MyBitcoin Username/Password Breach - Revision history

Azoundria: Restoration from old database.

2024-09-13T21:26:00Z

Restoration from old database.

← Older revision		Revision as of 15:26, 13 September 2024
Line 1:		Line 1:
	[[File:Mybitcoin.jpg\|thumb\|MyBitcoin Logo/Homepage]]MyBitcoin was a ~~popular~~ wallet service for new users of bitcoin~~. The exact origins and founding of the service are not fully known~~. A file containing usernames and passwords from Mt. Gox, a large cryptocurrency exchange, was ~~accessed~~, ~~and~~ this allowed ~~multiple~~ breaches to occur to around 1% of the users on the ''MyBitcoin'' platform.		[[File:Mybitcoin.jpg\|thumb\|MyBitcoin Logo/Homepage]]MyBitcoin was a wallet service which was popular for new users of bitcoin. A file containing usernames and passwords from Mt. Gox, a large cryptocurrency exchange, was breached. Since some users used the same password between MyBitcoin and Mt. Gox, this allowed breaches and theft of funds to occur to around 1% of the users on the MyBitcoin platform.

	Ultimately, MyBitcoin sought to cover the losses for users.		Ultimately, MyBitcoin sought to cover the losses for users.

	== About MyBitcoin ==		== About MyBitcoin ==
	MyBitcoin was a wallet platform catering primarily to ~~cryptocurrency newbies~~ interested in buying bitcoin for the first time. The exact founding date of MyBitcoin is not fully known. One source reports that "MYBITCOIN has been in business since [the] middle of 2009"<ref name="fbireport" />, while domain name WHOIS reports that the domain first existed on April 25th, 2010<ref name="stackexchange" />. Actual content was first reported on the site by Internet Archive on February 11th, 2011<ref name="mybitcoinarchive" />, although prior versions of the site may have loaded content if the user installed "CACert's security certificate"<ref name="mybitcoincacert" />.		MyBitcoin was a wallet platform catering primarily to those interested in buying bitcoin for the first time. MyBitcoin built its reputation by providing a free, user-friendly service targeted at newbie Bitcoin buyers. An excerpt from the first version of the website mentioned it as "[a]n intuitive web-interface for Bitcoin" with "[n]o software to download, install, or configure", with easy integration for merchants to send and receive funds in bitcoin<ref name="mybitcoinarchive" />.<blockquote>MyBitcoin sports an easy to use interface with large navigation buttons. It is suitable for those who are just trying Bitcoin out, or for those who want to use Bitcoin for commerce now, and without delay.

	This website showed the name MyBitcoin LLC<ref name="bitcoinwiki" /><ref name="mybitcoinarchive" /> while domain name WHOIS entries showed the mailing address to be a post office box in Nevis<ref name="bitcoinwiki" /><ref name="mybitcoindown" />, part of the Caribbean island nation of St. Kitts and Nevis<ref name="wikipedianevis" />. It is not known if this truly is an LLC and if so, where the organization was located<ref name="bitcoinwiki" />. Domain name WHOIS and a later announcement on the website showed that the founder was someone named Tom Williams<ref name="mybitcoindown" /><ref name="99bitcoins" />.

	MyBitcoin built its reputation by providing a free, user-friendly service targeted at newbie Bitcoin buyers. An excerpt from the first version of the website mentioned it as "[a]n intuitive web-interface for Bitcoin" with "[n]o software to download, install, or configure", with easy integration for merchants to send and receive funds in bitcoin<ref name="mybitcoinarchive" />.<blockquote>MyBitcoin sports an easy to use interface with large navigation buttons. It is suitable for those who are just trying Bitcoin out, or for those who want to use Bitcoin for commerce now, and without delay.

	Downloading and installing the Bitcoin software isn't a requirement to trade with MyBitcoin. Of course, you can still use the Bitcoin software in conjunction with MyBitcoin. The choice is entirely yours!		Downloading and installing the Bitcoin software isn't a requirement to trade with MyBitcoin. Of course, you can still use the Bitcoin software in conjunction with MyBitcoin. The choice is entirely yours!
Line 20:		Line 16:
	MyBitcoin is completely free. We are supported by selling small text ads that are in our login area. We are also planning on selling support packages in the near future.</blockquote>Dozens of users flocked to the platform in its early days, and it reportedly had more deposits than the third largest exchange at the time, Bitomat.pl<ref name="observer2" />. One of the more prominent users was Bitcoin evangelist and host of The Bitcoin Show Bruce Wagner.<ref name="brucewagner" /><ref name="observer2" /> <blockquote>We have a lot of bitcoin there..... ( as has already been reported in the press )... Many -- perhaps most -- non-technical people... and businesses, I know and associate with,.... rely on MyBitcoin.com		MyBitcoin is completely free. We are supported by selling small text ads that are in our login area. We are also planning on selling support packages in the near future.</blockquote>Dozens of users flocked to the platform in its early days, and it reportedly had more deposits than the third largest exchange at the time, Bitomat.pl<ref name="observer2" />. One of the more prominent users was Bitcoin evangelist and host of The Bitcoin Show Bruce Wagner.<ref name="brucewagner" /><ref name="observer2" /> <blockquote>We have a lot of bitcoin there..... ( as has already been reported in the press )... Many -- perhaps most -- non-technical people... and businesses, I know and associate with,.... rely on MyBitcoin.com

