Mt.Gox Hacker Demands Ransom From Exchange Users To Not Reveal Their Personal Data

[Ares]

The bankruptcy of the once largest Bitcoin exchange may be history, but now the real drama begins.

First, over the weekend, allegations surfaced that not the whole truth may have been revealed during the heartfelt announcement by Mt. Gox CEO, Mark Karpeles, who claimed that $400 million in Bitcoin were stolen by hackers. As Forbes reported, hackers took over the Reddit account and personal blog of Mark Karpeles, to reveal that the exchange he ran had actually kept at least some of the bitcoins that the company had said were stolen from users.

"It’s time that MTGOX got the bitcoin communities wrath instead of [the] Bitcoin Community getting Goxed,” wrote the unidentified hackers, referring to the multiple occasions over its three year history when Mt. Gox has gone offline, delayed trades or suspended withdrawals, events so common that Bitcoin users coined the phrase to be “goxed”–to suffer from Mt. Gox’s technical glitches.

In addition to merely allege, however, the hackers provided proof:

The hackers also posted a 716 megabyte file to Karpeles’ personal website that they said comprised stolen data from Mt. Gox’s servers. It appears to include an Excel spreadsheet of over a million trades, a file that purports to show the company’s balances in eighteen difference currencies, the backoffice application for some sort of administrative access to the databases of Mt. Gox’s parent company Tibanne Limited, a screenshot of the hackers’ access to those databases, a list of Mark Karpeles’ home addresses and Karpeles’ personal CV.

http://www.zerohedge.com/sites/default/files/images/user5/imageroot/2014/03/Screen-Shot-2014-03-09-at-3.01.06-PM_0.png

In the hackers’ summary of Mt. Gox’s balances in various currencies, they point to a claimed balance of 951,116 bitcoins, which they take as evidence that Mark Karpeles’ claim to have lost users’ digital currency to hackers is fraudulent. “That fat fuck has been lying!!” a note in the file reads.

It remains unclear at this early stage in the MtGox bankruptcy if indeed Karpeles ended up Madoffing some or all of the Bitcoin entrusted to him: Forbes notes that "the Bitcoin community has been puzzled by the apparent lack of movement of Mt. Gox’s bitcoins since the company declared bankruptcy last month. Despite stating that it lost 850,000 bitcoins in total in its bankruptcy filing, Bitcoin experts haven’t seen the movement of those coins in the Bitcoin blockchain, the public ledger of transactions that prevents fraud and forgery in the Bitcoin economy."

But second, and far more important, "a user on the BitcoinTalk forum posted a message–since deleted by the forum’s moderators–claiming to be offering for sale a 20 gigabyte stolen database from Mt. Gox, including the personal details of all its users and even scans of their passports. “This document will never be elsewhere published by us,” wrote the user, who went by the name nanashi____. “Selling it one or two times to make up personal loses from gox closure.” The hacker asked for a price of 100 bitcoins for the database, about $63,600 at current exchange rates."

An updated announcement by user "nanashi" can be found in the following pastebin, in which he explains just how much it will cost naive Bitcoin traders to retain their anonymity. The price to put this entire gruesome episide behind them: 0.25 bitcoin, or a little over $150.

Mt. Gox database sale: steps to remove yourself from dump before sales.



Most around here know we are selling gox customer info. Many have contact us requesting to pay to have their data removed before we sell. We are doing this for a cost of 0.25 BTC per person removed. We have already sold and release 20% of data to 2 buyers, so if you are apart of that it's too late for you.



We are release the rest of this data to our buyers sometime this week, so after that happens it is too late for everyone who has not been removed already.



1) Email nanashi___@freemail.hu with the email you used with mtgox.



2) I will check file already sold, if you are not part of that I will send you unique bitcoin address. If you don't get response it means your data has already been sold in first batch or we have finalized sale of all data.



3) After you have sent .25 bitcoin payment, email us again to inform us of this.



4) Thats all, we will delete your personal data and passport scan from all copies of database.



DO NOT email asking to do this for cheaper unless you are doing 10+ accounts at once. Also do not email us asking to confirm what information we have about you. If gox had it, we have it, and as you can read on boards we have confirmed possession of this dump for many people. We let you use our same email for this as all other gox hack communication so you know we are same people. Doing this things will cause us to ignore all further message from you.



nanashi

And to think - the whole point of Bitcoin once upon a time (long, long ago) was to preserve the anonymity of the users... Oh, and the "money" was safe and unhackable...

http://www.zerohedge.com/news/2014-03-11/isnt-it-ironic-mtgox-hacker-demands-ransom-exchange-users-not-reveal-their-personal-

[EE_]

Whoever has the stolen bitcoins, good for them! If people want to give you their money, take it.
There's no security, or laws that guarantee the return of your money.
Would you leave a briefcase full of your money in a crowded mall, or airport? That's basically what you're doing with bitcoins.
If my money can't be protected, I'll just hang onto it myself thank you very much.

