Quote from: DeathAndTaxes on February 17, 2014, 10:43:17 PM

Quote from: PrintCoins on February 17, 2014, 10:26:27 PM

I don't know if I would call the attackers thieves. By the looks of things they aren't making off with bitcoins, they are just invalidating transactions that others are making, and thus making the db's of exchanges inconsistent with the actual bitcoins they possess. They are more like griefers.

There were two different scenarios involving the mutability.

The first was the attackers were ONLY modifying their OWN transactions. They would then report the tx failed, MtGox would lookup the tx id, see it wasn't in any block and pay them a second (and third? and twenty eight?) time.

After MtGox wised up 30 days later someone (possibly the same people, or new people) began mass modifying the tx of OTHERS. This particular event has no direct ecnomic value and your right it is likely griefers, or someone looking to damage the credability of the Bitcoin network. When people are talking about thieves they are talking about the former event.

Ok, now I finally grasped the attack I think on gox.

In my own wallet(s)
Transaction A is created
Transaction B is created Based on A.
Transaction C based on B is sent to Gox
... gox acts idiotically and recognizes C before B is finalized
Bitcoins bumped up in my gox account
I invalidate B so the bitcoins are still in my wallet
I withdraw bitcoins from gox and it says ok as its database of my account shows bitcoins it never really got.
I have just doubled my money

Rinse and repeat until gox notices the problem.

Sounds like gox would be empty in short order.

So then they wise up and shut the door (or they just see no money in their wallet). If they didn't lose most of their bitcoins in the process then they could just make a minor tweak to their process and only recognize confirmed transactions. Unfortunately I think they have been drained dry and are just looking for a way to open the bank with no money in the vault and prevent a run. They need to get some reserve of bitcoins back in their vaults to make payouts so people can feel calm and safe, and I suspect their bluster about waiting till bitcoin fixes itself is a delaying tactic.

Or if you want to be optimistic, gox could have kept 90% of their funds in a cold wallet and all is safe. They could easily verify such things to the public though and their lack of transparency is discouraging. A simple, "look guys, don't sweat it, here is one of our many addresses in cold storage with $1M in bitcoin and this message was signed from its private key. Chill out, and we will have things flowing smoothly in a jiffy."

Unfortunately, I am a pessimist, and this is the second time that gox has f-ed up on a massive scale. I think this will lead to a level of disappointment that wil make mybitcoin look like a small pickpocketing.