Excoin exchange's Bitcoins stolen, will be shutting down

If there's a $10 bill missing, it will noticed within hours. Where it went will probably be figured out the same day. If someone is stealing, management will usually find out who, how much, and when.

The Bitcoin crowd has a much simpler problem. They're all online, they don't have a staff of people handling money, and they don't have as many special cases as a supermarket does. (Travelers checks, returns, check cashing, etc - Bitcoin exchanges don't have to deal with that.) Most Bitcoin exchanges are doing a few transactions a minute. Bigger supermarkets do more than that. Yet the Bitcoin crowd consistently botches it.

The Bitcoin crowd needs to get some people who have passed Internal Financial Controls 101 at a 2-year business college.[1] This isn't rocket science.

[1] http://www.georgiacenter.uga.edu/courses/governmental-traini...

"World's stupidest bitcoin exchange admins, or some of the ballsiest? Inside job?"

That's always the question, isn't it?

If the answer is no (and I suspect it is), then incentives are aligned so that putting extra effort into security is something an exchange operator should definitely not do.

All of this is also assuming (on faith) that the business model is actually running an exchange, as opposed to a hack-blaming racket.

These adversaries will have more skill, more time, and more tenacity than you do.

Knowing this threat environment, what will you do differently from the dozens exchanges that have come before you and failed?

I have a friend who ported then maintained critical software at NASA about almost decade ago. He said that introducing source control was viewed as "a radical idea" at the time. Also, management seemed to go with superstition and "truthiness" as far as making decisions. "If it ain't broke, don't fix it" was the management mantra.

(I would reveal the piece of software he was working on, but that would easily reveal his identity.)

How do you officially investigate someone stealing your monopoly money?

Where is the FDIC insurance? Exactly what are they suppose to tell the police? The FBI? ... oh thats right, nothing, because they are not a bank, and the only thing "stolen" was some ones and zeroes off a hard-drive.

Seriously though... where is the police report on this? Or any of the other hacked bitcoin exchanges for that matter?

All logging and auditing data should be sent in real time to a write once medium, whether that's an S3 account with append (no overwrite/delete permissions) access, local DVD/Bluray, or even a dotmatrix printer if your volume is low enough.

It would be interesting to see how much they get targetted in comparison to startups that can at most spill some personal user info and cc numbers.

Even the way they handled this breach is amateur hour. From the post, it doesn't look like they've involved any authorities or sought out legal counsel to protect themselves.

Imagine if your citibank or chase account doing this. People would be in an uproar.

Startup companies with no serious experience in information security, or finance, or financial information security are making large web applications that store and trade digital currency. That currency, if taken, cannot be recovered in any way unless law enforcement physically raids the perpetrator, just as if they stole physical cash.

There are millions of unscrupulous fraudsters and black hats out there who realize they can effectively rob banks over the Internet, sometimes as easily as walking in through the side door and walking out with all their assets without anyone ever knowing they were there until they're long gone. Bitcoin banks and exchanges are the absolute most valuable target for cybercrime, due to the incredibly high potential for reward (6, 7, or 8 figures from one heist is not uncommon), the irrevocability of the currency, and the low chance of being found or caught.

It's a bank robber's perfect fantasy. It does take a lot of time to liquidate the treasure chest, but it's still pretty trivial to do securely.

There is one possible tangential relationship, however. As I've been researching the transactions, early indications point to a portion of the stolen BTC and NBT from Excoin being placed on BTER prior to BTER's announcement. If this is the case, the parties responsble for the Excoin theft may have inadvertently deposited their coins into an exchange that was subsequently pillaged...

(Disclosure: I'm a member of the Nu development team, so Excoin's and BTER's exchange problems affect our community)

As I said, amateur hour.

Banks do get hacked, and there's probably more going on than we hear about, but even so it seems banks are better at keeping money/secrets safe than Bitcoin exchanges, and probably better than the top-tier internet sites too (Google, Facebook, PayPal, Apple, Amazon).

That isn't the case with bitcoin.

It's just much more difficult to actually extract money from them. With Bitcoin, all you need to do is copy 32 bytes (the length of the ECDSA private key) over and over and suddenly you're a millionaire. It was a little more complicated in this scenario, since the attacker exploited an application flaw and appears not to have gained access to any private keys, but they still gained permanent control of the coins in a simple manner.

The bank will notice it, revoke the funds and then at best you will end up with a pile of debt and at worse will be charged with some financial fraud or another.

It's time that exchanges will develop the ability to reverse bitcoin transactions by extending the chain or by building their own transaction protocol on top of the current BTC chain. It's also about time that these establishments will get some private insurance if they want to play around as they were some private banks for oligarchs which are not tied directly to the central bank or insured by it.

With how BTC transactions work in general, and how exchanges seem to operate these days im amazed that people still use them.

It seems to have happened over a 5 day period. So a back of the packet calculation: 60 x 230 * 5 = $69,000

Of course that doesn't tell us anything about if people had larger amounts stored, just that the hot wallet should have contained around that amount before they needed to refill it.

So to get the money back, you would have to get the private key for the address where it all ended up. Our have the owners of the majority of mining power commit fraud on your behalf, that could work too.

Nobody has veified (or posssibly can verify) the damage of a "stolen' movie. For all we know piracy promotes purchase.

Either way, you can't "steal" information by copying it, but therein lies the difference in how the word might apply here but not in copyright discussions.

"Stealing" happens when the ownership of the money gets transferred to a third party without consent of the lawful owner.

This is what happens when bitcoins get stolen. They get transferred to somebody else and the global blockchain takes note of this. Yes you still have "your bits" but they are now worthless because nobody will accept them anymore.

   > Bitcoins are just sequences of ones and zeros. 

There is some secret data the user has which allows them to "unlock" their ones and zeros and rewrite them so that they can rewrite them to say "these are not my ones and zeros". And that transaction is combined with another one of the form "these ARE my ones and zeros", and after a minimum number of copies of the global list has that information the transaction can be said to be complete.

If the user were to attempt to reassert their ownership of the ones and zeros (they have all of the original data still) the global list which everyone else can see shows that have given up those ones and zeros in the past. And there is nothing the user can do to change the global list at that point. Its like the master tally stick was swapped out in the vault and their half no longer matches any part of it.

[1] http://en.wikipedia.org/wiki/Tally_stick

Before we had this, banks were robbed all the time..just like the Bitcoin exchanges. The only reason the government hasn't completely regulated it yet, is because the average person it's investing in it.