[Ares]

Whoever has the stolen bitcoins, good for them! If people want to give you their money, take it.
There's no security, or laws that guarantee the return of your money.
Would you leave a briefcase full of your money in a crowded mall, or airport? That's basically what you're doing with bitcoins.
If my money can't be protected, I'll just hang onto it myself thank you very much.

Not really a fair comparison.. Say you're a FOREX, NASDAQ, or DJIA trader and someone hacked them and retrieved their entire user base. Would you be okay with them holding your private information for ransom?

The information I used to verify my account at Mt.Gox is no longer accurate. I used my Indiana's drivers license, and a utility bill. I never linked it up with my personal bank account so I didn't need to use my SSN to wire the money. I used Dwolla. So they can have my no longer relevant data.

[Twisted Titan]

The Three Mercury Dimes in my left hand always feel good .but for some strange reason unknown to me they feel EXTRA good today.

[EE_]

Not really a fair comparison.. Say you're a FOREX, NASDAQ, or DJIA trader and someone hacked them and retrieved their entire user base. Would you be okay with them holding your private information for ransom?

The information I used to verify my account at Mt.Gox is no longer accurate. I used my Indiana's drivers license, and a utility bill. I never linked it up with my personal bank account so I didn't need to use my SSN to wire the money. I used Dwolla. So they can have my no longer relevant data.

Do you think the average bitcoin user is as savy as you?

[Horn]

A rather fine example of what happens when you replace Republic with an anarchy python script.

[Ares]

Do you think the average bitcoin user is as savy as you?

Not really savvy.... Luck played more of a role in that. My information that Mt.Gox had is inaccurate because I moved. I was lucky enough to still be able to use Dwolla before the U.S. told them to stop doing business with Mt.Gox so I never had to wire money to them. Other users, and I'm sure a large percentage of users did use International Bank Wire, which does require additional fee's and user authentication.

But those same authentication methods are used in FOREX, and Stock exchanges the world over. Or it can be buffered by using a Brokerage firm. But still feels like you're blaming a currency when it was the exchange that was at fault. Prior to the U.S. regulators breathing down Mt.Gox neck they didn't require personal identifying information. I'm sure a lot of that had to do with Silk Road using Mt.Gox and Bitstamp as a cash in, cash out exchange.

[Ares]

A rather fine example of what happens when you replace Republic with an anarchy python script.

Not really, it's a fine example of regulators trying to regulate something they know nothing about. If it was truly Anarchy and without government regluators trying to stick their nose into everything. No personal information at all would of been asked by the exchange. Because that's how Mt.Gox was run before March 2013 when U.S. and Japanese regulators asked them to verify who their users were.

So Horn, you're dead wrong with that statement. This hack is the direct result of Government.

[Horn]

So Horn, you're dead wrong with that statement. This hack is the direct result of Government.

The original intent of the hack was defined as vengence towards a "fat fuck" for lying, or an individual playing his own judge and jury.

True, the resultant ransom was capitulation towards the original anarchy to somehow maintain the culprits guilt into 1/2 innocence. All in all a fine example of doing whatever you like to do, without regards to others. or even taking advantage of those others afterwards, being judged as proper.

Karpels being one man trying to build a palace out of timbers.

[Ares]

The original intent of the hack was defined as vengence towards a "fat fuck" for lying, or an individual playing his own judge and jury.

True, the resultant ransom was capitulation towards the original anarchy to somehow maintain the culprits guilt into 1/2 innocence. All in all a fine example of doing whatever you like to do, without regards to others. or even taking advantage of those others afterwards, being judged as proper.

And what value would he or they have for ransom if there was no identifying information? He or they could of proved their point that Mark was a lying piece of shit by dumping the database and showing Mt.Gox was still in possession of Bitcoins (that's still debatable because that Database dump took place in January). But instead they get greedy and decide to hold the other users who also got screwed by Mt.Gox ransom the very data government regulators said Mt.Gox needed to have to verify their users.

Yeah that's the free markets fault... :rolleyes:

[Horn]

But instead they get greedy

Ahh the greed of virtual halfwits, true freemarket greed would be taking all the Bitcoins.

Intent was not the ransom, ransom was considered legal tender for the access.

[mick silver]

horn how many bitcoins do you have now , i know you buy them

[Ares]

Ahh the greed of virtual halfwits, true freemarket greed would be taking all the Bitcoins.

