Mercado Bitcoin: Difference between revisions

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Jump to navigation Jump to search
(Another 30 minutes. Exrtensive review of BitcoinTalk. Added a logo. Adding information from the Mercado Bitcoin homepage to the description. Update timeline with BitcoinTalk thread.)
(30 minutes. Reworded the about section to improve readability. Lots of research and incorporation of information from the BitcoinTalk thread. Expanding the wiki sections and removing placeholders.)
Line 1: Line 1:
{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/mercadobitcoin.php}}
{{Case Study Under Construction}}{{Unattributed Sources}}
{{Unattributed Sources}}


[[File:Mercadobitcoin.jpg|thumb|Mercado Bitcoin Logo/Homepage]]I could go into more detail of allegations; however let’s just say the Mercado Bitcoin exchange was long suspected to not be fully backed to begin with, and was of course not stored properly with any sort of multi-signature cold storage wallet.
[[File:Mercadobitcoin.jpg|thumb|Mercado Bitcoin Logo/Homepage]]Mercado Bitcoin was a dominant exchange .


This exchange or platform is based in Germany, or the incident targeted people primarily in Germany.<ref name="bitcointalklistold-20" /><ref name="kylegibson-86" /><ref name="bitcointalklist-87" /><ref name=":1">[https://bitcointalk.org/index.php?topic=179992.0 Semelhanças entre Leandro Mercado Bitcoin e Pirateat40 - BitcoinTalk] (Feb 27, 2024)</ref><ref>https://bitcointalk.org/index.php?topic=160150.0 (Feb 27, 2024)</ref>
I could go into more detail of allegations; however let’s just say the Mercado Bitcoin exchange was long suspected to not be fully backed to begin with, and was of course not stored properly with any sort of multi-signature cold storage wallet.
 
This exchange or platform is based in Germany, or the incident targeted people primarily in Germany.<ref name="bitcointalklistold-20" /><ref name="kylegibson-86" /><ref name="bitcointalklist-87" /><ref name=":1">[https://bitcointalk.org/index.php?topic=179992.0 Semelhanças entre Leandro Mercado Bitcoin e Pirateat40 - BitcoinTalk] (Feb 27, 2024)</ref><ref name=":2">[https://bitcointalk.org/index.php?topic=160150.0 Problema do Mercado Bitcoin - BitcoinTalk] (Feb 27, 2024)</ref>


== About Mercado ==
== About Mercado ==


The Mercado Bitcoin (Portuguese for Bitcoin Market) claimed to be the best place to buy and sell bitcoins in Brazil. As of March 9th, 2013, the platform boasted 2218 users, 78 open orders, and 92 bitcoins for sale, with 479 operations in the last 30 days. Over the past 90 days, the market has shown steady activity, with fluctuations in value against the Brazilian Real. Recent trends indicate a surge in trading volume, with notable fluctuations in Bitcoin prices. Stay updated with the latest Bitcoin news, including current prices and trading volumes, to make informed decisions in the cryptocurrency market<ref>[https://web.archive.org/web/20130310031854/http://www.mercadobitcoin.com.br/ Mercado Bitcoin Homepage Archive March 9th, 2013 8:18:54 PM MST] (Accessed Mar 12, 2024)</ref>.
The Mercado Bitcoin (Portuguese for Bitcoin Market) claimed to be the best place to buy and sell bitcoins in Brazil<ref name=":3">[https://web.archive.org/web/20130310031854/http://www.mercadobitcoin.com.br/ Mercado Bitcoin Homepage Archive March 9th, 2013 8:18:54 PM MST] (Accessed Mar 12, 2024)</ref>. In addition to bitcoin trading, the homepage acted as a source for the latest Bitcoin news, promising to help investors make informed decisions in the cryptocurrency market<ref name=":3">[https://web.archive.org/web/20130310031854/http://www.mercadobitcoin.com.br/ Mercado Bitcoin Homepage Archive March 9th, 2013 8:18:54 PM MST] (Accessed Mar 12, 2024)</ref>.
 
In statistics gathered on March 9th, 2013, the platform boasted 2218 users, 78 open orders, and 92 bitcoins for sale, with 479 operations in the last 30 days<ref name=":3">[https://web.archive.org/web/20130310031854/http://www.mercadobitcoin.com.br/ Mercado Bitcoin Homepage Archive March 9th, 2013 8:18:54 PM MST] (Accessed Mar 12, 2024)</ref>. The market showed steady activity, with fluctuations in value against the Brazilian Real<ref name=":3">[https://web.archive.org/web/20130310031854/http://www.mercadobitcoin.com.br/ Mercado Bitcoin Homepage Archive March 9th, 2013 8:18:54 PM MST] (Accessed Mar 12, 2024)</ref>.  


