not a path we want to go down. The potential for abuse is enormous, and rendering more and more coins useless.

altero• 13 years ago

I have better question:

If all transactions are public, in theory you could trace user, who has your bitcoin now. Than you could sue him to get your stolen stuff back.

lmm5• 13 years ago

Is it clear that you have any kind of legal property when you "own" a bitcoin? I mean, it's just some numbers in a distributed database (and not one with legal backing the way the banking system has).

runarb• 13 years ago

The FBI would probably come knocking with a warrant demanding that all Bitcoins that has passed thru Silk Road should be added to the list, because thus founds comes from illegal activities.

nwh3• 13 years ago

This was a long time coming. The owner of the site's first posts on the forum was offering blackhat SEO and forum spamming services. Anybody who looked into the background of the creator could see that.

https://bitcointalk.org/index.php?topic=111563.msg1208770#ms...

lbarrow• 13 years ago

"No regulations" sounds great up until the moment when the bank gets robbed, the police don't care, and the only proof that it wasn't an inside job is a screenshot of the banker's email[1]. (Not that I think that it was an inside job. I just think this whole situation is kinda funny.)

https://bitcointalk.org/index.php?topic=283756.msg3505394#ms...

stakecounter• 13 years ago

If the owner is either incapable or unwilling to refund everybody's money then it doesn't even matter whether it was an inside job or not. It's pretty telling that he's posting a screenshot that essentially says nothing instead of being open about whether or not he'll be able to fully reimburse the people who lost money. I don't think it was explicitly stated, but it seems like people are just getting whatever percentage of the remaining funds that they owned.

camus2• 13 years ago

If that guy did not have some kind of insurance like banks do, how can he refund anyone? ( that's a question ).

And would insurances insure this kind of business ? Now are bitcoin wallets banks ? and are they subject to the same regulations ?

Is that guy a US citizen ? can he be sued by his clients ?

icedicedavid• 13 years ago

Back in July, TradeFortress, the operator of input.io claimed that 0 coins are store on the web facing server.

https://bitcointalk.org/index.php?topic=251553.0

simonebrunozzi• 13 years ago

1.1 Million US$ is a strong incentive to fake a theft. How can they prove it was someone else?

sz4kerto• 13 years ago

They don't need to

grey-area8• 13 years ago

These coins were stored on a VPS? On Linode? All it took to steal 1 million USD was to hack an email account?

Insanity.

tinco• 13 years ago

This needs to be upvoted more. How can someone have a hosting provider whilst claiming to be the most secure BANK out there?

This should have been pointed out long ago. It's a terrible thing that people get away with this. Arrogant developers who think they can do without sysadmin skills when building crucial software.

nwh3• 13 years ago

This should have been pointed out long ago.

It was. The creator smugly relied that it wasn't going to be an issue.

rmc• 13 years ago

BitCoin is security amateur hour. That's why the BitCoin protocol and client hasn't been attacked too much. It's just easier to hack some exchange.

justinholmes• 13 years ago

When are these online wallet companies going to start using colocated servers owned by themselves instead of Linode and other vps companies.

borplk• 13 years ago

Smells like inside job

sjwright• 13 years ago

It doesn't smell like either, because a competent outside or inside job will smell the same.

sojorn• 13 years ago

Interesting that the "theft" didn't happen until BTC reached $300.

barkingcat2• 13 years ago

"Please don't store Bitcoins on an internet connected device, regardless of it is your own or a service's."

Best advice I've read so far about bitcoins. All these services that's started up around keeping bitcoins for you, wallets, banks, they are all dodgy and no matter how well their marketing seems or how nice their webpages look, I think in the end - I'd like to keep my own money.

martinml• 13 years ago

They seem to be using Google Apps for the e-mail. And they claim:

    > The attacker was able to bypass 2FA due to a flaw on the server host side

Which flaw is this? Is it a known issue for Google? I would like to know more details.

jtolj• 13 years ago

As a Linode & GApps customer that uses DFA I'm curious about this as well... Are they talking about Google, Linode or their own app?

ryanthejuggler• 13 years ago

I had 0.25 BTC on Inputs.io and was uneasy about using the service. I withdrew it all on Monday to my phone... now I'm so glad that I did!

aric• 13 years ago

People who don't understand the importance of storing their own bitcoins spread across plenty of cold addresses -- generated from fresh, never-connected boxes and enough entropy -- are begging for loss. Given the attitude people have with security and the nature of viruses alone, 99%+ of people aren't 'ready' to use bitcoin beyond small amounts. It's inherently risky for any considerable amount. I never recommend bitcoin to most other people. It's recommended as worthy in and of itself, though.

Bitcoin's digital fungibility, which will always be a curse to some, will always be its greatest virtue. Distrust is one of its most valuable effects. Respect it or don't respect it. That's up to you.

odihack• 13 years ago

Available BANK HACKING SOFTWARE = $1500 This software hacks bank accounts.

HACKDOO (TROJAN) = $1100 Can steal information from any computer, informations like username and passwords, other account login details and credit card details.

VAMPIRE 3.5 = $200 Helps in hiding your ip unlimitedly. you can use any ip address you want

SOFTWARE BUG WESTERN UNION VERSION 2013 = $900 Western Union Bug is a software that cracks Western Union databases and gives the DATA of Western Union infomation for payment made to any country in the world. It scans the Western Union worldwide database and gets you MTCN from any country and city you choose just within 20 Minutes of clicking on the button start hack The Western Union Bug 2013 version comes with two types of Activation code, the first 20 digit activation code logs you into the first panel whereby you do fresh transfer while the second 20 digit activation code logs you into the Western Union database You can also use the software to make a fresh transfer by also scanning out a Western Union agent logins and using it to make a transfer to any Western receiving country in the world It is easy to use. And make quickly countries such as Africa, EU, CA, AU. TEACHING FEES BUY BANK HACKING SOFTWARE

I will teach you Hacking 3 months with all softwares for $3000 Become a hacker today. Contact me Odidollarsman@gmail.com

Bank transfers are now available to the following countries : USA UK EU Canada Australia Russia Singapore Dubai Vietnam

$2,000 - $10,000 per transfer to Personal accounts (Checking accounts, Savings accounts, Current accounts, Standard accounts) Transfers over $10,000 are available to Business or Corporate accounts only

Same day service to UK/USA/EU/Canada/Australia - 1 to 2 business days service to Russia/Dubai/Singapore,

Contact: odidollarsman@gmail.com

Inputs.io hacked – 4100 BTC stolen

Related Stories