
I'm the guy who bought 259684 Bitcoins for under $3000 yesterday - wmf
http://forum.bitcoin.org/index.php?topic=20207.0
======
kwantam
The poster makes some good points about the inconsistencies in Mt. Gox's
handling of things, but it seems to me that he's ascribing to malice what is
well explained by incompetence on the part of the person or people running the
site.

The security practices are appalling, and their lack of clarity on the
counter-party issue is damning. If I were Kevin---or, indeed, any customer of
that exchange---I'd take my money and go elsewhere.

Still, it's pretty astounding how myopic the rest of the Mt Gox forum users
appear. They're taking a situation that's beyond a doubt the fault of the Mt
Gox admins and getting ready to lynch a dude who seems to have acted rather
reasonably (intentionally not exploiting a known loophole to exceed the
withdrawl limit, reporting his disposition immediately to the site's
maintainer, et cetera).

~~~
vl
>fault of the Mt Gox admins

Mt Gox is run in such amateurish way, it's appalling.

In real life, with many brokers you trade doesn't close in 3 days and as such
you can't withdraw proceeds from the trade for 3 days (but you can use the
proceeds to continue trading).

In this situation Mt Gox is effectively both exchange and the broker. Not to
have rule in place to block funds from recent transactions is like people who
designed it never traded real stock with real brokers.

~~~
bobz
The three day settlement rule applies to the NY equity markets. Other markets,
including NY fixed income products, run under different rules, including same
day settlement.

And this isn't a fraud prevention measure, it's a legacy of the days when
settlement included someone carting a stack of stock certificates from one
bank's vault to another.

Lastly, most traders trade on a contractual basis, not a settlement basis, so
their trades are considered binding as soon as the agreement is in place.

~~~
Nrsolis
There are some other important differences:

1\. In the US, most exchange operators are the counter-parties to all trades.
They also interact with settlement and clearing services that ensure the
verification of proper ownership and conveyance of securities. In the old
days, something like a third of all trades failed to meet the three-day window
because some part of this process would fail.

2\. There are very very specific rules regarding how the orders are crossed
(buy and sell side) and which orders take precedence in the (limit order)
book. It looks like the MtGox guys didn't think this through and the trader in
question took advantage of this naivete on the part of MtGox.

3\. Most exchanges are "brokered" to facilitate trades while MtGox is more
like a swap-meet. Brokered exchanges are more expensive to trade in but they
have the advantage that brokers can "know" how to get price-improvement based
on market conditions. In short, they are "informed traders" vs the "uninformed
traders" you see in most post/notice markets. When the informed meet the
uninformed, you see situations like this where someone takes the whole shebang
home.

Personally, I find it amusing that the Bitcoin fanboys are clamoring for
intervention here. It's almost like they are getting to the idea that a strong
regulatory environment is a /good/ thing for the free market. If this were the
cryptopunk/libertarian paradise that everyone dreams of for Bitcoin, there
would be /no/ recourse.

~~~
pdovy
I'm not sure where you're coming from with #2. Most exchanges use price-time
priority to determine execution order. From the description the best bid was
$0.01, so obviously he would get filled first at $0.0101.

The real problem is that the market was able to descend to that level to begin
with. There should have been some sort of circuit breaker limits in the Mt.
Gox system that would have halted such a massive decline, similar to what
exist in the US equity and futures markets.

As to #3, really the only thing that matters in terms of exchange access in
the US is that you satisfy the appropriate compliance burdens (broker-dealer
status) and can pay the fees required for naked access. That may be good
selection criteria for "informed traders" but it certainly isn't any
guarantee.

~~~
Nrsolis
What I meant in #2 was that there are market structure rules about things like
minimum price improvement levels and how widely a buy or sell order is
circulated before finding a cross. The HFT guys are masters at exploiting the
market microstructure to extract alpha. Google SOES bandit if you need further
examples.

As for #3, naked access is a relatively new invention and the rules are
sufficiently constructed to virtually guarantee that only implicitly informed
parties are ever going to see "naked" access.

Circuit breakers (actually the lack of them) is one of those things that
enabled this to occur. The party in question essentially copied a strategy
that was used by the HFT guys to soak up the offer. The seller got liquidity
but it came at a very dear price.

And that's really the issue here: circuit breakers are a compromise between
liquidity and price discovery. If the exchange suddenly sees that price
discovery is trending outside of a range, they shut down trading. If the
problem is a systemic market one, then this probably is a good idea. But if
price movement is because of new information, then all the circuit breakers in
the world wont help you because as soon as trading resumes, the new regime
will be in play.

~~~
pdovy
An order with 1/100th penny precision isn't usual for currencies, but I see
your point. Either way, this was a very unusual situation. Why were there so
many people sitting at $0.01? If you're going to play that game, why not jump
on at $0.011 or $0.02? Hell, pretty much anything < $1.00 you could probably
safely assume would give you a profit as long as you were willing to bet you
weren't watching the demise of the BTC.

------
haberman
The community that for months has been preaching the virtues of the currency
nobody can control is suddenly arguing that a middleman should roll back a
bunch of free-market transactions.

I decided a while ago that arguing against the "bitcoin has no problems" crowd
was futile: people are too enamored with the idea to see problems like this
until they happen.

~~~
danboarder
It's not a BitCoin problem, this entire episode revolves around one exchange
(MtGox) and its security problems.

Mt Gox Exchange =/= BTC Currency Nasdaq Exchange =/= USD Currency

~~~
william42
Out of curiosity, how big is Mt. Gox compared to the other bitcoin exchanges?

~~~
rmc
MtGox has about 90% of the bitcoin change market.