== The Reality ==
== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
The bitcoin rain platform had an issue where a user could generate a balance in their account without properly completing a deposit.
 
* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.


== What Happened ==
== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
Over a few days prior to March 28th, 2013, hackers profited by exploiting a vulnerability in the Mercado Bitcoin platform.
{| class="wikitable"
{| class="wikitable"
|+Key Event Timeline - Mercado Bitcoin
|+Key Event Timeline - Mercado Bitcoin
Line 29: Line 27:
|Bitcoin Rain Launch
|Bitcoin Rain Launch
|The reported launch of the Bitcoin Rain ponzi scheme<ref name="bitcointalklistold-20" />.
|The reported launch of the Bitcoin Rain ponzi scheme<ref name="bitcointalklistold-20" />.
|-
|March 28th, 2013 8:32:18 AM MDT
|BitcoinTalk Thread Announces Breach
|A BitcoinTalk thread announces a security breach of the Mercado Bitcoin marketplace<ref name="bitcointalklistold-20" /><ref name=":2" />. The breach reportedly had happened over the course of the past few days.
|-
|-
|March 28th, 2013
|March 28th, 2013
|Bitcoin Rain Defaulted
|Bitcoin Rain Defaulted
|The ponzi scheme Bitcoin Rain defaults<ref name="bitcointalklistold-20" />. On the same day, Leandro César claimed there was a security breach on his exchange website<ref name="bitcointalklistold-20" />.
|The ponzi scheme Bitcoin Rain defaults<ref name="bitcointalklistold-20" />.
|-
|March 29th, 2013
|Update Provided To Users
|Leandro pro
|-
|April 1st, 2013
|Withdrawals Completed
|Leandro announces that all withdrawals have been completed except for 2 which reported the wrong account number<ref name=":2" />.
|-
|April 11th, 2013
|Deposits Repaid
|Leandro announces that all deposits which have been identified have now been repaid<ref name=":2" />.
|-
|-
|April 18th, 2013 3:47:29 PM MDT
|April 18th, 2013 3:47:29 PM MDT
|BitcoinTalk Thread Claiming Ponzi
|BitcoinTalk Thread Claiming Ponzi
|A BitcoinTalk thread in Portuguese compares Mercado Bitcoin / Bitcoin Rain to the ponzi scheme run by Trendon Shavers<ref name=":1" />.
|A BitcoinTalk thread in Portuguese compares Mercado Bitcoin / Bitcoin Rain to the ponzi scheme run by Trendon Shavers<ref name=":1" />.
|-
|April 18th, 2013 5:25:34 PM MDT
|Mercado Bitcoin Back Online
|The Mercado Bitcoin exchange is reportedly brought back online in an announcement on BitcoinTalk<ref name=":2" />. The original thread about the security breach is updated to announce the relaunch<ref name=":2" />.
|}
|}


== Technical Details ==
== Technical Details ==
There are limited details available about the breach. Known information:
* The breach lasted a few days, starting a few days prior to March 28th<ref name=":2" />.
<ref name=":2" /><blockquote>The Bitcoin Market suffered an attack, which unfortunately was successful, in its implementation of a network code. Due to a coding error, it was possible for the attacker to generate new credit codes, without the amount being duly debited in his final balance. Getting it like this, generate a false amount of bitcoins within the system and redeem it in a timely manner during the night.</blockquote>


== Total Amount Lost ==
== Total Amount Lost ==
Line 47: Line 70:


=== Victims of Bitcoin Rain ===
=== Victims of Bitcoin Rain ===
A Google Docs lists some of the victims in Bitcoin Rain<ref name=":0">[https://docs.google.com/spreadsheets/d/1kFhHzq0ak2LyVw_9a_fQFgS_RW-K9_lx0mdw5JpTFZU/edit#gid=0 Bitcoin Rain - Google Sheets] (Accessed Feb 27, 2024)</ref>.
A Google Docs was compiled to list some of the victims in Bitcoin Rain<ref name=":0">[https://docs.google.com/spreadsheets/d/1kFhHzq0ak2LyVw_9a_fQFgS_RW-K9_lx0mdw5JpTFZU/edit#gid=0 Bitcoin Rain - Google Sheets] (Accessed Feb 27, 2024)</ref>.
{| class="wikitable"
{| class="wikitable"
!BitcoinTalk User
!BitcoinTalk User
!Scammed XBT
!Claimed Loss
!Source
!Source
|-
|-
Line 91: Line 114:
The total amount lost has been estimated at $101,000 USD.
The total amount lost has been estimated at $101,000 USD.