	Most of my friends and family and associates.... all have all their bitcoin there too.</blockquote>		Most of my friends and family and associates.... all have all their bitcoin there too.</blockquote>One source reports that "MYBITCOIN has been in business since [the] middle of 2009"<ref name="fbireport" />, while domain name WHOIS reports that the domain first existed on April 25th, 2010<ref name="stackexchange" />. Actual content was first captured by Internet Archive on February 11th, 2011<ref name="mybitcoinarchive" />, although prior versions of the site may have loaded content if the user installed "CACert's security certificate"<ref name="mybitcoincacert" />.

			This website showed the name MyBitcoin LLC<ref name="bitcoinwiki" /><ref name="mybitcoinarchive" /> while domain name WHOIS entries showed the mailing address to be a post office box in Nevis<ref name="bitcoinwiki" /><ref name="mybitcoindown" />, part of the Caribbean island nation of St. Kitts and Nevis<ref name="wikipedianevis" />. Domain name WHOIS and a later announcement on the website showed that the founder was someone named Tom Williams<ref name="mybitcoindown" /><ref name="99bitcoins" />.
	== The Reality ==		== The Reality ==
	It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold" /><ref name="bitcointalklist" /> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins" /><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?		It is not known if this truly is an LLC and if so, where the organization was located<ref name="bitcoinwiki" />. It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold" /><ref name="bitcointalklist" /> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins" /><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?

	05:11:10 < shockdiode> people use that country as a privacy cloak		05:11:10 < shockdiode> people use that country as a privacy cloak
Line 87:		Line 84:
	At first glance, we didn't see any hard evidence that a password leak had even occurred. There was just a lot of speculation to an SQL injection vulnerability in Mtgox's site. A few clients of ours had informed us of the forum threads, and we watched them carefully.		At first glance, we didn't see any hard evidence that a password leak had even occurred. There was just a lot of speculation to an SQL injection vulnerability in Mtgox's site. A few clients of ours had informed us of the forum threads, and we watched them carefully.

	The following morning a client of ours sent us the download link to the leaked Mtgox password file. We ~~prompty~~ downloaded the file, put up a warning on the main page, and disabled the login.		The following morning a client of ours sent us the download link to the leaked Mtgox password file. We prompt[l]y downloaded the file, put up a warning on the main page, and disabled the login.

	We attempted to line up usernames from the leak, and we found a lot of matching ones. We started locking down all of those accounts using a script that we had to have written at a moment's notice. It was during this time that we noticed a flurry of spends happening. Yes, even with the site disabled.		We attempted to line up usernames from the leak, and we found a lot of matching ones. We started locking down all of those accounts using a script that we had to have written at a moment's notice. It was during this time that we noticed a flurry of spends happening. Yes, even with the site disabled.
Line 101:		Line 98:

	== Ultimate Outcome ==		== Ultimate Outcome ==
	Affected users were reimbursed the total value of their losses on the MyBitcoin platform. ~~While~~ the MyBitcoin platform ~~later~~ collapsed<ref name="mybitcoinincident" />, those who withdrew their funds from the platform could have kept them.		Affected users were reimbursed the total value of their losses on the MyBitcoin platform. This left the MyBitcoin platform assets definitely not properly backed. Unsurprisingly, the [[MyBitcoin Exchange Hack/Fraud\|MyBitcoin platform collapsed within 2 more months]]<ref name="mybitcoinincident" />, though those who withdrew their funds from the platform could have kept them.

	== Total Amount Recovered ==		== Total Amount Recovered ==

Azoundria: Another 30 minutes complete. Significant expansion and added technical analysis.

2023-12-11T18:05:18Z

Another 30 minutes complete. Significant expansion and added technical analysis.

← Older revision		Revision as of 12:05, 11 December 2023
Line 1:		Line 1:
	[[File:Mybitcoin.jpg\|thumb\|MyBitcoin Logo/Homepage]]MyBitcoin was a popular wallet service for new users of bitcoin. The exact origins and founding of the service are not fully known. A file containing usernames and passwords from ~~the large~~ Mt. Gox cryptocurrency exchange was accessed, and this allowed multiple breaches to occur of around 1% of the users on the ''MyBitcoin'' platform.		[[File:Mybitcoin.jpg\|thumb\|MyBitcoin Logo/Homepage]]MyBitcoin was a popular wallet service for new users of bitcoin. The exact origins and founding of the service are not fully known. A file containing usernames and passwords from Mt. Gox, a large cryptocurrency exchange, was accessed, and this allowed multiple breaches to occur to around 1% of the users on the ''MyBitcoin'' platform.