~~~
dedward
I'm probably thinking of something different - but wasn't it clear in the
bitcoin protocol itself that if a single actor controlled a majority
percentage of the bitcoins out there, the model falls apart and is at risk?

~~~
rmc
Sorry, we have our wires crossed. You can still transfer bitcoins from one
person to the other. An exchange is a website that allows you convert bitcoins
in USD. MtGox controlled about 90% of the BTC↔USD conversions.

------
wiredfool
So, There's something like 21 million bitcoin possible, and 6 million 'in
circulation' now. A sell order comes in for 1/12 of total amount of
outstanding bitcoin. And the system processes it, flashcrashes, and. 3)
Profit, I guess. or 4) rollback.

That's something like what would happen if someone dumped 1 trillion USD onto
a bond exchange. There are only a couple entities who could do this.

So how did 1/12 of the value in this ecosystem wind up in one account at Mt
Gox? I'd have to think that it's likely an insider/early adopter. (or Mt Gox
itself?) There's a limit on the number of entities who could amass that sort
of 'fortune'.

~~~
romland
Or it could, again, be stupidity by MtGox:

This was a "test account" that had no real user attached to it. After all, if
the trade is internal on MtGox, it's just a double in a database.

If that is the case, then hell yes, I can see why MtGox would want this
rollback.

~~~
dangero
That's a really good point. Who says that there really was anyone with that
many bitcoins in their account? Maybe someone just hacked the database, put
500,000 btc into an account, and then sold them on the market? We know the
user database was dumped, so why shouldn't we think that someone edited the
account balances too?

~~~
dkokelley
The way I understand bitcoin is that you can't simply sell coins made by
adding them to a db record. Perhaps the MtGox system can artificially generate
the appearance of those coins, but the actual validation of the transaction by
the network would have failed.

~~~
dangero
The way I understand Mt. Gox is that they have a giant pool of real btc. They
are the "owner" of these btc. So, for instance, if your account says you have
3000 btc, then your 3000 is just an entry in a database, and the only time
that actually becomes a bitcoin is when you cash out the coins from Mt. Gox.
At that point, they give you the amount of coins that you requested to be
withdrawn from their giant btc pool. So, in other words, there aren't actually
any specific bitcoins that are assigned to you specifically. You essentially
own an IOU for 3000 bitcoins that you can cash out at any time. That's also
why they can roll back transactions, because no bitcoins are actually
transfered in their system, only database entries that state who owns how many
bitcoins. That's why I think someone could update an account's bitcoins
balance to any number, and then sell them on the market, because you're not
really transferring bitcoins. You're transferring IOUs for bitcoins in a
database.

Judging by the amateur security issues they've had lately, I think it's highly
unlikely that they have the right controls in place to catch something like
that automatically.

~~~
Gormo
Or, to analogize, your MtGox balance is a gold certificate, MtGox is the bank
with the actual gold in its vault, and someone just robbed the bank.

------
sliverstorm
What on earth is all this talk about "attacks" and "rolling back the market"?
This is how currency works; we've just been witness to one of the darker
parts. Just because you don't like it doesn't mean it's not legitimate.

Even if it's illegal to manipulate the US Dollar, it is most certainly legal
to manipulate the BitCoin, whose express purpose was to be _wholly
unregulated!!!_

~~~
bradleyland
There's been a lot of talk about regulation, but I read something earlier
today that I found rather surprising:

"Unlike stocks, futures or options, currency trading does not take place on a
regulated exchange. It is not controlled by any central governing body, there
are no clearing houses to guarantee the trades and there is no arbitration
panel to adjudicate disputes. All members trade with each other based on
credit agreements. Essentially, business in the largest, most liquid market in
the world depends on nothing more than a metaphorical handshake." - 1

So basically, the method of bitcoin exchange isn't all that different from
ForEx. What's happened here is that the trading house has taken a fall, but
doesn't appear prepared to take it on the chin. I don't know much about Mt.
Gox. Any guesses as to whether or not they're insured? If this turns out to be
a case of Mt. Gox's systems being hacked, are they liable?

What's most interesting for me is the irony on display. Bitcoin, Mt. Gox, and
the whole ecosystem were established on principles like lack of regulation,
anonymity, and un-traceability, yet here they are, hoist by their own petard.

[1]
[http://www.investopedia.com/articles/forex/06/SevenFXFAQs.as...](http://www.investopedia.com/articles/forex/06/SevenFXFAQs.asp?partner=aol-d)

~~~
sethg
I suppose this makes sense... the US government doesn’t really care if you get
fleeced buying or selling British pounds, and the British government doesn’t
care if you get fleeced buying or selling US dollars.

------
johnzabroski
Very good synopsis by Kevin.

However, he has two technical mistakes in his post from a security
perspective:

1) We don't know the attack vector. For example: If Mt Gox has a SQL injection
vulnerability, then a sophisticated attacker will not waste their time doing a
rainbow attack on a random user. Instead, if the account balance is not
encrypted and the key kept secret, then the attacker simply needs to do a SQL
injection attack that returns the account with the largest balance:

select top 1 t1.account_id, t1.balance from Account t1 order by t1.balance
desc

Instantly, the attacker knows the largest balance. This automatically reduces
the attack space. This is a standard trick attackers use to bypass even
needing to guess a password.

