Mt. Gox Auditor Theft - Revision history

Azoundria at 21:29, 13 September 2024

2024-09-13T21:29:32Z

Azoundria: Another 30 minutes completed. Significant revisions to multiple sections of the article. Amount of losses section updated.

2024-01-03T17:14:19Z

Another 30 minutes completed. Significant revisions to multiple sections of the article. Amount of losses section updated.

← Older revision		Revision as of 11:14, 3 January 2024
Line 51:		Line 51:
	\|June 26th, 2011		\|June 26th, 2011
	\|Mt. Gox Relaunches.		\|Mt. Gox Relaunches.
	\|The Mt. Gox trading platform ~~relaunched~~<ref name="mtgoxpressrelease" />.		\|The Mt. Gox trading platform reopened<ref name="mtgoxpressrelease" />.
	\|-		\|-
	\|August 26th, 2011 2:17 AM		\|August 26th, 2011 2:17 AM
Line 59:		Line 59:

	== Technical Details ==		== Technical Details ==
	The Mt. Gox exchange was undergoing a transition to new management<ref name="bitcointalklistold" />. To audit the revenue, the ~~seller~~ was granted an account with administrative access<ref name="bitcointalklistold" />. An attacker obtained credentials to the administrative account<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />, potentially due to brute forcing those credentials from the database breach a week prior<ref name="mtgoxpressrelease" />. The attacker was able to use their access to arbitrarily increase their balance on the exchange<ref name="mtgoxpressrelease" />~~, with none~~ of ~~those balances~~ backed by real bitcoin<ref name="bitcointalklistold" />.		The Mt. Gox exchange was undergoing a transition to new management<ref name="bitcointalklistold" />. To audit the revenue, the auditor was granted an account with administrative access<ref name="bitcointalklistold" />. An attacker obtained credentials to the administrative account<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />, potentially due to brute forcing those credentials from the database breach a week prior<ref name="mtgoxpressrelease" />. The attacker was able to use their access to arbitrarily increase their balance on the exchange<ref name="mtgoxpressrelease" />. None of the new bitcoins minted in that database adjustment were backed by real bitcoin<ref name="bitcointalklistold" />.

	=== Platform Purchase And Management Transition ===		=== Platform Purchase And Management Transition ===
Line 79:		Line 79:
	"06/19/11 17:51 Bought BTC 259 684.77 for 0.0101"		"06/19/11 17:51 Bought BTC 259 684.77 for 0.0101"

	~~This~~ "security breach ... caused ... the price of a bitcoin to fraudulently drop to one cent, after a hacker allegedly used credentials from a Mt. Gox auditor's compromised computer to transfer a large number of bitcoins illegally to himself." "On 19 June, a stream of fraudulent trades caused the nominal price of a bitcoin to fraudulently drop to one cent on the Mt. Gox exchange, after a hacker allegedly used credentials from a Mt. Gox auditor's compromised computer to transfer a large number of bitcoins illegally to himself. He used the exchange's software to sell them all nominally, creating a massive "ask" order at any price. Within minutes the price corrected to its correct user-traded value.		"On 19 June, a stream of fraudulent trades" caused by this "security breach ... caused ... the price of a bitcoin to fraudulently drop to one cent, after a hacker allegedly used credentials from a Mt. Gox auditor's compromised computer to transfer a large number of bitcoins illegally to himself." The attacker "used the exchange's software to sell them all nominally, creating a massive "ask" order at any price. Within minutes the price corrected to its correct user-traded value."
	== Total Amount Lost ==		== Total Amount Lost ==
	~~Loss accounts very widely, with some estimates as large as 500,000 bitcoin<ref name="bitcointalklistold" />. The losses in this case stem from two sources<ref name="bitcointalklistold" />.~~

	The first source of loss was a theft of 2000 bitcoin from a hacker directly withdrawing from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.		The first source of loss was a theft of 2000 bitcoin from a hacker directly withdrawing from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.

	The second source of loss was a reported 643.27 bitcoin which were purchased by other Mt. Gox users at deflated prices<ref name="bitcointalklistold" />. The actions of the seller resulted in a price drop from approximately $17.50 USD to $0.01 USD on the exchange<ref name="mtgoxpressrelease" />. Some additional funds were lost through traders on the platform taking advantage of the resulting price fluctuation<ref name="bitcointalklistold" />. The service was finally relaunched on June 26th, 2011<ref name="mtgoxpressrelease" />.		The second source of loss was a reported 643.27 bitcoin which were purchased by other Mt. Gox users at deflated prices<ref name="bitcointalklistold" />. The actions of the seller resulted in a price drop from approximately $17.50 USD to $0.01 USD on the exchange<ref name="mtgoxpressrelease" />.

