Bitcoinica Still Out of Action

Bitcoinica is still out of action, with the postings growing more and more angry and fedup with the pace of development.   We really hope that Bitcoinica can be back in action and all funds are allocated to the correct customers.   It is a very interesting part of Bitcoin and hopefully it will continue to be a very interesting part of Bitcoin.

Btc-E Hacked

Btc-E was hacked which is another blow to the Bitcoin project as Btc-E is one of the more popular exchange.  I loved to use Btc-E especially it gave a lot of choices of crytographic currency.   It seemed that someone fraudulently entered a lot of USD and buy up the value of the Bitcoin until it spiked to over US$90.   The situation is still unfolding.  Best Wishes to Btc-E, may it resume operations asap.

This is a recommendation taken from the popular Bitcon forum:

1. Sell ALL USD immediately. There is definitely not enough USD to pay out.
2. Withdraw ALL BTC immediately. Unless fractional reserve or cold storage was employed, there should be enough. This is confirmed by one of DeathAndTaxes's experiments.
3. Change passwords for other websites immediately. The database is likely to leak, if a SQL injection was the culprit.

A public plea for help regarding Bitcoinica and my 24,841 BTC

I have reproduced this in full to help the member.

Please help me.
I have 24,841 bitcoins on deposit with Bitcoinica.
I have provided them with my full and complete account history including every transaction since day one.There is no question as to exactly how much I am owed. (I'm happy to provide proof to other trusted entities)
I have patiently been asking for them for my money back for months, but they have refused to return even a single Bitcoin to me.

I'm a core Bitcoin proselytizer.
I'm responsible partly or in full for:

www.Bitinstant.com
www.coinlab.com
www.lovebitcoins.org
www.ogrr.com
www.bitcoinchipin.com
www.memorydealers.com
National Bitcoin radio adds @ $2,800 a month for over the last year.
The Bitcoin Bet.
Bitcoin Billboard
Numerous national radio interviews.
Several more projects that are in the works including a Bitcoin competitor to newegg.com.

For the last 1.5 years I have spent every waking moment promoting Bitcoin,  and my 24,841 Bitcoins were to be used exactly for that.

Hacker, Tihan,  Zhou,  Patrick, Donald, Amir, or anyone else with access to my money,  please return it to
16HMoS4TryH7wWsAv2PtvxiHX8QGXMGczi

so that I can continue to effectively promote Bitcoin.
Returning my funds will likely make everyone's worth even more in the long run.
I promise I will continue using them to help advance Bitcoin.

Roger Ver
roger@memorydealers.com
Cell +1-408-313-1853

Dismantling of Deepbit

There are on and off requests to dismantle Deepbit, not because it is no good but because it is too good and attracted too many of the miners until their share of the hashing power is dominant.   As we know those who control more than 50% of the Bitcoin hashing power has the ability to manipulate the entire Bitcoin, once in a while there are talks in forums or suggestions to dismantle Deepbit.   IMHO I do not think it is fair.   Yes I do favor a pool that has lesser hashing power so that it will not be a threat to the Bitcoin.   What I suggest is the rest of the pool operators improve upon their services so as to capture more hashing powers from the Deepbit pool rather than ask for Deepbit to be dismantled.

Upgrade to Bitcoin Client 0.6.3

Do upgrade to the latest Bitcoin Client 0.6.3, and it is always a good practice to backup your wallet during the upgrading.

Bitcoin version 0.6.3 is now available for download at: http://sourceforge.net/projects/bitcoin/files/Bitcoin/bitcoin-0.6.3/ This is a bug-fix release, with no new features.

CHANGE SUMMARY

==============

Fixed a serious denial-of-service attack that could cause the bitcoin process to become unresponsive. Thanks to Sergio Lerner for finding and responsibly reporting the problem. (CVE-2012-3789) Optimized the process of checking transaction signatures, to speed up processing of new block messages and make propagating blocks across the network faster. Fixed an obscure bug that could cause the bitcoin process to get stuck on an invalid block-chain, if the invalid chain was hundreds of blocks long. Bitcoin-Qt no longer automatically selects the first address in the address book (Issue #1384). Fixed minimize-to-dock behavior of Bitcon-Qt on the Mac. Added a block checkpoint at block 185,333 to speed up initial blockchain download.

Bitconica Post Mortem

Below is Bitconica Post Mortem, we the Bitcoin Community certainly awaits its return!  Best Wishes to Bitconica!

The hacker was successful able to access an email server. This gave the attacker access to info@bitcoinica.com which in turn allowed them to reset passwords with our hosting provider, Rackspace. From there, they were able to change root passwords, steal the private keys of our hosted bitcoin wallet, and compromise our online database.

In the past, Bitcoinica has been victim to the poor security practices of an irresponsible hosting provider. In this case, the fault was entirely ours. Specifically, here's how things went wrong:

 1) We had too many bitcoins in our online wallet.
In light of past experiences you might say this is inexcusable. You would be right. Our practice was to keep online balances to a minimal amount by periodic transfer to offline storage. However, this was a manual process and the online balance could grow quickly and unpredictably from user deposits. We should have had an automatic process or an alert system to prevent the online wallet from growing too large. Indeed, that was planned, but it didn't happen soon enough.

2) Access control and server security did not get the proper attention
Since administrative email accounts can receive password reset links from Rackspace, the administrative contact should have been a secure email address, it was not. Access to this email account should have been limited to administrative personnel.

3) We did not retain needed expertise fast enough
As many of you know, Bitcoinica began as a small project by a solo founder. The advanced trading experience that Bitcoinica brought to the world would not have been possible without Zhou Tong's brave innovation. In light of rapid growth, it was prudent to bring in a larger team with diverse technical specialties, including security. This occurred officially last month when the Bitcoinica Consultancy team stepped in as managers and operators of the business. A transition period ensued. A new platform was conceived which would strengthen Bitcoinica in the long term but took focus away from the present system in the short term. The recent security breach was not beyond our team's skills to prevent. We know better. But we did not address relevant issues as quickly as was needed.
So, what are we going to do about it?
We are choosing to leave Bitcoinica offline until such time as a new platform can be built and tested with security best-practices built-in from scratch. We do not yet have a firm estimate for availability but it will most probably be measured in months.
We will set up a process in the short term for users to withdraw their funds. Further details will be provided once we determine the best approach.
We thank you in advance for your patience. And we humbly apologize for this incident.

Upgrade Bitcoin Client Urgent to 0.6.2

CVE-2012-2459: Critical Vulnerability

A denial-of-service vulnerability that affects all versions of
bitcoind and Bitcoin-Qt has been reported and fixed. An attacker
could isolate a victim's node and cause the creation of blockchain
forks.

Because this bug could be exploited to severely disrupt the Bitcoin
network we consider this a critical vulnerability, and encourage
everybody to upgrade to the latest version: 0.6.2.

Backports for older releases (0.5.5 and 0.4.6) are also available if
you cannot upgrade to version 0.6.2.

Full technical details are being withheld to give people the
opportunity to upgrade.