freeworm



Offline



Activity: 297

Merit: 250







Sr. MemberActivity: 297Merit: 250 Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 06:45:33 PM #1

Details can be found from

https://bitcointalk.org/index.php?topic=261986.0



One attacker (ID on bter: m100003-6399 and m100002-12129) deposited around 120k TRC on Bter.com during the TRC network attack and dumped more than half of them.

The attacker withdrew about 50BTC value (in BTC, LTC, FTC, TRC, etc) from Bter successfully before we disabled his accounts.

Some of his deposits are listed below. The deposits are confirmed normally without any problem but later the confirmations all became zero and all he deposited TRC disappeared.



We have disabled the TRC trade.

We need to reverse all the trading transactions people made with the attackers IDs m100002 and m100003.

BTCs will be credited back the Bter users' accounts who are affected so that they can get their BTC back.

Bter will take all the loss during the attack.



We need time to handle all the affected transactions very carefully. Please be patient.



I am sorry for all the trouble to Bter users during this event. We are doing our best to handle it.



---------------------------------------------------

--balance of the attacker's two accounts



./terracoind getbalance 6399

-39381.71600000

./terracoind getbalance 12129

-82980.08650000



----------------------------------------------------

----- last 5 deposits from the attacker

[

{

"account" : "12129",

"address" : "18dCGtwALpJJMF6horVcbYY1Afft6pZfZq",

"category" : "receive",

"amount" : 480.00000000,

"confirmations" : 0,

"txid" : "68ce85dce72c4cc28053e823e453b52acbf2aa29ddd22f17f8c244ce756a6536",

"time" : 1374858805,

"timereceived" : 1374858805

},



{

"account" : "12129",

"address" : "18dCGtwALpJJMF6horVcbYY1Afft6pZfZq",

"category" : "receive",

"amount" : 4000.00000000,

"confirmations" : 0,

"txid" : "b5f3444bd2f8289b3d88e7784dd0fd6277054847acb8d5b7390c3ac0007e9207",

"time" : 1374859127,

"timereceived" : 1374859127

},



{

"account" : "12129",

"address" : "1M5jECA4CU4KnNVgbDAdPBcvScdhdkJT1H",

"category" : "receive",

"amount" : 7600.08650000,

"confirmations" : 0,

"txid" : "5b53dbd629d0bfb4ab71db94308f4f08ca073d40ce6eb8f07bde4cd18aa6ab92",

"time" : 1374860903,

"timereceived" : 1374860903

},



{

"account" : "12129",

"address" : "1M5RGitwKkT9AUea6638ZwzfiPV5kasu3c",

"category" : "receive",

"amount" : 8520.00000000,

"confirmations" : 0,

"txid" : "ebc4df3e1ecc4569cd51cc255e19852039a673d2f48e322f094e27300715146e",

"time" : 1374861841,

"timereceived" : 1374861841

},



{

"account" : "12129",

"address" : "1MnsunUAK2vJW21mE6azbXyXJSgJhDsy1Y",

"category" : "receive",

"amount" : 62380.00000000,

"confirmations" : 0,

"txid" : "172e3c1ba0ccf8284d4a031a149786788cf122dba9800e15ce73af4cc6022bfa",

"time" : 1374862281,

"timereceived" : 1374862281

}, A horrible Terracoin attack happened recently. Hundreds of thousands of TRC were created and disappeared.Details can be found fromOne attacker (ID on bter: m100003-6399 and m100002-12129) deposited around 120k TRC on Bter.com during the TRC network attack and dumped more than half of them.The attacker withdrew about 50BTC value (in BTC, LTC, FTC, TRC, etc) from Bter successfully before we disabled his accounts.Some of his deposits are listed below. The deposits are confirmed normally without any problem but