	~~According to BitcoinTalk, the equivalent loss was estimated to be $46,970.91 USD<ref name="bitcointalklistold" />.~~

	~~In addition to the lost funds, the Mt. Gox database was leaked which included hashed passwords of multiple users<ref name="bitcointalklistold" />.~~



	~~The hacker acquired an~~ estimated 2,~~000 BTC through this strategy, with an additional 650~~ BTC ~~purchased by other Mt. Gox users at deflated prices~~.”		According to BitcoinTalk, the equivalent loss was estimated to be $46,970.91 USD based on a lower bound of 2643.27 BTC<ref name="bitcointalklistold" />.

	Accounts with the equivalent of more than $8,750,000 were affected."		Loss accounts very widely, with some estimates as large as 500,000 bitcoin<ref name="bitcointalklistold" />. Some additional funds were lost through traders on the platform taking advantage of the resulting price fluctuation<ref name="bitcointalklistold" />. Accounts with the equivalent of more than $8,750,000 were reportedly affected.

			In addition to the lost funds, the Mt. Gox database had been leaked prior to the incident, which included hashed passwords of a significant number of users<ref name="bitcointalklistold" />.
	== Immediate Reactions ==		== Immediate Reactions ==
	Mt. Gox posted a press release on their website shortly after the events unfolded<ref name="mtgoxpressrelease" />.<blockquote>For a brief period, the number of Bitcoins in the Mt. Gox exchange vastly outnumbered the Bitcoins in our wallet. Normally, this should be impossible.</blockquote>In it, they questioned the attacker's motive, given that a lot more damage could have been done<ref name="mtgoxpressrelease" />.<blockquote>Perhaps the attack simply was not well-orchestrated but the possibility exists that the attacker was more interested in making a statement, hurting Mt. Gox’s reputation, or hurting the public image of Bitcoins in general than he was in any monetary gain.</blockquote>Users were notified of the database breach ~~and~~ instructed to change any shared passwords<ref name="mtgoxpressrelease" />.<blockquote>We strongly encourage all our users to immediately change the passwords of any other accounts that now or previously shared a password with their Mt. Gox account, if they have not done so already.		Mt. Gox posted a press release on their website shortly after the events unfolded<ref name="mtgoxpressrelease" />.<blockquote>For a brief period, the number of Bitcoins in the Mt. Gox exchange vastly outnumbered the Bitcoins in our wallet. Normally, this should be impossible.</blockquote>In it, they questioned the attacker's motive, given that a lot more damage could have been done<ref name="mtgoxpressrelease" />.<blockquote>Perhaps the attack simply was not well-orchestrated but the possibility exists that the attacker was more interested in making a statement, hurting Mt. Gox’s reputation, or hurting the public image of Bitcoins in general than he was in any monetary gain.</blockquote>Users were notified of the database breach, instructed to change any shared passwords, and instructed to use more secure passwords<ref name="mtgoxpressrelease" />.<blockquote>We strongly encourage all our users to immediately change the passwords of any other accounts that now or previously shared a password with their Mt. Gox account, if they have not done so already.


Line 109:		Line 102:
	Going forward, we are certain that the launch of the new site will exceed the rightful expectations our users have of the service. We only hope that we can once again earn the trust of the Bitcoin community. In the meantime, we sincerely appreciate the patience all our users have shown</blockquote>"He realized that these bitcoins were most likely from hacking and wanted to behave as honestly as possible, especially since on the eve he sent his id documents for passing verification. There was a limit for withdrawal, but there was a bug that allowed you to withdraw $ 1000 many times in a day, he could also sell a huge number of bitcoins, lower the price again to 0.01 cents, and withdraw all bitcoins fitting in the daily limit, but he did not do it, he only withdraw 643 bitcoins. He hoped until the end that he would be let to keep these BTC, but there where decision to roll back all transactions, and Kevin gained only 643 BTC."		Going forward, we are certain that the launch of the new site will exceed the rightful expectations our users have of the service. We only hope that we can once again earn the trust of the Bitcoin community. In the meantime, we sincerely appreciate the patience all our users have shown</blockquote>"He realized that these bitcoins were most likely from hacking and wanted to behave as honestly as possible, especially since on the eve he sent his id documents for passing verification. There was a limit for withdrawal, but there was a bug that allowed you to withdraw $ 1000 many times in a day, he could also sell a huge number of bitcoins, lower the price again to 0.01 cents, and withdraw all bitcoins fitting in the daily limit, but he did not do it, he only withdraw 643 bitcoins. He hoped until the end that he would be let to keep these BTC, but there where decision to roll back all transactions, and Kevin gained only 643 BTC."

	The thief has reportedly never been caught<ref name="bitcointalklistold" />.		The thief of the 2000 BTC has reportedly never been caught<ref name="bitcointalklistold" />.

