Slashdot Mirror
Tracking a Bitcoin Thief
An anonymous reader writes A small group of researchers were able to publish an investigative report on the hacking of a popular Bitcoin exchange earlier this year by the name of CryptoRush.in. Close to a million dollars stolen in crypto currency lead the group to discover evidence, track down the attacker and put together a timeline of what exactly happened. A captivating read for a community desensitized by thefts, hackings and lack of reporting. With pictures, and logs to prove it all.
Never heard of it.
They'll involve ponzi accusations, pedophilia, "non-backing", etc....the usual lame arguments.
That would be refreshing then. Slashdot is usually quite pro-Bitcoin.
By all means, send in your masterpiece then. Let's see if you have enough cock to write a proper article.
I don't frequently come here, was assuming it would be more like the comments on news articles :P
Bennett Haselton? How long is his penis
about 0.00069 furlongs
Both these things can easily be faked, so unless they have something more damning, I'd hardly call this proven as presented on it's own. Now, take it to trial and allow the other side to refute the allegations and provide their own evidence and I will give it merit as "proof".
Steal a million dollars... in a perfectly traceable currency where every transaction is public.
Whipping up a few lame PHP scripts, leaving all the logs, using real name, your own static IP and a personal Dropbox account?! Is that what cuts for a hacker these days? With a million dollar payoff? I am starting to think I am not optimizing my earnings potential :)
I actually tried to read the article, but their images which are supposedly irrefutable proof are all broken. Good job, geniuses.
Calm your butthurt Bennett. You've never written a "proper" article ever.
I wonder what would happen here is someone used Bitcoin to buy an Apple?
I read the article, but do we have any record of Bennett's thoughts on crypto currency? I would like to read any insight he has before drawing my conclusions. He's a frequent contributor.
turns out to be much more traceable than the old fashioned kind, because you need the traceability to verify the transaction and establish who "has" the bitcoins.
Look out, Mark Karpeles.
You scared bro?
Well that sounds like the solution to http://xkcd.com/792/ 's problems...
On a serious note though, I won't shed a tear for CryptoRush.in. Using the same password on a small, no-reputation mining pool as the admin access to a currency exchange!?! That's a huge fail even by the lowest security standards, and these guys should know better.
Then what about getting coins stolen from the hot wallet and not even flagging the loss? What's even the point of an offline wallet when you don't reconcile the hot wallet before adding funds to it?? Another huge neglect on their part.
I actually it's probably a good thing they're now out of business because with that level of laxity, if not now there's no doubt it would have happened later, likely with more users and bigger balances... It's just sad for those who lost their coins in the process.
Someone stole my buttcoins :(
That's a pretty recent development.
I've bought clothes, hosting, food, electronics, stuff with bitcoin, with varying degrees of anonymity and source ips.
what's your point?
I mean OK he stole and it is now public. Now what ? He is in philippine, and how do you complain you were hacked in ,say, germany, by this guy ? How far does it sticks ? Wake me up when that JBA guys feel some legal consequence. I doubt it.
Oh my God! Ebola hysteria is imfecting other Slashdot threads! Why are they telling us it's so hard to spread! The only sensible solution is to prevent people from posting in other discussions after being in the daily Ebola discussion thread! Shame on the Slashdot administrators for not implementing such a trivial solution that would be guaranteed to stop the spread of Ebola hysteria to unrelated discussions!
It's technically a clitoris.
Sorry if I misunderstood and the crypto currency is actually made out of lead....
What varying degrees of anonymity did the perps in TFS use?
It little behooves the best of us to comment on the rest of us.
I don't have a copy.
It little behooves the best of us to comment on the rest of us.
I wear those cool blue CSI rubber evidence gloves when I type and handle my mouse. Also, I an careful to wear a mask when I lean in a squint at my small screen.
People who post Ebola shit on /. are putting us all at risk.
It's very hard to discern, just from screen names (and the ACs), who, exactly is from NYC or Dallas and stuff.
It little behooves the best of us to comment on the rest of us.
1 single transaction tracked ? Yes, you mostly get just 1 other bitcoin wallet.
Massively track thousands of such transaction? (that's beyond the capabilities of a small budget research team. But that's well within the capabilities of any decent government) And correlate them with "end-point transaction" (transaction that can be traced to a real-world identity: buying something from an e-shop using bitcoins and ordering it delivered to an address) ?
then, if the tracked person isn't using an insanely high number of "tumbler/mixers" (i.e.: laundering) or moving it in-and-out of tons of exchanges (basically also a form of mixing), you might find some correlation:
aka "a significant number of these BTC have transited to these wallets all mapped to the same real-world address/person"
that is not enough to warrant an arrest, but that is enough to put these real-world persons with the shortest "path" to the tracked transaction on a suspects list for further investigation by classical police work.
(Saddly, often government don't have such concepts of "suspect list". Very often such unsure statistical result won't be used as a "hunch" but will get you put on the "no fly list" and such)
That's why bitcoin protocol is considered "pseudonymous" and not "anonymous".
That's also why we need to have:
- law against data-collection abuses (because someone brilliant in the NSA/CIA/etc. will definitely try to jail people on this base or at least put them on a "pedo watch list" without much tinking)
- better way to do anonymous transactions (optionnal tumblers/mixers for BTC, or alternate protocols that include provision for anonymity)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
So what? Since there's no central authority to block transactions or seize funds they'll simply be passed around until any relation with the crime is meaningless with almost everybody in the transaction chain is blissfully unaware that somewhere they were stolen.
Will they pass them around? Enough to blur any relation ship? In a secure way that never leaks any identity?
(oops, one of the exchange I sent money to managed to record my IP address. No matter how much I keep mixing downstream, part of identity are leaked here)
Remember that they have adversaries like government who (as recently proven for the NSA, for example) have quite a few ressources. :-P ) and decides to throw ressources at it, tracking might be achievable.
A single policeman might not be able to pull enough data and analysis.
But if goverment suspects that some big danger as possible ("pedo-terrorist pirates!" threat, or more realistically: juicy corporate spying opportunities
It's not impossible for the thief to manage to get out un-identified. But it requires being particuliarly smart.
Imagine if cash was that way, every time the grocery store tried to despoit money at the bank the bank would say "oh no, this and that bill came from a gas station robbery two years ago so we'll return it to the gas station and deduct it from your deposit.
Cash *does* function this way (a bit): bills have serial numbers. Of the grocery stores deposits a bill with a known serial number on it, police might show up the next day asking for the CCTV suveraillance tapes, because that serial number happens to be a bill passed through the hands of known drug kingpin/terrorist/pedophily ring leader/etc. do it enough with enough of such incidents, and you might get a vague idea of the identity of the people you're looking for.
Unless the criminals have been absolutely perfect in their laundering and have managed to never leak any info (i.e.: by the time the known bill are flagged, they're in the hand of complete random strangers).
Google for "Ransom bill reappear" type of news reports.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Yeah, but it's all electronic, man!! It's all a bunch of ones-and-zeros!! Just like electronic file-sharing - you can't copyright a number. You can't call it theft!! Dude din't steal shit!!
With your current score of 1, the subject of your post shows "....3....2..." [...] 1
Nicely done. But why not aim for higher? Use subjects that say "....7....6..."
I'm wondering what would happen here in the Slashdot community if such a transaction came to light.
Which this time?
What use is complete anon currency when the shit is easier to steal then any other form of money.
At first glance, I thought this said Bacon Thief. And I was very outraged and concerned.
Then I realized it was only Bitcoin.