Hacker News new | ask | show | jobs
Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied (coindesk.com)
105 points by vlastik 4601 days ago
9 comments

Every new day seems to bring another new Bitcoin scandal -- whether it's a hacked exchange, stolen wallets, frozen funds, collapsed Ponzi schemes, arrested illegal-market operators, or who knows what else.

Yet, despite all this, Bitcoin keeps appreciating, recently reaching an all-time high.[1]

--

[1] https://blockchain.info/charts/market-price?timespan=all

Bitcoin continues to appreciate, because positive developments surpass negative ones, by far. In the last week alone:

- Winklevosses: Bitcoin worth at least 100 times more: http://www.cnbc.com/id/101190181

- Federal Reserve economist says bitcoin is a remarkable technical achievement: http://www.coindesk.com/federal-reserve-economist-says-bitco...

- Shopify (70,000 merchants!) accepts Bitcoin: http://thenextweb.com/insider/2013/11/09/shopify-now-accepts...

- China fuels Bitcoin surge to record high: http://money.cnn.com/2013/11/12/investing/bitcoin-record-hig...

I'm not sure that I'd lead with speculation from the Winklevosses in order to convince a skeptic. Your other three points are much stronger.

Also, only the latter two are actual economic developments, rather than analysis. The upcoming Congressional hearings might be newsworthy too.

lol at a couple of dudes who are publicly known to be existing large amounts in bitcoin stating that it "should be worth a lot more!".
If they did not hold bitcoins, you would fault them saying they did not put their money where their mouth is...

One can never be right against the HN crowd. sigh

Their speculation might not be worth much, but if they succeed in setting up a bitcoin ETF it could definitely boost bitcoin's credibility.
1. The Winklevoss name doesnt exactly boost credibility.

2. What you're describing already exists.

https://www.secondmarket.com

Don't the Winkelvii have large Bitcoin holdings, whose value they presumably wish to drive upwards? Sorry, but I think this is a case of a market remaining irrational for longer than some people can remain solvent. I don't intend to waste money betting against it, but I'm not impressed. A couple of years ago people were predicting the price of gold was headed for the stars too, and a lot of them have lost money since.
depends how far you go back on gold prices, 50 years ago buying into gold was a great idea. 10 years ago, maybe not so much, bitcoin is currently at the very early stages so buying in now could be considered cheap in 10 years time.
Buying into stocks 50 years ago was also a good idea, though.
I'm old enough to remember a time when using your credit card to buy something on the internet was considered wildly stupid and irresponsible. Just saying.
Bitcoin can be even safer to spend online than credit cards, since you're not handing the merchant your card number which they can turn around and use at their whim.

For that to be a reality, we need to combine hardware wallets (https://en.bitcoin.it/wiki/Hardware_wallet http://www.bitcointrezor.com/), the new payment protocol (https://en.bitcoin.it/wiki/BIP_0070), and escrow transactions (https://en.bitcoin.it/wiki/Bitcoin_Escrow_Service), but the result would be pretty awesome.

One difference is that slashdot didn't lead with a new "all the credit cards are gone!" story every day...
Yes, but only because it didn't exist yet!
When exactly was that? The Fair Credit Billing Act was passed in 1975.

http://en.wikipedia.org/wiki/Fair_Credit_Billing_Act

Yes, consumers using credit cards definitely had more protections at that time than they do today with bitcoin. My point is merely that less than 20 years ago people had an almost universal aversion to putting their credit card information into a form on a website. That changed rapidly. I believe that the pieces aren't yet in place to give people the same level of confidence in bitcoin, but I also believe that it's a (short) matter of time until they are. Multi-signature transactions are very interesting in that regard.

I don't believe that bitcoin will destroy fiat or the finance industry as a whole, but I do think it will become a very convenient way of moving money around, especially between national currencies. Much in the same way that sending an email is more convenient than sending a letter internationally. It's not a complete solution; it's a foundation to build services upon, and those services will most likely be offered by the same large financial institutions we have today, along with a few upstarts. Just my 2 μBTC.

Like from Adobe circa last month :P
Because you're not looking at the important metric.

The _price_ of BTC is completely irrelevant to its "success". The only people who care about BTC price are speculators who are simply "day-trading" with the newest penny-stock.

The real measurement is whether or not people are actually using BTC as a mechanism to transfer wealth between each other.

https://blockchain.info/charts/n-transactions

Notice: the number of BTC Transactions have remained steady for months.

When BTC transactions reach an all-time high (and when those BTC transactions are more than just temporary "flash crash" exchange volume), then I'll start calling it a success.

Your exact same graph (zoomed out to show all-time data) shows that we are at an all-time high (the moving 6-month average clearly is):

https://blockchain.info/charts/n-transactions?timespan=all&s...