	Ultimately, MyBitcoin sought to cover the losses for users.		Ultimately, MyBitcoin sought to cover the losses for users.
Line 29:		Line 29:
	05:11:44 < shockdiode> getting incorporated there pretty much gu[a]rantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins" />.		05:11:44 < shockdiode> getting incorporated there pretty much gu[a]rantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins" />.
	== What Happened ==		== What Happened ==
	~~An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database~~ of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="bitcointalklist" /><ref name="bitcointalklistold" />.		A large number of users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="bitcointalklist" /><ref name="bitcointalklistold" />.

	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - MyBitcoin Username/Password Breach		\|+Key Event Timeline - MyBitcoin Username/Password Breach
Line 38:		Line 37:
	\|-		\|-
	\|June 13th, 2011 5:00 PM		\|June 13th, 2011 5:00 PM
	\|~~Potential~~ Breach		\|Mt. Gox Database Breach
	\|It is believed that the user account data breach may trace back to a June 13th incident where 478 accounts were robbed of 25,000 BTC<ref name=":1">[[Mt. Gox Auditor Theft]]</ref><ref>[https://web.archive.org/web/20110622064643/http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+Full+Story/article21942.htm Inside the Mega-Hack of Bitcoin: the Full Story - DailyTech] (Feb 2, 2023)</ref>.		\|It is believed that the user account data breach may trace back to a June 13th incident where 478 accounts were robbed of 25,000 BTC<ref name=":1">[[Mt. Gox Auditor Theft]]</ref><ref>[https://web.archive.org/web/20110622064643/http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+Full+Story/article21942.htm Inside the Mega-Hack of Bitcoin: the Full Story - DailyTech] (Feb 2, 2023)</ref>.
	\|-		\|-
	\|June 17th, 2011		\|June 17th, 2011
	\|Pastebin ~~Leak~~		\|Pastebin Publication
	\|Hacked information from the Mt. Gox database was leaked on Pastebin "signed by ~cRazIeStinGeR~ and tied to auto36299386@hushmail.com"<ref name=":1" />.		\|Hacked information from the Mt. Gox database was leaked on Pastebin "signed by ~cRazIeStinGeR~ and tied to auto36299386@hushmail.com"<ref name=":1" />.
	\|-		\|-
	\|June 20th, 2011 03:57:31 AM MST		\|June 20th, 2011 03:57:31 AM MST
	\|First Transaction		\|First Transaction
	\|Users with the same password on Mt. Gox and the MyBitcoin platform started to see their accounts breached. The very first transaction was for 28.21 BTC<ref>[https://www.blockchain.com/explorer/transactions/btc/0c3d4a6b57a511fabb1ec31ff7c8db1e0a91419baa281ac81c6176d856205c96 First Bitcoin Withdrawal Transaction - Blockchain.com] (Feb 1, 2023)</ref>.		\|Users with the same password on Mt. Gox and the MyBitcoin platform started to see their accounts breached. The very first transaction reported was for 28.21 BTC<ref>[https://www.blockchain.com/explorer/transactions/btc/0c3d4a6b57a511fabb1ec31ff7c8db1e0a91419baa281ac81c6176d856205c96 First Bitcoin Withdrawal Transaction - Blockchain.com] (Feb 1, 2023)</ref>.
	\|-		\|-
	\|June 20th, 2011 04:16:15 AM MST		\|June 20th, 2011 04:16:15 AM MST
Line 61:		Line 60:
	\|The MyBitcoin website is reported to be down on the BitcoinTalk forums, the last time the service was ever accessible<ref name="mybitcoindown" /><ref name="mybitcoinincident" />.		\|The MyBitcoin website is reported to be down on the BitcoinTalk forums, the last time the service was ever accessible<ref name="mybitcoindown" /><ref name="mybitcoinincident" />.
	\|}		\|}

			== Technical Details ==
			There was a breach of the Mt. Gox user database. Due to a weak hashing algorithm, it was possible to obtain user passwords through the database. Many users reused passwords

			=== Initial Breach Of Database ===
			An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]]. This was initially kept private for a period of 4 days, however it was subsequently published on Pastebin.

			=== Brute Force Of Passwords ===
			Mt. Gox employed minimal protection on user passwords, using the relatively weak MD5 hashing algorithm and a potentially faulty salting algorithm which may have applied the same salt to all passwords.<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>Therefore, once the database was obtained, any malicious user could simply try guessing different common passwords until they matched the same MD5 hash. If the same salt was used on all passwords, this only prevented using a common existing dictionary of MD5 hashes. Users could try each MD5 hash against all the passwords in the database at one time, quickly matching potentially multiple users.