2) Compounding this issue, it seems Kevin is right, the attacked account had a
naive password susceptible to a rainbow attack. According to rumors, this
attack was a pooled account that mediated all the assets traded on the
exchange. This implies that MtGox used a password susceptible to a rainbow
attack to secure the master account. To answer Kevin's question, what user
would amass $8M in bitcoins and use a bad password? The system administrators.
0xDEADBEEF.

Postscript: I have never traded or owned bitcoins, or even signed up for an
exchange. I just find the security breach fascinating!

~~~
vessenes
Unless this was changed in the last six months, the administrators did not
amass bitcoins in their own accounts; each account had its own balance.

------
evgen
Reading through the forum posts is really quite illuminating. The childishness
of the bitcoin miners/traders is understandable given the demographic that
this system appeals to at the moment, but the stunning naivete and downright
ignorance of the law that is on display from the Mt. Gox admins is the most
remarkable thing to me. At this point I am expecting bitcoin to die not due to
its inherent failures as a currency but due to the incompetence of the major
bitcoin exchange.

------
lubos
he claims that $1,000 daily limit at MtGox is broken and you are able to
withdraw as many times as you want as long as each withdrawal is under $1,000.

the most interesting part I think is that he was actually able to withdraw
643.27 bitcoins (much more than usual daily limit) when they were for around
$1.55 each which means withdrawal limit for BTC was calculated at current
market prices.

If this is all true, then hacker is probably banging his head against the wall
now because he was likely able to steal millions without any hope being ever
caught. or did he?

MtGox claims he got away with only $1,000 worth of bitcoins however if he took
them out of the exchange right after the crash when their market value was
around $0.01... oh well, there is something very fishy going on here. I
suspect MtGox doesn't have enough bitcoins to back their accounts now. If you
see in upcoming days people complaining about MtGox not willing to physically
transfer bitcoins back to their traders, it will be more than obvious.

~~~
drivebyacct2
Well, the OP here is actually claiming that the hacker made away with the btc,
if I'm to understand his accusations correctly.

------
ISeemToBeAVerb
I think people trading in Bitcoin need to keep perspective on what they are
actually doing, which is participating in an experiment.

No investor with a sane mind would consider Bitcoins a solid investment
decision. Unfortunately, ideas like this tend to attract both extremely savvy
people as well as a bunch of lazy people who would otherwise be lapping up
"Make 10,000 a week with Clickbank" e-books.

There will likely be many more stories in the same vein as this one.

In my mind, the wealth of this discussion isn't who is right and who is wrong,
it's the fact that we're recognizing the current faults in a new and ambitious
system, in the hopes that we can make a better one in the future.

------
cpeterso
> Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hashing.
> The unsalted user accounts in the wild are ones that haven't been accessed
> in over 2 months and are considered idle. Once we are back up we will have
> implemented SHA-512 multi-iteration salted hashing and all users will be
> required to update to a new strong password.

I'm quite surprised that a service with accounts holding millions of dollars
would store passwords without salt or a stronger hash algorithm than MD5!

~~~
nullc
FreeBSD MD5 is pretty strong— Its randomly salted and runs 1000 iterations of
MD5. None of MD5's weaknesses are especially relevant in this context.

The most important thing is the how slow it is, and it's likely that if they'd
taken defaults bcrypt would actually have been faster.

The saddest thing is that many of the people howling about MD5 are proposing
weaker alternatives like straight SHA-512 with a static "salt" embedded in the
source code.

In fact, MTGOX almost deployed such a replacement in their upgrade until they
were cluesticked by people screaming to not invent you own cryptographic
functions.

~~~
derobert
I don't think you understand how fast MD5 is. On the order of 10 billion
MD5/sec is doable for very cheap. If you're going after millions, getting
multiple graphics cards is a no-brainer.

See, for example, <http://www.golubev.com/gpuest.htm>

------
sunchild
Sounds to me like the admins at MtGox are, at the very least, amateurish, and
shouldn't be trusted with millions of dollars in escrowed funds.

~~~
FlowerPower
Millions of fantasy dollars.

~~~
michael_dorfman
Which are (subject to Mt Gox's rules) convertible to real dollars.

~~~
ceejayoz
Subject to Mt Gox's holdings of real dollars, too.

------
gte910h
A thief can't pass good title on stolen goods: If you buy a stolen item, it is
not yours, it is still the original owner's. Doesn't matter if it's a bitcoin,
a car, or a quarter.

The sale was not legit, it should not stand. The rest of the rollback is
fuzzier, but on this gentlemans coins, a seizure should occur.

[http://www.lexisnexis.com/community/corpsec/blogs/bus-law-
an...](http://www.lexisnexis.com/community/corpsec/blogs/bus-law-
analysis/archive/2011/06/15/rights-in-collateral-and-estoppel-
under-u.c.c.-article-9.aspx)

~~~
jacques_chester
The exception to this rule is a "bona fide purchaser for value without
notice". If someone has no reason to believe that property is stolen and buys
it, then it's their property now. So sorry.

I'm still confused about whether or not bitcoin transactions are traceable. If
they have deniability, it might be impossible to prove/disprove that you knew
the goods were stolen.

Of course, I am neither a lawyer nor a crypto specialist and this isn't legal
advice.

(In particular, the rules vary depending on whether the property is realty, on
whether you have a Torrens system, whether you have fused equity and what your
local courts and legislatures have decided).

~~~
Tichy
Uh, is that really so? So I can steal whatever I want, as long as I can sell
it off fast enough?

Say I am 99 years old and have only one week left to live. What if I go on a
car stealing spree and steal Porsche cars for my extended family. Then I sell
it to them for a symbolic 1 cent each, claiming that I have collected them
over my lifetime and now want my family to benefit.