	=== Kevin's Side Of The Story ===		=== Kevin's Side Of The Story ===
	"The forum has a thread with the title “I'm Kevin, here's my side”. In which the user toasty tells how once he saw that gigantic sell order was burning through the bids at exchange, the price dropped from 17.5$ dollars to 10$, Mt. Gox processed orders slowly, it all lasted a minutes, there were many orders to buy bitcoin for $ 0.01, so he placed his order for $ 0.0101, the exchange was heavily lagging, but with some effort, he managed to place that order, then The site stopped responding completely, when he got back in, he saw:"		"The forum has a thread with the title “I'm Kevin, here's my side”. In which the user toasty tells how once he saw that gigantic sell order was burning through the bids at exchange, the price dropped from 17.5$ dollars to 10$, Mt. Gox processed orders slowly, it all lasted a minutes, there were many orders to buy bitcoin for $ 0.01, so he placed his order for $ 0.0101, the exchange was heavily lagging, but with some effort, he managed to place that order, then The site stopped responding completely, when he got back in, he saw" that the order had gone through.

			=== Proving Control of Bitcoins ===
			"To prove that Mt. Gox still had control of the coins, the move of 424,242 bitcoins from "cold storage" to a Mt. Gox address was announced beforehand, and executed in Block 132749."'

			=== Collapse of Mt. Gox Exchange ===
			The Mt. Gox exchange would go on to [[Mt. Gox Coins Destroyed\|accidentally destroy bitcoin in October 2011]], [[Mt. Gox User champbronc2 Hacked\|have a user report their accounts hacked in July 2013]], and [[Mt. Gox Halts Trade Over Major Hack\|eventually spectacularly collapse in February 2014]].

	== Total Amount Recovered ==		== Total Amount Recovered ==
	Mt. Gox publicly stated that they would cover the 2000 bitcoin that had been lost<ref name="mtgoxpressrelease" />.<blockquote>Unfortunately, the 2000 BTC withdrawn did have real wallet backing and they will be replaced at Mt. Gox’s expense.</blockquote>Mt. Gox reverted all balances and trades to a previous state<ref name="bitcointalklistold" />. While many users claim that they lost money after the reversion, Mt. Gox claims that it has made right all affected users<ref name="bitcointalklistold" />.		Mt. Gox publicly stated that they would cover the 2000 bitcoin that had been lost<ref name="mtgoxpressrelease" />.<blockquote>Unfortunately, the 2000 BTC withdrawn did have real wallet backing and they will be replaced at Mt. Gox’s expense.</blockquote>Mt. Gox reverted all balances and trades to a previous state<ref name="bitcointalklistold" />. While many users claim that they lost money after the reversion, Mt. Gox claims that it has made right all affected users<ref name="bitcointalklistold" />.



	~~"To prove that Mt. Gox still had control of the coins, the move of 424,242 bitcoins from "cold storage" to a Mt. Gox address was announced beforehand, and executed in Block 132749."~~

	“None of the [withdrawn] bitcoins were returned to their rightful owners.”		“None of the [withdrawn] bitcoins were returned to their rightful owners.”

	== Ongoing Developments ==		== Ongoing Developments ==
	While the issues ~~here~~ have been largely settled out, the Mt. Gox bankruptcy continues to play out.		While the issues related to the auditor theft have been largely settled out, it likely played a material role in the eventual collapse of the platform. The Mt. Gox bankruptcy continues to play out into the future.
	==Individual Prevention Policies==		==Individual Prevention Policies==
	{{Prevention:Individuals:Avoid Third Party Custodians}}		{{Prevention:Individuals:Avoid Third Party Custodians}}

Azoundria: Another 30 minutes complete. Added technical analysis and massively expanded the prevention sections. Expanded and revised most text in the article.

2023-12-08T20:32:30Z

Another 30 minutes complete. Added technical analysis and massively expanded the prevention sections. Expanded and revised most text in the article.

Show changes

Azoundria at 22:25, 13 February 2023

2023-02-13T22:25:15Z

← Older revision		Revision as of 16:25, 13 February 2023
Line 153:		Line 153:

	Regarding the lost funds, these all came from the hot wallet. Serious losses can be prevented with a multi-signature cold storage wallet, limiting the total losses to the funds available in the hot wallet. There is no need for an auditor to have access to any funds, as access can be proven by creating a small transaction or partially signing a hypothetical transaction.		Regarding the lost funds, these all came from the hot wallet. Serious losses can be prevented with a multi-signature cold storage wallet, limiting the total losses to the funds available in the hot wallet. There is no need for an auditor to have access to any funds, as access can be proven by creating a small transaction or partially signing a hypothetical transaction.

	~~<ref name="bitcointalklistold" />~~

	== References ==		== References ==

Azoundria: /* About Mt. Gox */ add verisign verification

2023-02-10T15:33:33Z

About Mt. Gox: add verisign verification

← Older revision		Revision as of 09:33, 10 February 2023
Line 14:		Line 14:
	"Fully automated, always available, 24 hours a day, Safe and Easy."		"Fully automated, always available, 24 hours a day, Safe and Easy."

