
Breaking open the Mt. Gox case, part 1 - pcorey
http://blog.wizsec.jp/2017/07/breaking-open-mtgox-1.html
======
buryat
So according to the following, Vinnik was aware of the origin of bitcoins that
were sold on BTC-e:

> Some of the funds moved to BTC-e seem to have moved straight to internal
> storage rather than customer deposit addresses, hinting at a relationship
> between Vinnik and BTC-e.

and he was stupid enough to deposit them back to his account on MtGox:

> Moving coins back onto MtGox was what let us identify Vinnik, as the MtGox
> accounts he used could be linked to his online identity "WME"
> [http://archive.is/6cFcY](http://archive.is/6cFcY)

All in all, there a strong suggestion that he participated in money laundering
and was involved in the whole scheme.

I wonder, if BTC-e somehow artificially pumped the bitcoin valuation
leveraging the huge amount of bitcoins they put hands on, same as what MtGox
did.

Also, it looks like that Mark Karpeles wasn't involved in the whole scheme,
and the hack was that simple thanks to the low or no security and engineering
culture at MtGox:

> In September 2011, the MtGox hot wallet private keys were stolen, in a case
> of a simple copied wallet.dat file.

> the shared keypool of the wallet.dat file lead to address reuse, which
> confused MtGox's systems into mistakenly interpreting some of the thief's
> spending as deposits, crediting multiple user accounts with large sums of
> BTC and causing MtGox's numbers to go further out of balance by about 40,000
> BTC. None of these users seem to have reported their "sudden luck".

~~~
ryanlol
>All in all, there a strong suggestion that he participated in money
laundering and was involved in the whole scheme.

Well duh, anyone involved in the Bitcoin community was very well aware of
this. BTC-e has been flagrantly disregarding AML and KYC laws for it's entire
existence.

~~~
jstanley
Lots of people in Bitcoin hate KYC and AML laws, and consider them invasive. I
am one of these people.

In itself, it's not an indicator of wrongdoing.

~~~
dragonwriter
Hating KYC/AML law may not be a strong indicator of legal wrongdoing; breaking
it, OTOH, is not merely an indicator of legal wrongdoing, but is itself such
wrongdoing.

------
NelsonMinar
The coin flow graph is terrific:
[http://wizsec.jp/images/theft_flow.svg](http://wizsec.jp/images/theft_flow.svg)

Is this type of visualization common in Bitcoin? Is it a tool anyone can
easily use?

 _Edit_ , let me restate my question. "Is there a tool that generates Sankey
diagrams from blockchain data that is easy to use?"

~~~
showerst
These are called Sankey diagrams.

~~~
sonium
Actually more specific is 'alluvial diagram' [1] since the style emphasizes a
'flow' character.

[1]
[https://en.wikipedia.org/wiki/Alluvial_diagram](https://en.wikipedia.org/wiki/Alluvial_diagram)

[2]
[https://en.wikipedia.org/wiki/Sankey_diagram](https://en.wikipedia.org/wiki/Sankey_diagram)

------
Jabanga
This would have all been avoided if MtGox had transferred its coins to a new
wallet after the 2011 breach. I guess they assumed that any attacker that got
access to the private keys would have immediately emptied the wallet, and the
fact that this hadn't happened proved that the private keys hadn't been
compromised by the breach.

I have to admit, that is a reasonable assumption. This may show the limits of
the usefulness of heuristics, and the importance of organizations like
exchanges, that have very significant fiduciary duties, to undertake a
systematic process after a security breach to eliminate all possible remaining
vulnerabilities, no matter how unlikely and counterintuitive.

~~~
jmcqk6
>I have to admit, that is a reasonable assumption.

I really have to disagree. You get breached, you change your private keys.
There shouldn't be a debate about that.

~~~
dopamean
You don't have to disagree. I dont think he's arguing that you shouldn't
change the keys based on that assumption.

------
austenallred
Can't wait to get my refund :)

It's still insane to me that MtGox never moved coins to a wallet or
acknowledged the breach until long after it was too late. You would think if
you have billions of dollars sitting somewhere and you realize someone is
starting to take them you would, you know, _do something_.

~~~
wcummings
>Can't wait to get my refund :)

I had like 0.000001 BTC in mtgox and it was worth it for the cute sticky
unfoldy postcard thing I got from the Japanese court.

~~~
vocatus_gate
Same here, I saved mine to show to my kids some day. "Hey look kids, your dad
was summoned to a Japanese district court over the loss of 0.0001 bitcoin!"

~~~
mtanski
Since bitcoin is deflationary (max supply) it's technically possible that
0.0001 might be worth something one day.

~~~
vocatus_gate
My holdings are much higher than that so it's a drop in the bucket either way
at this point.

------
Pyxl101
It sounds like MtGox must have had no auditing of their wallets, or completely
ineffective auditing.

How did they not at least perform a simple sum of coins held by their wallets
and compare it against the amount expected by their databases? Or is the
attack more sophisticated than this would detect?

If I were building a system like this, I'd want to run an auditing system
continuously that looks for discrepancies, and then "shuts down everything" if
they're detected.

