Mark Karpeles' blog hacked

http://blog.magicaltux.net/

by drewblaisdell • 12 years ago

152 82 12 years ago

blog.magicaltux.net

bhaumik• 12 years ago

Original post from his reddit account: http://www.reddit.com/r/Bitcoin/comments/1zz21j/mtgox_2014_h...

Bitcoin's history already has a trilogy's worth of entertainment

bertil• 12 years ago

Does this (the almost one million BitCoins) mean that he openly lied about being insolvent, or is this an undisclosed donation?

mpyne2• 12 years ago

It might be as simple as there being a balance in the accounts, but being insolvent on the books due to outstanding liabilities owed by MtGox. But I'm not an accountant so YMMV.

fredgrott• 12 years ago

even at $100 is more than the liabialities of 66 million

sp3327• 12 years ago

Remember, the "transaction malleability" attack would have siphoned money from their real wallet while not showing up in their accounting software. So having a balance in this file doesn't mean the wallet actually has BTC left.

antonius• 12 years ago

Waiting for a class-action against Mark Karpeles any minute now.

rmc2• 12 years ago

Does Japan have class action lawsuits? Not all countries do.

wfn• 12 years ago

I wonder if the balances revealed are concretely tied to wallet data, or rather simply are entries in a database. If the latter (and from what they said it seems to indeed be the latter), doesn't really mean much / doesn't contradict Mark's words in itself. (cf. Mark's comment that 'technically speaking [bitcoins are] not "lost" just yet, just temporarily unavailable.')

nwh2• 12 years ago

They would just be balances, otherwise every trade in their engine would hammer the Bitcoin network with transactions. No sane person would do anything but have an external databases with a fairly tenuous connection to the actual wallet balances.

yanghan2• 12 years ago

It's just a database dump. This doesn't mean that these values are backed by their wallets.

It's possible the bitcoin could be stolen and not reflected in the data.

iamshs6• 12 years ago

My cousin had an account on there with 102 BTC, and bought it while the price was around $650. He was having a hard time since last few days, but after a trekking trip and being with him since the fiasco he seems to be coping up fine. He is more worried about the Driver's license copy he provided as a verification. The database sure is leaked, and Identity theft seems real possibility. What are the safeguards that can be adopted now? Any help will be good.

jsaxton86• 12 years ago

FWIW, the original reddit post says "Keeping in line with fucking Gox alone, no user database dumps have been included."

nwh2• 12 years ago

Just because it's not posted publicly doesn't mean it won't be used by whatever parties have it. Given that this seems to be an American posting (comments about pizza and beer) and not the badly-typed Russian hacker earlier, it would appear that two parties at least have a copy of this information now (or alternatively got the information independently). You'd be a fool to assume this person is acting in good faith, they've exposed a hell of a lot of private data by posting this alone.

iamshs6• 12 years ago

True. They have not included it, they probably have it. Maybe there are other people who already have accessed it. He is effectively considering it in hands he may not want.

LocalPCGuy• 12 years ago

But, if that hacker can get in, more nefarious ones can as well. You should assume that any information stored with Gox is now no longer private.

gwern• 12 years ago

That's because they may be selling the rest of it. A 'nanashi' has already posted on Bitcointalk their terms (100btc for the entire dump, 10btc for 2gb etc).

colechristensen• 12 years ago

The ground-floor safeguard-which-isn't-a-safeguard is subscribing to one of many credit monitoring sites so you know what's happening.

Your state will have information about what to do if your drivers license was lost or stolen (even though obviously he still has the physical license). Some states will have somewhere to report you may be the target of identity theft. You should see if you can replace your license.

iamshs6• 12 years ago

It is a freaky situation to experience. It was straight freakout at first, which will now be replaced by lifelong paranoia of stolen identity.

Thank you. I did not know that the license could be replaced. If that can be done, that would be somewhat good.

Here are the steps found on the mounties site [1]:-

A- File a police report.

B- Contact your financial institutions.

C- Report to Equifax and TransUnion Canada

D- Report to info@antifraudcentre.ca

He is more freaked out due to the recent news reports of stolen passports used on the MAH 370.

[1] http://www.rcmp-grc.gc.ca/scams-fraudes/id-theft-vol-eng.htm

mindslight8• 12 years ago

Primarily, you need to straighten out your framework - "identity theft" isn't actually a real thing. It's a marketing term to scare people into thinking they share fault for institutions' trivially broken systems. In the event that a third party commits fraud using your cousin's non-secret driver's license number and your cousin suffers repercussions, the actual concepts you're looking for are libel and tortious interference committed by credit bureaus and banks.

carbocation• 12 years ago

Is that a legal theory that has been supported by court victories?

roel_v2• 12 years ago

What kind of stupid comment is this? "Identity theft" has caused people to be chased by collection agencies, to be prosecuted for or imprisoned for crimes they had nothing to do with, and credit ratings ruined.

