Slashdot Mirror
NiceHash Hacked, $62 Million of Bitcoin May Be Stolen (reddit.com)
New submitter Chir breaks the news to us that the NiceHash crypto-mining marketplace has been hacked. The crypto mining pool broke the news on Reddit, where users suggest that as many as 4,736.42 BTC -- an amount worth more than $62 million at current prices -- has been stolen. The NiceHash team is urging users to change their online passwords as a result of the breach and theft.
Hacked by its employees more like
1) setup trading site
2) wait until the pot is full
3) announce hacked
4) keep the loot
FDIC says what?
NiceHash you got here. Be shame if anything happened to it. /got nuthin'
Learn what? Not to trust others with your Bitcoin? That's been the #1 rule since day 1. Treat Bitcoin like cash.
Putting any appreciable amount in an online wallet or exchange is just asking for it to be taken.
"The NiceHash team is urging users to change their online passwords as a result of the breach and theft." ... quick! Close the barn door.
Sheesh.
Seems like the bitcoin value is unfazed despite this hack. Trending at near $14000 now.
What's the easiest way to make money off a bunch of people who are trusting you with their valuables? The only thing missing here is the insurance claim after the "theft"...
Probably spent $10.29 in electricity doing it, too.
The first rule of Bitcoin is: never trust anyone anywhere ever
The second rule of Bitcoin is: keep telling yourself you're not the mark
Obliteracy: Words with explosions
What's truly bizarre to me, after looking at the Reddit thread, is all the people who are impatient that the app is shut down for 24 hours because they want to keep using it. This company just lost more than $60 million of its users' money, and the users are upset that there is a delay in them sending the company more of their money.
What? You lost our $60 million?! Well, gosh, we'll give you more, but be more careful this time...
Treat bitcoin like cash?
Put it in the bank and you'll still get it all back back (with interest!) if the bank gets robbed?
In an age of digital currency, the digital vaults are pilfered by digital thieves. Anonymous entities stealing anonymous currency. Now we need digital dye packs and a means of chasing the digital Bonnies and Clydes down the dusty digital backroads. The problem for the courts: If the currency is really recognized and it can't be traced, was anything really stolen? The defense raises only a slim shadow of doubt by reminding each and every juror about the pictures they lost when they last upgraded their phones. Maybe the coin is just mislaid?
On NiceHash, you mine hashes that are in turn sold to others for the purpose of minting new coins (and/or more sophisticated/creative purposes). NiceHash automatically selects an in-demand and valuable hash type for your system to calculate so that you can send the results back to NiceHash for sale, and you get rewarded on a regular schedule for your recent calculations. NiceHash won't assign your GPU/CPU to calculate hashes for Bitcoin, because that wouldn't pay. It will assign you hash types associated with hot altcoins, similar to what you'll see at the top of the chart a on whattomine.
Sits back and laughs at the comedy show.
AC re "You spent more than that on just the electricity to run the damn things."
The price of electricity, the performance of a gpu, cpu for a given result can be estimated.
So that value can be after the price of electricity is covered.
Domestic spying is now "Benign Information Gathering"
Most people who use NiceHash never send any coin/money to NiceHash. You just run hash calculations and get paid regularly. So in effect, what's likely happened here is that a lot of people won't receive the payment associated with their computers' last few days work. It's fortunate in this case that most aren't hit hard, and people feel relatively okay about losing something that was never fully actualized/in-hand.
When mining for them, you can let it collect earned BTC payments in a virtual wallet until you 'withdraw' it, paying a fixed transaction fee that is the lowest once you have 0.15 of BTC -- about $2000.
Alternatively, you can let them pay a real external wallet directly, but you have to pay extra fees, will be paid less often, and some of the stats on their web page don't work as well. They talk about sending 1000 BTC or so every Friday which is probably to external wallets only.
They also accept bitcoin payments to purchase hashing power. Hopefully, they have just lost a wallet for handling some types of transactions and they have a lot more BTC offline somewhere to cover their internal wallets they pretty much force you to use.
