Almost everyone had transactions from "united". It does NOT mean that your account was compromised. It does mean that the attacker has your username. It was just them using the merchant API to send you 0 BTC.
There were only two accounts that had money stolen from them as far as I can tell.
It was a dictionary attack since I saw it happening.
I plugged the vulnerability that allowed them to run the attack so your weak passwords will be safe again.
I'm still working out with cryptofo if/how to reimburse him.
Ideally Liberty Reserve would help us since they can easily fix the issue. But they don't seem to be cooperating. Anyone have ideas there?
Finally, your answer is much appreciated.
Guess you both share the responsibility for the story, vulnerability+weakpassword= 50:50