Intent was not the ransom, ransom was considered legal tender for access.

How could they take the Bitcoins? They exploited a widely known security flaw to get a Database dump. (SQL packet injection). Mark is an idiot and didn't even know how to protect against an exploit that is over 10 years old....

The database is separate from the Mt.Gox wallet. So they weren't able to steal any Bitcoins from that attack. If there were any to be stolen... With the Bankruptcy filing here as well as Japan, we'll find out what if any virtual assets Mt.Gox had.

Intent was to try and expose Mark as lying. Then to recoup the individuals or groups bitcoins they decided to sell the individuals government regulated and mandated personal information.

So in that respect the free market also played a role. Just not in a way that would of been available had Government regulators never mandated that Mt.Gox verify their users.

btc-e.com another Bitcoin exchange requires no personal identifying information to have USD or BTC. Not sure on the legalities of it, but if the "hackers" (I call them script kiddies as a hacker does something original, these guys exploited a known security flaw) performed an SQL dump of btc-e the users over there would laugh their asses off at them for demanding ransom. As there is no identifying information from there for them to ransom.

Anarchy works, it may not work well in an environment of heavy regulation but it does work.

[Ares]

horn how many bitcoins do you have now , i know you buy them

I only bought Bitcoins once, and it was at Mt.Gox. I transferred them out into a wallet that only I control and have access too. The rest I have mined, and I've mined much more than what I purchased.

Here's my mining wallet address. You can see how many Bitcoins I have in that one wallet. (I control several)

https://blockchain.info/address/1QGHe9f3yyjnHsMexuiQgHN6CMf8TypfgJ

[Horn]

The database is separate from the Mt.Gox wallet. So they weren't unable to steal any Bitcoins from that attack.

I want Ares as a lawyer if my Bitcoins get hacked. :)

[Ares]

I want Ares as a lawyer if my Bitcoins get hacked. :)

Opps. lol I corrected the typo. Thanks for pointing it out. :)

[Horn]

Opps. lol I corrected the typo. Thanks for pointing it out. :)

Maybe I mistook the article as they would also return the Bitcoins that were hacked minus the ransom.

Regardless double accusations and a proven hack all amounts to a good case against your python script. lol!

[mick silver]

no no how many does HORN have now

[Horn]

no no how many does HORN have now

I have the right to remain silent on grounds it may incriminate me.

I am working on a solar powered Bitcoin mining rig that is grid tied to give back anymore than I consume.

[mick silver]

thats a real good one

[madfranks]

btc-e.com another Bitcoin exchange requires no personal identifying information to have USD or BTC. Not sure on the legalities of it, but if the "hackers" (I call them script kiddies as a hacker does something original, these guys exploited a known security flaw) performed an SQL dump of btc-e the users over there would laugh their asses off at them for demanding ransom. As there is no identifying information from there for them to ransom.

Anarchy works, it may not work well in an environment of heavy regulation but it does work.

Quoted for truth. I never set up an account with gox, but I do have an active account at btc-e. All they have on me is a throw-away email address I made up specifically for them, and my password. That's it. I trade BTC/LTC/USD on that site totally anonymously.

[Ares]

Quoted for truth. I never set up an account with gox, but I do have an active account at btc-e. All they have on me is a throw-away email address I made up specifically for them, and my password. That's it. I trade BTC/LTC/USD on that site totally anonymously.

Same here, why I love that site. I can buy, sell, trade on that site with absolutely no one including the site owners knowing who I am..

Probably stands to reason why no one even knows who the owner(s) are. LOL

[Horn]

Both you guys would make terrible Anarchists, just gave your anonymity away to me.

[Ares]

Both you guys would make terrible Anarchists, just gave your anonymity away to me.

What's my screen name on btc-e.com? :)

[madfranks]

What's my screen name on btc-e.com? :)

Yeah, mine too, what is it?

[Horn]

Not sure of your usernames, but you both have the same middle name of Cyclops.

[mick silver]

you guys tell me first then i will tell you all later

[1970 silver art]

I only bought Bitcoins once, and it was at Mt.Gox. I transferred them out into a wallet that only I control and have access too. The rest I have mined, and I've mined much more than what I purchased.

I used Coinbase to buy BTC but I do not store them there. Once my BTC purchase is in Coinbase, I transfer it to my own bitcoin wallet and make a new backup of my wallet.dat file.

[1970 silver art]

Quoted for truth. I never set up an account with gox, but I do have an active account at btc-e. All they have on me is a throw-away email address I made up specifically for them, and my password. That's it. I trade BTC/LTC/USD on that site totally anonymously. I also used BTC-e but have been using Cryptsy recently since it has more alt coins to trade out of.