You have to keep in mind that during the course of those six months, Silk Road was taken offline. SR was assumed to be driving most of the non-exchange transaction volume. The fact that its dissolution had no impact on this metric is quite surprising and I'd argue it's an indication that "legitimate" trade activity has actually increased over the last few months.
https://blockchain.info/charts/trade-volume

Trade volume has skyrocketed. IE: people are trading more BTC for USD than ever. It wasn't since the Crash of April since we've seen trade volume this high.

And you know that people are actually doing transactions how? As far as I can tell a big whale is keeping the volume of transactions steady moving coins from one portfoglio to another. There you go, transactions steady.
Yes. What I'd really like to know is, how many bitcoins are being exchanged for actual goods and services, not just shifted from wallet to wallet or swapped back and forth for dollars.
Well, all those hacked BitCoins have to be moved around as well.
These stories of hacks & scandals and your link showing increasing-value only increases my desire to buy bitcoin. Also, this wild story[1] makes me want bitcoin too. What if I just want to buy $500 USD worth of bitcoin and just sit on it? Maybe 10 years from now it'll be worth close to a million, or maybe bitcoin will be shutdown and it'll be worth nothing. I think I can risk it. Who's trust-worthy these days if I want to make that purchase?

1. http://now.msn.com/kristoffer-koch-norwegian-man-buys-apartm...

Coinbase.com is a YC company that's trustworthy and convenient if you have a US bank account
+1 for coinbase. As long as you transfer the bulk of your coins to an offline wallet (Electrum is pretty simple), you can buy from any exchange like this pretty safely.

I've been doing dollar cost averaging through coinbase for the last three months (buying $20 worth every week), and with the recent surge my ~$300 investment is now worth over $1,000.

Eh, I wouldn't recommend Coinbase. They deemed one of my purchases from them as "high-risk" and have been holding my money hostage since. Support team has been taking 3-4 days to reply to each email in the thread.
Yeah, their support department is absolutely awful.
They've been chalking that up to growing pains -- for the longest time, they didn't even have a dedicated support guy hired; it was just the two founders. Last time I checked they had just one member of staff dedicated to support, although by now they might have one or two more.
Sometimes this happens. They deal with purchases every day and can't aid with money laundering.
But a 3-4 day response time isn't part of fraud prevention.
Maybe you should buy it and hold.

https://www.youtube.com/watch?v=qHUPPYzzZrI

That vid @ 0:25 - 0:39 ...it grew three thousand percent from last year to now? O_o;
I think https://localbitcoins.com/ it's still one of the safest way to buy bitcoins.
As long as you don't use MtGox. It has problems with withdrawals of USD, and hence has an inflated bitcoin price compared to others.
if in 10 years the price fluctuated from say $50 to $1000 and then rested at $500, you gained a huge opportunity cost. You could have shorted $500, played the market, sold early and reap the rewards =P
localbitcoins.com

quick, easy and escrow available.

It's important to distinguish the crimes that happen involving theft of bitcoin, from bitcoin as a payment system and protocol. Do you know how many crimes happen per day involving dollars? It's many orders of magnitude more than bitcoin related crimes. Just sayin'

edit: a word

These crimes don't point to a weakness of technical protocol, but they do point out to a weakness in bitcoin as an unregulated payment system.

If you want to do business in such a system, then you must rely only on yourself and keep in mind the risks from counterparties and intermediaries that are significantly different than for "normal" currencies.

For example, if you want to wire $10 000 to someone, you can basically ignore risks of someone stealing it in the middle; if you want to give someone $10 000 worth of bitcoin - then if any intermediaries are involved, you'd have to check them yourself. If a regulated financial institution holds $10 000 of your money, you can pretty much ignore risks of it going bankrupt; but if an unregulated money transmitter holds your bitcoins or cash in the same amount, and they go insolvent or fraudulent, then your funds are gone.

> Do you know how many crimes happen per day involving dollars? It's many orders of magnitude more than bitcoin related crimes. Just sayin'

This is true, yet means absolutely nothing. You're using absolutes when you should be using relatives.

If in a pool A of a hundred transactions one is a fraud, and in a pool B of ten thousands transactions a hundred are frauds, both pool present the same risk of a transaction being a fraud despite one having orders of magnitude more frauds than the other.

Using relatives is fine; my only point is that bitcoin is new and interesting and newsworthy and the negatives tend to get focused on. I honestly do not think that crime is more rampant in the bitcoin economy than the dollar economy. And this is just considering financial theft, and not institutionalized crime - e.g., innumerable instances of malfeasance committed by large banks or the wholesale robbery of the population through inflation of the dollar. Considered in total, I think bitcoin represents a far more honest and less crime-prone monetary system.
My pet theory for the spate of hacks as of late is that they're all happening now precisely because Bitcoin is trading so high.

