Quote from: ECGpaypal on April 26, 2013, 11:10:53 PM

Quote from: YipYip on April 26, 2013, 09:11:44 AM

Quote from: YipYip on April 26, 2013, 01:51:58 AM

My friend djdave got hacked and 24 btc was stolen from btc-e on the 20th/04/2013

We have sent an email regarding this to support with all the detail including the address that it was transfred out to

What is happening about returning his funds Huh

?

So you sent us a log of IP address's what are we supposed to do with this

When are you going to return funds of 24btc to djdave account Huh

What are they supposed to do? Pay from their own pocket just because your friend got hacked? It's not their responsibility.

Well, that all depends on the nature of the 'hack', doesn't it?

BTCe has a duty to take reasonable care of the deposits you send to them. That includes protecting them from fraudulent activity, such as hacking.

There have been several people already who have said they suspected SQL injection attacks, which is possible judging from the number of people who have so far come forward, to find their email addresses and passwords changed, without getting an email notification or confirmation message, which is supposed to prevent unauthorized people from getting their hands on your funds.

If those protections turned out to be flawed, and didn't protect the owner of the account in the manner they were intended to? Then the failure is BTCe's responsibility, and it is their duty to make it right with the customer, including, yes, refunding the customer out of their own pocket if necessary.

On the other hand, if the 'hack' (not really a hack, but whatever) consisted of the 3rd party obtaining the customer's login credentials, in various ways that were out of the control of BTCe's system (3rd party keyloggers, for example), not having email confirmations enabled, or the mail host the customer is using itself gets hacked, then the responsibility falls on the customer failing to protect his/her credentials, and BTCe has no duty to replace them with their own funds.

So, all this boils down to, is where the vulnerability was.

With the number of people so far who have claimed to have the email confirmations on withdrawls enabled, who didn't get a confirmation, and the withdrawls were executed, that implies BTCe was at fault. Also, if the cracker/phisher was able to change the personal data (like the email linked to the account) to a new address without any kind of intervention/confirmation via the old address, that also implies some fault with BTCe for the failure of their security.

My account wasn't one of the hacked ones, so I can only go by what others have recently posted, I have no first-hand info to base any of this on, so don't know the specific nature of the 'hack'.

In either case, however... only replying with a list of IP addresses and no other information? Tacky... very tacky... and BTCe is going to have to do better than that, even if they have no culpability in the problem.

-- Smoov