Notice: Undefined offset: 1 in /usr/local/src/wordpress/wp-content/themes/montezuma/includes/parse_php.php on line 79

*POOF*, BitCoins Gone

Silk Road 2.0 ‘Hack’ Blamed On Bitcoin Bug, All Funds Stolen

Oh.   dear.   I’ve been tracking this bug and should have known that if Mt Gox got hit, so would SR.   After this hit the news and I researched it, it looks like numerous SR users warned them beforehand too.   It may be that these warnings tipped off the perpetrator and gave him the idea.

This is why you keep coins in your own wallet and avoid leaving them lay on third-party accounts like SR.   Only transfer coins when you’re about to buy something.   (but not at SR)

It’s a shame that this has tarred the escrow model, as it protected both sides.   But it looks like they’re developing a technological improvement, so that would be even better.

I’d normally say that buyers on SR probably lost little as they tend to transfer in to buy, and sellers probably lost the most.   But then sellers tend to be much more aware of the hazards than buyers (not to mention paranoid) so maybe not.   I’ll sure bet some sellers really got caught out.   Defcon (the admin) has a long and reliable reputation, so I doubt he took them.

Here’s the effect it had on BitCoin.

… and LiteCoin.

In any case this helps drive down the value of all crypto-currencies, which I whole-heartedly welcome.   This will discourage and scare all the n00bs and tourists, and make it not worth it for those with high electricity costs.   The difficulty level for LiteCoin has already dropped from 3,500 to 2,600 in the past couple days.   This means I make coins faster.

Hard to say whether this bug affects LiteCoin.   LiteCoin uses an entirely different algorithm than BitCoin, although it’s based on its model.   I’ll be watching for the answer.

Turns out I was wrong.   The SR2 community has identified the thief and it is DPR2 (Dread Pirate Roberts 2) aka St Elmo aka Defcon aka …etc…   He lives in London and is in quite a bit of danger now as they are ‘doxxing’ (providing identifying documents on) him.

I remember now why I didn’t expect the malleability bug to be used on SR2;   the Mt Gox BitCoin hack was said to be because of flaws in MtGox’s highly customized software.   The BitCoin Foundation also said this was the case and that it is not a general bug.   But now it turns out this is incorrect and the BitCoin Foundation sure lost credibility on this one.   No wonder the value went down.

You may remember that Silk Road 1 was taken down by the FBI after DPR1 (Ross Ulbrecht) made a number of amateurish security errors to connect his identity.   Then in December DPR2 (a moderator of SR1, StElmo) started SR2 despite being identified as greedy and untrustworthy in several DarkNet articles, and by Oracle, a long-trusted member of the community.   I couldn’t believe that DPR2 would be behind this theft, as he has so much more to gain by keeping the site running and maintaining trust.   Why would he stop at $2.7m when DPR1 had $86m (now confiscated)?   Found the answer:   DPR1 and two other arrested moderators know who DPR2 is, and they’ve already spilled the beans on many things.   It can be expected that DPR2 will be identified so it looks like he cashed out while he can.   There were several who said they miss DPR1 now…

I was thinking it may be sellers who lost the most in the heist, and from the forum it seems that’s right.   And they were the ones hollering loudest after the heist.   A good part of the money taken was in ‘escrow’ on SR2, waiting for the buyer to acknowledge that he got the product.   For example I read of one buyer who lost $128, and a seller who lost tens of $thousands.   Well it could be argued that alot of them deserved it.   Some thought law enforcement had done the heist…   but that wouldn’t be legally supportable, and I think only an intelligence entity would be that inventive anyway.

When DPR2 (‘Defcon’) made the post about the ‘hack’, he explained that although the SR2 BitCoins are usually kept off-line in ‘cold storage’ and only those demanded are transferred to ‘hot storage’…   at the very time of the heist he happened to have them -all- in ‘hot storage’ (online and available for withdrawal) so he could make some back-end improvements.   He portrayed it as bad luck.   This was plausible as it would make the Coins vulnerable to the malleability bug, but it turns out it was just a cover story.

Here are a couple of screenshots from the SR2 forum in DarkNet.   The only way to reach it is through TOR.   I use the TOR Browser Bundle.   For those who don’t know, TOR gives uncompromised anonymity, as long as you follow the rules.   I run about everything through TOR (including all email), just because. (click to enlarge)

bitcoin_theft_how
bitcoin_theft_who

Forum member Oracle, who is a long-trusted member of the community, checked around in background and confirmed that it was DPR2.   He has documentation but can’t publish it for safety reasons, although he is making it available to vendors who got burned.   Most vendors have now migrated to another DarkNet market called Agora at TOR address https://agorabasakxmewww.onion

So, DPR2 is likely on his way to somewhere far away, and he’d better stay there because he has some unsavory enemies now!   That’s the old-fashioned definition of ‘hot‘.   I read that he’ll likely use a certain Polish bank to trade alot of the BitCoins for prepaid Visa cards, and then on maybe to a South Pacific island.

,'after' => '

') )