~~~
jacques_chester
You've misread me.

You, the thief, are still on the hook for your crime.

The buyer, if they really are a bona fide purchaser for value without notice,
is not.

Your family would probably not meet the test, as this would be the first time
they've heard of the Porsches.

(IANAL, TINLA)

~~~
Tichy
Yes, what I mean is that if I was 99, I wouldn't care much about being
punished for being a thief. I could therefore make a lot of people happy. If
not my family, then maybe I could go Robin Hood, steal from the rich and sell
cheaply to the poor.

I can't imagine that it works that way. I can believe that as a buyer of
stolen good without knowing they were stolen, you won't be punished. But you
will still have to return the stuff. I am not a lawyer either, though.

If it works as you describe, let's found a guild of 99 year old Robin Hoods...

~~~
nkassis
SO if I understand this correctly, by buying the coins at ridiculously low
prices and the fact that in the post he said it was weird and he tried to take
advantage of it. Would he not completely fail the test?

~~~
tedunangst
He doesn't know they are stolen. It could have been a legit attempt to panic
the market by someone hoping to recover their losses plus some profit in the
recovery. It's not illegal to ride along.

------
ersmith
What I find interesting is that everyone is saying what needs to be done when
no one seem to be sure what really happened. The first thing that needs to
happen is an investigation into what really happened (perferably by some
outside party). At the same time Mt. Gox needs to undergo a security audit and
overhaul as it seems like no matter what happened, they have some major
security issues.

I also find it interesting that the person who supposedly initiated the trade
has yet to be heard from. Their story would really help clarify things, not to
mention that they have not been heard from yet makes it seem as if there is no
such single user...

------
juiceandjuice
"Every major exchange breaks trades. Too bad for you, consider yourself lucky
if you don't get sued for the 643 btc."

I'd _love_ to see how this would go down in the courts.

~~~
jacques_chester
"You may not be interested in the law", goes the saying, "but the law is
interested in _you_ ".

Bitcoin is meant to be unregulated, but MtGox and its identifiable customers
all have legal personality. The main challenge would be identifying
jurisdiction, but after that I suspect usual laws would be found to be
applicable.

(IANAL, TINLA)

------
marckremers
"If I had to store that much there, even temporarily, I would use a password
so long it would make War and Peace look like a Twitter message." - Brilliant

~~~
kd0amg
Wouldn't it likely have a hash collision with a much shorter password though?

~~~
gojomo
It would have many collisions with many shorter passwords.

But almost certainly not any collisions with _very simple_ and _very short_
passwords. The hash output space is sufficiently large.

Someone who (given infinite time) found a brute-force collision would likely
find one of the shorter preimages first – you aren't really gaining anything
by going ever-longer, after your preimage choice has as many bits as the hash
output.

But if the attacker truly needed to brute-force it over the entire 160-bit
(SHA1) or larger (other hashes) output space, unconstrained by usual simple-
password-like limits on what to try as preimages, that's impractical, and
you've achieved your goal... even if you overdid it on the input.

~~~
saalweachter
I suppose the defender could have a rainbow file of his own and purposefully
choose a password which didn't hash-collide with a password of < N characters.

~~~
politician
That's a fantastic idea for a web service. Google, are you listening?

~~~
gojomo
Doubt that'd be worth the effort/storage, even in the case of a weak, unsalted
hash like MD5.

Take N to be 10, assume 7 bits per character. Then all 10-character passwords
fill no more than 2^70 of the 2^128 MD5 space. Any 11-or-larger character
password then has a less than 1-in-2^58 chance of colliding with any shorter
password. (That's how much larger the full space is, from which each longer-
password hash will be drawn.) That's 1-in-288-quadrillion for us decimal apes.

The service would probably never deliver a useful warning before MD5 falls
completely to a preimage attack.

The analysis for such a service only gets harsher for 160/256/512 bit hashes.

------
nupark2
If there is real money in bitcoins, then there should be a real engineering
staff running a real, secure trading platform.

~~~
spitfire
Sounds like a market opening there. Who wants to start an exchange? A true
exchange, so you wouldn't have to front a dime, except for the virtual server.
IE: You're only matching orders and taking a cut, not putting any skin in the
game.

~~~
zokier
Bitcoin wiki already lists several exchanges. What would a new one do to make
a difference?

~~~
spitfire
Stability. People will pay for a known quantity.

If you create a clear, well defined entity there very well may be an opening
in the market for another bitcoin exchange.

In fact, i'd say there absolutely is an opening and I presume the market will
grow over time. Skim 0.75% off each side of the transaction and you're looking
to be in good shape. Particularly as btc trading activity increases.

------
brown9-2
Why would anyone keep $8,000,000 USD in an account where you can only
(according to the operator's "rules") withdraw $1000 USD a day?

It would take 21.9 years to withdraw the full amount of that account.

~~~
wmf
The $1,000 limit is only for unverified accounts. Also, it's possible that the
BTC was transferred into the account months ago when it was worth vastly less.
Or the BTC was accrued through trading.

Or it wasn't a real account...

~~~
_ikke_
According to MtGox they attackers ran into the $1000 limit, so it was not a
verified account.

~~~
danssig
This part of their story was made up to cover themselves. The "attackers"
didn't run into any limit. They sold off a bunch of bit coins. A legitimate
user bought then and then (sensibly) tried to get them out of the system,
hitting the limit.

------
swah
The stolen user hasn't reported until now, it seems. From one of the comments:

"It was definitely all our bitcoins that mtgox had in one account! I remember
a few days before, people saying that some big bitcoin movements on bitcoin
monitor were from mtgox, and the quantity being moved was around 400 000 to
500 000 bitcoins. No single user lost that quantity, it was our coins, from
all of us!"

