Quote from: PJDavis1970 on February 05, 2014, 10:24:54 AM

Quote from: btcltcdigger on February 05, 2014, 10:19:47 AM

Quote from: def_ender on February 05, 2014, 09:13:18 AM

Hm, maybe it was mistake. Some of them was DEcrypted by hacker. If you know hashed password, within 5-20 hours you can decrypt it into unencrypted one.

This is complete BS.

md5 passwords, if used in a right way, take years to decrypt.

Of course a password like 12345 can be decrypted in matter of seconds using rainbow tablets, but if this is the case, then it's a slap in the face for your to allow such passwords

OK lets say this is true.. Let me understand this.

You received a message form a hacker claiming he has hacked site and got passwords. He has taken coins from a few accounts and asked you for 10 btw or you will loose rest.

HUMMM.. OK

Firstly why didn't the hacker just take everything and make more? Hackers who steal are not nice people that will just say,.. ok just give me a little and ill leave you rest.

SO think for a second.. He claims to have decrypted hashed passwords ( I DONT THINK SO )

Is it not more likely someone has created 10 + accounts.. Deposited coins to all accounts.. Empited all those accounts and then pretended to be a hacker and blackmail you for btw?

>Firstly why didn't the hacker just take everything and make more?
Because we don't store everything in one wallet. We had ~300 ltc on our exchange wallet, and had ~1000 on our cryptsy wallet (cuz it's obvously more safe than our exchange).

Quote from: murkster on February 05, 2014, 10:25:47 AM

Proof of hack please.
As mentioned emails with full headers.
Any server logs showing pertinent information to share with community so others can harden their exchanges.
Relevant blockchain entries.
The passwords could well have been brute forced the easy ones first. Most probably bluffing about taking monies as if I had access to all accounts I would empty all. Which will probably happen anyway given enough time to brute force passwords.
If genuine Im gutted fir you...

.

Just now i know one adress to which was withdrawn 0.4 and 0.8 ltc (we blocked it and in a few time there were support ticket 'why so long to withdraw' and after this - DONT WITHDRAW THIS IT IS NOT MY WALLET STOP IT). After it i don't know which wallet was really hacker's one, and which was real one.
After it i have support ticket from some guy with threat, and now - message from this guy in our btalk thread.
Just now that's all.
I will post logs as soon as admin gives it to me.