Feeds

Silk Road reboot claims: Hacker STOLE all our Bitcoin funds

In shocking turn, drug world proves unworthy of trust

Top 5 reasons to deploy VMware with Tegile

The latest incarnation of the Silk Road underground market says it lost all of its Bitcoin reserves (estimated to be worth two to three million dollars) in a fraud attack.

A site administrator said on Wednesday that a group of hackers appear to have exploited the Bitcoin "transaction malleability" loophole to withdraw funds from the site just as admins were conducting maintenance work that required funds to be placed in a vulnerable location.

The result, according to administrator "Defcon" was the complete loss of all Bitcoin funds the site had in its escrow holdings.

"This attack hit us at the worst possible time. We were planning on re-launching the new auto-finalize and Dispute Center this past weekend, and our projections of order finalization volume indicated that we would need the community's full balance in hot storage," Defcon said in announcing the attack.

The administrators believe that the attackers were able to exploit a transaction malleability flaw similar to those spotted in the MtGox exchange. Such errors allow attackers to manipulate hash information and spoof transactions before they are processed by the vendor. In the case of Silk Road redux, the administrators say that the attackers performed such operations many times over until all funds it controlled were drained.

Despite the headlines and attention afforded to the transaction malleability flaw, the condition has been known about since 2011, and experts say that sites and exchanges using best practices could eliminate the vulnerability from their bitcoin services.

"I have failed you as a leader, and am completely devastated by today's discoveries. I should have taken MtGox and Bitstamp's lead and disabled withdrawals as soon as the malleability issue was reported," Defcon said.

"I was slow to respond and too skeptical of the possible issue at hand. It is a crushing blow."

The admin also posted a series of accounts believed to have been used by an individual or individuals involved in the attack. The majority of the funds, says Defcon, went to an individual in France, while two others in Australia are also believed to be involved. The admin has asked users to contribute any information they may have which could lead to the recovery of the funds.

The theft is the latest misfortune to strike the Silk Road family of underground market sites. Once seen as a haven for users to anonymously trade in information and goods (okay, drugs) the original Silk Road was dismantled last year and its creator, and a San Francisco man who went by the alias Dread Pirate Roberts now faces a lengthy stretch in federal prison.

Subsequent efforts to re-launch successors to Silk Road have similarly been met with police takedowns and arrests, though that has not prevented the establishment of a number of other smaller anonymous markets. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.