Hacker News Reader

Comment by ReverseCold | Hacker News Reader

Posting this as a top level comment as well (probably a better idea):

The coins stolen are XEM (https://nem.io/) not Bitcoin. They're currently tracking the stolen coins to ensure they are not sold.

Preliminary evidence suggests that it was a private key stolen and not a network problem.

Disclaimer: Am somewhat associated with the team, and I hold a small amount of XEM.

Feel free to ask questions.

View on HN

Over 100 Million XRP ( Ripple ) worth 130 Million USD was also allegedly stolen.

Source:

Here's the original tweet from Bloomberg Tech Reporter in Toyko, Yuji Nakamura. https://twitter.com/ynakamura56/status/956790270036619265

Tweet In English:

> Japanese crypto exchange Coincheck halts withdrawals, deposits, trading in NEM. Rumors is a big chunk was moved from their wallet. Also seems >$130m of XRP moved out too. I called Coincheck, but they wouldn't answer questions and asked me to email them

Here's the actual Ripple XRP Transaction that is moving the 101-ish Million XRP out of the Coincheck account. https://xrpcharts.ripple.com/#/transactions/FC32DBF1C0CE6780...

Here's a news page / story that is following this and updating it frequently. It mentions that XRP was also stolen in addition to NEM. https://bitpinas.com/news/coincheck-suspends-nem-trading-rum...

The stolen 101m xrp moved into an account that already had 3billion xrp? That seems odd to begin with. Is it another exchange or coin tumbler or something?

That wallet only has 45 transactions on it -- that doesn't seem reasonable for a tumbler or an exchange, does it?

Also, 3 billion XRP means that they have 12% of all circulating XRP right now.

The 530M figure was in XEM (been floating around $1) - but that may be an additional amount.

'Am somewhat associated with the team'

Can you please be more specific? It was almost not worth saying unless you'll be more specific IMHO.

Sorry, I'll clarify. I'm in the chat group quite a bit and have contributed to the wallet source code. I said partially as I'm not involved as an "official" capacity.

Thank you for responding!

So if they're tracking the coins to ensure they're not sold, and assuming it's never sold, wouldn't that mean the price of XEM should increase, as the supply has now decreased?

If 100 million of them were stolen you could also imagine that decreasing demand.

any calls for a hardfork yet?

The president of the NEM.io Foundation is against it [1]

[1] https://twitter.com/2017Lon/status/956880456154099712?s=17

Nope, they're against hardforking. The current measure being taken is just tainting the hacker's accounts and blocking them at exchanges.

Genuinely curious: How do you know a private key is stolen with a cryptocurrency? Is there some sort of secondary proof mechanism?

If funds move out from your wallet without your intervention then somebody else has to have your key.

Yes, but from the exchange's perspective: How do they know?

I'm presuming that in this case (given the amount) that this was not a typical user. But is there some framework of dispute for lesser amounts?

If a key was indeed stolen, they must have stole the keys to the exchange's wallet, not a user's wallet. I heard in the press conference they don't have a multi-sig wallet so all it took was one key and not multiple keys.

It is not possible to move funds unless you have the private key, or if you have broken the cryptographic scheme the key uses.

Since the funds have moved (visible on the overall distributed blockchain system, where everything is public), either of the two scenarios must have happened. It really is that simple, there are no other "moving parts" or "possible human error" in other parts of the system here.

So you have a case like this: the funds were moved with the private key. 24 hours after the owner comes and says: ‘I didn’t do that! Someone else must have copied my key and made that transaction!’

How does the exchange handle that? What’s the dispute mechanism?

It's the exchange's own key that is thought to be compromised, not one of their customers'.

Dispute?

You can create addresses which require multiple valid signatures (private keys) in order to spend the contents. And other sort of smart-contracts.

But it’s still based around having the correct mathematical keys to unlock an address.

Sorry, do you have a source for any of your claims?

The Japanese press conference - English translations are here: https://twitter.com/kanemoneyqian

>and I hold a small amount of XEM.

*held

:^)

I doubt someone who actually understands crypto currencies is keeping their money on an exchange, since this exact thing can happen.

Yup, my coin is safe.

Reply on news.ycombinator.com