YOINK.
Back when bitcoin went over a dollar for the first time, I noticed that people were unusually willing to steal it. For your own personal safety, you should absolutely not draw attention to your possession of bitcoin. If you do, you will be targeted. Not just drivebys and portscans, but actual they-are-after-me targeted.
If you are unable to create distance between your identity and your identity as a bitcoin holder, like if you are doing a public project involving bitcoin, you absolutely positively must not let your security be amateur shit.
The first thing you must do is establish ironclad multilayer operational security. If you don't know what that is, or don't know what it means in a bitcoin project, stop - you are not tall enough for this ride. That is actually intended to be a bit less offensive than it sounds at first. It just means that you are too young (inexperienced) to have good odds.
There is no reason to have 10 bitcoins in an online wallet, much less 4600. Those keys should be printed on paper in a N-of-M scheme and distributed to the people who will be authorizing transactions.
Yes, people should be processing transactions of that size, not computers. Ideally, the never-online signing computer software would print out the candidate transaction in a format that puts the recipient addresses and amounts in the exact same location as the request sheet so that you can visually diff the two (hold them up to a strong light to make sure they are the same) before unlocking the key and passing it on to the next signing agent.
Never-online? Yup, there should be no electronic communication between the computer that occasionally has the signing keys decrypted in memory and the rest of the world. There are Free (and free) options for generating barcodes and QR codes and hardware scanners that can read them as keyboard input or virtual character device input. Generate the payment online, print it as a QR code. Scan it on the signing computer. Verify the transaction (human job!) Scan the key, type the passphrase to decrypt it. The signing computer can then print the signed or partially signed transaction as another QR code that you can take back to the online computer for sending (or sending to the next signer).
If your security plan is not at least this good, you should under no circumstances be handing bitcoin that doesn't wholly belong to you and that you aren't willing to lose.
On the other hand, it seems like millions of dollars of bitcoins get stolen from fools every few months and no one seems to care, so maybe I'm wrong and the level of "security" seen in the field is exactly right.
See that "Preview" button?
But he's going to buy a few more rigs. That way, he'll be able to make it up on volume.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
On the other hand, it seems like millions of dollars of bitcoins get stolen from fools every few months and no one seems to care, so maybe I'm wrong and the level of "security" seen in the field is exactly right.
The theft of bitcoin from the fools, even if it's eventually spent (no earlier than the owner would have spent it), doesn't negatively affect the other owners of bitcoin. They still have theirs. They might take notice of the thefts and try to keep their bitcoin in a more secure storage, but unless and until THEY're robbed, they still have their currency.
If the stolen bitcoin is lost, the rest of the bitcoin just deflated. So its value went UP. The same is true, to a lesser extent, if the thieves hold onto it for a while while it "cools off" (longer than the owner would have held it) before they spend it.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Why you answer anonymous trolls whose knowledge of bitcoins obviously dates back to 2010. And is it confirmed that is a breach not just a simple directory find?
What I love is that someones are full bent on FUDing crypto on slashdot, and the voluntary ignorance on the matter makes every single crypto article on /. a parade of cluelessness and regret.
Interesting times when you get deeper tech discussions with 12yos on 4chan than with veterans on slashdot.
And you have spend more than $10 on electricity and mountain dew cluelessly FUDing crypto on this article. Your point?
Treat bitcoin like cash? Put it in the bank and you'll still get it all back back (with interest!) if the bank gets robbed?
You put cash in a bank? Where are you, 1985?
Does anyone know if laws about dealing with stolen property have ever been applied to bitcoin? Since the stolen coins are now in a single, known wallet wouldn't anyone that is ever paid using those coins be guilty of knowingly receiving stolen property?
You don't put cash in a bank. You give cash to a bank and they issue you an increment on your account balance.
If you put cash in a safety deposit box like in the movies to hide it for when you need to bug out / go on an international crime spree, you're a fucking retard.