	"The only multi-currency Bitcoin trading platform where you can trade with the entire world in your local currency."</blockquote>Mt. Gox achieved a wide popularity due to the ease with which users could sign up for services there. <blockquote>"Buying and selling Bitcoin doesn't have to be complicated! Get trading in a few simple steps."		"The only multi-currency Bitcoin trading platform where you can trade with the entire world in your local currency."</blockquote>Users could trade on Mt. Gox using a wide range of world currencies<ref name="mtgoxarchive2" />. Mt. Gox achieved a wide popularity due to the ease with which users could sign up for services there<ref name="mtgoxarchive1" />. <blockquote>"Buying and selling Bitcoin doesn't have to be complicated! Get trading in a few simple steps."

	"4 Easy Steps:		"4 Easy Steps:
Line 24:		Line 24:
	3. Buy or Sell Bitcoins.		3. Buy or Sell Bitcoins.

	4. Withdraw your converted funds."</blockquote>Basic features like SSL were provided for account security and 24/7 uptime was advertised as a selling point<ref name="mtgoxarchive2" />.<blockquote>"Mt.Gox is protected by Prolexic and certified by VeriSign, which means all communications with our servers are encrypted with SSL technology." "We're always on. Buy and sell Bitcoin 24/7/365 with the world's most sophisticated trading platform." </blockquote>		4. Withdraw your converted funds."</blockquote>Basic features like SSL were provided for account security and 24/7 uptime was advertised as a selling point<ref name="mtgoxarchive2" />. The Mt. Gox platform featured a "Norton Secured" seal<ref name="mtgoxarchive2" />.<blockquote>"Mt.Gox is protected by Prolexic and certified by VeriSign, which means all communications with our servers are encrypted with SSL technology." "We're always on. Buy and sell Bitcoin 24/7/365 with the world's most sophisticated trading platform." </blockquote>


Line 96:		Line 96:
	\|Mt. Gox Relaunches.		\|Mt. Gox Relaunches.
	\|The Mt. Gox trading platform relaunched<ref name="mtgoxpressrelease" />.		\|The Mt. Gox trading platform relaunched<ref name="mtgoxpressrelease" />.
			\|-
			\|August 26th, 2011 2:17 AM
			\|Verisign Verification
			\|The Mt. Gox trading platform announces they are now verified by Verisign, directly referencing the attack from June as part of the motivation<ref>[https://web.archive.org/web/20120505175000/https://support.mtgox.com/entries/20395323-mt-gox-now-verified-by-verisign/ Mt.Gox (K.K. Tibanne): Now Verified by VeriSign - Internet Archive] (Feb 10, 2023)</ref>.
	\|}		\|}

Azoundria: /* About Mt. Gox */ More information about Mt. Gox .

2023-02-10T15:18:37Z

About Mt. Gox: More information about Mt. Gox .

← Older revision		Revision as of 09:18, 10 February 2023
Line 6:		Line 6:

	== About Mt. Gox ==		== About Mt. Gox ==
	At the time Mt. Gox was established, there were no other major trading platforms for cryptocurrencies.<blockquote>"Mt.Gox is the world's most established Bitcoin exchange. You can quickly and securely trade bitcoins with other people around the world with your local currency!"		Mt. Gox launched with a very simple interface<ref name="mtgoxarchive1" />. At the time Mt. Gox was established, there were very few other major trading platforms for cryptocurrencies. Mt. Gox was thus able to obtain over 80% of the global trading volume for bitcoin<ref name="mtgoxarchive2" />.<blockquote>"Mt.Gox is the world's most established Bitcoin exchange. You can quickly and securely trade bitcoins with other people around the world with your local currency!"

	"It allows you to trade US Dollars (USD) for Bitcoins (BTC) or Bitcoins for US Dollars with other Mt Gox users. You set the price you want to buy or sell your BTC for."		"It allows you to trade US Dollars (USD) for Bitcoins (BTC) or Bitcoins for US Dollars with other Mt Gox users. You set the price you want to buy or sell your BTC for."
Line 24:		Line 24:
	3. Buy or Sell Bitcoins.		3. Buy or Sell Bitcoins.

	4. Withdraw your converted funds."</blockquote>Basic features like SSL were provided for account security and 24/7 uptime was advertised as a selling point.<blockquote>"Mt.Gox is protected by Prolexic and certified by VeriSign, which means all communications with our servers are encrypted with SSL technology."		4. Withdraw your converted funds."</blockquote>Basic features like SSL were provided for account security and 24/7 uptime was advertised as a selling point<ref name="mtgoxarchive2" />.<blockquote>"Mt.Gox is protected by Prolexic and certified by VeriSign, which means all communications with our servers are encrypted with SSL technology." "We're always on. Buy and sell Bitcoin 24/7/365 with the world's most sophisticated trading platform." </blockquote>

	"We're always on. Buy and sell Bitcoin 24/7/365 with the world's most sophisticated trading platform." </blockquote>The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

	Include:		Include:
Line 45:		Line 44:

	== The Reality ==		== The Reality ==


	This sections is included if a case involved deception or information that was unknown at the time. Examples include:		This sections is included if a case involved deception or information that was unknown at the time. Examples include:

Line 158:		Line 159:
	<ref name="bitcoinexchangeguide">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)</ref>		<ref name="bitcoinexchangeguide">[https://bitcoinexchangeguide.com/bitcoin/scams-hacks/ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com] (Mar 4)</ref>
	<ref name="darknetdiaries">[https://darknetdiaries.com/episode/9/ The Rise and Fall of Mt. Gox – Darknet Diaries] (Jun 24)</ref>		<ref name="darknetdiaries">[https://darknetdiaries.com/episode/9/ The Rise and Fall of Mt. Gox – Darknet Diaries] (Jun 24)</ref>
	<ref name="mtgoxarchive1">[https://web.archive.org/web/20110203031942/http://mtgox.com/ Mt Gox - Bitcoin Exchange] (Oct 12)</ref>		<ref name="mtgoxarchive1">[https://web.archive.org/web/20110203031942/http://mtgox.com/ Mt Gox - Bitcoin Exchange - February 3rd, 2011 - Internet Archive] (Oct 12)</ref>
	<ref name="mtgoxarchive2">[https://web.archive.org/web/20120112024603/https://mtgox.com/ Mt.Gox - Bitcoin Exchange] (Oct 12)</ref>		<ref name="mtgoxarchive2">[https://web.archive.org/web/20120112024603/https://mtgox.com/ Mt.Gox - Bitcoin Exchange - January 12th, 2012 - Internet Archive] (Oct 12)</ref>
	<ref name="blockonomimtgox">[https://blockonomi.com/mt-gox-hack/ The History of the Mt Gox Hack: Bitcoin's Biggest Heist] (Dec 22)</ref>		<ref name="blockonomimtgox">[https://blockonomi.com/mt-gox-hack/ The History of the Mt Gox Hack: Bitcoin's Biggest Heist] (Dec 22)</ref>
	<ref name="consensystimeline">https://media.consensys.net/mtgox-btc-e-and-the-missing-coins-a-living-timeline-of-the-greatest-cyber-crime-ever-f94fbb1eb42 (Dec 22)</ref>		<ref name="consensystimeline">https://media.consensys.net/mtgox-btc-e-and-the-missing-coins-a-living-timeline-of-the-greatest-cyber-crime-ever-f94fbb1eb42 (Dec 22)</ref>

Azoundria: Removed duplicate of mtgoxpressrelease as mtgoxpressreleasearchive

2023-02-10T00:26:38Z

Removed duplicate of mtgoxpressrelease as mtgoxpressreleasearchive

← Older revision		Revision as of 18:26, 9 February 2023
Line 58:		Line 58:
	At some point prior to June 13th, 2011, an SQL injection vulnerability was exploited to gain read-only access to the Mt. Gox database. This allows for the attacker to remove 25,000 bitcoin from 478 accounts. By that Friday, June 17th, the database had been leaked and was for sale on the pastebin website<ref name="mtgoxpressrelease" />.		At some point prior to June 13th, 2011, an SQL injection vulnerability was exploited to gain read-only access to the Mt. Gox database. This allows for the attacker to remove 25,000 bitcoin from 478 accounts. By that Friday, June 17th, the database had been leaked and was for sale on the pastebin website<ref name="mtgoxpressrelease" />.

	After being purchased by Tibanne Co. Ltd. in March 2011<ref name="mtgoxpressrelease">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html Mt. Gox Press Release - Archive] (Feb 6, 2023)</ref>, Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" /> for a limited time period<ref name="mtgoxpressrelease" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.		After being purchased by Tibanne Co. Ltd. in March 2011<ref name="mtgoxpressrelease">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html Mt. Gox Press Release - Archive] (Feb 2, 2023)</ref>, Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" /> for a limited time period<ref name="mtgoxpressrelease" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.

	An attacker obtained credentials to the administrative account<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />, potentially due to brute forcing those credentials from the database breach a weak prior<ref name="mtgoxpressrelease" />. The attacker was able to use their access to arbitrarily increase their balance on the exchange<ref name="mtgoxpressrelease" />, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was then able to sell that fake bitcoin on the exchange platform and withdraw 2000 bitcoin from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.		An attacker obtained credentials to the administrative account<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />, potentially due to brute forcing those credentials from the database breach a weak prior<ref name="mtgoxpressrelease" />. The attacker was able to use their access to arbitrarily increase their balance on the exchange<ref name="mtgoxpressrelease" />, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was then able to sell that fake bitcoin on the exchange platform and withdraw 2000 bitcoin from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.
Line 165:		Line 165:
	<ref name="bitcointalklegendaryprofiles">[https://bitcointalk.org/index.php?topic=3247239.0 Legendary profiles of bitcointalk.] (Mar 7)</ref>		<ref name="bitcointalklegendaryprofiles">[https://bitcointalk.org/index.php?topic=3247239.0 Legendary profiles of bitcointalk.] (Mar 7)</ref>
	<ref name="kevinsidebitcointalk">[https://bitcointalk.org/index.php?topic=20207.0 I'm Kevin, here's my side.] (Mar 15)</ref>		<ref name="kevinsidebitcointalk">[https://bitcointalk.org/index.php?topic=20207.0 I'm Kevin, here's my side.] (Mar 15)</ref>
	~~<ref name="mtgoxpressreleasearchive">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html] (Feb 2, 2023)</ref>~~
	</references>		</references>

Azoundria: /* Immediate Reactions */ Lots of information from the press release added.