later the confirmations all became zero and all he deposited TRC disappeared.We have disabled the TRC trade.We need to reverse all the trading transactions people made with the attackers IDs m100002 and m100003.BTCs will be credited back the Bter users' accounts who are affected so that they can get their BTC back.Bter will take all the loss during the attack.We need time to handle all the affected transactions very carefully. Please be patient.I am sorry for all the trouble to Bter users during this event. We are doing our best to handle it.-----------------------------------------------------balance of the attacker's two accounts./terracoind getbalance 6399-39381.71600000./terracoind getbalance 12129-82980.08650000--------------------------------------------------------- last 5 deposits from the attacker"account" : "12129","address" : "18dCGtwALpJJMF6horVcbYY1Afft6pZfZq","category" : "receive","amount" : 480.00000000,"confirmations" : 0,"txid" : "68ce85dce72c4cc28053e823e453b52acbf2aa29ddd22f17f8c244ce756a6536","time" : 1374858805,"timereceived" : 1374858805},"account" : "12129","address" : "18dCGtwALpJJMF6horVcbYY1Afft6pZfZq","category" : "receive","amount" : 4000.00000000,"confirmations" : 0,"txid" : "b5f3444bd2f8289b3d88e7784dd0fd6277054847acb8d5b7390c3ac0007e9207","time" : 1374859127,"timereceived" : 1374859127},"account" : "12129","address" : "1M5jECA4CU4KnNVgbDAdPBcvScdhdkJT1H","category" : "receive","amount" : 7600.08650000,"confirmations" : 0,"txid" : "5b53dbd629d0bfb4ab71db94308f4f08ca073d40ce6eb8f07bde4cd18aa6ab92","time" : 1374860903,"timereceived" : 1374860903},"account" : "12129","address" : "1M5RGitwKkT9AUea6638ZwzfiPV5kasu3c","category" : "receive","amount" : 8520.00000000,"confirmations" : 0,"txid" : "ebc4df3e1ecc4569cd51cc255e19852039a673d2f48e322f094e27300715146e","time" : 1374861841,"timereceived" : 1374861841},"account" : "12129","address" : "1MnsunUAK2vJW21mE6azbXyXJSgJhDsy1Y","category" : "receive","amount" : 62380.00000000,"confirmations" : 0,"txid" : "172e3c1ba0ccf8284d4a031a149786788cf122dba9800e15ce73af4cc6022bfa","time" : 1374862281,"timereceived" : 1374862281},

bcp19



Offline



Activity: 532

Merit: 500









Hero MemberActivity: 532Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 06:53:23 PM #2 Don't know if this will help at all or not, but here are all known address that attacker's account sent/received money from:



1PAnMKuTs9R4U9FF7xdQSmQc655d2r9zeB (main account)

13kfKR1BS9gtsxppMeqDTx4rAvbwWjvYSL (Used back in April, then mined blocks 175027-175037)

19hWiCHiWk3Bu3mXCCCDRhY9WVLUvoPVAR

1LEyVjbVJw3NSFtxa8o45TvAkpjWkYCuqX

1JZp28yknx5jm9TMPSnGzMyJq3ENCkvme7

111exFkjLXP5mXmEfVqGd2r7bXQhVhux3

1LrwViNiowvXaCKb33BYoYeXkQfUiAHpZ7

122xarBR5XSvcgZ27qNmgvP4VQCUgfzcsa

1LGkXWSE5qvMbxtY6H3CFTCJBKN5wa2NA2

1EYD7hV7t8fN9qXHsj41v2vpyq9SbySqkR

1Kbq1XfK8Zs2wZsAK6SAmaF5jAwym8xaKg

149JyDVZCW46vRJfLRfH1hzypLD5mV4mDk

1M3hwfdTVAHEEmLCepAj3ULNFaM2C7SF3v

1CVkkpMqK7fvNz5t6KecnuErnJxpzGCumS

1D5y3YSzTfT6WTqioW99cuJ6izXiTZg8YD

149JyDVZCW46vRJfLRfH1hzypLD5mV4mDk

1MwK8iA8nSqDDSiYytEntdd9UVYdiZ3qFe

1NCoJCE4sp5sjAnFwgViwRQrcCAE2hsq9u

1Q47BFwRP7nPEewgkRNQFzjVsQp3maQURx

1E1YNV1Rdv8vZtr6iHppGtkrFfFdMTYezK

15fZ3Dk3t89EBgwJieMv43oVGWLZkAHojL

1KeheSehZLUrXCSd5bcFGHNKDBgDWuhdZu

17gvfTjPVtNqV4b7iX1zALoNjCV93na4Y

15AzEWzQwi1wGvUtjEKCXi14zGikR6eSzk

I do not suffer fools gladly... "Captain! We're surrounded!"

I embrace my inner Kool-Aid.

