Quote from: shtylman on September 04, 2012, 05:18:16 PM

Quote from: DeathAndTaxes on September 04, 2012, 05:16:19 PM

Please quantify the amount of BTC lost as well as the total BTC owed.
What % of BTC were lost?

From the tx it looks like 30K BTC in outputs (although one involved two large outputs so it is unclear what is going on there).

This was almost all of the BTC.

Quote from: DeathAndTaxes on September 04, 2012, 05:16:19 PM

Was there a loss of any USD funds?

No. All USD bank accounts are secure. And all records for the current status of the exchange (accounts, trades, etc) are all also secure.

Quote from: shtylman on September 04, 2012, 05:21:02 PM

Quote from: jojo69 on September 04, 2012, 05:19:25 PM

unencrypted backup Huh

Yes. It was made when I manually did an upgrade and was put in the unencrypted area on disk. I realize the details of the failure and attack are interesting but I am currently focused on user accounts and exchange status going forward.

Quote from: shtylman on September 04, 2012, 05:23:02 PM

Quote from: DeathAndTaxes on September 04, 2012, 05:21:41 PM

So ~30K of ~30K in BTC has been lost?

The amount totals to ~24K BTC.

Quote from: shtylman on September 04, 2012, 05:26:47 PM

Quote from: nimda on September 04, 2012, 05:21:37 PM

How long, given average operation, would it take to regain the 25K in fees?

We have seen steady growth over the last few months but our 30 day volume is ~64K BTC (717K USD) and given that we get 0.3% from each trade this means we make roughly 2.1k per month in USD (210 BTC at current rate). So quite a long time if trading did not ramp up. Regardless of the recovery time I felt it important to make this announcement as it impacts many users and the community.

Quote from: shtylman on September 04, 2012, 05:35:21 PM

Quote from: TangibleCryptography on September 04, 2012, 05:33:47 PM

Since neither the USD balances nor account records have been compromised please process scheduled ACH withdraws.

We have a pending ACH withdraw which should be processed today.
Should we send ACH withdraw request for the balance by email since the site will be down for the immediate future?

ACH withdrawals placed before the compromise have been processed. New withdrawals are currently on hold while I work through the future of the exchange.

Quote from: shtylman on September 04, 2012, 05:37:01 PM

Quote from: SkRRJyTC on September 04, 2012, 05:34:46 PM

Could you secure some investor funds to pay back losses to customers now, and payback the investor after your business picks back up?

This would be a possibility if investors interested in helping continue operations show interest. It is certainly something I am thinking about.

Quote from: shtylman on September 04, 2012, 05:42:27 PM

Quote from: notme on September 04, 2012, 05:39:40 PM

I never store keys on a webserver for a project involving customer funds. If all monies belong to the site operator that's their business, but if there are customer accounts I refuse to write code for someone who isn't willing to put the keys on a separate, heavily locked down server (preferably with no public ip).

I don't wish to go into too many details on this thread about it, but this box was not public facing.

Quote from: shtylman on September 04, 2012, 06:19:03 PM

Quote from: notme on September 04, 2012, 06:12:57 PM

Still irrelevant. Maybe try understanding the question. It still won't help though since the question isn't directed to you and you don't know the answer. A system, holding an unencrypted copy of the keys was hacked. He claims this system was not public facing, yet he also claims that the attacker connected from a specific IP. If the system was not public facing, how did the attacker connect to it?

The system was connected to from one of our other boxes which was accessed through a virtual console. The wallet box had all public ports blocked but was able to be connected to from a few of the other boxes.

Quote from: shtylman on September 04, 2012, 07:42:21 PM

I have put the website back online for users who have USD to request a withdrawal via ACH. If you choose to leave your USD funds in the account they will be available for trading once it resumes. I hope to resume trading later in the week.

If you had outstanding orders they have all been cancelled.

Once trading resumes, I hope to be able to start repaying BTC losses using the proceeds from fees. More information about this will be provided later.

Quote from: shtylman on September 04, 2012, 08:52:02 PM

Please note that I have taken the website offline. I am consulting legal council about the current situation and will post once I have more details. I want to make sure the matter is handled appropriately given the financial situation the exchange is currently in.

The website was causing too much confusion in the current form and once I have more details I will post a very clear message for all users.