[Ares]

I also used BTC-e but have been using Cryptsy recently since it has more alt coins to trade out of.

Hey welcome back Silver Art. Glad to see you posting again. I also do some trading at Cryptsy. Awesome site for trading a number of altcoins. They don't have any personal information about me either. They ask it, but I falsified all the information anyway and use a throw away email address.

[1970 silver art]

Hey welcome back Silver Art. Glad to see you posting again. I also do some trading at Cryptsy. Awesome site for trading a number of altcoins. They don't have any personal information about me either. They ask it, but I falsified all the information anyway and use a throw away email address.Thanks Ares. :) Honestly speaking, I am a newbie to cryptos with my first bitcoin purchase occurring in Nov. 2013. I have bought alt cryptos but traded most of the one that I bought earlier this year using Cryptsy and bought into one that I wanted. The only cryptos that I currently have now are BTC, DOGE, Credits (Cr) and EMU (obtaining through their faucet since it has 0.68% premine). I used some of my alt crypto profits to buy some Credits (Cr) and some shares of Prypto.

[Horn]

More Cyclops.

[Ares]

Thanks Ares. :) Honestly speaking, I am a newbie to cryptos with my first bitcoin purchase occurring in Nov. 2013. I have bought alt cryptos but traded most of the one that I bought earlier this year using Cryptsy and bought into one that I wanted. The only cryptos that I currently have now are BTC, DOGE, Credits (Cr) and EMU (obtaining through their faucet since it has 0.68% premine). I used some of my alt crypto profits to buy some Credits (Cr) and some shares of Prypto.

Most of mine have been acquired doing mining. Here lately, I've been pointing my SHA256 and Scrypt miners at multipools that mine the most profitable alt coin but pay me in Bitcoin. Seems to pay better that way. My scrypt miner has mined almost 0.2btc in 2 weeks at the multipool I have it pointed too. SHA256 coins aren't as highly sought after as some of the scrypt coins by my 60Gh miner is still profitable mining alt SHA256 coins.

Definitely fun and a learning experience, I can say that.

[1970 silver art]

Most of mine have been acquired doing mining. Here lately, I've been pointing my SHA256 and Scrypt miners at multipools that mine the most profitable alt coin but pay me in Bitcoin. Seems to pay better that way. My scrypt miner has mined almost 0.2btc in 2 weeks at the multipool I have it pointed too. SHA256 coins aren't as highly sought after as some of the scrypt coins by my 60Gh miner is still profitable mining alt SHA256 coins.

Definitely fun and a learning experience, I can say that.I cannot mine any cryptos because I have a laptop that it not very powerful at all. I used Coinbase to buy my fractional BTC (1st purchase was 0.053 BTC in Nov. 2013) and bought the alt cryptos on ebay that I was interested in at that time. Most of those alt cryptos I do not have any more. I am up about 9.5% ($ percent) from my BTC cost basis and I was up about 24%($ percent) in my DOGE investment before I sold 2/3 of my DOGE investment to buy some Prypto shares and some Credits (Cr.). I still have some DOGE that I will keep just in case it goes up further from where it is. The Premine and Smartcoin cryptos were premine cryptos that I was up well over 300%+ ($ percent) but that is not saying much because they were only worth a few $'s in them before I traded out of them using Crypsy and Crypto Rush. I was on the losing trade on LTC, WDC, QRK, SXC and RPC mainly because I paid too much for them on ebay but I did pick up some crypto trading experience and I feel better to be in the cryptos that I like. The cryptos that I currently have are BTC, Credits (Cr.), DOGE and EMU. I have a $0 cost basis on EMU since I am still able to obtain a few from their faucet.

[madfranks]

Hey silver art, good to see you again. I think it's cool that you're into cryptos too. Right now I'm 90% LTC because the writing is on the wall that this is going to be a big year for that coin.

[1970 silver art]

Hey silver art, good to see you again. I think it's cool that you're into cryptos too. Right now I'm 90% LTC because the writing is on the wall that this is going to be a big year for that coin.Thanks Madfranks. It has been about 15 months since I posted here but I saw the crypto threads on here and decided to jump in on the threads. I have an open mind about cryptos, however, I see it as a speculative investment. In terms of cryptos, I currently have BTC, DOGE, Credits (Cr) and EMU. The EMUCoin (EMU) has a 0.68% premine but I am obtaining a few at their faucet since I am not able to mine any EMU or any cryptos for that matter. As far as I know, EMU is not listed on any exchange yet but I plan to get as many as I can from their faucet. FWIW I am a newbie and I am still learning.