Arbitrageur



Offline



Activity: 556

Merit: 500







Hero MemberActivity: 556Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 07:37:13 PM #4 wait wait.. if the bastard moved 120k trc and sold half of them on BTER, how did they disappear? aren't they on the account of the people who bought them? or just HIS coins he was unable to sell disappeared?









lucasjkr



Offline



Activity: 644

Merit: 500







Hero MemberActivity: 644Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 07:42:16 PM #5 A couple days ago, it sounded like the TRC network was 51%'ed; sounds like this was a MAJOR double spend. He sold the coins, all thought they were fine so he got BTC, then overwrote the blockchain from the point of transfer onward. Correct, or no? Definitely would be of aid to BTC and all the others to have an understanding of exactly what occurred.

bcp19



Offline



Activity: 532

Merit: 500









Hero MemberActivity: 532Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 07:46:40 PM #6 Quote from: Arbitrageur on July 28, 2013, 07:37:13 PM wait wait.. if the bastard moved 120k trc and sold half of them on BTER, how did they disappear? aren't they on the account of the people who bought them? or just HIS coins he was unable to sell disappeared?









1st, it wasn't a 51% attack, but a time warp attack. The fix TRC made to their client (by my understanding) was supposed to invalidate all the time-warped blocks, meaning all the coins this person exploited vanished once the block chain hit the 175000 block. Therefore, any coins he mined and sent elsewhere should have vanished at block 175000 (which they seem to have from the OP). The current TRC blockchain is at block 175040 while the old client chain (that someone is still mining) thinks the current blockchain it at 175460. If you were still using the old client, those coins would still be there. 1st, it wasn't a 51% attack, but a time warp attack. The fix TRC made to their client (by my understanding) was supposed to invalidate all the time-warped blocks, meaning all the coins this person exploited vanished once the block chain hit the 175000 block. Therefore, any coins he mined and sent elsewhere should have vanished at block 175000 (which they seem to have from the OP). The current TRC blockchain is at block 175040 while the old client chain (that someone is still mining) thinks the current blockchain it at 175460. If you were still using the old client, those coins would still be there. I do not suffer fools gladly... "Captain! We're surrounded!"

I embrace my inner Kool-Aid.

Sunny King



Offline



Activity: 1205

Merit: 1003









LegendaryActivity: 1205Merit: 1003 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 07:50:05 PM #7 Quote from: bcp19 on July 28, 2013, 07:46:40 PM Quote from: Arbitrageur on July 28, 2013, 07:37:13 PM wait wait.. if the bastard moved 120k trc and sold half of them on BTER, how did they disappear? aren't they on the account of the people who bought them? or just HIS coins he was unable to sell disappeared?

1st, it wasn't a 51% attack, but a time warp attack. The fix TRC made to their client (by my understanding) was supposed to invalidate all the time-warped blocks, meaning all the coins this person exploited vanished once the block chain hit the 175000 block. Therefore, any coins he mined and sent elsewhere should have vanished at block 175000 (which they seem to have from the OP). The current TRC blockchain is at block 175040 while the old client chain (that someone is still mining) thinks the current blockchain it at 175460. If you were still using the old client, those coins would still be there.

1st, it wasn't a 51% attack, but a time warp attack. The fix TRC made to their client (by my understanding) was supposed to invalidate all the time-warped blocks, meaning all the coins this person exploited vanished once the block chain hit the 175000 block. Therefore, any coins he mined and sent elsewhere should have vanished at block 175000 (which they seem to have from the OP). The current TRC blockchain is at block 175040 while the old client chain (that someone is still mining) thinks the current blockchain it at 175460. If you were still using the old client, those coins would still be there.

This sounds like a serious 51% doublespending attack on bter. Note the original time warp requires 51% attack as a basis. This sounds like a serious 51% doublespending attack on bter. Note the original time warp requires 51% attack as a basis.

Arbitrageur



Offline



Activity: 556

Merit: 500







Hero MemberActivity: 556Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 08:27:45 PM #9 wouldn't have been better to keep those coins as valid, so to let the attacker keep his profits without harming specific people (like bter in this case), at the end of the story he didn't cause any harm apart from an increased inflation and dilution of the coin...which basically it's what central banks do everytime they print new money out of nothing.

roy7



Offline



Activity: 434

Merit: 250







Sr. MemberActivity: 434Merit: 250 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 08:30:09 PM #10 Quote from: Arbitrageur on July 28, 2013, 08:27:45 PM wouldn't have been better to keep those coins as valid, so to let the attacker keep his profits without harming specific people (like bter in this case), at the end of the story he didn't cause any harm apart from an increased inflation and dilution of the coin...which basically it's what central banks do everytime they print new money out of nothing.



Yeah that's why the dev didn't roll things back to before the attack, because of the valid trades the exchanges had done/etc and they rely on the chain remaining intact as best as possible.

