Mt. Gox leak rumor

by yeukhon • 12 years ago

70 31 12 years ago

Zombieball• 12 years ago

I've loosely been following the MtGox fiasco, including previous hacking that revealed voice conversations, passport scans, etc. However, I don't quite understand the context or ramifications of this leak. Could someone give a brief description?

Much appreciated!

junto• 12 years ago

I took this away as a tl;dr

   Currency: BTC Balance: 951,116.21905382 <– That fat fuck has been lying!!

bradyd• 12 years ago

But in another part of the statement it says "We stole no bitcoins. There were none to steal.", which seems to contradict them having ~1 million BTC.

Danieru• 12 years ago

It appears the hackers think it is a lie because all public statements I remember seeing and even the leaked "resurrection" plan talk about 0.7M BTC.

There has been talk of a Wally trading program which is said to have be run by Mt. Gox to profit from the price imbalances. If this is true then the 200k might be Wally's account. Which would explain why Mt. Gox does not consider it real liabilities.

DrStalker3• 12 years ago

It means they had a security issue that let someone steal their database.

The DB shows they have lots of bitcoins and money available, but that doesn't mean anything because if they were hacked in the manner they described the DB would still show them as having bitcoins that they don't actually have.

This means the information presented matches multiple scenarios including the bitcoins were stolen by Gox, the bitcoins were stolen by hackers and the exchange is still operational and fully funded. It rules out a hack that involved someone removing coins in a way that updated the bitcoin balance in the DB (such as password theft) but there was never any speculation that such an attack had occurred so that isn't helpful.

rys2• 12 years ago

The full leak contains a back office administration tool used by Mt.Gox, and what looks to be complete trade logs up to and including November 2013. The leakers haven't included any personally identifiable information.

If it means anything, I've had a look for my trading activity and it's all there and completely correct.

nwh• 12 years ago

They certainly have. The amounts withdrawn and deposited are enough to make solid connections between addresses on the blockchain. With this information it's possible to make a lot of associations between addresses you couldn't before knowing this information. From what I've read it gives the amount, account hash and the time, that's more than enough to uniquely identify them on the blockchain.

nullc• 12 years ago

For people who had frequently reused publicly known addresses it's as good as putting their account name on the records.

I guess people didn't learn from the infamous AOL search data release.

rys2• 12 years ago

You're right, I didn't think about the connection between exact BTC amounts and those being visible on the blockchain in plain sight.

542458• 12 years ago

Before everybody gets all up in arms about how this says that they still had around 1 million BTC, remember that this lines up exactly with what Mt. Gox has been saying.

This is Mt. Gox's own accounting. It should report that they still have BTC. But these are just numbers from a database. What Gox has said is that while they thought that they still had BTC, while their systems (AKA this) still reported them having lots of BTC, the actual wallets had long since been emptied.

So really, this doesn't help anybody in any ways. It could still be a hack, or it could be Gox screwing with everybody, or it could be something else entirely. It really doesn't mean anything. Other that showing that Gox still can't secure anything to save their life.

glesica• 12 years ago

Can someone explain how these guys managed to write their software in such a way that there was zero automatic verification that what their database said matched what was in the wallets, even just a cron job that ran once a week or something? I mean, I'm assuming there's a good reason, because I can't figure out how anyone could overlook something like that.

iSnow• 12 years ago

If the rumors are right, then Gox not even had unit tests or a version control system go figure.

Bitcoin squarely is in the hand of amateurs - good ones like the dev team and bad ones like Karpeles et al.

drewcrawford• 12 years ago

It's pretty easy to miss "basics of a good design" like a cron job job when you are also missing actual basics like source control or any release process whatsoever [1]. I understand the Wired article to mean that for awhile they were actually editing source code on production servers in some cases.

This really is a case of a company managing assets well in excess of the limitations of its experience or ability, literally a trading card company that found themselves operating as a bank.

The thing I don't know was whether their customers had adequate notice that mtgox was grossly incompetent. Smart people have told me they did, but at the same time, the list of services I use where I have personally bothered to check if they use source control and have a test environment is not very long.

[1] http://www.wired.com/wiredenterprise/2014/03/bitcoin-exchang...

sheetjs• 12 years ago

To be fair, even major financial firms and hedge funds have these types of problems. Lack of pre-trade risk controls and position checks (not too dissimilar to what happened with MtGox) contributed to the spectacular blow-up of Knight Capital a few years ago

waterlesscloud• 12 years ago

Forget automatic verification, I'm extremely skeptical you wouldn't notice this just manually.

hibikir• 12 years ago

You'd be amazed by the large, boneheaded moves that even the smartest people make when they fail to think defensively. Any security holes, even when people see them, can be easily discounted by just 'eh, nobody will try to hack us'. I've seen that done in Fortune 500 companies whose main business is all about IP!

If you can't identify how likely you are of being hacked, and how much is there to lose if that happens, you'll make terrible security decisions, regardless of the engineering skills available.

PeterisP2• 12 years ago

If you have bitcoins in 'cold storage' (Gox supposedly had 99+% their BTC that way) - i.e., the keys are physically offline and not accessible remotely in any way - then I don't see any easy ways of checking if all those coins are still valid.

tlrobinson• 12 years ago

This is the same content posted to Karpeles' blog, already being discussed here: https://news.ycombinator.com/item?id=7369072

yeukhon• 12 years ago

Ah thanks. Poster of this HN post here. I posted it on pastebin because the original content could be removed later and I thought saving in a cache like pastebin was a good idea, so I didn't check whether original link has been posted or not.

mckee1• 12 years ago

Yeah you were quite right, the info has now been removed from Mark's blog.

xpda• 12 years ago

It is possible that MtGox lost its money by dipping into deposits and pending cash withdrawals for its own use. Then, maybe some bad investments snowballed and they couldn't recover.

This seems more likely than someone hacking them and ripping off hundreds of millions of dollars worth of bitcoins without them noticing.

There is regulation that prevents this (most of the time) in banks, but in an unregulated exchange it would be easy (and stupid) to start gambling with customer deposits and pending withdrawals.

A few months ago I set up a MtGox account, and noticed the MtGox policy of taking weeks or months to wire the proceeds from a bitcoin sale. That seemed like a red flag, and made me wonder what they're doing with the cash between the bitcoin sale and the wire transfer. I'm glad I opted out of MtGox.

fleitz• 12 years ago

From a legal perspective for mtgox you really couldn't hope for better news, not only have their systems been tampered with but now there is undoubted proof.

Just paint yourself as the good guy amongst a scene of money launderers, hackers and drug dealers. This isn't proof of fraud, it's proof that people broke into their systems and tampered with them.

DrStalker3• 12 years ago

The attackers here broke in and stole a DB copy, they may not have been able to tamper (e.g.: they had access to a backup of the DB but not the running copy)

It's probably still a good part of a "we're incompetent not malicious!" defense, if that is how they decide to handle things.

dcc1• 12 years ago

Its correct, has 20 euro balance on an account I haven't used in 2 years and forgot about until this hoopla began

Mt. Gox leak rumor

Related Stories