If you can hack a Bitcoin "bank" and rob it, wouldn't it be smartest to wait until the money inside it is worth the most?

I agree. One of the smaller (but oldest) surviving black markets, Deepbay, apparently seized all bitcoins on deposit and stole them from its users a few days ago. Was it hacked? No, just the operator decided to cash out. Does this have something to do with Bitcoin tripling over the last month and additional competition from new black markets like Pandora and SR 2 and Tormarket? Probably...
That's not how it works.

Stealing 100 BTC today is not different from stealing 100 BTC tomorrow.

Their "value" only gets confirmed at the time of the exchange/transaction. Nothing stopped them from stealing that money 2 months ago, and hold it until it reached a high value.

That said, the motivation indeed rises when the value of Bitcoin rises (100 BTC worth $0.01 each is not worth the hack).

There was once a time when armed bank robbers would risk their lives and those of other people to illegally acquire US dollars.

Today, why would you steal worthless US dollars? We all know that Wall Street and the Fed have an enforced monopoly allowing them to 'steal' dollars anywhere possible!?

Rather, (non-bankster) criminals go where opportunity lies. Steal BTC and you don't need to risk anybody's life. Steal BTC and your heist will triple in value in a very short time.

i like my missed opportunities in logarithmic:

https://blockchain.info/charts/market-price?showDataPoints=f...

btw, isn't the point of bitcoin system is that all transactions are forever traceable, ie. bitcoins can't just disappear, they only can be moved from one known place to another?

if you move them to a known place that is unreachable then they have effectively disappeared
Yeah. In trading it's called a Dark Pool.
It might be interesting to note that someone in the discussion under the original article (an unregistered user going by the name 'The one who knows') claims that "the admin of bitcash.cz Carlos upset the czech hacker comunity SooM.cz and accordingly to Blockchain (https://blockchain.info/tx/44f66e60460926d1ac75667ce30604290...) it looks like those hackers donated all the BTC that was on bitcash.cz to wikileaks".
That's not the bitcoin address listed on the wikileaks website. The only mention of the address was on bitcoin-charity.info where it was connected to wikileaks but that's now offline. Seems suspicious that only one website had that address listed.

Edit: From the 'wikileaks' account listed on bitcoin-charity.info 150btc each were sent to 2 other addresses listed on that site. An african charity 'Amani Kinderdorf' and a 'Nonprofit Recycling and Exchange Network'. It seems like (though the charities are real) the bitcoin links are not related to them and bitcoin-charity.info was a scam site. (google cache: http://webcache.googleusercontent.com/search?q=cache:bitcoin...)

If all BTC are on single place, it could be possible to recover them. Seems like well documented case, both parties are in civilized countries and court could take it.

Soom.cz is not very reliable source. Also Czech Linux community does not mention anything.

But according to some users it did not even used SSL!!!

> But according to some users it did not even used SSL!!!

It's never going to stop amusing me that Bitcoin's big selling point is how it's this amazing form of applied cryptography... and the people who actually try to do this kind of thing cheerfully neglect security concerns that seem rather basic.

It's not hard to explain this phenomenon, but it's still amusing.

Please. Please. For the love of god please. https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_sa...
How safe is this compared to using a brainwallet (https://en.bitcoin.it/wiki/Brainwallet) with sufficiently strong password (say, a hundred secure-randomly generated characters)?

A brainwallet sounds far far simpler to set up, at least.

Brainwallets are never a good idea.

See here: https://www.google.com/search?q=brainwallet+(stolen+OR+hacke...

Uh, no.

Brainwallets with weak passphrases are a bad idea. Every case of a brainwallet theft has been due to users coming up with predictable passphrases to generate the key.

Most brainwallet private keys are simply a SHA256 hash of a passphrase, which is fairly easy for a dedicated attacker to crack via bruteforce or dictionary attacks, yes. But if you use, say, a 12-word sentence with completely random words, like SHA256("fire pickle shipment lachrymose deity unwitting pernicious obstacle kitchen tumbleweed mannequin erudite"), and maybe some random letters or numbers at the end, it's infeasible that it'll ever be cracked.

One common problem is that many people will pick song lyrics, book titles, or Bible quotes as their passphrase. Obviously attackers are going to scrape and add those to their dictionaries (which will then also be permutated in many ways), so it's critical that the words are picked arbitrarily and that there are enough of them.

The idea itself isn't inherently insecure, except for the fact that SHA256 was probably a poor hash function to use since it's fast.

I can guarantee that this will always be more secure than trusting any online service to store your wallet instead. The only risk is you forgetting one or more of the words, in which case you're in trouble.

