Live data from Hacker News

Inputs.io hacked – 4100 BTC stolen

inputs.io

41–50 of 193 posts

Re: Inputs.io hacked – 4100 BTC stolen

#41

Earlier quoted context omitted.

>You bought into a system where coins could be permanently lost because you forgot a password. As opposed to a system where coins can be permanently lost because you have a hole in your pocket?

Would have to be a rather large hole to lose a million dollars through it. Would have to be about 43" wide.

It's funny seeing you on my side. How you been? I haven't crossed words with you in a while. james_d?

Re: Inputs.io hacked – 4100 BTC stolen

#42
post #22
post #14

Earlier quoted context omitted.

You can still use a "mixing" service, which takes many coins from many sources and mixes it in a way that you can't tell anymore what is the source of Bitcoins you received. Blockchain.info operates one of these.

Interesting thought. Could there be "shunned" Bitcoins where, if they held certain blacklisted wallets in their history, businesses and users would choose not to accept them? One could imagine people still choosing to trade in these Bitcoins, but that such a penalty would forevermore reduce their value next to "unshunned" coins. Could legit businesses and people using Bitcoin collectively reduce the value of stolen B…

Who would manage such database of "shunned" Bitcoins? Who would decide which ones are "shunned" and which aren't? This is a delicate topic, almost as much controversial as censoring internet to get rid of child porn. With decentralized protocol/currency as Bitcoin is, that is not possible to do properly. OTOH, every service can decide on their own what they accept and how they operate, so each and every service operator COULD implement such measures. But then the thief would just choose another service provider who doesn't implement that.

Re: Inputs.io hacked – 4100 BTC stolen

#43
post #37

So I have seen several of these stories pop up and I am still kind of confused by them. Are these hackers actually getting "real" money at some point? Are they able to cash out these bitcoins to USD or something else in a reasonable time-frame, or do they simply have a large amount of "fake" money that they can use for very specific goods and services?

They can certainly cash it out using a number of bitcoin to currency services. So the hacker has done the equivalent of stealing $1mil out of a bank, except a bank is very easy to trace while stealing BTC means the thief is home free. https://www.bitcoin.de/en?cr=1 https://www.bitstamp.net/ https://btc-e.com/ https://www.bitfinex.com/ https://localbitcoins.com/

They may very well hang onto them for a while, and in the event the price goes up even more in the coming months, they may make out with quite a bit more than $1M.

Re: Inputs.io hacked – 4100 BTC stolen

#44

I don't know what you expected, Bitcoin enthusiasts. You bought into a system where coins could be permanently lost because you forgot a password. You bought into a system where the government cheerfully gained control of a large share of the market by simple confiscation. You have recreated money . But you aren't even good at it! You still think that simple cryptography will excuse you from the fact that you're gree…

Are you referring to the 144,000 BTC confiscated in the Silk Road bust? There are almost 12,000,000 BTC in circulation. The Silk Road share accounts for about 1.2% Compare that with any government currency that is 100% government-controlled.

It's easy to permanently lose cash, too.

Re: Inputs.io hacked – 4100 BTC stolen

#45
Is there anything to stop the community from creating a database of known-stolen Bitcoins which participants can choose to reject? I guess all it takes is one non-participating exchange, but it seems like you could make it much less convenient to cash out.

Re: Inputs.io hacked – 4100 BTC stolen

#46

Anybody wondering how long it will take for Bitcoin to gain enough respectability for the FBI or Secret Service to get involved after hacks like this? If the same amount of money was stolen from a normal bank, it'd likely be covered by every news outlet.

Banks losing $1 million to hackers are not exactly science fiction. Typical outcomes including authorities not catching the thief, insurance paying out or the bank self-insuring, reiterating NDAs to employees who became aware of the theft, and absolutely no media coverage.

[Edit to add: For avoidance of ambiguity, I'm really, really, REALLY not suggesting that "Since banks are equally insecure, bitcoins are a great idea." Of greatest interest to HN readers, if your bank has a security fumble and your account is debited $25,000 as a result of this, you will almost certainly be reimbursed for every penny of that post-haste.]