~~~
vessenes
This is absolutely not how the Mt. Gox database works.

I know because I have access to the source code of the site.

You can't post a trade from 'all' accounts; if a large trade pushed the price
down, then a large trade pushed the price down, and that trade was executed
from a single account.

Given Mark's statement that the logins which had been dormant for more than a
few months were the easily rainbow-table attacked ones, it seems that someone
had sent in a lot of bitcoins and then stopped using the system for a while;
they apparently had a weak / rainbow-table vulnerable password.

If that's the situation, I'd call this a medium-sophisticated attack; better
would have been to drive prices down slowly over a day or so, then use other
hacked accounts to buy them up cheaply and withdraw over BTC. That might have
taken some time to notice and unravel.

As it is, it looks like someone tried to flash-crash the market, then send out
$1,000 worth of BTC at very low market rates, so a lot of BTC. Someone who
would do this intrinsically believes in the resilience of bitcoin by the way,
which is interesting. I'm not sure how they would plan on dealing with the
taint on their coins, though. They'd have needed some sort of high-volume
laundering service; none of the ones I know have enough volume to deal with
this.

~~~
marshray
_This is absolutely not how the Mt. Gox database works. I know because I have
access to the source code of the site._

All that source code you're looking at means nothing if the attacker gained
arbitrary SQL execution on the database.

~~~
vessenes
If you had sql injection rights in the database, there would be no need to
trade; you would just insert a few nice rows in the db for yourself, mark
yourself 'super trusted' and then initiate a withdrawal. This wasn't a SQL
injection attack in my opinion.

~~~
marshray
Hmm, but what if the attacker wasn't in it for the $currency?

What if he were in it to destroy Mt. Gox, as they say, "for the lulz"?

Making all their customers angry and causing a run on their escrow accounts
might just do it more effectively than trying to withdraw whatever could be
obtained through their online trading platform.

~~~
barkingcat
I agree - I think this has the earmark of a competitor exchange - to crash and
destroy Mt. Gox so they can take the business.

------
pash
Canceling trades disincentivizes traders to fill the dry side of the order
book during a liquidity crisis.

That alone makes cancellations bad policy. If you're worried about so-called
erroneous trades, you should disallow market orders; make all traders provide
an explicit buy or sell price and there is no such thing as a bad trade except
in the event of systems failures.

------
alvarosm
You should have moved the coins out. Now they're reverting the trades because
the alternative is accepting liability for their awful security (which is
probably, well, still awful). Bitcoin trading is the wild west, if you behave
like Jesus Christ you're just going to get nothing out of it. What I mean is
that in such a risky business you shouldn't feel guilty ripping people off,
they had it coming after all, it was their choice.

UNLESS, of course, you're having second thoughts because you're related to the
hacking and backed off when you got nervous, seeing how far the prices went
down and how the massive buy order did manage to go through... just a
possibility, no offense. The fact that you gave them your id and didn't behave
like a shady guy is irrelevant as long as it's impossible that you be proven
guilty, in fact that's exactly how the clever shady guy should be behaving...
like "not guilty", because money is usually traced in the end, and you want to
look like a saint when that happens. So, their position about contacting you
is perfectly reasonable and natural; to them you might be related to the
hackers anyway and anything they say to you (nothing they could say would be
good- a conversation with them would be full of unanswered questions) is
likely to end up in a public forum. Not good pr.

------
illumin8
This guy doesn't really have a leg to stand on. Just like when the flash crash
happened on the real stock market, transactions are going to be rolled back.

One thing that has become abundantly clear from reading all of the comments on
the Bitcoin forums is that the investing knowledge of most BTC traders is much
less than your average equities, fixed income, or ForEx trader.

MtGox is a pretty low budget operation, but even a low budget operation isn't
just going to let someone steal the equivalent of $10,000,000 USD and not
reverse the transactions. It would be like your bank telling you "sorry,
someone transferred money out of your account without your authorization, but
we're just going to let them keep it because, hey, they won it fair and square
by hacking your account."

(As I write this last line I realize there was recently a court case regarding
this exact issue, ETF fraud, but it occurred over many days and the company
had authorized an agreement that they would check their account balance daily
for fraudulent transactions.)

~~~
mbreese
I had transactions in the flash crash that weren't rolled back and I lost a
big chunk of cash (well, for me).

I just don't see how an exchange that doesn't have builtin failsafes/circuit
breakers can just roll back trades. I think that in this case, the exchange
should be liable. He was just exploiting the market.

~~~
davemabe
There are trades that get "busted" (i.e. rolled back) every day in the US
stock markets. I've had it happen several times. This is part of normal market
activity. In my experience it has seemed pretty subjective - some trades that
I thought for sure would have been busted weren't and others were.

There's some speculation that when some more powerful market participants
(read: Goldman Sachs) are on the losing end of a questionable trade they
complain to the exchange and get the trade busted far more frequently than
when it happens to less powerful participants.

