Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking open the Mt. Gox case, part 1

blog.wizsec.jp

Post reply on HN
Print view View original

21–30 of 99 posts

Re: Breaking open the Mt. Gox case, part 1

#21

Post by jcousins »

frew wrote: post #12
NelsonMinar wrote: post #9

The coin flow graph is terrific: http://wizsec.jp/images/theft_flow.svg Is this type of visualization common in Bitcoin? Is it a tool anyone can easily use? Edit , let me restate my question. "Is there a tool that generates Sankey diagrams from blockchain data that is easy to use?"

The graph itself is d3: https://bost.ocks.org/mike/sankey/

I vaguely recalled seeing these in practice somewhere before - it was ntopng netflow visualisation: https://en.wikipedia.org/wiki/Ntopng#/media/File:Ntopng.png

Re: Breaking open the Mt. Gox case, part 1

#22

Post by Pyxl101 »

It sounds like MtGox must have had no auditing of their wallets, or completely ineffective auditing.

How did they not at least perform a simple sum of coins held by their wallets and compare it against the amount expected by their databases? Or is the attack more sophisticated than this would detect?

If I were building a system like this, I'd want to run an auditing system continuously that looks for discrepancies, and then "shuts down everything" if they're detected.

Re: Breaking open the Mt. Gox case, part 1

#23

Post by kzrdude »

barkingcat wrote: post #10
NelsonMinar wrote: post #9

The coin flow graph is terrific: http://wizsec.jp/images/theft_flow.svg Is this type of visualization common in Bitcoin? Is it a tool anyone can easily use? Edit , let me restate my question. "Is there a tool that generates Sankey diagrams from blockchain data that is easy to use?"

This is relatively easy to do since all bitcoin traffic is transparent and open for easy tracking. You can probably do this in gnuplot. Anyone who has the blockchain downloaded can run their own analysis algorithms on it - it's already there for you to see.

I imagine the difficult part is to group transactions and addresses into understandable entities. A good tool could certainly make incremental diagrams that help improving that grouping though.

Re: Breaking open the Mt. Gox case, part 1

#25

Post by dmix »

buryat wrote: post #2

So according to the following, Vinnik was aware of the origin of bitcoins that were sold on BTC-e: > Some of the funds moved to BTC-e seem to have moved straight to internal storage rather than customer deposit addresses, hinting at a relationship between Vinnik and BTC-e. and he was stupid enough to deposit them back to his account on MtGox: > Moving coins back onto MtGox was what let us identify Vinnik, as the MtGo…

> All in all, there a strong suggestion that he participated in money laundering and was involved in the whole scheme.

I don't see how this proves he had direct involvement in the scheme instead of just running a laundering service for people.

This blog post mentioned he was connected to other thefts as well:

>> The stolen MtGox coins were not the only stolen coins handled by Vinnik; coins stolen from Bitcoinica, Bitfloor and several other thefts from back in 2011 and 2012 were all laundered through the same wallets.

Not much solid evidence here of direct involvement in the hacks despite the bold claims, but it does look like there is some connection to the crime at the post-hack stage...

Re: Breaking open the Mt. Gox case, part 1

#26

Post by StavrosK »

Jabanga wrote: post #4

This would have all been avoided if MtGox had transferred its coins to a new wallet after the 2011 breach. I guess they assumed that any attacker that got access to the private keys would have immediately emptied the wallet, and the fact that this hadn't happened proved that the private keys hadn't been compromised by the breach. I have to admit, that is a reasonable assumption. This may show the limits of the useful…

I don't care how reasonable the assumption is, moving those coins would have cost nothing! It's inexcusable not to have done that.

Re: Breaking open the Mt. Gox case, part 1

#27

Post by ringaroundthetx »

Jabanga wrote: post #4

This would have all been avoided if MtGox had transferred its coins to a new wallet after the 2011 breach. I guess they assumed that any attacker that got access to the private keys would have immediately emptied the wallet, and the fact that this hadn't happened proved that the private keys hadn't been compromised by the breach. I have to admit, that is a reasonable assumption. This may show the limits of the useful…

I only hear about the hackers that empty addresses and wondered if they could be more effective by slowly draining.

Well now know turns out the biggest one was doing just that

Re: Breaking open the Mt. Gox case, part 1

#28

Post by FRex »

Pyxl101 wrote: post #22

It sounds like MtGox must have had no auditing of their wallets, or completely ineffective auditing. How did they not at least perform a simple sum of coins held by their wallets and compare it against the amount expected by their databases? Or is the attack more sophisticated than this would detect? If I were building a system like this, I'd want to run an auditing system continuously that looks for discrepancies, a…

The site was originally made for trading Magic The Gathering Online cards by one guy who later got bored and then got into Bitcoin but I have no idea and wikipedia doesn't mention if they reused any code or just the domain name itself.

It's a fun piece of trivia one crypto currency guy told me and it seems to be true.

Re: Breaking open the Mt. Gox case, part 1

#29

Post by dmix »

> By mid 2013 [..] the thief had taken out about 630,000 BTC from MtGox.

630,000 BTC to USD = 1,560,069,000.00 US Dollars

Crazy.

$1.5 billion USD = 2.5% of Bitcoin's market cap ($40 billion) and someone stole it.

Post reply on HN