210
211

Shapeshift.io has been hacked (self.Bitcoin)

gol64738 が 投稿

From Shapeshift.io: Hello everyone, We wanted to provide a quick update on our status. Yesterday afternoon, we noticed several pieces of evidence indicating our server infrastructure was compromised and threatened. We made the decision to scrap that infrastructure, and rebuild in a wholly new and safe environment. This is what we are currently engaged in. While we hate having the service offline, it was the safer path. By design, ShapeShift doesn't hold customer balances, so even in the case of a security breach, there is no customer money at risk. However, a portion of our own hot wallet inventory funds were taken, but nothing that will interfere with operations once our new environment is online. This is also by design. We've built customer protection into our platform – hacks may be inevitable, but customer losses should not be. Not a cent of customer funds was lost, nor could they have been. For those few customers who had a pending order processing with us when we went offline, we'll get those funds returned to you within 24 hours. Customer support link is below. Existing in Bitcoinland is a pioneering struggle against many threats and challenges. We'll use the opportunity to build even bigger, better, and more resilient infrastructure. We've been inspired by the immense growth ShapeShift has seen over the past several months, and will get this beast back online ASAP. Kind regards, -Erik Voorhees CEO ShapeShift.io Direct link to customer support while site is down: https://shapeshift.zendesk.com/hc/en-us

全 75 件のコメント
並べ替え:
ベスト
トップ新着論争中古い順Q&A

[–]ShapeShift_io [スコア非表示]  (7子コメント)

We will continue to update the community on progress on our Reddit post and other social media channels so please feel free to connect:

Facebook: https://www.facebook.com/shapeshiftexchange

Twitter: https://twitter.com/ShapeShift_io

Subreddit: https://www.reddit.com/r/shapeshiftio/

Public Slack: https://shapeshiftcommunity.herokuapp.com/

[–]billykeed [スコア非表示]  (1子コメント)

great service. come back stronger.

[–]ShapeShift_io [スコア非表示]  (0子コメント)

Thanks! We are working on doing just that!

[–]AnalyzerX7 [スコア非表示]  (0子コメント)

Good guy Shapeshift with the customer updates and accountability +1

[–]BrainDamageLDN [スコア非表示]  (1子コメント)

No centralised system is impenetrable and these guys do a great job. Well played lads. Wishing you a speedy recovery.

[–]benperrin117 [スコア非表示]  (0子コメント)

Eric and Shapeshift are a model that everyone in the industry should continue to look up to. Stellar service, great interaction with the community, and a solid commitment to grow & better themselves along with everyone else in the ecosystem. Digital high fives all around.

[–]PixelPhobiac [スコア非表示]  (3子コメント)

Shapeshift is a great service. Really the last company to deserve this. Hope to see you back soon!

[–]Dude-Lebowski [スコア非表示]  (2子コメント)

You will. Shapeshift is a cash cow. They need to get it back online ASAP to keep making money.

[–]Bit_to_the_future [スコア非表示]  (1子コメント)

Damn that was spitefull

[–]Dude-Lebowski [スコア非表示]  (0子コメント)

Not meant to be. the "You will" was directed to the "Hope to see you back soon" :)

[–]Zaromet [スコア非表示]  (4子コメント)

Remember: "MtGox where is my money?"

Than next one: "BitStamp where... oh never mind..."

Now: "S.... oh never mind"

Services are getting better... Hope you didn't lost to much from hot wallet.

[–]evoorhees [スコア非表示]  (2子コメント)

The free market at work, it's a beautiful thing to watch the industry develop.

[–]xiphy [スコア非表示]  (1子コメント)

I don't see any trusted fiat-btc exchange with proof of funds yet

[–]gol64738[S] [スコア非表示]  (1子コメント)

I want to give special thanks to the shapeshift team on being very open and public facing with this issue.

[–]chrisguida [スコア非表示]  (0子コメント)

Setting the example for how these things should be handled. Bravo, ShapeShift!

[–]BIGbtc_Integration [スコア非表示]  (0子コメント)

Good luck -- Great effort and products from Shapeshift!

[–]camraid [スコア非表示]  (0子コメント)

Legend.

[–]ozme [スコア非表示]  (0子コメント)

Do you plan on publishing a post-mortem? I believe this would be helpful for other services and the community at large. Great work with the site.

