Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breaking open the Mt. Gox case, part 1

blog.wizsec.jp

Post reply on HN
Print view View original

91–99 of 99 posts

Re: Breaking open the Mt. Gox case, part 1

#91

Post by jimrandomh »

Pyxl101 wrote: post #22

It sounds like MtGox must have had no auditing of their wallets, or completely ineffective auditing. How did they not at least perform a simple sum of coins held by their wallets and compare it against the amount expected by their databases? Or is the attack more sophisticated than this would detect? If I were building a system like this, I'd want to run an auditing system continuously that looks for discrepancies, a…

Because they knew they were running (illegally) on fractional reserve, but needed to avoid creating any evidence that they knew.

Re: Breaking open the Mt. Gox case, part 1

#93

Post by whiskyant »

iak8god wrote: post #18
austenallred wrote: post #7

Can't wait to get my refund :) It's still insane to me that MtGox never moved coins to a wallet or acknowledged the breach until long after it was too late. You would think if you have billions of dollars sitting somewhere and you realize someone is starting to take them you would, you know, do something .

> Can't wait to get my refund :) There's no chance of that, right? (Hence ":)") At the time of the MtGox implosion I was bummed to have lost a few hundred $ worth of BTC. Now I'd be very interested in recovering that balance ... in BTC.

There is a good chance part of what customers lost during MtGox will be redistributed after bankruptcy hearings, but you needed to file a claim by July 29, 2015.

Re: Breaking open the Mt. Gox case, part 1

#94

Post by Atheros »

Pyxl101 wrote: post #70
wmf wrote: post #61

Earlier quoted context omitted.

In the early days, Bitcoin exchanges weren't making enough money to pay for "real" engineering. Then things tended to take off so fast that just keeping the site up consumed all its resources. There were one or two exchanges that did things "right" (e.g. TradeHill) and were immediately driven out of business by their own high costs.

I don't buy that argument, if it implies that the site operators were anything but flabbergastingly incompetent. It's pretty straightforward to compute the sum of all coins in your wallets, I would assume. It's also straightforward to compute the sum of all account deposits tracked by your database. Just knowing those two numbers is really simple stuff, like a single SQL query on the DB. All they need to do is calcul…

There is a lot of space between 'real engineering' and 'flabbergastingly incompetent'.

> It's pretty straightforward to compute the sum of all coins in your wallets, I would assume.

You assume incorrectly. It's a cold wallet. It's not connected to anything; that is its purpose. To monitor the balance, one would have to write software to watch the blockchain and calculate the balance of specific addresses. This is by no means impossible but in 2011 there were very very few engineers on Earth competent to do it and Mt Gox was trading bitcoins for pennies. Don't underestimate how fast Bitcoin went from a strange curious technology to being worth significant money.

Ultimately you are judging their actions through the lens of hindsight. Best practices weren't even established yet.

Re: Breaking open the Mt. Gox case, part 1

#95

Post by i_am_nomad »

dmix wrote: post #29

> By mid 2013 [..] the thief had taken out about 630,000 BTC from MtGox. 630,000 BTC to USD = 1,560,069,000.00 US Dollars Crazy. $1.5 billion USD = 2.5% of Bitcoin's market cap ($40 billion) and someone stole it.

Of course, there is almost no way to liquidate those BTC for $1.5 billion. Unless you can find a buyer for all of them at once, the market price will fall sharply as you sell them off.

Re: Breaking open the Mt. Gox case, part 1

#96

Post by h1d »

barkingcat wrote: post #10
NelsonMinar wrote: post #9

The coin flow graph is terrific: http://wizsec.jp/images/theft_flow.svg Is this type of visualization common in Bitcoin? Is it a tool anyone can easily use? Edit , let me restate my question. "Is there a tool that generates Sankey diagrams from blockchain data that is easy to use?"

This is relatively easy to do since all bitcoin traffic is transparent and open for easy tracking. You can probably do this in gnuplot. Anyone who has the blockchain downloaded can run their own analysis algorithms on it - it's already there for you to see.

You sound like the poster dismissing DropBox's idea saying it could be manually done easily.

Re: Breaking open the Mt. Gox case, part 1

#97

Post by h1d »

mrb wrote: post #84
wcummings wrote: post #13

Earlier quoted context omitted.

>Can't wait to get my refund :) I had like 0.000001 BTC in mtgox and it was worth it for the cute sticky unfoldy postcard thing I got from the Japanese court.

I got that card and had 0 BTC in my account. I think they sent it to anyone who ever used the exchange, regardless if they had funds in it at the time it fell apart.

Not even any fiat?

Re: Breaking open the Mt. Gox case, part 1

#98

Post by h1d »

strgrd wrote: post #3

I remember a time when BTC-e was the most logical exchange to use, especially in the fallout of MtGox. I really enjoyed how straightforward the exchange was, and how easy it was to get started using their API. I don't think they're coming back after this.

Was never the logical choice.
Post reply on HN