Just wanted to add a note that you can come up with whatever deterministic process you want to generate the keypair.

For example SHA256(MySuperSlowAwesomeLongHash("fire pickle shipment lachrymose deity unwitting pernicious obstacle kitchen tumbleweed mannequin erudite"))

True. Many people appear to use http://brainwallet.org or similar sites though; they don't really understand what hashing functions are, so they trust these sites to securely generate a private key.

Someone should really make an alternative with bcrypt or scrypt.

100 randomly generated characters (a-z, A-Z, 0-9) would be 595 bits of entropy. You will not be brute forcing it. Although 100 characters is pretty excessive, since a Bitcoin address only has 160 bits of entropy.
Remember scales - there is a lot more entropy in 160 bits than there is in 100 bits.
I don't think you read my statement very carefully. The password has 595 bits of entropy, not 100.
I'm getting somewhat tired of these kinds of stories, the stories and the responses here both follow identical patterns.

1) Security is compromised at an entity that deals somehow with bitcoins. The security of the blockchain remains unimpacted, it is as relevant to the fundamentals of the currency as much as someone getting robbed is relevant to the fundamentals of the fiat currency they were robbed in.

2) Much whining and gnashing of teeth ensues as to how bitcoin is going to collapse any second now because clearly it is just some crazy snake oil and look at the rash of compromises as evidence, and by the way it also happens I disapprove of it because it goes against my views on what a currency needs to be.

3) People respond much along the lines I'm responding now.

4) It devolves into an ideological argument along the lines of the characteristics of the currency itself and the potential death of fiat money and its implications.

Conclusion; Some people are fundamentally ideologically opposed to bitcoin and will use whatever they can to drag it through the mud at every opportunity.

Compromising the blockchain or the fundamentals of bitcoin itself is news, even when it's overblown or exaggerated like the recent Cornell findings, some venture getting owned because they failed to adequately secure their place of business is par for the course and barely a footnote at this point in time.

For the first time in normal everyday business history, security really matters now. You can't just put up a banner with the legal penalties for acting against corporate policy and actually expect to hold people accountable via the legal system for ignoring your banner, the new rules are that you need real security.

Frankly I think that's a good thing and something that is far overdue, the swiss cheese state of general security practices coupled with the apathy and ignorance of general computer users has gone on for far too long, but because the individuals in question were never held personally to account there was never the motivation to really fix the problem.

Now there is, people need to accept this new paradigm if they want to deal in this space.

re: #1, don't you think it would be newsworthy if someone robbed a bank of all its customers' uninsured deposits? That doesn't really happen commonly, and if it did, it would be huge news.
It was just as much news when Gox got owned, even though they covered the losses. Also, Insured vs uninsured is irrelevant in this category because you simply can't have an uninsured traditional bank in the fashion you're talking about.
This is the third story in two weeks. Either the hacking attempts are increasing or the site owners are cashing out. Either way it's bad news. Anyone with bitcoins must use an offline wallet.
It's been shown that it can happen, so it will continue to happen until it becomes unprofitable or infeasible.....
Surveillance-driven sabotage, perhaps?
First the Chinese exchange (GBL) and now this? Scammers have been hitting the exchanges hard recently.
Of course, this is a prime time to get btc and sell it. Scammers probably are not expecting the price to climb much longer in short term.
On the other hand I see this more like a concerted attempt to build mistrust against the virtual currency and its distribution network. Tinfoil hat anyone?

[Edit: Thank you for your lame negative votes, sad people. You can go further and ask for more negative power to vote this down and then just die negatively voting right here.]

Another theory says that the webmasters are stealing the coins themselves. Perfect crime ;).
Sure, makes sense but why would I steal millions when I could do billions? - though it's better to err on side of petty.
Once you get past about $5million you might as well cash it in there rather than take any more risks - you're set for life either way.
^ lmm would have sold the methylamine & quit cooking
Also, the Swedish exchange Kapiton is having problems with "delays" in payments and is currently not accepting deposits:

https://kapiton.se/news/2 https://kapiton.se/news/3 (site in swedish language)

I'd love to say there's some more nefarious work going on, like governments trying to quash Bitcoin and executing these hacks...

But my guess is it comes down to poor security.

I couldn't agree more. I took a cool seminar in college about web security, in which a former senior security specialist for a government agency said that there is no such thing as full security, just varying levels of insecurity. Scary thought...
>there is no such thing as full security, just varying levels of insecurity

Six in one hand...

But it is good to realize that there really no such thing as perfect security. If it can be accessed, it can be accessed nefariously.

I think CoinMKT with its verification seems like the only solid place....
I think Mt. Gox, the most reputable exchange, is the only solid place. This sounds like self advertising.
Sure if you like to wait 8 weeks for your money.
You mean, they weren't insured?