2023-02-07T07:17:31Z

Immediate Reactions: Lots of information from the press release added.

← Older revision		Revision as of 01:17, 7 February 2023
Line 52:		Line 52:
	* Details of what audits reported and how vulnerabilities were missed during auditing.		* Details of what audits reported and how vulnerabilities were missed during auditing.
	It would appear that the security around passwords was such that they were not properly secured. If passwords were hashed, it was a weak hashing algorithm. It was possible to reverse engineer the weak hashing function with brute force attacks on the account passwords.		It would appear that the security around passwords was such that they were not properly secured. If passwords were hashed, it was a weak hashing algorithm. It was possible to reverse engineer the weak hashing function with brute force attacks on the account passwords.

			The Mt. Gox platform contained an SQL injection vulnerability which could allow read-only access to the database<ref name="mtgoxpressrelease" />. The database contained email addresses, usernames, and hashed passwords<ref name="mtgoxpressrelease" />. Passwords were hashed using the relatively weak MD5 hashing algorithm, and some older passwords were hashed without the extra security of a salt<ref name="mtgoxpressrelease" />.<blockquote>The truth is that Mt. Gox was unprepared for Bitcoin’s explosive growth. Our dated system was built as a hobby when Bitcoins were worth pennies a piece. It was not built to be a Fort Knox capable of securely handling millions of dollars in transactions each day.</blockquote>

	== What Happened ==		== What Happened ==
	After being purchased by Tibanne Co. Ltd.<ref name="mtgoxpressrelease">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html Mt. Gox Press Release - Archive] (Feb 6, 2023)</ref>, Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" /> for a limited time period<ref name="mtgoxpressrelease" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.		At some point prior to June 13th, 2011, an SQL injection vulnerability was exploited to gain read-only access to the Mt. Gox database. This allows for the attacker to remove 25,000 bitcoin from 478 accounts. By that Friday, June 17th, the database had been leaked and was for sale on the pastebin website<ref name="mtgoxpressrelease" />.

			After being purchased by Tibanne Co. Ltd. in March 2011<ref name="mtgoxpressrelease">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html Mt. Gox Press Release - Archive] (Feb 6, 2023)</ref>, Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" /> for a limited time period<ref name="mtgoxpressrelease" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.

	An ~~unknown process was used to obtain~~ credentials to ~~that~~ administrative account<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />. The attacker was able to use their access to arbitrarily increase their balance on the exchange<ref name="mtgoxpressrelease" />, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was then able to sell that fake bitcoin on the exchange platform and withdraw 2000 bitcoin from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.		An attacker obtained credentials to the administrative account<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />, potentially due to brute forcing those credentials from the database breach a weak prior<ref name="mtgoxpressrelease" />. The attacker was able to use their access to arbitrarily increase their balance on the exchange<ref name="mtgoxpressrelease" />, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was then able to sell that fake bitcoin on the exchange platform and withdraw 2000 bitcoin from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.

	The actions of the seller resulted in a price drop from approximately $17.50 USD to $0.01 USD on the exchange<ref name="mtgoxpressrelease" />. Some additional funds were lost through traders on the platform taking advantage of the resulting price fluctuation<ref name="bitcointalklistold" />.		The actions of the seller resulted in a price drop from approximately $17.50 USD to $0.01 USD on the exchange<ref name="mtgoxpressrelease" />. Some additional funds were lost through traders on the platform taking advantage of the resulting price fluctuation<ref name="bitcointalklistold" />. The service was finally relaunched on June 26th, 2011<ref name="mtgoxpressrelease" />.