Yeah that's why the dev didn't roll things back to before the attack, because of the valid trades the exchanges had done/etc and they rely on the chain remaining intact as best as possible.

Arbitrageur



Offline



Activity: 556

Merit: 500







Hero MemberActivity: 556Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 10:35:00 PM #12 Quote Yeah that's why the dev didn't roll things back to before the attack, because of the valid trades the exchanges had done/etc and they rely on the chain remaining intact as best as possible.

have those coins disappeared or not? I still don't understand.

if I bought some on BTER (which actually I did) and sold them on there or on another exchange, did those who bought from me see the trc disappear after block 175k??? this sounds impossible to me! in fact I was able to move like 18 coins I bought on bter (most likely from the attacker) to another exchange and I still see them! they have not disappeared anywhere. I still own them, as I think any other buyer do.



please explain.. this is fishy.



if BTER says the coins have disappeared when actually they have not, in reimbursing the buyers at the price they bought, they keep the TRC for themselves and do make a profit selling them at current prices. not so much as taking a loss... come on!



please explain!!



thanks

have those coins disappeared or not? I still don't understand.if I bought some on BTER (which actually I did) and sold them on there or on another exchange, did those who bought from me see the trc disappear after block 175k??? this sounds impossible to me! in fact I was able to move like 18 coins I bought on bter (most likely from the attacker) to another exchange and I still see them! they have not disappeared anywhere. I still own them, as I think any other buyer do.please explain.. this is fishy.if BTER says the coins have disappeared when actually they have not, in reimbursing the buyers at the price they bought, they keep the TRC for themselves and do make a profit selling them at current prices. not so much as taking a loss... come on!please explain!!thanks

Arbitrageur



Offline



Activity: 556

Merit: 500







Hero MemberActivity: 556Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 11:02:32 PM #14 Quote from: n4ru on July 28, 2013, 10:40:47 PM Was this double spend after or before the double spend attacks started? If after, then the exchange is completely to blame for not stopping TRC deposits upon the first double spend hitting the network.



the exchange is with no doubt to blame for not stopping the unusual activity on TRC... vircurex did, other raised the confirmation up to 100, bter stood still at 4 confirmations and let massive and unusual trading to take place for more the 24 hrs. I mean when I saw that massive dumping I bought something and I took a huge risk, in fact everybody was talking about TRC to be screwed up and worth nothing, so to me the dumper could have been just a guy with lots of them just scared to lose his money and wanting out. but that was indeed suspicious to me. since my activity is arbitrage coins I saw the opportunity and even if I thought it was very risky I bought some in order to sell somewhere else at higher price.



NOW, what I want to know here: the coins the bastard sold on BTER have disappeared OR NOT?? cause it doesn't look like to me... the ones I was able to move out of BTER are sitting on my other accounts and have NOT disappeared. so how could BTER affirm the coins have disappeared... the only coins that might have disappeared after block 175k are the ones the bastard couldn't sell which are still sitting on his account...



...unless, and here I prove I don't know how exchanges really works, the buying/selling trades on each exchange aren't really settled until the coins are moved from the buyer to another address. in this case everything that's still on BTER truly disappeared, except the coins that buyers were able to move out of their BTER account.



am I right?



the exchange is with no doubt to blame for not stopping the unusual activity on TRC... vircurex did, other raised the confirmation up to 100, bter stood still at 4 confirmations and let massive and unusual trading to take place for more the 24 hrs. I mean when I saw that massive dumping I bought something and I took a huge risk, in fact everybody was talking about TRC to be screwed up and worth nothing, so to me the dumper could have been just a guy with lots of them just scared to lose his money and wanting out. but that was indeed suspicious to me. since my activity is arbitrage coins I saw the opportunity and even if I thought it was very risky I bought some in order to sell somewhere else at higher price.NOW, what I want to know here: the coins the bastard sold on BTER have disappeared OR NOT?? cause it doesn't look like to me... the ones I was able to move out of BTER are sitting on my other accounts and have NOT disappeared. so how could BTER affirm the coins have disappeared... the only coins that might have disappeared after block 175k are the ones the bastard couldn't sell which are still sitting on his account......unless, and here I prove I don't know how exchanges really works, the buying/selling trades on each exchange aren't really settled until the coins are moved from the buyer to another address. in this case everything that's still on BTER truly disappeared, except the coins that buyers were able to move out of their BTER account.am I right?