How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
== Immediate Reactions ==


== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?


“Leandro César claimed there was a security breach on his exchange website Mercado Bitcoin.
Leandro César claimed there was a security breach, which had happened in the last few days. An announcement was made on the BitcoinTalk forum in Portuguese. It indicated limited information at the time, but was later updated with more information.<blockquote>In the last few days we have had a security breach on our website.
 
We are at this time raising the information and creating the necessary strategy to return operations and mainly restore our ability to pay in the shortest possible time.
 
We cannot provide much information at this very moment when we are working on them.
 
All withdrawals of requested reais that have not yet been met, will be met as of today.
 
All legitimate deposits in reais that have not yet been credited will be canceled and their respective users refunded within 2 to 3 business days. Just wait for contact and instructions.
 
I will be updating the information here on this Thread.
 
We ask everyone just a little more patience for more information.</blockquote>


== Ultimate Outcome ==
== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?


=== Reimbursements Announced ===
<ref name=":2" /><blockquote>Thank you for your patience!
We apologize for the time without giving news and the waiting time for response of emails.
It has been a few days since we have been dedicated exclusively to solving all doubts and questions related to the market. However, as we have to update many people and at the same time, choose and execute a best possible action plan, we end up taking longer than desired.
The Bitcoin Market suffered an attack, which unfortunately was successful, in its implementation of a network code. Due to a coding error, it was possible for the attacker to generate new credit codes, without the amount being duly debited in his final balance. Getting it like this, generate a false amount of bitcoins within the system and redeem it in a timely manner during the night.
The amounts diverted were sufficient to compromise the functioning of the Bitcoin Market and another website that I also manage.
We will bear the losses with the limit of our current payment capacity.
All amounts will be paid according to the list below.
Bitcoin values will have to be paid in reais, following the last market price, also according to the list below.
Unfortunately we will not be able to take on a debt in bitcoins with the variation that is currently taking place. The last recorded Bitcoin Market quote was R$180.00 the unit of bitcoin.
We believe that we will be able to put on the air, a version of the site with the updated balances.
I honestly do not believe that it will please everyone with the decisions made, but it is the actions that we will BE ABLE to take to resolve the situation.
I appreciate the trust and partnership of the more than 2000 users who walked with us in this brief troubled period of the history of bitcoins in Brazil.
I also thank everyone who even during the silence still maintained the trust, which I promise, will never be broken.
I cannot say at the time whether or not the Bitcoin Market will continue. Only the next few days can say...
Any questions or new ideas use the Bitcoin Market administration email: admin@mercadobitcoin.com.br</blockquote>
=== Mercado Bitcoin Back Online ===
The Mercado Bitcoin website was brought back online with an announcement on April 18th, 2013<ref name=":2" />.<blockquote>Hello user,
I am happy to announce that I am no longer alone in this long and hard battle called Bitcoin Market.
After a long negotiation, I finally agreed on a partnership that will not only help in this time of crisis, but, how will also make the Bitcoin Market continue in its goal of popularizing and making Bitcoin as viable as possible in Brazil.
The new partners represent a large group of investors, possessing a lot of know-how and just like us, believe that Brazil can and will be the country of Bitcoin.</blockquote>
=== Inclusion In Lists ===
The incident was featured on multiple BitcoinTalk lists<ref name="bitcointalklistold-20" /><ref name="bitcointalklist-87" />, the list put together by Kyle Gibson<ref name="kylegibson-86" />, and in the Bitcoin Exchange Guide list<ref name="bitcoinexchangeguide-218" />.
The incident was featured on multiple BitcoinTalk lists<ref name="bitcointalklistold-20" /><ref name="bitcointalklist-87" />, the list put together by Kyle Gibson<ref name="kylegibson-86" />, and in the Bitcoin Exchange Guide list<ref name="bitcoinexchangeguide-218" />.


== Total Amount Recovered ==
== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.


What funds were recovered? What funds were reimbursed for those affected users?
 
Leandro announced that customers of the exchange would be refunded


A donation address set up by Leandro César received a reported 5075.181457 bitcoin<ref name=":0" />. There was suspicion that Leandro César was donating to this address himself<ref name=":0" />.
A donation address set up by Leandro César received a reported 5075.181457 bitcoin<ref name=":0" />. There was suspicion that Leandro César was donating to this address himself<ref name=":0" />.


