The popular Bitcoin transaction processor that disappeared from the internet about 10 days ago, taking at least tens of thousands of Bitcoins in user deposits with it, has been communicating via statements posted to the site. In essence: We screwed up. We were hacked. We have enough BTC to refund some of the lost Bitcoins, and then we’re done. “It appears to be human error combined with a misunderstanding of how Bitcoin secures transactions into the next block,” the most recent statement says by way of explanation.
Some members of the Bitcoin community suspect foul play (more about that later). But as promised, there is now a claims form for users who lost Bitcoins in the debacle: “Claims are manually reviewed and will be processed within 48 hours of being filed. This claim form will remain online for 30 days.”
And as of Saturday night, the historically-reticent MyBitcoin has a voice: “Tom Williams,” who stepped forward to field questions from the Bitcoin community via the #bitcoin-police channel on IRC, where he verified his association with the site by moving Bitcoins from the MyBitoin IP to a pre-specified address and providing the same encrypted signature that was used to sign the official statements posted on MyBitcoin.
After passing muster with the tech-savvy denizens of #bitcoin-police, a loosely-organized group of Bitcoin enthusiasts who investigate various issues in the Bitcoin community, Mr. Williams got down to tacks. “Listen: what did you think we did after the hack happened? We got shitfaced for many days. What would you do? Fuck.”
MyBitcoin had half its deposits in “cold storage,” he said, so it will be refunding all users 49 percent of their deposits. But he advised patience. “Cleaning up the mess takes time,” he said. “We can’t just start transmitting coins all over the bloody place.”
MyBitcoin claims to have had
230,073 154,406 Bitcoins in its coffers at the time of the incident, which at the time translated to more than $2 million USD. The price has fluctuated considerably since then due to several high-profile incidents. At today’s, or rather, this moment’s prices, MyBitcoin’s deposits would equate to $1.18 million USD.
MyBitcoin built its reputation by providing a free, user-friendly service targeted at newbie Bitcoin buyers. It collected scores of users, including Bitcoin evangelist and host of The Bitcoin Show Bruce Wagner, who says he had 25,000 Bitcoins–$192,500 at today’s price of $7.70, but worth more than $250,000 at the time of MyBitcoin’s disappearance. Mr. Wagner was also in the habit of recommending the service, especially to new users of Bitcoin. Betabeat also used the service to buy a few Bitcoins from a restaurant for the newsroom (and promptly lost all our co-workers’ money).
MyBitcoin was simply the easiest and best-designed option available–and that’s what has some Bitcoin users suspicious that perhaps the “hack” was an inside job. Mr. Wagner has spoken to the FBI’s cyber crimes unit, which took enough interest in the case to give him a call back. He says the FBI has requested that affected users who suspect a crime report the incident online.
The counter-theory, as related by some users in the Bitcoin community–who are careful to hedge every word to avoid libel, retaliation and the chance that any action might discourage MyBitcoin’s operators from refunding any Bitcoins at all–is that MyBitcoin was an elaborate hoax, designed to lure users into a false sense of security and then make off with their Bitcoins at just the right time.
Through the emerging science of Bitcoin forensics, some leads point to hacker aliases out of Canada. But clues are far from a smoking gun. For example, the #bitcoin-police hivemind concluded that the hacker collective Hack Canada registered its domain via PrivacyShark, the anonymized domain registrar that also registered MyBitcoin.com, among a long list of other domains including bitcoinreserve.com (empty), bitcoinia.com (expired), and pussyjuicegirls.com (active), which led them to name Edmonton programmer Dalin Owen as a person of interest along with five IRC handles and the owner of digital currency exchange nanaimogold.com.
“Dalin Owen is the one name that is linked to everything, and ppl have independently named him as the guy behind mbc,” one Bitcoin user told Betabeat in a private message, but–”there is no hard proof yet.” Dalinowen.com has been wiped and replaced with the message, “Yes, we sold a domain name to mybitcoin, but we have nothing to do with its operation. I also referred them to Morningstar Holdings as a professional courtesy as their corporate filing services have worked well for us in the past. All of the threats of bodily harm are being sent to the local authorities. I will not respond to any more threats or intimidation.”
“Many of us think Tom Williams is TheMadhatter who used to sell prepaid credit cards bought in Canada,” another said. Mr. Owen may well be TheMadhatter, he added.
On IRC, Mr. Williams denied that he was TheMadhatter or Dalin Owen. He also denied Betabeat an interview. “I’m not interested in the press. No offense implied,” he said. HackCanada has not responded to an email inquiry.
The Bitcoin community has done some impressive sleuthing on the MyBitcoin incident. But whether collaborative auditing can keep Bitcoin crime in check is hard to say. Now that MyBitcoin is offering restitution, Bitcoiners are less vocal about their accusations. There also hasn’t been much progress on another open investigation: the Polish Bitcoin exchange that shut down around the same time as MyBitcoin, claiming to have accidentally deleted users’ 17,000 Bitcoins and declaring itself up for sale for that amount before resuming trading shortly thereafter.