	On Monday, June 13th, 2011, the Mt. Gox bitcoin exchange reported that 25,000 BTC (US$400,000 at the time) had been robbed from 478 accounts. Then, on Friday 17 June, Mt. Gox's user database leaked for sale to pastebin, signed by ~cRazIeStinGeR~ and tied to auto36299386@hushmail.com. The theft of Bitcoins from Mt. Gox accounts continued, reportedly, throughout that day."		On Monday, June 13th, 2011, the Mt. Gox bitcoin exchange reported that 25,000 BTC (US$400,000 at the time) had been robbed from 478 accounts. Then, on Friday 17 June, Mt. Gox's user database leaked for sale to pastebin, signed by ~cRazIeStinGeR~ and tied to auto36299386@hushmail.com. The theft of Bitcoins from Mt. Gox accounts continued, reportedly, throughout that day."
Line 84:		Line 88:
	It was reported that a theft of bitcoins from accounts continued through the day.		It was reported that a theft of bitcoins from accounts continued through the day.
	\|-		\|-
	\|June 19th, 2011 6:00 PM		\|June 19th, 2011 12:00 PM
	\|~~Auditor Steals Bitcoins~~		\|Bitcoin Sale Price Crash
	\|~~The auditor hired~~ to ~~verify~~ that the ~~holding~~ of Mt. Gox ~~were sufficient used their access to sell bitcoins to their own wallet~~.		\|"On June 20th at approximately 3:00am JST (Japan Time), an unknown person logged in to the compromised admin account, and with the permissions of that account was able to arbitrarily assign himself a large number of Bitcoins, which he subsequently sold on the exchange, driving the price from $17.50 to $0.01 within the span of 30 minutes<ref name="mtgoxpressrelease" />."
			\|-
			\|June 26th, 2011
			\|Mt. Gox Relaunches.
			\|The Mt. Gox trading platform relaunched<ref name="mtgoxpressrelease" />.
	\|}		\|}

Line 107:		Line 115:
	== Immediate Reactions ==		== Immediate Reactions ==
	How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?		How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

			Mt. Gox posted a press release on their website shortly after the events unfolded<ref name="mtgoxpressrelease" />.<blockquote>For a brief period, the number of Bitcoins in the Mt. Gox exchange vastly outnumbered the Bitcoins in our wallet. Normally, this should be impossible.</blockquote>In it, they questioned the attacker's motive, given that a lot more damage could have been done<ref name="mtgoxpressrelease" />.<blockquote>Perhaps the attack simply was not well-orchestrated but the possibility exists that the attacker was more interested in making a statement, hurting Mt. Gox’s reputation, or hurting the public image of Bitcoins in general than he was in any monetary gain.</blockquote>Users were notified of the database breach and instructed to change any shared passwords<ref name="mtgoxpressrelease" />.<blockquote>We strongly encourage all our users to immediately change the passwords of any other accounts that now or previously shared a password with their Mt. Gox account, if they have not done so already.


			While we are making great strides with the advancement of our security, we should remind our users that they too play an important role in securing their accounts. Please use a long password—the standard is not whether a person could guess it but rather whether a computer could guess it—and computers can guess pretty fast. Please do not share passwords across services—where passwords are shared, a compromise at one service means a compromise at all services. Help us help you.</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==
	"He realized that these bitcoins were most likely from hacking and wanted to behave as honestly as possible, especially since on the eve he sent his id documents for passing verification. There was a limit for withdrawal, but there was a bug that allowed you to withdraw $ 1000 many times in a day, he could also sell a huge number of bitcoins, lower the price again to 0.01 cents, and withdraw all bitcoins fitting in the daily limit, but he did not do it, he only withdraw 643 bitcoins. He hoped until the end that he would be let to keep these BTC, but there where decision to roll back all transactions, and Kevin gained only 643 BTC."		Mt. Gox took a number of significant steps to improve the security of user accounts<ref name="mtgoxpressrelease" />. The Mt. Gox platform was able to relaunch on June 26th, 2011<ref name="mtgoxpressrelease" />.<blockquote>The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing and soon will have an option for users to enable a withdraw password that will be separate from their login passwords. Other security measures such as one-time password keys are planned for release very soon as well.


			Going forward, we are certain that the launch of the new site will exceed the rightful expectations our users have of the service. We only hope that we can once again earn the trust of the Bitcoin community. In the meantime, we sincerely appreciate the patience all our users have shown</blockquote>"He realized that these bitcoins were most likely from hacking and wanted to behave as honestly as possible, especially since on the eve he sent his id documents for passing verification. There was a limit for withdrawal, but there was a bug that allowed you to withdraw $ 1000 many times in a day, he could also sell a huge number of bitcoins, lower the price again to 0.01 cents, and withdraw all bitcoins fitting in the daily limit, but he did not do it, he only withdraw 643 bitcoins. He hoped until the end that he would be let to keep these BTC, but there where decision to roll back all transactions, and Kevin gained only 643 BTC."

	What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?		What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
Line 116:		Line 132:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	Mt. Gox reverted all balances and trades to a previous state<ref name="bitcointalklistold" />. While many users claim that they lost money after the reversion, Mt. Gox claims that it has made right all affected users<ref name="bitcointalklistold" />.		Mt. Gox publicly stated that they would cover the 2000 bitcoin that had been lost<ref name="mtgoxpressrelease" />.<blockquote>Unfortunately, the 2000 BTC withdrawn did have real wallet backing and they will be replaced at Mt. Gox’s expense.</blockquote>Mt. Gox reverted all balances and trades to a previous state<ref name="bitcointalklistold" />. While many users claim that they lost money after the reversion, Mt. Gox claims that it has made right all affected users<ref name="bitcointalklistold" />.

Azoundria: /* What Happened */ more from press release.

2023-02-07T02:33:07Z

What Happened: more from press release.