			Many tools exist to automate this process, which means that rather than a human being sitting there trying different combinations, a computer program runs through thousands or millions of combinations every second and provides a summary of the generated results.

			=== Bypassing Other Protections ===
			There were no protections in MyBitcoin such as 2FA or email confirmations. In fact, many users of MyBitcoin had not even provided an email address when they set up their account<ref name=":2" />.

			Withdrawals continued to be processed from the platform following the breach, and prior to the announcement. During this period, the attacker performed very limited withdrawals in order to avert suspicion<ref name=":2" />.

			While the login had been disabled, active sessions of users who had already logged in continued to allow access and withdrawals to be performed. The attacker had a lot of live sessions and was likely running through withdrawals at a slow rate automatically to avoid suspicion. Once an announcement had been made on the site, the attacker sprung into a sudden flurry of requesting withdrawals on all the active sessions, many of which were processed immediately<ref name=":2" />.

	== Total Amount Lost ==		== Total Amount Lost ==
Line 66:		Line 83:

	== Immediate Reactions ==		== Immediate Reactions ==
	The pseudonymous operator of MyBitcoin acknowledged the situation at the time. He elaborates that he was actively monitoring the situation during the attack and that the attacker used sophisticated methods to ensure that he could withdraw as much as possible<ref>[https://bitcointalk.org/index.php?topic=22221.msg279396#msg279396 Tom Williams on MyBitcoin account breaches] (Feb 2, 2023)</ref>.<blockquote>As many of you already know, Mtgox was hacked and its password file was leaked. As soon as we heard about the leak we were closely monitoring the system for abnormal activity, and we didn't see any.		The pseudonymous operator of MyBitcoin acknowledged the situation at the time. He elaborates that he was actively monitoring the situation during the attack and that the attacker used sophisticated methods to ensure that he could withdraw as much as possible<ref name=":2">[https://bitcointalk.org/index.php?topic=22221.msg279396#msg279396 Tom Williams on MyBitcoin account breaches] (Feb 2, 2023)</ref>.<blockquote>As many of you already know, Mtgox was hacked and its password file was leaked. As soon as we heard about the leak we were closely monitoring the system for abnormal activity, and we didn't see any.

	At first glance, we didn't see any hard evidence that a password leak had even occurred. There was just a lot of speculation to an SQL injection vulnerability in Mtgox's site. A few clients of ours had informed us of the forum threads, and we watched them carefully.		At first glance, we didn't see any hard evidence that a password leak had even occurred. There was just a lot of speculation to an SQL injection vulnerability in Mtgox's site. A few clients of ours had informed us of the forum threads, and we watched them carefully.

Azoundria: Working on the prevention section.

2023-11-30T23:34:52Z

Working on the prevention section.

@@ Line 91: / Line 91: @@
 == Ongoing Developments ==
 This case was largely settled at the time with MyBitcoin agreeing to reimburse users who had lost funds.
-== Prevention Policies ==
+{{Prevention:Individuals:Store Funds Offline}}
 Databases can be better protected by ensuring that passwords are strongly hashed. A strong password hash includes a unique salt and a hashing protocol with higher entropy. This makes it significantly harder to brute force the passwords. Protocols can also force users to select stronger passwords when initially setting up their accounts.
 Platforms can protect against the breach of user accounts by requiring a second factor of authentication. Other common characteristics to look for to detect an account breach would be access from a different IP address (particularly one in another region of the world, a VPN, or a Tor exit node), accessing multiple accounts from the same IP address, proceeding immediately to initiate a full withdrawal on the account, changing passwords, or a large and unexpected cluster of account logins at times they don't normally log in. When an account breach is suspected, delaying the withdrawal of cryptocurrencies is key to prevent loss, as it allows the real account owner time to secure their account.
 == References ==

Azoundria: Minor formatting changes.

2023-11-30T21:37:54Z

Minor formatting changes.

