Quote from: Herodes on April 08, 2013, 02:10:08 AM

I do not have a stake in instawallet, I did not have any funds there. If I had, and it was some sizeable amount, I would go to France in person, and not leave until I was reinstated the lost funds. I don't believe in having things done through 'authorities' and lawyers. Most of the time, things are quite simple, and it's only a matter of persuading the right person to do the right thing.

I believe anything that can be done privately can be done much more efficient than dealing with any 'official agency' that will do nothing in the end anyway.

Clear tale signs of a scammer and con-man is:

* Evasiveness (don't communicate or do it very poorly)
* Constant delays (to buy time)
* Telling lies, and making up things.

This situation is very simple.

Instawallet has lost funds. From their records, they will be able to see how much funds they lost and how much they've got left. Let's say that 30% of the total funds has been lost as 30% was in the hot wallet and the rest in cold storage.

This means that all users will have to take a 30% haircut. Although users would not be happy with this, they would be happier to get 70% back, then nothing at all. This is the fair way to do it. Setting an arbitrarily limit of 50 BTC and stating that those with lesser balances should be paid in full, while those with a 50BTC+ balance will be paid on a best effort basis does not make sense. It's reasonable to believe that people storing in excess of 50 BTC on instawallet also would have more funds which they would be happy to use to seek legal action and other direct action. So letting these people taking the pain, is not a smart move.

If one is not honest about ones business operations, shit will hit the fan sooner or later - that always happens. Mistakes and fuckups can happen, but people will be more forgiving if there is good and honest communication.

The 90 day claim process is highly questionable, and it's a typical scammer way of evading and delaying the process. After 90 days, people will have 'forgotten', many give up, because they only have small amounts and so on... Lot's of accounts (read: unique urls) should be possible to verify beyond doubt given pieces of information, and should be handled manually on an ongoing basis, then those remaining in an uncertain state should be held until the 90 days are up, and then be released to the person claiming it. To avoid having to pay out to some hacker who've submitted multiple claims, some verification would be possible to do, to ensure multiple claims does not go to the same person. (I know some may have more instawallets, but it's a difference in having 2-3 and having 45...)

There are many pieces of info that could be used to determine whether it's a legitimate claim or not, and these could be handled on an ongoing basis.

For instance a user could be using the same ip for most of his access to instawallet, and he might even be able to remember transactions in or out of instawallet, and he may even have access to adresses from which he previously have sent coins, and can prove he control these, perhaps he even have screenshots from an exchange showing withdrawals to his adress, or have transaction history in a local wallet.

Also, it depends on how much information the hacker got from the database. How much does he know about the users, and how easy would it be to fake a claim ? That's rather important information needed to determine the course of action.

As for the number on the police report, even if this is on paper, and there's not a computerized database of the police report, the owners of instawallet should be able to give a reference to a contact within the french police that can confirm that the case is reported. When this reference is given, one or more members of this forum shold be able to call up the police through their official listed phone number and ask to speak with this policeman to have it confirmed that a police report is filed.

Also there was stated that independent auditing is going on, here Instawallet should be able to give permission to the auditing company to be able to confirm they're infact working with Instawallet on the issue at hand. Again forum members should be able to call the auditing firm to have this confirmed.

Since the communication from Instwallet is not the best, perhaps a 3rd party (1 or 2 forum members) that actually is trusted in the community and that have a high level of technical expertise should move in to assist with the case in determining whether a claim is legit or not. Also, the logs of the web-server should be able to give information about ip-adresses and perhaps also user-agent information. Not sure what server is used, but if it's apache, these logs are archived by default to the best of my knowledge. So it may be possible to extract some information from that. If a user states he always used his home DSL-connection, and the weblogs shows that indeed this is the truth, and the claim comes from the same ip-adress, then that is a very good indicator that the user is legit, if he also can prove ownership of some of the bitcoin-adresses used to fund his wallet, we can almost be certain that the rightful owner has made the claim. In cases of doubt, it may also be possible for the user to contact his ISP and ask them to contact Instawallet and confirm for them that he's a subscriber with them using that IP-adress.