------
kees
A bitcoin exchange is a shady business, no regulation exists. So it is a
freespace for criminals and hackers. You hustle or you will be hustled. This
guy should have made a withdrawal by any means. In the bitcoin business only
your wallet file counts, the rest is just a big hustle. And please forgot that
you're able to sue somebody over a bitcoin dispute.

~~~
bradleyland
Would you be surprised to hear that ForEx (the method of exchanging currencies
like the USD, EURO, and YEN) are also unregulated?

"Unlike stocks, futures or options, currency trading does not take place on a
regulated exchange. It is not controlled by any central governing body, there
are no clearing houses to guarantee the trades and there is no arbitration
panel to adjudicate disputes. All members trade with each other based on
credit agreements. Essentially, business in the largest, most liquid market in
the world depends on nothing more than a metaphorical handshake."

\-
[http://www.investopedia.com/articles/forex/06/SevenFXFAQs.as...](http://www.investopedia.com/articles/forex/06/SevenFXFAQs.asp?partner=aol-d)

------
mbreese
If I were this guy, I'd have my attorney try to get an immediate injunction in
place. It seems like mtgox is just making this up as they go.

------
Astrohacker
There are two sides to this story. Here is Mt Gox's response:
<https://forum.bitcoin.org/index.php?topic=20250.0>

~~~
rapind
I don't get the significance of the logins. The hacker logs in every 15
minutes. What are the chances someone who makes a trade with him logs in a few
minutes after one of his logins?? I'd say the odds are pretty high... and that
log doesn't mean anything.

~~~
bluelu
And I bet there are hundres of other users loging in at that time as well.

------
unreal37
The law clearly is on the side of rolling back the transactions. Just like
Amazon.com can refuse to fulfill an order for an 50 inch LCD TV that was
accidentally priced for $1[1], and a bank can withdraw money from your account
that was accidentally deposited there[2], and just like the NYSE can nullify
mispriced orders[3], its clear Mt Gox can legally do the same. Transactions
can be rolled back and are in the real world all the time. It has to be that
way, to maintain fairness in the system.

Do you think this guy deserves $5 million worth of bitcoins because of the
work of a hacker? Uh no.

His rationalizations for his behavior are astonishing. Assuming he is not the
hacker, he got caught up in the excitement of buying cheap bitcoins (as we all
would have), realized after the fact he probably did something wrong, and
through contacting Mt Gox and coming out to the community he was hoping to get
away with at least some profits. He shouldn't be able to keep any of it. Sorry
Kevin.

[1]
[http://www.amazonsellercommunity.com/forums/thread.jspa?thre...](http://www.amazonsellercommunity.com/forums/thread.jspa?threadID=124006)
[2]
[http://articles.moneycentral.msn.com/Banking/BetterBanking/B...](http://articles.moneycentral.msn.com/Banking/BetterBanking/BankErrorInYourFavorYourProblem.aspx)
[3] [http://www.thestar.com/business/markets/article/806459--
regu...](http://www.thestar.com/business/markets/article/806459--regulators-
reverse-trades-after-market-meltdown)

~~~
danssig
>The law clearly is on the side of rolling back the transactions

No it isn't, there's no precedent for this because it hasn't existed before.
The nearest thing I can think of is when that fake letter was sent out about
some company causing the stock to tank. Did all the people who bought the
stock when it was low have their transactions rolled back? Because that's what
happened here, someone used highly technical means to cause an artificial
price dive and one guy was able to take advantage of it. It's not at all clear
to me that he should give _any_ of it back.

------
blhack
This reminds me of a conversation I was having with a friend a couple of days
ago about network affects. Once a system gets too big, the nice people that
started it start getting screwed by the people who don't understand (or care
about) the founding ideals.

The problem with a trading house like Mt. Gox is that some people assume that
all of the players are altruistic (these "some people" being "me", somebody
with a technical, non-financial interest in bitcoin).

What happened here is just natural selfishness: the person that executed this
buy order knew that the market was crashing, and that something was going
wrong, but decided to exploit it regardless.

Then trying to withdraw $5 million USD from Mt. Gox?

I guess it's just crowd psychology. "If I don't exploit this market, somebody
else will!"

It's sad, and it's just my naivety showing here, but bitcoin looks like a
nerdy sandbox from the outside (casually reading about it on HN); it's a place
for crypto/economics geeks to play around with finance.

Of course it isn't, and the actions of this [very greedy] person demonstrate
that.

So why do I want to use bitcoin? What advantages does it offer me over USD
right now? Before seeing this crash for the last couple of days, it felt like
the advantage was that bitcoin users were mostly geeks, and mostly
trustworthy. The regulation that bitcoin is avoiding is starting to look
pretty darn appealing.

How stupid/childish of me is it to daydream about a world where somebody saw
this crash happening, did exactly what he did (or maybe put in the buy order
at exactly $0.02), held the bitcoins until the crash ended, then just gave
them back to the sellers at cost?

~~~
anigbrowl
_Before seeing this crash for the last couple of days, it felt like the
advantage was that bitcoin users were mostly geeks, and mostly trustworthy._

Yeah whatever. 90% of the people using Bitcoin don't believe in the Federal
Reserve system or fiat money and just want anonymous online cash transactions.
There is nothing wrong with such beliefs or desires, but the idea that such
people are on a higher moral plane is the complaint of a naive person at best.

~~~
Produce
On the other hand, holding the belief that everyone is morally identical is
even more naive.

------
perfunctory
Regulating the exchange has nothing to do with regulating the currency. I
don't see how exchange regulation contradicts the bitcoin philosophy.

Having said that, regulatory rules should not have retroactive effect.

------
jrs235
Has it occurred to anyone that the reason Mt Gox may want to rollback the
transactions is because the account that was hacked belonged to Mt Gox or
someone affiliated with Mt Gox???

~~~
danenania
I think this is ~99% certain based on how it played out.

------
danssig
Wow, Mt. Gox sound like a bunch of criminals. Did everyone see the link
(posted 2 or 3 times) where something shady happened before and they just
moved jurisdiction so they couldn't be sued? I wouldn't be surprised to find
out that they did this whole thing themselves to steal some bit coins.

------
swah
Is there a place one can play with HFT (or just automated trading) in the
bitcoin market?

