Scams, Frauds, and Hacks
One of the bad raps that Bitcoin has been getting is that it is used by criminals and money launderers. The truth is that although it can be, so is government issued money, and to a much greater degree. Bitcoin is only a tool, and like any tool it can be used or abused. This is space is dedicated to listing a summary of some of the more notable scams, frauds, and hacks of the Bitcoin community and, if possible, find a lesson to be learned from them. If you have information about a scam, fraud or hack that deserves to be listed on this page, please let us know.
 |
Mt. Gox |
| Mt.Gox was once the preeminentBitcoin exchanges, and as late a the spring of 2013 looked like they would dominate the future ofBitcoin trading. Originating as a trading site for game cards, the exchange soon shifted into trading the new digital money. In 2011, the original owner, JedMcCaleb sold the site to MarkKarpeles and is still active in projects such as Ripple.Starting early 2013, the site started to show signs that it would not be able to scale up its operations to meet the growing popularity ofBitcon. In April 2013 they had to suspend trading to allow the market to cool when trading exceededthe capacity of their trading engines. They then had a bank account seized in the US due to a failure to properly report that they were engaged in money transmission on the bank account application. As a result they were dropped byDwolla, a budget payment processor, freezing them out of the dollar market.At the beginning of 2013 Mt. Gox announced a link up with CoinLab, which would handle their US operations. The deal fell apart with both sides accusing the other of not living up to the agreement. Mt. Gox claimed CoinLab did not become fully compliant with US money transmitter laws as they had promised. In its countersuit, CoinLab claimed that they were unable to make the necessary applications due Mt. Gox’s failure to provide customer information that would have allowed CoinLab to prove to regulators that they were compliant with Know Your Customer laws.
In the fall of 2013, Mt. Gox was no longer processing US dollar withdrawals and withdrawals to other currencies were slow due to banking restrictions and manual processing, they claimed. This caused the price of Bitcoin to inflate above other exchanges as investors drove prices up by buying Bitcoin to get them off the exchange. There were great arbitrage opportunities, but these were so difficult to take advantage of that the price remained artificially high for months. In February of 2014, Mt. Gox ceased Bitcoin withdrawals, claiming that a bug had been discovered in the Bitcoin protocol had been discovered. The bug, a real one, was well-known and minor aberration that allowed someone to copy a new, unconfirmed transaction with and give the copy a different identifying tag. If the copy of the transaction was confirmed in the blockchain rather than the original, the person could then go back to the sender and claim it had never been received. If the sender checked only for the tag, and not for the full transaction, they could be fooled into resending the funds, thinking that the transaction had not completed. The Bitcoin community erupted in indignation when Mark Karpeles announced that the exchange was crippled due to this bug. It was a well-known aberration and was slowly being fixed through various technological improvements in wallets and systems. As soon as Mt. Gox made its statements, all the other major exchanges came under attack from persons unknown and many shut down for a few days. All of the exchanges updated their systems and were operational within a week. Although Silk Road 2 was crippled in the attack, as a dark site that was not professionally run, it could not be used as an example of the weakness of the network. Within a few weeks, Mark Karpeles had given up his seat on the board of the Bitcoin Foundation, deleted the Gox twitter account, pulled the Mt. Gox site, and declared bankruptcy. A leaked ‘Crisis’ document that appeared to be one proposal for how to get Gox up and running again claimed that the exchange had been the victim of the theft of more than 744,000 bitcoins that had happened years earlier and remained undiscovered. Karpeles story has not been consistent here, but it seem either that a theft had drained the Gox cold-storage wallets years earlier and never been discovered because they were never checked on, or that the theft had been ongoing for years due to automated systems double paying Bitcoin withdrawals to hackers using transaction malleability. Both of these explanations cannot be true, but if it is one, the other, or something else again, it is clear that Mark Karpeles was wantonly irresponsible in his role as the caretaker of his customer’s investments. There are many claiming that this is an inside heist, as is usual in these cases. But, this does not seem to be the case. Mark Karpeles, as of this writing, is still in Tokyo, working with Japanese authorities, and, according to reports, trying to salvage the company somehow. This does not seem to be realistic, but does seem in keeping with what we have seen from Karpeles, a guy who bought a Magic: The Gathering trading card exchange. |