Azoundria at 22:04, 16 February 2023

2023-02-16T22:04:50Z

← Older revision		Revision as of 16:04, 16 February 2023
Line 120:		Line 120:
	<ref name="mybitcoincacert">[https://web.archive.org/web/20100718090911/http://www.mybitcoin.com/cacert/index.php MyBitcoin - A simple web-based Bitcoin wallet (CaCert Notice) - Internet Archive] (Jan 30, 2023)</ref>		<ref name="mybitcoincacert">[https://web.archive.org/web/20100718090911/http://www.mybitcoin.com/cacert/index.php MyBitcoin - A simple web-based Bitcoin wallet (CaCert Notice) - Internet Archive] (Jan 30, 2023)</ref>
	<ref name="mybitcoindown">[https://bitcointalk.org/index.php?topic=32900.0 mybitcoin down or just me? - BitcoinTalk Forum] (Jan 30, 2023)</ref>		<ref name="mybitcoindown">[https://bitcointalk.org/index.php?topic=32900.0 mybitcoin down or just me? - BitcoinTalk Forum] (Jan 30, 2023)</ref>
	<ref name="observer2">[https://observer.com/2011/08/mybitcoin-disappeared-with-bitcoins/ MyBitcoin.com Is Back: A Week After Vanishing With at Least $250 K. Worth of BTC, Site Claims It Was Hacked \| Observer] (Jan 30, 2023)</ref>		<ref name="observer2">[https://observer.com/2011/08/mybitcoin-disappeared-with-bitcoins/ MyBitcoin.com Is Back: A Week After Vanishing With at Least $250 K. Worth of BTC, Site Claims It Was Hacked - Observer] (Jan 30, 2023)</ref>
	<ref name="buybitcoinsworldwide">[https://buybitcoinworldwide.com/price/ BuyBitcoinsWorldwide Historic Bitcoin Price Chart] (Jan 30, 2023)</ref>		<ref name="buybitcoinsworldwide">[https://buybitcoinworldwide.com/price/ BuyBitcoinsWorldwide Historic Bitcoin Price Chart] (Jan 30, 2023)</ref>
	<ref name="wikipedianevis">[[wikipedia:Nevis\|Nevis - Wikipedia]] (Jan 30, 2023)</ref>		<ref name="wikipedianevis">[[wikipedia:Nevis\|Nevis - Wikipedia]] (Jan 30, 2023)</ref>

Azoundria at 21:14, 13 February 2023

2023-02-13T21:14:24Z

← Older revision		Revision as of 15:14, 13 February 2023
Line 23:		Line 23:

	== The Reality ==		== The Reality ==
	It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold"~~>[https:~~/~~/bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref~~><ref name="bitcointalklist" /> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins" /><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?		It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold" /><ref name="bitcointalklist" /> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins" /><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?

	05:11:10 < shockdiode> people use that country as a privacy cloak		05:11:10 < shockdiode> people use that country as a privacy cloak

Azoundria at 00:35, 10 February 2023

2023-02-10T00:35:02Z

← Older revision		Revision as of 18:35, 9 February 2023
Line 23:		Line 23:

	== The Reality ==		== The Reality ==
	It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref><ref name="bitcointalklist" /> and some have argued he ran the entire service as a fraud.<ref name="~~99bitcoins2~~"~~>[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)<~~/~~ref~~><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?		It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref><ref name="bitcointalklist" /> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins" /><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?

	05:11:10 < shockdiode> people use that country as a privacy cloak		05:11:10 < shockdiode> people use that country as a privacy cloak

	05:11:44 < shockdiode> getting incorporated there pretty much gurantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="~~99bitcoins2~~" />.		05:11:44 < shockdiode> getting incorporated there pretty much gurantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins" />.
	== What Happened ==		== What Happened ==
	An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="bitcointalklist" /><ref name="bitcointalklistold" />.		An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="bitcointalklist" /><ref name="bitcointalklistold" />.

Azoundria at 17:30, 9 February 2023

2023-02-09T17:30:12Z

← Older revision		Revision as of 11:30, 9 February 2023
Line 23:		Line 23:

	== The Reality ==		== The Reality ==
	It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref><ref name="~~list2~~"~~>[https:~~/~~/bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref~~> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins2">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?		It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref><ref name="bitcointalklist" /> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins2">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?

	05:11:10 < shockdiode> people use that country as a privacy cloak		05:11:10 < shockdiode> people use that country as a privacy cloak
Line 29:		Line 29:
	05:11:44 < shockdiode> getting incorporated there pretty much gurantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins2" />.		05:11:44 < shockdiode> getting incorporated there pretty much gurantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins2" />.
	== What Happened ==		== What Happened ==
	An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="~~list~~" /><ref name="bitcointalklistold" />.		An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="bitcointalklist" /><ref name="bitcointalklistold" />.

	{\| class="wikitable"		{\| class="wikitable"
Line 63:		Line 63:

	== Total Amount Lost ==		== Total Amount Lost ==
	The loss to all users affected were totaled to 4019.42939378 BTC based on the receive address<ref>[https://www.blockchain.com/explorer/addresses/btc/1MAazCWMydsQB5ynYXqSGQDjNQMN3HFmEu Attacker's Bitcoin Wallet - Blockchain.com] (Feb 1st, 2023)</ref><ref name="~~list~~" /><ref name="bitcointalklistold" />. On BitcoinTalk, this was estimated to be worth $71,656 USD at the time<ref name="~~list~~" /><ref name="bitcointalklistold" />. BuyBitcoinsWorldWide lists a price of $17.51 USD on June 20th, 2011, which would give a total loss of $70,380.21 USD<ref name="buybitcoinsworldwide" />.		The loss to all users affected were totaled to 4019.42939378 BTC based on the receive address<ref>[https://www.blockchain.com/explorer/addresses/btc/1MAazCWMydsQB5ynYXqSGQDjNQMN3HFmEu Attacker's Bitcoin Wallet - Blockchain.com] (Feb 1st, 2023)</ref><ref name="bitcointalklist" /><ref name="bitcointalklistold" />. On BitcoinTalk, this was estimated to be worth $71,656 USD at the time<ref name="bitcointalklist" /><ref name="bitcointalklistold" />. BuyBitcoinsWorldWide lists a price of $17.51 USD on June 20th, 2011, which would give a total loss of $70,380.21 USD<ref name="buybitcoinsworldwide" />.