~~~
FRex
The site was originally made for trading Magic The Gathering Online cards by
one guy who later got bored and then got into Bitcoin but I have no idea and
wikipedia doesn't mention if they reused any code or just the domain name
itself.

It's a fun piece of trivia one crypto currency guy told me and it seems to be
true.

~~~
viraptor
It really bothers me how often people repeat it like it means anything in this
case. Like they forget Amazon was just selling books. Also no idea if it still
uses any of the old code or just the name itself.

~~~
mikeyouse
Jed McCaleb built a beta release of a Magic trading card exchange for the
MtGox domain. He then read about bitcoin in a Slashdot article posted on July
11th, 2010 after which he decided to write an exchange. McCaleb insists that
the bitcoin exchange was completely different from the Magic cards exchange,
but Mt Gox went live as a Bitcoin exchange _July 18th, 2010_.

So either McCaleb built a brand new exchange from the ground up in one week,
or he reused code from his Magic card trading service.

McCaleb sold the site to Karpeles 8 months later, and 3 months after that, it
was breached for the first time. Allegedly, the hacker used McCaleb's old
admin credentials to arbitrarily assign himself any amount of bitcoin, which
he then started selling off to crash the price. Since the price crashed to
$0.01, the dollar value of the withdrawal limit represented several thousand
bitcoin, which the attacker promptly sent off-site.

No matter if the site was reused code from a Magic card exchange, or was
written from the ground up, it never should have been within a thousand miles
of anything of value.

~~~
viraptor
> So either McCaleb built a brand new exchange from the ground up in one week,
> or he reused code from his Magic card trading service.

Or he spent some time writing the new service while the previous one was still
running.

~~~
FRex
How could he have spent time writing a new service if it went from him getting
the bitcoin idea from slashdot to launch in 7 days?

------
dmix
> By mid 2013 [..] the thief had taken out about 630,000 BTC from MtGox.

630,000 BTC to USD = 1,560,069,000.00 US Dollars

Crazy.

$1.5 billion USD = 2.5% of Bitcoin's market cap ($40 billion) and someone
stole it.

~~~
loader
Around Mid 2013 Bitcoin supply was around 11.5M coins so 630K was more like
5.5% of total Bitcoin. Just using a different kind of math. There's more coins
now so using todays market cap % makes it seem less then it actually was.

~~~
mikeyouse
But mid 2013, the price of Bitcoin was ~$100.. So 630k was "only" $63 million.
A much larger percentage of a much smaller asset.

------
strgrd
I remember a time when BTC-e was the most logical exchange to use, especially
in the fallout of MtGox. I really enjoyed how straightforward the exchange
was, and how easy it was to get started using their API. I don't think they're
coming back after this.

~~~
h1d
Was never the logical choice.

------
jron
Never a dull moment in Bitcoin.

~~~
vocatus_gate
If penny stocks are the cocaine of the finance world, bitcoin and related
cryptocurrencies are like freebasing crack.

~~~
FRex
More like krokodil.

~~~
JCzynski
Give BTC a little credit, it's capable of giving you a solid rush and getting
you(r bank balance) high. It doesn't _always_ bankrupt you. That's a lot
better than you can say of krokodil.

~~~
vocatus_gate
I don't even know what krokodili IS so I'll take your word for it, ha ha

~~~
runholm
It's what you get if you walk into a gas station determined to mix everything
they have on their shelves and hope this results in a drug. It's a very cheap
and easy drug to create, but its ability to destroy the user's body far
surpasses more conventional drugs like heroin.

The life expectancy of a user is 1-2 years as their tissue starts to die.

------
zx2c4
Unrelated to the actual topic at hand, but anybody know which software
generated this svg?

[http://wizsec.jp/images/theft_flow.svg](http://wizsec.jp/images/theft_flow.svg)

I like graphs like this. They remind me of Charles Joseph Minard's famous
Napoleon graph:

[https://en.wikipedia.org/wiki/Charles_Joseph_Minard#/media/F...](https://en.wikipedia.org/wiki/Charles_Joseph_Minard#/media/File:Minard.png)

~~~
wmf
D3: [https://bost.ocks.org/mike/sankey/](https://bost.ocks.org/mike/sankey/)

------
scotty79
If they recover some coins, will they be transferred to mtgox bankruptcy
trustee.

~~~
h1d
If they can prove that they came out of it, I hope so.

------
racecliffer
Is the diagram simplifying things? It looks like in a number of cases, coins
were stolen, sent to a single wallet, and then sent to an exchange. That
doesn't seem like a particularly ambitious attempt to launder. I must be
missing something...

~~~
wmf
If the exchange doesn't know its customers and doesn't keep logs then it might
be successful.

------
asdz
Until today, I'm still waiting for my Mt.Gox refund :(