~~~
Devilboy
MtGox has a trading API

------
muyyatin
Interesting, MagicalTux said earlier they would not rollback transactions of
this type:

[https://forum.bitcoin.org/index.php?topic=18858.msg237804#ms...](https://forum.bitcoin.org/index.php?topic=18858.msg237804#msg237804)

~~~
bluelu
I bet this was his personal account and he used an easily breakable password
there. He has all interest to do a rollback there ;).

------
Tichy
I don't see the problem with a rollback. Couldn't the legal users just redo
all their transactions?

It sounds to me, as the first commentator on bitcoin.org says, that someone
would like to keep their fat booty.

~~~
pbhjpbhj
> _I don't see the problem with a rollback._

Suppose I gamble my life savings, buy Kleenex shares. Tomorrow a report comes
out showing that using paper tissues causes allergies and prolongs colds. The
shares tank ... I'd like a rollback please!

Strangely enough the guy that saw the report first and shorted those shares
making millions doesn't want a rollback.

Of course he wants to keep the money, he traded correctly on what was
apparently a correctly operating exchange and won. That's how this sort of
gambling works.

MtGox screwed up. Why would they allow a transaction that crashed the exchange
so easily?

~~~
Tichy
The difference is that the BTC being sold were stolen. It is a completely
different thing from what you describe.

If tomorrow it was discovered that the BitCoin protocol has been hacked and
BitCoins are worthless, a rollback wouldn't be justified.

~~~
pbhjpbhj
> _The difference is that the BTC being sold were stolen._

First up, who stole the bitcoins from whom?

Second, why allow trades that you know that you won't honour and will instead
want to roll back?

Third, rarely the bank loses, why do they get a do-over just because they lost
at playing at forex?

~~~
Tichy
"First up, who stole the bitcoins from whom?"

Allegedly one account with a lot of BTC was hacked. The Bitcoins were stolen
from that account.

~~~
pbhjpbhj
There doesn't appear to be any evidence.

People on the Mt.Gox forums are sceptical because the amount traded appears to
be equal to the entire Mt.Gox trading volume (from the little I've read).

The speculation is that it is either Mt.Gox himself/themselves, an account
representing the entire volume of all Mt.Gox traders or some other buyer who
has been in from the start and has somehow escaped the notice of the other
traders (this last option also accounts for the ability to break in as the
account security apparently was very weak and hasn't been forcedly enhanced).

------
elb0w
I work at the NYSE, anytime something like this happens there would be a roll
back. You cannot have a functioning stock market without this feature it would
be chaos.

------
RockyMcNuts
sure seems like the best of all possible worlds... a currency based on nothing
of tangible value, no central bank to try to keep it stable and stem panics,
no real economy or legal infrastructure behind it or army to protect them if
they existed, transactions easily traceable (even reversible), prone to
speculative fever and vulnerable to security issues.

------
ZipCordManiac
That was a great read. If I was Kevin I would give the coins back and not do
business with MtGox any longer. It's clear their systems are not secure enough
to handle these kind of transfers. It wouldn't surprise me if MtGox was
influenced by organized crime, they are in Japan and the Yakuza love these
kind of quasi-legal schemes as of late.

~~~
danssig
According those that forum (same thread) they're only in Japan to escape
fallout from a previous scandal.

------
benedikt
Since there is quite a bit of money involved one might wonder if someone is
trying to profit. One could take this even further, put up his best tinfoil
hat and ask how much control MtGox has or had over the market. Is that
possible scenario?

------
charlesju
This is largely irrelevant. As long as Mt. Gox has the capacity to do option
1, the impacts of option 1 exist or should exist already.

~~~
knorby
In what way do they have that capacity? That they let him and others clear
trades (and made no policy against it) in the window between the trade and
rollback, and that their policy pretty much doesn't give them the power to do
rollbacks, I don't see how that can fly. As far as I can see, the only real
option that Mt. Gox is to let all the trades go through this time and then let
the trades go through. It is the only way that Mt. Gox will avoid several
million dollars (USD that is) of liability.

------
nextparadigms
Didn't MtGox say they'll rollback all transactions from that time period,
including the legit ones?

~~~
cdcarter
Yes. He's complaining about that decision.

~~~
swah
He also mentions that no stolen user has reported, and that its hard to
believe a single user held that much money.

~~~
pbhjpbhj
It seems possible that Mr (or Mrs) Mt. Gox is playing them all big-time and
attempted to do something clever, messed up and got found out. Of course if
you can change the rules and roll back the game at will then you can do what
you like. /cynical

~~~
danssig
Given their track record this seems very possible.

------
DiabloD3
As a Bitcoin forum moderator, I'm debating if I should nuke the thread, or
move it to the comedy section

------
drivebyacct2
Sounds like a good reason to be as anonymous in your interactions with mt.gox
as you are with anything else when using BitCoins (no judging here).

If I was on a public IP, it'd be very hard for me to not sprint with that much
coinage.

------
ignifero
I wonder what's the next coin when people get bored of playing with bitcoins?

~~~
wiredfool
I have some bytecoins over here. They're worth roughly 8x a bitcoin.