== Ongoing Developments ==
== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
TBD
== General Prevention Policies ==
Coming soon.
== Individual Prevention Policies ==
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}
{{Prevention:Individuals:Placeholder}}

Revision as of 12:37, 1 April 2024

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Mercado Bitcoin Logo/Homepage

Mercado Bitcoin was a dominant exchange .

I could go into more detail of allegations; however let’s just say the Mercado Bitcoin exchange was long suspected to not be fully backed to begin with, and was of course not stored properly with any sort of multi-signature cold storage wallet.

This exchange or platform is based in Germany, or the incident targeted people primarily in Germany.[1][2][3][4][5]

About Mercado

The Mercado Bitcoin (Portuguese for Bitcoin Market) claimed to be the best place to buy and sell bitcoins in Brazil[6]. In addition to bitcoin trading, the homepage acted as a source for the latest Bitcoin news, promising to help investors make informed decisions in the cryptocurrency market[6].

In statistics gathered on March 9th, 2013, the platform boasted 2218 users, 78 open orders, and 92 bitcoins for sale, with 479 operations in the last 30 days[6]. The market showed steady activity, with fluctuations in value against the Brazilian Real[6].

The Reality

The bitcoin rain platform had an issue where a user could generate a balance in their account without properly completing a deposit.

What Happened

Over a few days prior to March 28th, 2013, hackers profited by exploiting a vulnerability in the Mercado Bitcoin platform.

Key Event Timeline - Mercado Bitcoin
Date Event Description
March 10th, 2011 Bitcoin Rain Launch The reported launch of the Bitcoin Rain ponzi scheme[1].
March 28th, 2013 8:32:18 AM MDT BitcoinTalk Thread Announces Breach A BitcoinTalk thread announces a security breach of the Mercado Bitcoin marketplace[1][5]. The breach reportedly had happened over the course of the past few days.
March 28th, 2013 Bitcoin Rain Defaulted The ponzi scheme Bitcoin Rain defaults[1].
March 29th, 2013 Update Provided To Users Leandro pro
April 1st, 2013 Withdrawals Completed Leandro announces that all withdrawals have been completed except for 2 which reported the wrong account number[5].
April 11th, 2013 Deposits Repaid Leandro announces that all deposits which have been identified have now been repaid[5].
April 18th, 2013 3:47:29 PM MDT BitcoinTalk Thread Claiming Ponzi A BitcoinTalk thread in Portuguese compares Mercado Bitcoin / Bitcoin Rain to the ponzi scheme run by Trendon Shavers[4].
April 18th, 2013 5:25:34 PM MDT Mercado Bitcoin Back Online The Mercado Bitcoin exchange is reportedly brought back online in an announcement on BitcoinTalk[5]. The original thread about the security breach is updated to announce the relaunch[5].

Technical Details

There are limited details available about the breach. Known information:

  • The breach lasted a few days, starting a few days prior to March 28th[5].

[5]

The Bitcoin Market suffered an attack, which unfortunately was successful, in its implementation of a network code. Due to a coding error, it was possible for the attacker to generate new credit codes, without the amount being duly debited in his final balance. Getting it like this, generate a false amount of bitcoins within the system and redeem it in a timely manner during the night.

Total Amount Lost

As Bitcoin Rain's funds were stored there, investors in Bitcoin Rain as well as account holders on Mercado Bitcoin lost money. Some money was reportedly paid back, but the vast majority is still outstanding.”

The BitcoinTalk list has estimated the amount lost as 4,000 bitcoin[1], which was an average of known Bitcoin Rain victims, Mercado Bitcoin victims, and a donation address[7].

Victims of Bitcoin Rain

A Google Docs was compiled to list some of the victims in Bitcoin Rain[7].

BitcoinTalk User Claimed Loss Source
yelllowsin 180 https://bitcointalk.org/index.php?topic=160150.msg1697855#msg1697855
Kaioflores 100 Trust Ratings
TradeFortress 70 Trust Ratings
rudrigorc2 60 Trust Ratings
andrehorta 43 https://bitcointalk.org/index.php?topic=179992.msg1884659#msg1884659
jajajuta 20 https://bitcointalk.org/index.php?topic=327848.msg3529629#msg3529629
Pimbox 1.04 https://bitcointalk.org/index.php?topic=160150.msg1882168#msg1882168
Total 474.04

Victims of Mercado Bitcoin

The only known victim of Mercado Bitcoin which was listed was ThiagoCMC, who was reported to have lost 2260.781192[7].

The total amount lost has been estimated at $101,000 USD.

Immediate Reactions

Leandro César claimed there was a security breach, which had happened in the last few days. An announcement was made on the BitcoinTalk forum in Portuguese. It indicated limited information at the time, but was later updated with more information.

