I do wonder how long this lasts because Mt Gox was always the exchange with the highest prices relative to market value, and usually by a good % too. So this is interesting that in a possible cash crunch, they flip the script, and now are selling coin for well less than market value. Possibly pocketing all of the difference, all amid a brewing scandal.Originally Posted by Dan Druff
Sorry if I misunderstood, to be clear;
Its been my contention for a long time (and a lot of people have come to agree with this) that Gox had inflated BTC values on their exchange because they were, for a while, an easy option for US clients, and because they had a suspiciously horrible cashout process. The inference being that Gox would suck people in with inflated BTC prices then postpone cashouts until the prices fluctuated towards positive equity for them.
Obviously that sounds like some conspiracy theory lunatic bullshit at face value, but we see it happening on the Dogecoin exchanges, its documented behavior, we even know the name of the guy doing the most of it.
And long before Anonymous pierced the veil on that fucker, everyone paying attention knew with absolute atomic certainty that it was happening on the BTC networks.
Combine the ability to create arbitrary fluctuations in BTC value, a totally opaque and unregulated exchange with an unnaturally inflated BTC value, and the extremely low end customer service on cashouts, and I think a prima facie case for malicious manipulation cant be avoided.
Regarding the transfers issues, there have absolutely been period where Gox slow boated transfers. What % of those were because of DDoS or were simple manipulation is up for debate.
And the reason why the price is dropping is because Gox is no longer "fucking about" with cashouts, its just straight up refusing to honor those requests, and has been for some time, so this isnt the usual paradigm of suspect behavior, its looking more like either they are tumbling BTC out the back door or they have a major forensic investigation taking place.
"Birds born in a cage think flying is an illness." - Alejandro Jodorowsky
"America is not so much a nightmare as a non-dream. The American non-dream is precisely a move to wipe the dream out of existence. The dream is a spontaneous happening and therefore dangerous to a control system set up by the non-dreamers." -- William S. Burroughs
Yup, I just sold a little @ $50 above the quoted Gox price. I got $720USD or $796AUD
Something really screwy going on.
"20 minutes ago Sell Bitcoin 345.0000 A$ 345.00
ORDER=2ba19716-197b-4167-b198-5792dcd9754e EXCHANGE_RATE=796.4906 FEE=3.48 NET_TRANSFER=345.0 AUD TIMESTAMP=2014-02-09 06:39:53 +1000"
I do wonder how long this lasts because Mt Gox was always the exchange with the highest prices relative to market value, and usually by a good % too. So this is interesting that in a possible cash crunch, they flip the script, and now are selling coin for well less than market value. Possibly pocketing all of the difference, all amid a brewing scandal.
Holy shit youre bad at this. Stick with physically assaulting members of your family.
"Birds born in a cage think flying is an illness." - Alejandro Jodorowsky
"America is not so much a nightmare as a non-dream. The American non-dream is precisely a move to wipe the dream out of existence. The dream is a spontaneous happening and therefore dangerous to a control system set up by the non-dreamers." -- William S. Burroughs
Bitcoin fell off my radar. You guys woke me up.
Bitcoin took a dump. 760 was an obvious important fail. Missed it. Too late.
Break 675 should trigger fall to 610 maybe more.
Daily Chart
Hourly Chart
If you got some gamble, you short fall through 695.
Dump probably coincides with when Russia told the coin to go fuck itself.
I still think this is an excellent opportunity to buy Bitcoins... not on Mt Gox of course.
Panic and hysteria is always a good opportunity to make money.
This is a good read:
http://www.cryptocoinsnews.com/2014/...nsaction-woes/
Well, this is officially a crash.
The question is whether it will do its usual and rebound shortly after falling to 600, or if this will be more serious because of Gox's problems.
I'll be watching closely.
id absolutely consider this market deprecated, providing mtgox comes back online basically.
"Birds born in a cage think flying is an illness." - Alejandro Jodorowsky
"America is not so much a nightmare as a non-dream. The American non-dream is precisely a move to wipe the dream out of existence. The dream is a spontaneous happening and therefore dangerous to a control system set up by the non-dreamers." -- William S. Burroughs
Hurry and double your position to 0.2 BTC before the prices rebound.
Another article well worth reading. I'm quite confident all BTC and fiat on Mt Gox will be returned to their rightful owner.