← Older revision		Revision as of 20:33, 6 February 2023
Line 56:		Line 56:
	After being purchased by Tibanne Co. Ltd.<ref name="mtgoxpressrelease">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html Mt. Gox Press Release - Archive] (Feb 6, 2023)</ref>, Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" /> for a limited time period<ref name="mtgoxpressrelease" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.		After being purchased by Tibanne Co. Ltd.<ref name="mtgoxpressrelease">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html Mt. Gox Press Release - Archive] (Feb 6, 2023)</ref>, Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" /> for a limited time period<ref name="mtgoxpressrelease" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.

	An unknown process was used to ~~breach~~ that administrative account<ref name="bitcointalklistold" />. The attacker was able to use their access to ~~massively inflate bitcoin balances~~ on the exchange, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was able to sell that fake bitcoin ~~to their own account~~ and withdraw it from the platform<ref name="bitcointalklistold" />.		An unknown process was used to obtain credentials to that administrative account<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />. The attacker was able to use their access to arbitrarily increase their balance on the exchange<ref name="mtgoxpressrelease" />, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was then able to sell that fake bitcoin on the exchange platform and withdraw 2000 bitcoin from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.

	~~Additional~~ funds were lost through traders on the platform taking advantage of the resulting price fluctuation<ref name="bitcointalklistold" />.		The actions of the seller resulted in a price drop from approximately $17.50 USD to $0.01 USD on the exchange<ref name="mtgoxpressrelease" />. Some additional funds were lost through traders on the platform taking advantage of the resulting price fluctuation<ref name="bitcointalklistold" />.

	On Monday, June 13th, 2011, the Mt. Gox bitcoin exchange reported that 25,000 BTC (US$400,000 at the time) had been robbed from 478 accounts. Then, on Friday 17 June, Mt. Gox's user database leaked for sale to pastebin, signed by ~cRazIeStinGeR~ and tied to auto36299386@hushmail.com. The theft of Bitcoins from Mt. Gox accounts continued, reportedly, throughout that day."		On Monday, June 13th, 2011, the Mt. Gox bitcoin exchange reported that 25,000 BTC (US$400,000 at the time) had been robbed from 478 accounts. Then, on Friday 17 June, Mt. Gox's user database leaked for sale to pastebin, signed by ~cRazIeStinGeR~ and tied to auto36299386@hushmail.com. The theft of Bitcoins from Mt. Gox accounts continued, reportedly, throughout that day."
Line 90:		Line 90:

	== Total Amount Lost ==		== Total Amount Lost ==
	Loss accounts very widely, ~~ranging from~~ estimates as large as 500,000 bitcoin<ref name="bitcointalklistold" />. The losses in this case stem from two sources<ref name="bitcointalklistold" />.		Loss accounts very widely, with some estimates as large as 500,000 bitcoin<ref name="bitcointalklistold" />. The losses in this case stem from two sources<ref name="bitcointalklistold" />.

	The first source of loss was a theft of 2000 bitcoin from a hacker directly<ref name="bitcointalklistold" />.		The first source of loss was a theft of 2000 bitcoin from a hacker directly withdrawing from the platform<ref name="bitcointalklistold" /><ref name="mtgoxpressrelease" />.

	The second source of loss was a reported 643.27 bitcoin which were purchased by other Mt. Gox users at deflated prices<ref name="bitcointalklistold" />.		The second source of loss was a reported 643.27 bitcoin which were purchased by other Mt. Gox users at deflated prices<ref name="bitcointalklistold" />.

Azoundria at 02:26, 7 February 2023

2023-02-07T02:26:54Z

← Older revision		Revision as of 20:26, 6 February 2023
Line 54:		Line 54:

	== What Happened ==		== What Happened ==
	Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.		After being purchased by Tibanne Co. Ltd.<ref name="mtgoxpressrelease">[https://web.archive.org/web/20110919162635/https://www.mtgox.com/press_release_20110630.html Mt. Gox Press Release - Archive] (Feb 6, 2023)</ref>, Mt. Gox was underdoing a transition to new management<ref name="bitcointalklistold" />. That sale deal included an ongoing portion of the revenue to be provided to the seller<ref name="bitcointalklistold" /> for a limited time period<ref name="mtgoxpressrelease" />. To audit the revenue, the seller was granted an account with administrative access<ref name="bitcointalklistold" />.

	An unknown process was used to breach that administrative account<ref name="bitcointalklistold" />. The attacker was able to use their access to massively inflate bitcoin balances on the exchange, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was able to sell that fake bitcoin to their own account and withdraw it from the platform<ref name="bitcointalklistold" />.		An unknown process was used to breach that administrative account<ref name="bitcointalklistold" />. The attacker was able to use their access to massively inflate bitcoin balances on the exchange, with none of those balances backed by real bitcoin<ref name="bitcointalklistold" />. The attacker was able to sell that fake bitcoin to their own account and withdraw it from the platform<ref name="bitcointalklistold" />.