Re: Inputs.io hacked – 4100 BTC stolen

#47
post #2

4100 BTC = 1.1 mil USD at current prices. These Bitcoins were stolen from website's "hot wallet" (every shared wallet has to operate one to process current withdrawals). This hot wallet was probably too hot though, as it seems that they had most of their coins online, and only about one third offline (other services claim to store 80-90% offline). According to postings on Bitcointalk.org forums people are getting bac…

I see what you did there[3] ;-) Also, it's a shame that this kind of breach happens, but it seems like it's been a while since a "$COMPANY hacked X BTC stolen" headline was out there[1]. There seem to have been more of those in the past and they appear with less frequency, which is a good thing, I guess. [1] Silk Road doesn't count toward this recollection, since it falls under the "Bitcoin $COMPANY busted by the fed…

It's probably because the market for such services is slowly saturating. Entry bar is quite high, and people are not willing to use newly released services as much anymore, as it was before. So yeah, it's good that the rate is decreasing, but unless we remove the source of this (i.e. move away from "hosted Bitcoin wallets" scheme) this will still happen in the future.

Re: Inputs.io hacked – 4100 BTC stolen

#48
post #5

Earlier quoted context omitted.

From what I've been told, yes....they can be used when stolen; it's kinda the whole untraceable, distributed nature of it all.

> untraceable This is wrong. Every single transaction is saved, by everyone. It's the core of how the protocol works. That doesn't mean there aren't ways to obscure who controls the wallets, but it's not untraceable, and 'distributed' has nothing to do with privacy.

I find this point a very interesting one. Everyone insists that transactions are saved and traceable (which of course they are), but I've never heard of anyone finding out who stole their coins and getting them back. People just seem to accept after a break-in that the money is gone and there's nothing they can do about it. That's not acceptable to me in a currency, particularly not one that people use as a store of value long-term. So it is effectively untraceable even if technically you can trace the anonymous transactions. The important part of that statement, which was not wrong, is they can be used when stolen.

This is my biggest reservation about bitcoin - they have taken the worst attributes of paper cash (pretty anonymous, not tied to a verifiable identity), and replicated them in a digital currency. If I'm transacting with someone I want to know who they are, in case of fraud or theft. People even openly run money laundering operations (mixing), and the community put up with it! In contrast, most people never store large values of money in actual paper cash anymore, they store it in a bank, which has identification and laundering checks, proper tracing of accounts to identities, immediate yet reversible transactions, and compensation if money is stolen. Bitcoin doesn't come out well in that comparison.

The other reservation I have about it is the lack of regulation - these exchanges which hold the money of lots of people are not regulated as banks are. No-one knows exactly what security they actually have (as opposed to say they have), sometimes people don't know who's behind them (I remember that 17 year old from Singapore talking here about starting one[1]), and there's no protection against market manipulation, speculation and cornering, or it seems against online theft. Given they have become so valuable so quickly, you can be quite sure the market is heavily manipulated, perhaps even in advance of thefts like this in order to gain the maximum benefit. What is the cause of the huge recent spike in prices for example? If bitcoin is to work as a currency and a store of value (the traditional roles of money), it does need regulation and verification, but I find it hard to see how that would come about, given the lack of a central authority and the lack of will to deal with incidents like this.

I'd love to see a digital currency that tried to emulate the advantages of digital cash, while doing away with the ability of a central government to print the currency ad infinitum - that's the big downside of our current state-backed currencies - it seems Bitcoin is not that currency.

[1] https://news.ycombinator.com/item?id=2973301

Re: Inputs.io hacked – 4100 BTC stolen

#49
post #37

So I have seen several of these stories pop up and I am still kind of confused by them. Are these hackers actually getting "real" money at some point? Are they able to cash out these bitcoins to USD or something else in a reasonable time-frame, or do they simply have a large amount of "fake" money that they can use for very specific goods and services?

They can certainly cash it out using a number of bitcoin to currency services. So the hacker has done the equivalent of stealing $1mil out of a bank, except a bank is very easy to trace while stealing BTC means the thief is home free. https://www.bitcoin.de/en?cr=1 https://www.bitstamp.net/ https://btc-e.com/ https://www.bitfinex.com/ https://localbitcoins.com/

BitCoins are difficult to anonymize. If you take your stolen coins directly to an exchange, the exchange would be able to identify you if law enforcement asked.

Re: Inputs.io hacked – 4100 BTC stolen

#50
post #15

Do bit coins have identity and hence be flagged as stolen somewhere ?.

Each bitcoin goes into a wallet, which contains an address. There's no connection between a person and a wallet, though, and it's not a 1:1 mapping, either. > flagged as stolen That would imply some sort of centralized authority to decide exactly what 'stolen' means. Even if a third-party service kept track, it'd be meaningless in short order, as mixers exist...

Also there is no connection between a wallet and an address except the wallet stores the address.

When the client sends the address the change is returned to a new change address, and the wallets are being designed now to never reuse addresses.

So it would become very hard to determine which of the outputs are change addresses and in the same wallet.

Post reply on HN