Fantastic opportunity to buy!!!
http://www.coindesk.com/mt-gox-first...exchange-dead/
Here's Maxwell's Reddit post.
"[–]nullc 59 points 1 day ago
Because the quotes are irreparably messed up I'll write up a long form explanation:
Some background: MtGox runs custom wallet software.
This is a reasonable and common practice for a service of its size and nature.
Getting a wallet implementing right isn't easy as there is very little room for error, much like the rest of the Bitcoin system.
Some have criticized their use of custom software here but it is a reasonable and common practice for a service of its size and nature. The reference client's wallet is basically suitable for small scale single party use. I would not recommend something like MtGox use the reference node wallet, at least not without a healthy layer of abstraction on top of it— relieving it of duties harder than key management and chain monitoring— or otherwise improving it greatly.
(For that matter, MtGox's wallet software has caused them fewer concerning problems than some other companies. (E.g. some have completely re-implemented the Bitcoin protocol, incorrectly, and exposed it to the outside world and suffered numerous local blockchain rejecting glitches). Though its certainly taken Gox a fair amount of time to sort things out.)
I first heard people reporting stuck transactions back in ~September. I looked into it and determined that Mtgox was spending immature coins. Freshly generated Bitcoins (from mining) can not be spend until they are at least 100 blocks deep in the blockchain. This prevents the funds from vanishing forever if the chain reorgs. I pinged magicaltux and after a couple tries got ahold of him. I think they also wasted some time on dead ends trying to resolve this before the actual nature of the problem was brought to their attention, e.g. raising their transaction fees with a mistaken belief that their fees weren't high enough.
Mtgox wasn't tracking if the coins were freshly generated or what their height was in their software. Including this data would apparently be a non-trivial change, and for high risk finance software even a trivial change takes a lot of work. I suggested a workaround (basically, just try to spend the oldest coins), and as far as I know they implemented it and it was effective.
They continued to have problems with stuck transactions after, and further analysis revealed that they were producing transactions with excessively padded signatures. A minor tangent is required here:
There is a design flaw in the Bitcoin protocol where its possible for a third party to take a valid transaction of yours and mutate it in a way which leaves it valid and functionally identical but with a different transaction ID. This greatly complicates writing correct wallet software, and it can be used abusively to invalidate long chains of unconfirmed transactions that depend on the non-mutant transaction (since transactions refer to each other by txid).
This issue arises from several sources, one of them being OpenSSL's willingness to accept and make sense of signatures with invalid encodings. A normal ECDSA signature encodes two large integers, the encoding isn't constant length— if there are leading zeros you are supposed to drop them.
It's easy to write software that assumes the signature will be a constant length and then leave extra leading zeros in them.
In order to eventually remove this malleability flaw we've been gradually tightening the rules that govern what transactions nodes in the network will consider valid when they relay them or mine them. In Bitcoin 0.8— after months of work chasing down software authors to get them to fix their bugs transactions with these invalid encodings were no longer relayed.
This caused some problems for a few things.. For example bc.i's iphone app— BC.i itself had been fixed long before but they couldn't update the Iphone app without fear of triggering another review by Apple. Eventually this was just worked around on the server side by mutating the transactions produced by the iphone wallets. (And is moot now, I guess!).
MtGox also had problems with occasionally producing invalid signatures. This would normally be a simple fix. E.g. here is an example where I fixed this type of issue in some python wallet code I've never used (but saw a lot of people were copying): https://github.com/jgarzik/python-bi...12be2f163aeeac
But as I said before, in high value systems like Mtgox, even simple fixes aren't simple and it took them quite some time to deploy a fix. However, I believe that it is actually fixed now.
My current understanding and inference is that the remaining issues are because while MtGox was producing transactions of the bad form that the network won't relay anymore— some people decided to help out by 'fixing' these transactions like BC.i did for iphone users— making the signatures normal and broadcasting them. Of course, the new transactions— while functionally identical— have different TXIDs.
The difference here is that the MtGox wallet software appears to have not handled this case gracefully at all, and apparently simply wouldn't notice transactions that it "didn't make" spending its own coins.
As a result the Mtgox wallet believed some coins were available for spending which really had already been spent and it began double spending those inputs. This may have interacted particularly poorly with the earlier workaround I mentioned— trying to always use the oldest available coins— if they did implement that workaround.