I'm certain there are more things to think of also. For instance some might have used tor, and always accessed the wallet during work-hours, or only during weekends. Unless the hacker has acces to the web-logs, these are things he cannot simply know. Also screenshots of bookmarks to the instawalleturl could give an indication of legitimacy.

There are many datapoints that could be used to determine if a claim is valid or not, and only in cases where it can be proved 100%, or as close to 100% as you can get, the funds should be paid out early, if not there should be some waiting time. I would also suggest that stating how much remaining funds there are, and handing these funds over to one or more trusted members of the community would be a good thing to do. That way, the process would be more transparent.

If an intelligent competent person with a precise eye for details handles the verification procedure, then this should be rather safe. For those users where ownership of the account cannot be reasonably determined, then the waiting period of 90 days before a payout may be justified, but a 90 day payout period as default, that's just ridiculous.

This reminds me a lot about the bitcoinica situation, and I again very sad on behalf on the bitcoin community, and the affected users. Personally I would've ensured that security was as good as it possibly could be for a service like this, and in the event there was a breach of security, and funds were lost, I would bend over backward to have the situation resolved swiftly to the benefit of my customers. If I ran multiple services, and one service suffered a loss and customers would be out of pockets, I would promise them paybacks with earning from my other operations. It's all about being an upstanding individual and conducting business with paying attention to the ethical aspects.

Another thing with bitcoin businesses is that it's so incredible easy to say that you 'got hacked' and then run away with funds, as there is here now - there's no transparency, so we simply does not know.

I can understand that all details is not something that you would like to put in public, but perhaps now is a time to seek help from some of the most competent persons in this community, I'm sure there are several to chose from which have a high level of trust around here. Then these techheads could advise as to the best way of solving this issue.

I have no idea how many instawallets there were, and how much work it would be - but no matter how big the task would be, it must be done - and it should be done swiftly, and the claims process should start now, and be handled on an ongoing basis. Then there should be some kind of ongoing communication updated with stats, so the users can see what's going on and that there's in fact some progress.

If Instawallet owner doesn't have time for this, the work should be outsourced, and I'm sure many users rather would have their balance back now deducted a 5% claim fee (and a maximum of 0.25 BTC pr account), than having their full balance in 90 days. A claim fee could be used to pay the ones doing the manual verification job.

Let me know if there's anything I can do in this situation to help. I am not affiliated with Instawallet, nor do I hold a wallet there with coins, and I've never stored more than about 500$ worth of bitcoins there, but then for a very short amount of time.

I sincerely and genuinely hope that this situation will be solved the best way possible for all parties involved, and that users will learn from this and be wary of web-wallets in general in the future.

Thank you for your very insightful comments. It is good to feel your desire for this to work out well - for the people who do not have access to their funds as well as for the Bitcoin community altogether. We do not need another situation where everyone suffers a fundamental trust issue with one of the main Bitcoin operators - and one that will be continuing to function - as I'm sure Paymium certainly is.

Personally I believe you can help the situation - because you give a fuck, have made very intelligent points and obviously are a clear thinker, have some technical expertise and appear to a very active member of the Bitcoin community. Perhaps you could assist with potentially co-ordinating an approach to Payium that involves maximal Instawallet account holders. Also the fact that you are not an account holder is positive I feel as it gives you some emotional "distance" from the whole thing.

I am sure anyone holding coin with Paymium would be happy to compensate you for your assistance in this regard. Perhaps if other members could give their feelings about this?

Personally I would be happy to drive any legal approach, including filing criminal charges against Paymium and it's individual board members IF (and only if) they choose to not come to the party (my approach via the embassies I believe will have some effect). I have a fair amount of experience in litigation and have a "pitbull" attitude once I get going - my jaws will not unlock until it's over, so I can assist that way.

Let me know your feelings about how you might want to assist.

ghdp lives in Paris and has offered to visit Paymium. Perhaps a co-ordinated response from a group of account holders via ghdp would be a good initial action. ghdp would you be open to this? What would you require?