	== Immediate Reactions ==		== Immediate Reactions ==
Line 96:		Line 96:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	All bitcoin lost were apparently reimbursed to users<ref name="~~list~~" /><ref name="bitcointalklistold" />, although [[MyBitcoin Exchange Hack/Fraud\|the MyBitcoin platform would collapse within a few months]].		All bitcoin lost were apparently reimbursed to users<ref name="bitcointalklist" /><ref name="bitcointalklistold" />, although [[MyBitcoin Exchange Hack/Fraud\|the MyBitcoin platform would collapse within a few months]].

	== Ongoing Developments ==		== Ongoing Developments ==
Line 114:		Line 114:
	<ref name="99bitcoins">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref>		<ref name="99bitcoins">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref>
	<ref name="bitcoinwiki">[https://en.bitcoin.it/wiki/MyBitcoin MyBitcoin - Bitcoin Wiki] (Apr 12, 2020)</ref>		<ref name="bitcoinwiki">[https://en.bitcoin.it/wiki/MyBitcoin MyBitcoin - Bitcoin Wiki] (Apr 12, 2020)</ref>
	<ref name="~~list~~">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref>		<ref name="bitcointalklist">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref>
	<ref name="fbireport">[https://archive.org/stream/MyBitCoin/MyBitCoin_djvu.txt Full text of "MyBitCoin" - Archived FBI Report From August 17th, 2011] (Jan 30, 2023)</ref>		<ref name="fbireport">[https://archive.org/stream/MyBitCoin/MyBitCoin_djvu.txt Full text of "MyBitCoin" - Archived FBI Report From August 17th, 2011] (Jan 30, 2023)</ref>
	<ref name="stackexchange">[https://bitcoin.stackexchange.com/questions/21978/when-was-mybitcoin-created e wallet - When was MyBitcoin created? - Bitcoin Stack Exchange] (Jan 30, 2023)</ref>		<ref name="stackexchange">[https://bitcoin.stackexchange.com/questions/21978/when-was-mybitcoin-created e wallet - When was MyBitcoin created? - Bitcoin Stack Exchange] (Jan 30, 2023)</ref>

Azoundria at 18:52, 6 February 2023

2023-02-06T18:52:13Z

← Older revision		Revision as of 12:52, 6 February 2023
Line 23:		Line 23:

	== The Reality ==		== The Reality ==
	It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="~~list-old2~~">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref><ref name="list2">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins2">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?		It is unclear whether Tom Williams is the real name of the individual who founded MyBitcoin<ref name="bitcointalklistold">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref><ref name="list2">[https://bitcointalk.org/index.php?topic=576337 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses] (Feb 15, 2020)</ref> and some have argued he ran the entire service as a fraud.<ref name="99bitcoins2">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref><ref name=":0">[https://bitcointalk.org/index.php?topic=32900.msg411839#msg411839 Jine's Response - BitcoinTalk Forum] (Jan 31, 2023)</ref><blockquote>05:10:57 < shockdiode> In Charlestown in St Kitts and Nevis?

	05:11:10 < shockdiode> people use that country as a privacy cloak		05:11:10 < shockdiode> people use that country as a privacy cloak
Line 29:		Line 29:
	05:11:44 < shockdiode> getting incorporated there pretty much gurantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins2" />.		05:11:44 < shockdiode> getting incorporated there pretty much gurantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins2" />.
	== What Happened ==		== What Happened ==
	An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="list" /><ref name="~~list-old~~" />.		An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="list" /><ref name="bitcointalklistold" />.

	{\| class="wikitable"		{\| class="wikitable"
Line 63:		Line 63:

	== Total Amount Lost ==		== Total Amount Lost ==
	The loss to all users affected were totaled to 4019.42939378 BTC based on the receive address<ref>[https://www.blockchain.com/explorer/addresses/btc/1MAazCWMydsQB5ynYXqSGQDjNQMN3HFmEu Attacker's Bitcoin Wallet - Blockchain.com] (Feb 1st, 2023)</ref><ref name="list" /><ref name="~~list-old~~" />. On BitcoinTalk, this was estimated to be worth $71,656 USD at the time<ref name="list" /><ref name="~~list-old~~" />. BuyBitcoinsWorldWide lists a price of $17.51 USD on June 20th, 2011, which would give a total loss of $70,380.21 USD<ref name="buybitcoinsworldwide" />.		The loss to all users affected were totaled to 4019.42939378 BTC based on the receive address<ref>[https://www.blockchain.com/explorer/addresses/btc/1MAazCWMydsQB5ynYXqSGQDjNQMN3HFmEu Attacker's Bitcoin Wallet - Blockchain.com] (Feb 1st, 2023)</ref><ref name="list" /><ref name="bitcointalklistold" />. On BitcoinTalk, this was estimated to be worth $71,656 USD at the time<ref name="list" /><ref name="bitcointalklistold" />. BuyBitcoinsWorldWide lists a price of $17.51 USD on June 20th, 2011, which would give a total loss of $70,380.21 USD<ref name="buybitcoinsworldwide" />.

	== Immediate Reactions ==		== Immediate Reactions ==
Line 96:		Line 96:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	All bitcoin lost were apparently reimbursed to users<ref name="list" /><ref name="~~list-old~~" />, although [[MyBitcoin Exchange Hack/Fraud\|the MyBitcoin platform would collapse within a few months]].		All bitcoin lost were apparently reimbursed to users<ref name="list" /><ref name="bitcointalklistold" />, although [[MyBitcoin Exchange Hack/Fraud\|the MyBitcoin platform would collapse within a few months]].

	== Ongoing Developments ==		== Ongoing Developments ==

Azoundria at 18:03, 6 February 2023

2023-02-06T18:03:49Z

← Older revision		Revision as of 12:03, 6 February 2023
Line 111:		Line 111:
	A section with the references where information came from.		A section with the references where information came from.
	<references>		<references>
	<ref name="~~list-old~~">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref>		<ref name="bitcointalklistold">[https://bitcointalk.org/index.php?topic=83794.msg923918#msg923918 <nowiki>List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old]</nowiki>] (Jan 28, 2020)</ref>
	<ref name="99bitcoins">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref>		<ref name="99bitcoins">[https://99bitcoins.com/the-biggest-scams-in-bitcoin-history/?mod=article_inline The biggest scams in Bitcoin history] (Feb 15, 2020)</ref>
	<ref name="bitcoinwiki">[https://en.bitcoin.it/wiki/MyBitcoin MyBitcoin - Bitcoin Wiki] (Apr 12, 2020)</ref>		<ref name="bitcoinwiki">[https://en.bitcoin.it/wiki/MyBitcoin MyBitcoin - Bitcoin Wiki] (Apr 12, 2020)</ref>

← Older revision		Revision as of 15:37, 30 November 2023
Line 1:		Line 1:
	[[File:Mybitcoin.jpg\|thumb\|MyBitcoin]]MyBitcoin was a popular wallet service for new users of bitcoin. The exact origins and founding of the service are not fully known. A file containing usernames and passwords from the large Mt. Gox cryptocurrency exchange was accessed, and this allowed multiple breaches to occur of around 1% of the users on the ''MyBitcoin'' platform.		[[File:Mybitcoin.jpg\|thumb\|MyBitcoin Logo/Homepage]]MyBitcoin was a popular wallet service for new users of bitcoin. The exact origins and founding of the service are not fully known. A file containing usernames and passwords from the large Mt. Gox cryptocurrency exchange was accessed, and this allowed multiple breaches to occur of around 1% of the users on the ''MyBitcoin'' platform.

	Ultimately, MyBitcoin sought to cover the losses for users.		Ultimately, MyBitcoin sought to cover the losses for users.
Line 27:		Line 27:
	05:11:10 < shockdiode> people use that country as a privacy cloak		05:11:10 < shockdiode> people use that country as a privacy cloak

	05:11:44 < shockdiode> getting incorporated there pretty much ~~gurantees~~ your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins" />.		05:11:44 < shockdiode> getting incorporated there pretty much gu[a]rantees your anonymity</blockquote>The service was reportedly storing funds insecurely, with over half of the funds left in an online hot wallet<ref name="99bitcoins" />.
	== What Happened ==		== What Happened ==
	An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="bitcointalklist" /><ref name="bitcointalklistold" />.		An [[Mt. Gox Auditor Theft\|incident in Mt. Gox allowed a database of weakly hashed passwords to be compromised]].<blockquote>According to MagicalTux Mt. Gox's current protection scheme was to use and MD5 hash on passwords in its database, along with a salt. However, he did not specify whether a single salt was applied to all user passwords, multiple periodic salts, or whether user-specific unique salts were employed.</blockquote>It is reported that all users with reused passwords between Mt. Gox and MyBitcoin had their bitcoin withdrawn and sent to the attacker's bitcoin address<ref name="bitcointalklist" /><ref name="bitcointalklistold" />.
Line 67:		Line 67:
	== Immediate Reactions ==		== Immediate Reactions ==
	The pseudonymous operator of MyBitcoin acknowledged the situation at the time. He elaborates that he was actively monitoring the situation during the attack and that the attacker used sophisticated methods to ensure that he could withdraw as much as possible<ref>[https://bitcointalk.org/index.php?topic=22221.msg279396#msg279396 Tom Williams on MyBitcoin account breaches] (Feb 2, 2023)</ref>.<blockquote>As many of you already know, Mtgox was hacked and its password file was leaked. As soon as we heard about the leak we were closely monitoring the system for abnormal activity, and we didn't see any.		The pseudonymous operator of MyBitcoin acknowledged the situation at the time. He elaborates that he was actively monitoring the situation during the attack and that the attacker used sophisticated methods to ensure that he could withdraw as much as possible<ref>[https://bitcointalk.org/index.php?topic=22221.msg279396#msg279396 Tom Williams on MyBitcoin account breaches] (Feb 2, 2023)</ref>.<blockquote>As many of you already know, Mtgox was hacked and its password file was leaked. As soon as we heard about the leak we were closely monitoring the system for abnormal activity, and we didn't see any.