Worse, some of this may have resulted in users getting paid multiple times and could have been intentionally triggered with that end in mind if someone helpfully fixed some transactions and then noticed they got paid twice. (I think this is unlikely to have caused large losses, before people run off worrying about that, both because of the reuse of the oldest inputs and because of the hot wallet/cold wallet split).
At this point they likely have an accounting mess to clean up— figuring out who did and didn't get paid now with none of the txids matching. Cleaning that up will be somewhat tricky E.g. say there were three payments of MtGox coins to 1Apple in the block chain... and three users that attempted to pay 1Apple, and MtGox's records thinks that only one went through.. etc. So software will have to be written that matches up transactions with their mutants in order to figure out what went where.
I am not personally concerned— at least not by any of the details here. MtGox's slow speed at resolving these sorts of issues and poor communications are not terribly inspiring. They seem to be horribly short staffed— but competent and trustworthy people in this space may be hard to find: The regulatory morass of that business is sure to make many steer clear.
The claims that the delays indicate insolvency strike me as just hysteria: the technical background doesn't support this conclusion, and there may be a bit of opportunism at play from people who want to manipulate the market too. Don't get me wrong: I have not seen their books: Gox may well have financial problems— though with their income its hard for me to see how— but if any problems like that exist they're not being indicated here.
Of course, none of this suggests anyone should be happy with the service MtGox has been providing, but our anger should at least be well informed."
im still holding out on my 10btc ride this bitch out
The fact that in today's day and age of social media and the ability to communicate quickly with the masses, yet they have taken over a month to say anything about the issues they are having is completely unprofessional. I would run like hell from this "business".
They have twitter, they have facebook....yet they said NOTHING.
"The MtGox Debacle Explained from Reddit post by datavetaren
Currently, there's too much Fear Uncertainty and Doubt.
TL;DR version:
1) The withdrawal problems at MtGox are technical. 2) It is likely that a hacker exploit has taken place. 3) Any damage is likely to be limited. 4) Other exchanges need a heads up and could also be vulnerable. 5) MtGox is going through all erroneous transactions and will update all balances. This is the reason why BTC withdrawals are frozen. 6) Countermeasures need to be taken (for all exchanges)
BTC Withdrawal Problems
A couple of weeks ago (around January 26-28) I noticed that things at MtGox were not the way it supposed to be. Normally, withdrawing BTC is an instant process. This time my withdrawals went stuck. MtGox provides an API so that transactions that didn't get through were available for public scrutiny: https://data.mtgox.com/api/0/bitcoin_tx.php. I took my stuck transactions which were available in raw format and try to rebroadcast them manually. (MtGox no longer publishes the raw format; they are now redacted for a very good reason.) To my surprise it complained that some of the transaction inputs were already spent. Furthermore, this happened to many of my friends as well. I investigated their transactions as well and tried to rebroadcast them manually, but without luck due to complaints of double spending. My immediate (now wrong) conclusion was that MtGox F-d up big time and couldn't handle a simple concurrency problem. If several people are withdrawing BTC at the same time it is important to ensure that this is counted as an atomic operation so that coins from the wallet pool are not double spent. It turns out that it was much more interesting than I've first anticipated. Another (wrong) conspiracy theory of mine that MtGox did this intentionally to cover up the fact that they were running low on BTC as they use "fractional reserve bitcoin".
Exchanges and Custom Wallet Software
Most exchanges have completely custom bitcoin software. Either they are heavily modified source code of the official client, or everything is written from scratch. To my best knowledge MtGox has written their client completely from scratch. Some people critize them for that, but the standard client is not scalable to an exchange with a million of customers. You must modify the original source so at least the wallet part is going through a more suitable database, and also the built-in security only works for a single customer. The cons with writing your own custom bitcoin client are of course that you would from time to time become out of sync with the official client. It turns out that this is very problematic.