~~~
rbanffy
My bytecoins are worth 9 bitcoins each because they are parity-checked.

~~~
politician
Whoa there. Your parity-checked bytecoins are only worth 7 bitcoins each
(<http://en.wikipedia.org/wiki/8-bit_clean>).

~~~
rbanffy
Dammit. I was counting on the market not realizing this.

------
noduerme
I don't think o' Kev needs to worry about Mt. Gox thinking he hacked their
site. They know who executed the sale; it was them. I don't know why nobody
mentions this, but it seems rather obvious that Mt. Gox just dumped all their
own bitcoins and bought them back supercheap, apart from a relatively minor
500k worth that they can now "roll back" from his account.

I had a thread last week on HN where I was downranked severely for asking what
mt. gox was, i.e. if it was a mountain, in what was a sort of snarky,
derogatory tone (I'll admit it). I would like that thread upranked now thx.

------
napierzaza
TL;DR Bitcoins are possibly even more flawed than any other kind of currency.
There is one person who controls the flow of Bitcoins and can unmake
transactions it doesn't like.

~~~
danenania
You are confusing the currency with the exchange. It is definitely a weakness
for bitcoin that a shady exchange has captured 90% of the market, but this
problem isn't inherent to bitcoin. It seems likely that in the wake of news
like this, new exchanges will be created to try to capitalize on MtGox's
misfortune, and the exchange landscape will broaden.

As long there is someone, somewhere willing to put up products or state
currency in exchange for bitcoins, bitcoins will have their value. The best
case scenario for bitcoin could be for MtGox to go down in flames because if
it bitcoin held its value, it would prove that its fundamentals are sound, and
its price is based on legitimate demand for an anonymous medium of exchange,
not pure speculation.

If a MtGox collapse _did_ cause a bitcoin collapse, it would show that bitcoin
is not the real deal, just the result of a speculative frenzy. This may be
hard to stomach, but it's better than continuing to ignorantly pile money into
a bubble so fragile it can be popped by the guessing of a single password.

In my opinion this guy, if he really wants the best for bitcoin, should sue
MtGox hard if he honestly thinks what they did is wrong/illegal/breaks
contractual agreements. Let bitcoin sink or swim on its own merits.

------
bonch
What's with all the sudden HN coverage of these silly internet fun bucks?

~~~
sorbus
It's been going on for a while. Since midapril, there's been a minimum of two
stories about bitcoin each and every day[1]. There was, for a while, suspicion
that it was an attempt to boost interest in bitcoin, and get more people using
it - astroturfing, more or less - but I'm increasingly convinced that it's
just because stories about bitcoin tend to be upvoted, and it's often an
interesting topic. Well, ignoring the fact that there's very little left to
say about it, anyways.

[1] Based on a search for "bitcoin" on HNTrends,
<http://www.hntrends.dotcloud.com/>

------
ignifero
I 've seen people spending even more on useless novelty items, so no big deal.

------
rorrr
I don't get it. Who was did he buy the coins from at such a low price?

------
johnx123
I'm lost. Can somebody please brief what is bitcoin?

------
cbpavel
how about buying some miles from wwww.getAmile.com ? :)

------
rick888
The problems here with Bitcoin come across as the same problems with piracy:

Bitcoin are just bits on a computer.

Just like piracy, when we copy bits from one place to another, is it really
"stealing"?

Anyone that says "yes", better double-check their stance on software piracy as
well.

~~~
noonespecial
2 copies of a movie can exist simultaneously and both still have value. The
bitcoin network exists so that only one copy of a coin can have the value.
They are fundamentally different things, even if their physical instantiation
happens to be "just bits".

------
zbanks
Although I can completely understand why this guy (the sumbitter?) disagrees
with MtGox's solution, I thought it seemed perfectly reasonable.

Even though MtGox never stated they'd interfere, _being hacked_ is unexpected
enough to allow some leeway with follow-up. If the flashcrash happened
organically, I doubt MtGox would revert the trades.

~~~
kelnos
It's not that they never stated they'd interfere, it's that they explicitly
stated they would never interfere by publicly disclaiming any role as a
counter-party.

If they were hacked, it's their responsibility to make things right with the
party that was hacked, and not interfere with anyone else's accounts/trades.
Anything less does severe damage to faith in the exchange, which tends to lead
people to only keep money and BTC in the system for as long as they need to to
make a trade, and then pull it out. That's not good for the exchange or the
economy.

~~~
zbanks
Although I understand your perspective, and I agree that they have to do
_something_ to "make things right," I'm still inclined to accept the rollback.

As much as I hate to use analogies, its the best way I can think to explain my
reasoning. If someone (a hacker) robs a bank (user on MtGox), and they throw
the money on the ground as they fleeing the scene of the crime, only for it to
be picked up by bystanders (profiting users), what do you do?

To me, simply returning the money (rollback) seems to be the simplest
effective solution. Maybe I'm being too utilitarian, but it seems too complex
to add additional funds into the system, especially when we're talking about
nearly 10% of the entire value of BTC. Additionally, it establishes a strange
and dangerous precedent: hackers can get away with upsetting the market. And
who can make sure the hackers & profiteers aren't working together?

I don't think there's really much you can do to repair faith in the exchange
in the immediate future. More importantly, people will keep money as BTC the
exchange if it is value is stable (or deflating). Even now, I'd be more
worried about the market than hackers.

I'd love to see an insurance company spring up. It'd require major capital,
but it'd really help strengthen the value of BTC by providing security and
resolving nearly all of these issues. (Things I'd do with $1M...)

~~~
sneak
In your analogy, the bank is actually MtGox, the organization in actual
possession of the coins, NOT the user.

