Hackers Allege Mt. Gox Still Controls "Stolen" Bitcoins

The Verge reports that "Tokyo-based Bitcoin exchange Mt. Gox lost $400 million worth of bitcoins in February. Its management said the amount was stolen after hackers exploited a transaction bug to divert the funds, but some of Mt. Gox's users are not so sure, suggesting instead that the exchange's owners pocketed the cash. Now, facing silence from those owners about the fate of the money and the methods by which 6 percent of all of the Bitcoin in the world could have been stolen, a group of hackers claims it has broken into the bankrupted Bitcoin exchange's network to get answers. ... Forbes reports that the group gained access to the personal blog and Reddit account of Mark Karpeles, Mt. Gox's CEO. The hackers used the platforms to post a message that claimed Karpeles still had access to some of the bitcoins that he'd reported stolen. In support of the claim, they uploaded a series of files that included a spreadsheet of more than a million trades, Karpeles' home addresses, and a screenshot purportedly confirming the hackers' access to the data." (The Forbes article on which the Verge report is based.)

Re:Stills seems like it has to be an inside job

[delt0r]

Well i was on contract to fix bugs in a teleco accounting system where they could only find the missing cash every 3 months when a manual audit was done. Transaction volumes where a little over 1 Billion per year however, and it was only a million or so missing every 3 months.

Beware: Wallet-stealing virus in the dump

[psymastr]

Reddit users have verified [reddit.com] via decompilation that the dump file includes a wallet-stealing executable. The executable attempts to send the wallet to a hard-coded IP address, whose ISP has been notified of this.

Re:Stills seems like it has to be an inside job

[ras]

Consider these Mt. Gox loses [bitcointalk.org]:

• - June 2011: seller's administrator account was hacked by an unknown process. The priveleges were then abused to generate humungous quantities of BTC. None of the BTC, however, was backed by Mt. Gox. The attackers sold the BTC generated, driving Mt. Gox BTC prices down to cents. They then purchased the cheap BTC with their own accounts and withdrew the money. ... Many customers claim they have lost money from this reversion, but Mt. Gox claims it has reimbursed all customers fully for this theft. After the incident, Mt. Gox shut down for several days.
• - June 2011: Users with weak passwords on MyBitcoin who used the same password on Mt. Gox were in for a surprise after the June 2011 Mt. Gox Incident allowed weakly-salted hashes of all Mt. Gox user passwords to be leaked. These passwords were then hacked on MyBitcoin and a significant amount of money lost.
• - October 2011: Mt. Gox accidentally destroyed 2609.36304319 bitcoins.
• - July 2012: A hacker infiltrated the Mt. Gox account used by Bitcoin Syndicate, sold off the USD owned, and withdrew all balances.
• - July 2012: On July 13, 2012, a thief compromised the Bitcoinica Mt. Gox account. The thief made off with around 30% of Bitcoinica's bitcoin assets.

But for any programmer, none of this is a surprise given he hacked up an ssh server in PHP, then deployed it on a production server [ycombinator.com].

Re:Stills seems like it has to be an inside job

[Anonymous Coward]

They had half a billion dollars worth of bitcoins, a "currency" which is extremely hard to track and ridiculously easy to steal if you have the keys to the city. Stealing half a billion dollars (without being a bank) requires a truck and some heavy lifting.

Oh come on. Here is a story [cbsnews.com] about a single person stealing about 7billions worth without Bitcoins, trucks and heavy lifting.

Re:Beware: Wallet-stealing virus in the dump

[psymastr]

Actually it was Bulgaria, and they responded that they will take care of this.

Re:Sitting on a stack of traceable coins

[codebonobo]

Stolen coins can all be tracked but are still usable. There are numerous ways to make it harder to track with coinjoin, mixers, and trading back and forth between different crypto-blockchains that a thief can use to hide their assets however.

Re:Use them! don't save them

[Chas]

"Bitcoins are like cash."

I really REALLY wish people would stop saying this.
They're not. The way the Bitcoin system works, they're more like commodities.
Granted, some businesses have allowed you to pay for things with said fractional commodities, but still. At some point, an actual cash value has to be determined before you can actually SPEND them.

Re:This is why we can't have nice tihngs...

[Cardoor]

absolutely NOT. wow - and how long have you been employed by the fed I wonder - bringing out the 'magic of 1913'? is that you janet? modern currency as a fiat currency is not 'backed' by anything other than what it says on the bills - legal tender.. that the currency is acceptable as a means of payment in the eyes of the court system and hence, the structural society in which we live (with the implicit backing of the powers that be within that system). the fact that hard assets are used as collateral to make loans in a given currency in NO way means that said currency is then 'backed by those hard assets'. that is simply a line of recourse to a default on the CREDIT extended - nothing to do with the currency used as a medium of exchange. I could just as easily lend someone bitcoins using their car as collateral. jeez. and to say that debt-backed currency is even relatively immune to manipulation is incredible - especially when we are living in an age where it stares people in the face every day under the guise of 'quantitative easing', rate-rigging, and lawsuits involving currency manipulation. i'm not saying cryptocurrency is a solution, but damn. before you start throwing barbs under the guise of being the one who understands economics, you should make sure you know what you're talking about, and/or put down the propaganda talking points.

Re:This is why we can't have nice tihngs...

[durrr]

You've misunderstood what currency backing means.

A something-backed currency means that there have to be a _fixed_ amount of physical entity somewhere in the possession of whoever decides to give out the currency. This is not the case with the current fiat. Sure it can be exchanged for all those things you mentioned but it's backed by none of them, some central bankers could agree to create ex nihilo enough money to give a billion USD to every bank account in the world. If you then reason that a dollar is backed by cars then either there would be a huge surplus of cars somewhere to allow this to happen, or someone managed to multiply the current global carpool a millionfold overnight.