Live data from Hacker News

Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

coindesk.com

11–20 of 86 posts

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#11
post #10

Please. Please. For the love of god please. https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_sa...

How safe is this compared to using a brainwallet ( https://en.bitcoin.it/wiki/Brainwallet ) with sufficiently strong password (say, a hundred secure-randomly generated characters)? A brainwallet sounds far far simpler to set up, at least.

> a hundred secure-randomly generated characters

might as well just memorize the private key..

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#12
post #7

Earlier quoted context omitted.

On the other hand I see this more like a concerted attempt to build mistrust against the virtual currency and its distribution network. Tinfoil hat anyone? [Edit: Thank you for your lame negative votes, sad people. You can go further and ask for more negative power to vote this down and then just die negatively voting right here.]

Another theory says that the webmasters are stealing the coins themselves. Perfect crime ;).

Sure, makes sense but why would I steal millions when I could do billions? - though it's better to err on side of petty.

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#13
post #9

I'd love to say there's some more nefarious work going on, like governments trying to quash Bitcoin and executing these hacks... But my guess is it comes down to poor security.

I couldn't agree more. I took a cool seminar in college about web security, in which a former senior security specialist for a government agency said that there is no such thing as full security, just varying levels of insecurity. Scary thought...

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#14
It might be interesting to note that someone in the discussion under the original article (an unregistered user going by the name 'The one who knows') claims that "the admin of bitcash.cz Carlos upset the czech hacker comunity SooM.cz and accordingly to Blockchain (https://blockchain.info/tx/44f66e60460926d1ac75667ce30604290...) it looks like those hackers donated all the BTC that was on bitcash.cz to wikileaks".

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#15
post #2

First the Chinese exchange (GBL) and now this? Scammers have been hitting the exchanges hard recently.

Also, the Swedish exchange Kapiton is having problems with "delays" in payments and is currently not accepting deposits:

https://kapiton.se/news/2 https://kapiton.se/news/3 (site in swedish language)

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#16
post #10

Please. Please. For the love of god please. https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_sa...

How safe is this compared to using a brainwallet ( https://en.bitcoin.it/wiki/Brainwallet ) with sufficiently strong password (say, a hundred secure-randomly generated characters)? A brainwallet sounds far far simpler to set up, at least.

Brainwallets are never a good idea.

See here: https://www.google.com/search?q=brainwallet+(stolen+OR+hacke...

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#17
Every new day seems to bring another new Bitcoin scandal -- whether it's a hacked exchange, stolen wallets, frozen funds, collapsed Ponzi schemes, arrested illegal-market operators, or who knows what else.

Yet, despite all this, Bitcoin keeps appreciating, recently reaching an all-time high.[1]

--

[1] https://blockchain.info/charts/market-price?timespan=all

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#18
post #14

It might be interesting to note that someone in the discussion under the original article (an unregistered user going by the name 'The one who knows') claims that "the admin of bitcash.cz Carlos upset the czech hacker comunity SooM.cz and accordingly to Blockchain ( https://blockchain.info/tx/44f66e60460926d1ac75667ce30604290... ) it looks like those hackers donated all the BTC that was on bitcash.cz to wikileaks".

That's not the bitcoin address listed on the wikileaks website. The only mention of the address was on bitcoin-charity.info where it was connected to wikileaks but that's now offline. Seems suspicious that only one website had that address listed.

Edit: From the 'wikileaks' account listed on bitcoin-charity.info 150btc each were sent to 2 other addresses listed on that site. An african charity 'Amani Kinderdorf' and a 'Nonprofit Recycling and Exchange Network'. It seems like (though the charities are real) the bitcoin links are not related to them and bitcoin-charity.info was a scam site. (google cache: http://webcache.googleusercontent.com/search?q=cache:bitcoin...)

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#19
post #10

Earlier quoted context omitted.

How safe is this compared to using a brainwallet ( https://en.bitcoin.it/wiki/Brainwallet ) with sufficiently strong password (say, a hundred secure-randomly generated characters)? A brainwallet sounds far far simpler to set up, at least.

Brainwallets are never a good idea. See here: https://www.google.com/search?q=brainwallet+(stolen+OR+hacke...

Uh, no.

Brainwallets with weak passphrases are a bad idea. Every case of a brainwallet theft has been due to users coming up with predictable passphrases to generate the key.

Most brainwallet private keys are simply a SHA256 hash of a passphrase, which is fairly easy for a dedicated attacker to crack via bruteforce or dictionary attacks, yes. But if you use, say, a 12-word sentence with completely random words, like SHA256("fire pickle shipment lachrymose deity unwitting pernicious obstacle kitchen tumbleweed mannequin erudite"), and maybe some random letters or numbers at the end, it's infeasible that it'll ever be cracked.

One common problem is that many people will pick song lyrics, book titles, or Bible quotes as their passphrase. Obviously attackers are going to scrape and add those to their dictionaries (which will then also be permutated in many ways), so it's critical that the words are picked arbitrarily and that there are enough of them.

The idea itself isn't inherently insecure, except for the fact that SHA256 was probably a poor hash function to use since it's fast.

I can guarantee that this will always be more secure than trusting any online service to store your wallet instead. The only risk is you forgetting one or more of the words, in which case you're in trouble.

Re: Czech bitcoin exchange Bitcash.cz hacked, up to 4,000 user wallets emptied

#20
post #10

Earlier quoted context omitted.

How safe is this compared to using a brainwallet ( https://en.bitcoin.it/wiki/Brainwallet ) with sufficiently strong password (say, a hundred secure-randomly generated characters)? A brainwallet sounds far far simpler to set up, at least.

Brainwallets are never a good idea. See here: https://www.google.com/search?q=brainwallet+(stolen+OR+hacke...

100 randomly generated characters (a-z, A-Z, 0-9) would be 595 bits of entropy. You will not be brute forcing it. Although 100 characters is pretty excessive, since a Bitcoin address only has 160 bits of entropy.
Post reply on HN