	At first glance, we didn't see any hard evidence that a password leak had even occurred. There was just a lot of speculation to an SQL injection vulnerability in Mtgox's site. A few clients of ours had informed us of the forum threads, and we watched them carefully.		At first glance, we didn't see any hard evidence that a password leak had even occurred. There was just a lot of speculation to an SQL injection vulnerability in Mtgox's site. A few clients of ours had informed us of the forum threads, and we watched them carefully.


	The following morning a client of ours sent us the download link to the leaked Mtgox password file. We prompty downloaded the file, put up a warning on the main page, and disabled the login.		The following morning a client of ours sent us the download link to the leaked Mtgox password file. We prompty downloaded the file, put up a warning on the main page, and disabled the login.


	We attempted to line up usernames from the leak, and we found a lot of matching ones. We started locking down all of those accounts using a script that we had to have written at a moment's notice. It was during this time that we noticed a flurry of spends happening. Yes, even with the site disabled.		We attempted to line up usernames from the leak, and we found a lot of matching ones. We started locking down all of those accounts using a script that we had to have written at a moment's notice. It was during this time that we noticed a flurry of spends happening. Yes, even with the site disabled.


	The attacker had active sessions open to the site. We quickly flushed them and the spends stopped abruptly. We disabled the SCI, all payment forwarding, and all receipt URL traffic on all of the usernames in the Mtgox leak.		The attacker had active sessions open to the site. We quickly flushed them and the spends stopped abruptly. We disabled the SCI, all payment forwarding, and all receipt URL traffic on all of the usernames in the Mtgox leak.


	We proceeded to change the password on every account where the username matched our system's database. PGP-signed emails went out to all of the accounts that we changed the password on. If an account didn't have an email address or had already been compromised we put up a bulletin. (Email addresses were mandatory when we opened our service initially, but people complained that it wasn't truly anonymous so we made them optional. Unfortunately this makes contacting a security-compromised customer impossible.)		We proceeded to change the password on every account where the username matched our system's database. PGP-signed emails went out to all of the accounts that we changed the password on. If an account didn't have an email address or had already been compromised we put up a bulletin. (Email addresses were mandatory when we opened our service initially, but people complained that it wasn't truly anonymous so we made them optional. Unfortunately this makes contacting a security-compromised customer impossible.)


	An investigation was conducted at that time, and we determined that the attacker had opened up a session to each active user/password pair ahead of time, solved the captcha, and used some sort of bot to maintain a connection so our system wouldn't timeout on the session. It was likely his intent to gain access to more accounts than he did, but as soon as he noticed that we had changed the main page of the site he sprung into action by sending a flurry of spends. (Before you ask: no, we don't limit logins per IP address. We can't. We have a lot of users that come in from Tor and I2P that all appear to share the same source IP address.)		An investigation was conducted at that time, and we determined that the attacker had opened up a session to each active user/password pair ahead of time, solved the captcha, and used some sort of bot to maintain a connection so our system wouldn't timeout on the session. It was likely his intent to gain access to more accounts than he did, but as soon as he noticed that we had changed the main page of the site he sprung into action by sending a flurry of spends. (Before you ask: no, we don't limit logins per IP address. We can't. We have a lot of users that come in from Tor and I2P that all appear to share the same source IP address.)


	We've concluded that around 1% of the users on the leaked Mtgox password file had their Bitcoins stolen on MyBitcoin. It is unfortunate, and a horrible experience for the Bitcoin community in general.		We've concluded that around 1% of the users on the leaked Mtgox password file had their Bitcoins stolen on MyBitcoin. It is unfortunate, and a horrible experience for the Bitcoin community in general.


	The IP address that the attacker used was a Tor exit node and the spends were to an address that is outside of our system.</blockquote>		The IP address that the attacker used was a Tor exit node and the spends were to an address that is outside of our system.</blockquote>