Slashdot Mirror
Hacked Bitcoin Financial Site Had No Backups
An anonymous reader writes "A fortnight ago the Bitcoin financial website Bitcoinica was hacked and the hacker stole $87,000 worth of Bitcoins. At the time the owner promised that all users would have their Bitcoins and US dollars returned in full, but one of the site developers has just confirmed that they have no database backups and are having difficulty figuring out what everyone's account balance should actually be. A failure of epic proportions for a site holding such large amounts of money."
How are situations like this still happening?
I think 17 year olds running online currency exchanges is a fairly recent phenomenon.
Regulation of currency has nothing to do with this. In fact shortly before it closed Bitcoinica was boasting that it had recently come under regulatory supervision. And do you think dollars and euros are immune from incompetence leading to massive losses? If so, where have you been in the last few years?
The underlying problem here is simple, and actually has little to do with Bitcoin itself. The problem is that Bitcoin has grown so extremely fast that almost anyone who sets up a unique financial service, as Bitcoinica and MtGox did, is immediately flooded with users and vast sums of money. These guys are then plunged into the pain of scaling up their operations from zero almost overnight .... setting up customer support, dealing with bugs and new features, figuring out the relevant regulations so they can start to comply with them and attempting to secure their operations.
It does not help that many of these operations started out being run by rank amateurs. MtGox was written in amateurish PHP and had to be almost completely rewritten from scratch by Mark Karpeles, who appears to be fairly competent. Their big security breach came when the previous owner (the amateur) got hacked, he had retained too much access to the business internals. Bitcoinica was, notoriously, set up by a Chinese 17 year old who was able to build a nice UI and working trading platform, but quickly realized he was in over his head with regards to building a rock solid secure operation.
Securing IT systems is hard and Bitcoin as it stands today doesn't do much to help you with it. It's worth noting here that if you just want to sell things for coins (the common merchant case) your server does not need to have the ability to spend the received money at all. You can use a split wallet (also called a "watching wallet") on the server, and then only a totally diffferent secure machine of your choosing can actually move the money. So the difficulty mostly affects companies that need to automatically receive and send large sums of money. The community knows how to make improvements - the protocol allows for money to require multiple signatures to move it, so a framework for having an independent second system that verifies/risk-analyses a transaction stream before signing it would be a good step forward. Using trusted computing platforms like Intel TXT + the TPM chip allows you to secure your wallet in such a way that root level compromise of the machine cannot be used to extract the keys. And the use of "cold storage" wallets is already commonplace. Etc, etc.
The Bitcoin world is going through a period of rapid evolution in which amateur wildcat operations prove demand and are then rapidly replaced by companies designed by highly paranoid people. If you are skilled at computer security and willing to do a lot of paperwork, there's golden opportunities for you right now.
If the attacker deleted your backup, you didn't actually have a backup.
Until the government decides to steal that money from you: "Freezing your assets" because they suspect you of some crime, "garnishing" or "levying" your bank account because you didn't "voluntarily" pay their taxes, and so on. And then of course, the government can just decide to print more money at will, stealing wealth from everyone, through inflation.
The risk of theft or loss with government-backed banks is the same; the thieves are just more organized. And if you consider inflation, the slow, persistent, and inexorable theft of your banked USDs is all but certain.
Liberty in your lifetime
Meanwhile, the EUR is imploding due to abject irresponsibility on the part of its government backers, banks, and investors, and the USD is probably not far behind. I wonder how long off until we see wheelbarrows full of euros and dollars being used to feed woodstoves rather than as currency. The growing sovereign debt crises and $700T (yes, that's a "T") derivatives market going tits-up are going to make BTC's problems look like a joke.
Yet I see comment after comment of how irresponsible and amateurish BTC is, and how we should only trust regulated, state-backed currencies. Yeah.
Liberty in your lifetime
This story about the woes of Bitcoinica is grossly overblown. The amount of money is comparatively very small, and the Bitcoin network itself is nothing to do with this theft and is sound.
To put some perspective on the Bitcoinica incidents, in 2008, the estimated UK bank fraud level was £52.5 million; that is 990.28441 times the amount of this Bitcoin theft:
http://www.themoneystop.co.uk/042009/online-banking-fraud-is-on-the-rise-in-the-uk.html
There are people on many sides who want Bitcoin to fail, and who will do anything to stop it from growing. The banks hate it, because it will disintermediate and replace their business. The Statists dont like it because it will defund their socialist dreams. The gold bugs loathe it because it is not gold. Keynesian journalists bristle at the fact that the money supply in Bitcoin is limited, and dream of seeing it destroyed.
None of these people will matter in the end, and they do not understand Bitcoin.
Bitcoin will continue to grow, and events like this will winnow out the weak services and strengthen the existing ones. Each theft, disaster and problem are iterations that add to the unpublished "how to run a safe Bitcoin service" manual. Bitcoin and the services that will grow up around it cannot be stopped, just like Bittorrent cannot be stopped, and the latter is responsible for 53.3% of upstream traffic:
http://torrentfreak.com/bittorrent-still-dominates-global-internet-traffic-101026/
It doesn't take much to see how important Bitcoin is going to become once the core public facing interfaces are solidified, refined and reliable. Bitcoinica is not Bitcoin, and neither are any of the services that are built on it. Bitcoin is a protocol. Events like this are nothing more than a bump in the road, and a vanishingly small one at that.
ATH0 Bitcoin: 1DnwFLXczVZV8kLJbMYoheUrpqHesjxrSi
Right on; say what you want, at least Bitcoins don't change in value.
Bingo!
It sounds like the people running the place are I.T. morons.
Rsync to second server, both servers then have offline backup that is cycled to a safe onsite AND offsite. THAT is a backup, not what most idiot business owners think a backup is.
I recently had this discussion with our CEO. "We dont need to spend $12,500 on a backup system...."
Me: so all our data is worth less than $12,500? if we lost ot all right now it would not matter at all to the business?
CEO: No, we would be devistated and out of business!
Me: so the whole business is only worth $12,500??!? Why are you keeping this from everyone that we are about to go under!
CEO: No! No! We are doing fine, well over $10million in sales last quarter...
Me: and you are unwilling to spend $12,500 to protect that money....... Really.....
CEO: go and order the backup server and tape Drive robot.
Do not look at laser with remaining good eye.
Cash (or "money") is not a store of value, it's a lubricant for exchange. A monetary system without inflation (small, predictable) encourages people to store wealth in "money", as opposed to investing it in productive uses. Monetary systems with a small amount of inflation will encourage investment of wealth to earn a return at least as good as the inflation being experienced. Which is why virtually every economy on the planet left the gold standard; the economies with "inflatable" currencies will outperform those without.
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/