Case in point: a copy of a guy's id card here was used when signing a lease for an apartment. Apartment was later found to contain marihuana plantation. Public prosecutor claims the guy is the guy behind it all, and has him arrested several times until 2 years later, at trial, the judge decides 'well it can't have been this guy, given all the circumstances'. In the mean time, he lost his job over it, was so stressed and depressed that his relationship fell apart, and was in financial ruins.

He handed a copy of his id to a temp agency once before this thing happened. Probably somebody there copied it, or there was a break-in there and somebody took it. There was no way to hold them responsible, nor were the actual people who rented the house ever found.

How can you say that 'identity theft' isn't real?

mikeash2• 12 years ago

"Identity theft" is a catch-all term describing fraud committed using this sort of information. It may not be as specific a term as you want it to be, but that's far from not being "actually a real thing".

tzs• 12 years ago

From Richard Feynman:

--------

The next Monday, when the fathers were all back at work, we kids were playing in a field. One kid says to me, “See that bird? What kind of bird is that?” I said, “I haven’t the slightest idea what kind of a bird it is.” He says, “It’s a brown-throated thrush. Your father doesn’t teach you anything!” But it was the opposite. He had already taught me: “See that bird?” he says. “It’s a Spencer’s warbler.” (I knew he didn’t know the real name.) “Well, in Italian, it’s a Chutto Lapittida. In Portuguese, it’s a Bom da Peida. In Chinese, it’s a Chung-long-tah, and in Japanese, it’s a Katano Tekeda. You can know the name of that bird in all the languages of the world, but when you’re finished, you’ll know absolutely nothing whatever about the bird. You’ll only know about humans in different places, and what they call the bird. So let’s look at the bird and see what it’s doing—that’s what counts.” (I learned very early the difference between knowing the name of something and knowing something.)

--------

iamshs's cousin doesn't need to be straightened out on the NAME of his situation. He needs help on DEALING with it.

curiouscats2• 12 years ago

Very well said. The main problem is the poor system in place and people's lack of ability to put constraints on their records.

Given the current state of affairs it is unforgivable that users can't activate higher levels of security for using their information. Given that the cost of the credit industries practices are born by people it is not ok for people to have no say over how casually credit is handed out.

iamshs6• 12 years ago

I agree with you. Even my friends know everything that is contained on the driver's license. Obtaining SSN can be a trivial thing too. The thing is he wants to contain the damage because now there can be real repercussions. Even though the banks are liable, he still needs to be proactive.

sciguy772• 12 years ago

I feel for your friend. I lost a lot of money as well, plus they have a copy of my drivers license and a copy of a utility bill for my home.

iamshs6• 12 years ago

I feel for you. He says hardest part was breaking the news to family. Straight afterwards he drove down to me, he said hearing scorn every second was becoming overbearing for him. Cryptocurrency can be hard to explain in layman terms.

dantiberian2• 12 years ago

I signed up for a Mt. Gox account ~12 months ago and included my drivers license. I then cancelled the account a few weeks later after one of the many Mt. Gox incidents. A few months ago when the price skyrocketed to $1000 USD/BTC I reopened my account with Mt. Gox. They didn't require any further information from me, just a a request to open the account.

I took from that that even when an account is cancelled/deleted, they still retained all user information including drivers licenses. Even if you deleted your Mt. Gox account before they went bust you may still be at risk.

mrb• 12 years ago

Retaining a customer's information after the account is closed is usually required by know-your-customer and anti-money laundering laws.

sp3327• 12 years ago

magnet:?xt=urn:btih:b6545ecc7db8d44c8cbc4e93989edf8221af75f5&dn=MtGox2014Leak.zip

If you can't get a peer via DHT, add tracker udp://tracker.publicbt.com:80

natdempk• 12 years ago

Probably worth adding openbittorrent as a tracker as well:

    udp://tracker.openbittorrent.com:80/announce

skorgu• 12 years ago

From the reddit thread: http://burnbit.com/torrent/280433/MtGox2014Leak_zip

sp3327• 12 years ago

That has some advantages, but also some disadvantages. It uses the original server as a "web seed", so even though it's a torrent, it's still putting a little strain on the web server for no good reason. Also with all those unnecessary trackers in there, it's long and awkward to copy-and-paste.