Erroneous Transactions and Fatal Consequences
Suppose there's something that is inconsistent with MtGox client software with the rest of the bitcoin network. What would be the outcome of that? MtGox would broadcast the transaction to the bitcoin network and miners would reject it, so the transaction becomes stuck. After a couple of days, MtGox gives up because it can't get the transaction published in the blockchain so it returns the balance to the customer. This turns out to be VERY dangerous. BTC should not be returned to a customer without proper investigation. You may ask why? A hacker can exploit the erroneous transactions broadcasted by MtGox by modifying them manually (so they become consistent with the official bitcoin software) and then rebroadcast them manually her/him-self. If this happens, then the stuck transaction (at MtGox) gets actually through and at the same time the balance is returned to the customer's account. Therefore, the customer has doubled her/his BTC withdrawal attempt. If you repeat this process a couple of times then you can empty MtGox BTC vault without having to hack into their computers. So what about all those erroneous transactions with "double spending", surely this has nothing to do with the erroneous transactions mentioned recently? At the time the hacker broadcasts the modified (correct) transaction based on MtGox erroneous one, the transaction gets through, but MtGox still thinks the coins are still unspent. After all, it is only MtGox that has the private keys, so it is impossible (in general) that someone else can spend them. Therefore, MtGox still thinks those coins are unspent and trying to reuse them as fresh coins for other transactions. This explains why we had so many transactions that tried to double spend coins.
What is MtGox Doing Now?
First, the hackers that tried to modify the erroneous transactions and rebroadcast them manually are likely identified (MtGox surely knows the name of every customer). Their accounts will likely to be frozen. Second, MtGox has an accounting mess to clean up. There are many transactions registered as unsuccessful at MtGox that need to be checked whether they actually went through or not. Then MtGox needs to update all the BTC balances. This will likely take a couple of days and this is the main reason why all BTC withdrawals are blocked at this time. Once this is done MtGox will open for BTC withdrawals again.
Lessons Learned and Countermeasures
What happened at MtGox can happen at other exchanges as well. So how do we prevent these disasters from happening again in future? I have some proposals, 1) Try to stay close to the official bitcoin client and merge in new changes as soon as possible. Stay updated. 2) Bitcoin Foundation could setup some public servers that always run the latest official version of the bitcoin client. Exchanges should then be able to verify that the transaction is legitimate to the latest bitcoin client before broadcasting them. 3) At an exchange, when a transaction becomes stuck for whatever reason, always check if some other transaction with the same inputs and outputs has already been accepted by the network before returning the customers' balance."
As of today I am 10x richer than Dan Druff in the BTC world.
the day i brought up a possible hack, i google dorked some _real_ stupid url shit, just obviously terrible bad programming and found a fucking trove.
as of today, those urls 404.
news flash: other exchanges dont sit on yoga balls writing shite php code all day, so dont try to pawn this off as a protocol or API level vulnerability.
you faggots are inept and youre going out of business.
swallow it.
"Birds born in a cage think flying is an illness." - Alejandro Jodorowsky
"America is not so much a nightmare as a non-dream. The American non-dream is precisely a move to wipe the dream out of existence. The dream is a spontaneous happening and therefore dangerous to a control system set up by the non-dreamers." -- William S. Burroughs
can you talk to me like i'm five and explain wtf you are talking about?
the day i brought up a possible hack, i google dorked some _real_ stupid url shit, just obviously terrible bad programming and found a fucking trove.
as of today, those urls 404.
news flash: other exchanges dont sit on yoga balls writing shite php code all day, so dont try to pawn this off as a protocol or API level vulnerability.
you faggots are inept and youre going out of business.
swallow it.
i guess my question is, who is this directed at?
oh google dorking is where you use google to dig up url contents or page contents that indicate known or potential vulnerabilities.
i did like a real simple google dork on mtgox looking for urls that were php based and a few other things and found what looked like some really, really, really sketchy programming decisions in play.
today i opened up the browser i had used and the same urls that caught my attention were now 404'ing. so someone caught them. which means someone was auditing their website.
so yeah as far as the faggots comment goes i was talking to garrett obv.
"Birds born in a cage think flying is an illness." - Alejandro Jodorowsky
"America is not so much a nightmare as a non-dream. The American non-dream is precisely a move to wipe the dream out of existence. The dream is a spontaneous happening and therefore dangerous to a control system set up by the non-dreamers." -- William S. Burroughs
So you are saying gox's programmers had not even a most basic clue ? That you were able to tell with a little google work and URLs alone that they had some fundamental flaws?
So after years of handling transactions worth 100s of millions aggregate, they _still_ had some very serious security issues that you were able to easily find ?
Which they just now finally caught on! Jeez, what a shitty site !
Sonatine, you are God. I hope to have the level of knowledge and expertise that you do. At my age I don't think it will happen. I fake it instead but I'm not even good at that.
Keep keeping this site informed. Thank you for all you do.
There are currently 1 users browsing this thread. (0 members and 1 guests)
Reply With Quote