 |
Coinlenders / Inputs.io
|
| Coinlenders.com was aBitcoin investment site run by an individual known only asTradeFortress.Coinlenders took deposits from investors and lent them out to various businesses that needed a liquid supply ofBitcoin. Investments were claimed to have been secured both byASICMiner shares and through the personal assets ofTradeFortress. Returns were high, but seemed reasonable given the nature of the business.Deposits intoCoinlenders could only be made by first opening an account and depositing with Inputs.io, anoff-blockchain wallet created byTradeFortress. This was supposed toprovide an added layer of security as mostCoinlenders/Inputs asset were claimed to be secured in offline wallets.On October 23, Inputs.io was breached by using old admin email addresses that did not have high enough security. Around October 26th, the thieves hacked in and stole 4100+ coins.TradeFortress took a week toinform his depositors in bothCoinlenders and Inputs.io about the hack. Hesubsequently partially refunded money to some Inputs.io account holders according to a sliding scale favoring small accounts, but shorting many depositors by as much as 80%. There are reliable reports that many Inputs depositors did not get any refund.Coinlenders depositors were told that there would be an email announcing the status ofCoinlnenders and how refunds would be conducted. The email was never sent, and after some time,TradeFortress posted onBitcoinTalk.org that due to some of his debtors not repaying loans and not responding to emails, that he could not send out the email.Up until this point,Coinlenders investors had been fairly patient. It had been Inputs that had been hacked, andTradeFortress had claimed that only a small amount ofCoinlenders funds had been affected. It was also the belief of many of the investors that most of Coinlenders assets were lent out in secured loans and recoverable.TradeFortress remained active on the forums for the next few days, but would give littleadditional information. Then, under threat of a lawsuit,TradeFortress settled with a large investor namedDumbFruit setting off a panic of investors trying to cutindividual deals.TradeFortress finally settled on a system of responding only toindividuals who expressed interest in cashing out with 80% or more losses. For the most part, all others were ignored.Then, TradeFortress stopped responding and apparently went underground. Indications are that he is Chinese and has returned to China. Legal proceedings are underway both in Australia, where Coinlenders was hosted, and in China.In thefinal analysis, it is unclear whether TradeFortress was complicit in the hack. At the very least he was criminally negligent given that he was aware of the hack on October 23 and did not take steps to protect his depositors money or to warn them. The suspicion is that he walked away with a substantial amount of money and many of his investors have still not been reimbursed.CoinLenders Article |
|
|
Coingrounds / Bit-U |
| On November 5th, Bitcoin Warrior did a sponsored article with the not-yet active Coingrounds. We were in contact with Saif Altimimi, who impressed us as an entrepreneur trying something out in the Bitcoin economy. We were very happy to provide some publicity to the site and try to help the Bitcoin economy grow.Unfortunately, there was a falling out between the two main partners of this venture, Altimimi and a programmer who goes by the name Silfax. Coingrounds, the in beta, was switched completely to the control of Silfax and the name was changed to Bit-U.com. All Coinground accounts were transferred.On or about November 23, 2013, Bit-U was hacked and had 38 Bitcoin stolen from its wallet. Silfax shut the site down and was out of communication for about 24 hours. He then made an announcement of the situation on Bitsharestalk.org lettin people know the method of the hack. He claimed that after reviewing the situation, he would be able to re-up the site for 36 hours and allow depositors to withdraw 58% of their funds. Any funds left over after that period would be manually returned to the most seriously hit depositors.Unsubstantiated claims have been made that the hack was either Altimimi, a disgruntled Digital Ocean employee (the company that hosted Bit-U.com), or Silfax. The funds have been partially tracked through the blockchain, but there seems little hope of recovering the sums at present. |