In the last few days we have had a security breach on our website.

We are at this time raising the information and creating the necessary strategy to return operations and mainly restore our ability to pay in the shortest possible time.

We cannot provide much information at this very moment when we are working on them.

All withdrawals of requested reais that have not yet been met, will be met as of today.

All legitimate deposits in reais that have not yet been credited will be canceled and their respective users refunded within 2 to 3 business days. Just wait for contact and instructions.

I will be updating the information here on this Thread.

We ask everyone just a little more patience for more information.

Ultimate Outcome

Reimbursements Announced

[5]

Thank you for your patience!

We apologize for the time without giving news and the waiting time for response of emails.

It has been a few days since we have been dedicated exclusively to solving all doubts and questions related to the market. However, as we have to update many people and at the same time, choose and execute a best possible action plan, we end up taking longer than desired.

The Bitcoin Market suffered an attack, which unfortunately was successful, in its implementation of a network code. Due to a coding error, it was possible for the attacker to generate new credit codes, without the amount being duly debited in his final balance. Getting it like this, generate a false amount of bitcoins within the system and redeem it in a timely manner during the night.

The amounts diverted were sufficient to compromise the functioning of the Bitcoin Market and another website that I also manage.

We will bear the losses with the limit of our current payment capacity.

All amounts will be paid according to the list below.

Bitcoin values will have to be paid in reais, following the last market price, also according to the list below.

Unfortunately we will not be able to take on a debt in bitcoins with the variation that is currently taking place. The last recorded Bitcoin Market quote was R$180.00 the unit of bitcoin.

We believe that we will be able to put on the air, a version of the site with the updated balances.

I honestly do not believe that it will please everyone with the decisions made, but it is the actions that we will BE ABLE to take to resolve the situation.

I appreciate the trust and partnership of the more than 2000 users who walked with us in this brief troubled period of the history of bitcoins in Brazil.

I also thank everyone who even during the silence still maintained the trust, which I promise, will never be broken.

I cannot say at the time whether or not the Bitcoin Market will continue. Only the next few days can say...

Any questions or new ideas use the Bitcoin Market administration email: admin@mercadobitcoin.com.br

Mercado Bitcoin Back Online

The Mercado Bitcoin website was brought back online with an announcement on April 18th, 2013[5].

Hello user,

I am happy to announce that I am no longer alone in this long and hard battle called Bitcoin Market.

After a long negotiation, I finally agreed on a partnership that will not only help in this time of crisis, but, how will also make the Bitcoin Market continue in its goal of popularizing and making Bitcoin as viable as possible in Brazil.

The new partners represent a large group of investors, possessing a lot of know-how and just like us, believe that Brazil can and will be the country of Bitcoin.

Inclusion In Lists

The incident was featured on multiple BitcoinTalk lists[1][3], the list put together by Kyle Gibson[2], and in the Bitcoin Exchange Guide list[8].

Total Amount Recovered

Leandro announced that customers of the exchange would be refunded

A donation address set up by Leandro César received a reported 5075.181457 bitcoin[7]. There was suspicion that Leandro César was donating to this address himself[7].

Ongoing Developments

TBD

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.

References

  1. ↑ 1.0 1.1 1.2 1.3 1.4 1.5 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses [Old] - BitcoinTalk (Jan 28, 2020)
  2. ↑ 2.0 2.1 100 Crypto Thefts: A Timeline of Hacks, Glitches, Exit Scams, and other Lost Cryptocurrency Incidents - Kyle Gibson (Jan 25, 2020)
  3. ↑ 3.0 3.1 List of Major Bitcoin Heists, Thefts, Hacks, Scams, and Losses - BitcoinTalk (Feb 15, 2020)
  4. ↑ 4.0 4.1 Semelhanças entre Leandro Mercado Bitcoin e Pirateat40 - BitcoinTalk (Feb 27, 2024)
  5. ↑ 5.0 5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8 5.9 Problema do Mercado Bitcoin - BitcoinTalk (Feb 27, 2024)
  6. ↑ 6.0 6.1 6.2 6.3 Mercado Bitcoin Homepage Archive March 9th, 2013 8:18:54 PM MST (Accessed Mar 12, 2024)
  7. ↑ 7.0 7.1 7.2 7.3 7.4 Bitcoin Rain - Google Sheets (Accessed Feb 27, 2024)
  8. ↑ Bitcoin Scams and Cryptocurrency Hacks List - BitcoinExchangeGuide.com (Mar 5, 2020)
Retrieved from "https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Mercado_Bitcoin&oldid=5588"