Cless• 12 years ago

Just because my database says I have $100 trillion does not mean I have $100 trillion.

aegiso• 12 years ago

You know what would be brilliant? If this were Karpeles himself using "hackings" in a desperate attempt to deflect legal responsibility.

I have no idea what the likelihood of this is, but it's in the realm of plausibility with all of the feces hitting the fan at Gox.

itry• 12 years ago

Karpeles posting about himself "That fat fuck has been lying!!" is an amusing thought :)

rdl• 12 years ago

Just as long as it isn't him saying "every statement I make is a lie".

Aqueous3• 12 years ago

"Brilliant" seems like the wrong word for that.

jpatokal• 12 years ago

I'd go for "brillant": http://thedailywtf.com/Articles/The_Brillant_Paula_Bean.aspx

yanghan2• 12 years ago

It's more likely the other way around. The same hackers dumping it to put the blame on Mark and deflect it from themselves.

easy_rider• 12 years ago

"I only took a little bit" [1]

"Or Aliens" [2]

[1] http://business.asiaone.com/sites/default/files/2014/01/07/2...

[2] http://i.ytimg.com/vi/ijhzD7FFHSA/0.jpg

Aqueous3• 12 years ago

They might very well be in possession of the 950k but have lost the private key to spend those funds. It looks like in recent days they regained control of 200k BTC, so perhaps they've recovered a key or two?

I sure wish they would make a statement soon because if it was in fact the case that they recovered a large portion of their BTC, that would go a long way to bolstering faith in BitCoin itself, whose brand they totally damaged by blaming transaction malleability in the first place.

sp3327• 12 years ago

They never mentioned losing a private key, did they?

Aqueous3• 12 years ago

Not specifically - perhaps because saying they were stolen is slightly (but only slightly) less embarrassing than saying they misplaced the key.

Karpeles did say something to the effect that the funds were "temporarily unavailable" - which would be consistent with losing the key, if they had any hope of getting it back.

danielweber2• 12 years ago

According to /r/Bitcoin the .zip file contains a virus. It's taking forever-and-a-day for me to download it so I can't verify that.

sp3327• 12 years ago

Which post? I see several that say it's clean.

rmc2• 12 years ago

Does this mean MtGox should get on haveibeenpwned.com ?

codewiz• 12 years ago

Until a few minutes ago, you could see this hidden message:

  $ curl http://89.248.171.30/
  <a href='MtGox2014Leak.zip'>They were not made out of magic Mark...</a>
  <!-- I hated working with you.   You deserve everything you get for what you did. -->

The machine seems down now.

wcummings• 12 years ago

Up now

MiWDesktopHack• 12 years ago

The leaked data set contains:

  * screenshot of the back office application
  * OSX and Windows back office application binaries
  * btc_xfer_total_summary.txt
  * CV-Mark_Karpeles_20100325.pdf
  * home_addresses.txt
  * trades_summary.txt
  * btc_xfer_report.csv containing every deposit and withdraw 
  * mtgox_balances containing the balances of all user wallets
  * trades.zip containing monthly csv files of all trades within mtgox & coinlab between 2011-04 to 2013-11
  * trades csvs have fields:  
  Trade_Id	Date	User_Id	User	User_Id_Hash	 
  Japan	Type	Currency  Bitcoins	Money	
  Money_Rate	Money_JPY	
  Money_Fee	Money_Fee_Rate	Money_Fee_JPY	 
  Bitcoin_Fee	Bitcoin_Fee_JPY	User_Country	User_State

From this data you could reconstruct every trade within the site, and identify the address from transaction values.

This dataset could lead to loss of anonymity to a significant number of people in the cryptocurrency world.

Phlarp• 12 years ago

If what you say is true and this data is sufficient to recreate and de-anonymize the trades on gox against withdrawals from their addresses shouldn't we be able to see if coins were actually stolen through tx malleability?

cauterize• 12 years ago

Would it be possible to use an alternative blockchain (maybe currency) to do internal accounting? Low confirmation requirement, add the BTC block chain transaction ID as a memo, consistency, etc.

callahad• 12 years ago

Wow, this is interesting. The folks dumping the dox asked for donations via Bitcoin. Thanks to the public nature of the blockchain, we can watch in real time as the donations come in: https://blockchain.info/address/1859rayqN1X7DYjD1BrAHm4vaQxo...

Mark Karpeles' blog hacked

Related Stories