Feeds

Silk Road reboot claims: Hacker STOLE all our Bitcoin funds

In shocking turn, drug world proves unworthy of trust

The essential guide to IT transformation

The latest incarnation of the Silk Road underground market says it lost all of its Bitcoin reserves (estimated to be worth two to three million dollars) in a fraud attack.

A site administrator said on Wednesday that a group of hackers appear to have exploited the Bitcoin "transaction malleability" loophole to withdraw funds from the site just as admins were conducting maintenance work that required funds to be placed in a vulnerable location.

The result, according to administrator "Defcon" was the complete loss of all Bitcoin funds the site had in its escrow holdings.

"This attack hit us at the worst possible time. We were planning on re-launching the new auto-finalize and Dispute Center this past weekend, and our projections of order finalization volume indicated that we would need the community's full balance in hot storage," Defcon said in announcing the attack.

The administrators believe that the attackers were able to exploit a transaction malleability flaw similar to those spotted in the MtGox exchange. Such errors allow attackers to manipulate hash information and spoof transactions before they are processed by the vendor. In the case of Silk Road redux, the administrators say that the attackers performed such operations many times over until all funds it controlled were drained.

Despite the headlines and attention afforded to the transaction malleability flaw, the condition has been known about since 2011, and experts say that sites and exchanges using best practices could eliminate the vulnerability from their bitcoin services.

"I have failed you as a leader, and am completely devastated by today's discoveries. I should have taken MtGox and Bitstamp's lead and disabled withdrawals as soon as the malleability issue was reported," Defcon said.

"I was slow to respond and too skeptical of the possible issue at hand. It is a crushing blow."

The admin also posted a series of accounts believed to have been used by an individual or individuals involved in the attack. The majority of the funds, says Defcon, went to an individual in France, while two others in Australia are also believed to be involved. The admin has asked users to contribute any information they may have which could lead to the recovery of the funds.

The theft is the latest misfortune to strike the Silk Road family of underground market sites. Once seen as a haven for users to anonymously trade in information and goods (okay, drugs) the original Silk Road was dismantled last year and its creator, and a San Francisco man who went by the alias Dread Pirate Roberts now faces a lengthy stretch in federal prison.

Subsequent efforts to re-launch successors to Silk Road have similarly been met with police takedowns and arrests, though that has not prevented the establishment of a number of other smaller anonymous markets. ®

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.