n4ru



Offline



Activity: 350

Merit: 250









Sr. MemberActivity: 350Merit: 250 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 11:05:26 PM #15 Quote from: Arbitrageur on July 28, 2013, 11:02:32 PM Quote from: n4ru on July 28, 2013, 10:40:47 PM Was this double spend after or before the double spend attacks started? If after, then the exchange is completely to blame for not stopping TRC deposits upon the first double spend hitting the network.



the exchange is with no doubt to blame for not stopping the unusual activity on TRC... vircurex did, other raised the confirmation up to 100, bter stood still at 4 confirmations and let massive and unusual trading to take place for more the 24 hrs. I mean when I saw that massive dumping I bought something and I took a huge risk, in fact everybody was talking about TRC to be screwed up and worth nothing, so to me the dumper could have been just a guy with lots of them just scared to lose his money and wanting out. but that was indeed suspicious to me. since my activity is arbitrage coins I saw the opportunity and even if I thought it was very risky I bought some in order to sell somewhere else at higher price.



NOW, what I want to know here: the coins the bastard sold on BTER have disappeared OR NOT?? cause it doesn't look like to me... the ones I was able to move out of BTER are sitting on my other accounts and have NOT disappeared. so how could BTER affirm the coins have disappeared... the only coins that might have disappeared after block 175k are the ones the bastard couldn't sell which are still sitting on his account...



...unless, and here I prove I don't know how exchanges really works, the buying/selling trades on each exchange aren't really settled until the coins are moved from the buyer to another address. in this case everything that's still on BTER truly disappeared, except the coins that buyers were able to move out of their BTER account.



am I right?





the exchange is with no doubt to blame for not stopping the unusual activity on TRC... vircurex did, other raised the confirmation up to 100, bter stood still at 4 confirmations and let massive and unusual trading to take place for more the 24 hrs. I mean when I saw that massive dumping I bought something and I took a huge risk, in fact everybody was talking about TRC to be screwed up and worth nothing, so to me the dumper could have been just a guy with lots of them just scared to lose his money and wanting out. but that was indeed suspicious to me. since my activity is arbitrage coins I saw the opportunity and even if I thought it was very risky I bought some in order to sell somewhere else at higher price.NOW, what I want to know here: the coins the bastard sold on BTER have disappeared OR NOT?? cause it doesn't look like to me... the ones I was able to move out of BTER are sitting on my other accounts and have NOT disappeared. so how could BTER affirm the coins have disappeared... the only coins that might have disappeared after block 175k are the ones the bastard couldn't sell which are still sitting on his account......unless, and here I prove I don't know how exchanges really works, the buying/selling trades on each exchange aren't really settled until the coins are moved from the buyer to another address. in this case everything that's still on BTER truly disappeared, except the coins that buyers were able to move out of their BTER account.am I right? The attacker's deposit disappeared. ETH-Nova - Fully Automated OC/PL/P-state/Mining/Monitoring for Windows

ETH: 0x00972cd6a2c6786afbcc24ca592b8c86f33f747a / BTC: 1n4ruYy5QWbTDBbPEyBRWwj1Ni4U4Sz5P ETH: 0x00972cd6a2c6786afbcc24ca592b8c86f33f747a / BTC: 1n4ruYy5QWbTDBbPEyBRWwj1Ni4U4Sz5P

roy7



Offline



Activity: 434

Merit: 250







Sr. MemberActivity: 434Merit: 250 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 11:14:46 PM

Last edit: July 28, 2013, 11:50:56 PM by roy7 #16 Right, which is what double spend is all about.



Chain A I sent coins to BTCe. They clear, I sell them for BTC. I withdraw the BTC.



Now I make a new chain B started the block before I sent the coins, and make it longer than chain A so clients switch to it instead. My coins were never sent to BTCe, I still have them, but I also have the BTC I sold them for. BTCe is left without the BTC or the TRC.



I trust BTCe is on the mailing lists of all coins they support, so they always know about mandatory upgrades in advance.

Arbitrageur



Offline



Activity: 556

Merit: 500







Hero MemberActivity: 556Merit: 500 Re: Terracoin attack caused Bter.com 50BTC loss July 28, 2013, 11:16:09 PM #17 Quote The attacker's deposit disappeared.

let me understand how an exchange works...

a guy deposit x coins on his address...

then he sells something to someone else

are the coins really moved to the seller address to the buyer address after the trade?

let me understand how an exchange works...a guy deposit x coins on his address...then he sells something to someone elseare the coins really moved to the seller address to the buyer address after the trade?