[–]parabolik [スコア非表示]  (0子コメント)

Any idea how they broke in?

[–]TotesMessenger [スコア非表示]  (0子コメント)

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)

[–]ivanraszl [スコア非表示]  (0子コメント)

How much was taken from you guys? ] Good work on rewriting the platform.

[–]amorpisseur [スコア非表示]  (0子コメント)

We made the decision to scrap that infrastructure, and rebuild in a wholly new and safe environment.

Way to go. Automate all the things for next time to be back in 5 mins ;)

[–]pizza_brb [スコア非表示]  (0子コメント)

I had 2 transactions fail due to my mistake and they were refunded in less then 8 hours from emailing them. Shapeshift is great

[–]platinum_rhodium [スコア非表示]  (0子コメント)

This is how you do bitcoin.

[–]Dude-Lebowski [スコア非表示]  (0子コメント)

Erik and team rock!

[–]d4d5c4e5 [スコア非表示]  (4子コメント)

Is there any privacy-leaking information that may have been compromised, such as linking addresses across different coins and/or ip's?

[–]evoorhees [スコア非表示]  (1子コメント)

Our DB's were not compromised, however remember that every transaction on ShapeShift is transparent, shown on the home page.

[–]Petebit [スコア非表示]  (0子コメント)

Is the long term solution getting rid of servers and central points of weakness, maybe safe network when it's launched would be the ultimate. You already trade their proxy token :) hope you guys get back up soon anyway.

[–]Dude-Lebowski [スコア非表示]  (1子コメント)

Good question for /u/ShapeShift_io and /u/evoorhees. Linking them here so they see it.

[–]gidze [スコア非表示]  (0子コメント)

We have been using ShapeShift over a year in Coinomi wallet. One of the best services in the crypto land and our users love it. Wish luck to the team.

[–]mkobaredditor for 17 days [スコア非表示]  (0子コメント)

I've never had anything but good experiences with ShapeShift. Emily is the most awesome customer service agent ever. Wishing you good luck and a speedy recovery.

[–]Illesac [スコア非表示]  (9子コメント)

I don't know how anyone feels safe keeping anything on an exchange.

[–]ShapeShift_io [スコア非表示]  (7子コメント)

We don't hold your funds so there is no custodianship of bitcoin or altcoins with ShapeShift. We will be keeping everyone up to date as the day progresses!

[–]walden42 [スコア非表示]  (4子コメント)

As someone who hasn't used ShafeShift yet, can you explain how that coincides with "For those few customers who had a pending order processing with us when we went offline, we'll get those funds returned to you within 24 hours"? If you don't hold any funds, why do you need to return some funds? Were you holding them?

[–]evoorhees [スコア非表示]  (3子コメント)

If they hadn't confirmed, they the order hadn't processed when the site went down. Those orders get cancelled if site goes offline, so we need to return them to users. It's a handful of people.

[–]walden42 [スコア非表示]  (1子コメント)

Sorry, can you please clarify? This doesn't really answer the question. I'm not sure how it all works, so I don't understand whose money you were holding.

[–]evoorhees [スコア非表示]  (0子コメント)

Customers don't have accounts or balances with ShapeShift. Instead, like a vending machine, users can initiate single exchanges of one blockchain asset for another. The user selects which asset she wants, and then sends payment. This process takes 0-20 minutes, depending usually on the first block confirmation. The moment the payment is confirmed, the user's asset is sent to her. So, when the site goes down, any orders that were in process are cancelled, and we manually need to send the payments back to those users. The difference is that ShapeShift at any given time may have a few hundred dollars or a few thousand dollars of payments in process, which are easy to refund under any circumstance, as opposed to holding millions or tens of millions of dollars in customer account balances like a traditional exchange.

[–]rydan [スコア非表示]  (1子コメント)

You don't hold the funds but what are the safeguards that prevent those hackers from changing the addresses displayed on the website to their own?

[–]evoorhees [スコア非表示]  (0子コメント)

If there was evidence that happened which was ShapeShift's fault, ShapeShift would reimburse the amount. Any such loses would be small and manageable, and quickly discovered.

[–]repomies69 [スコア非表示]  (0子コメント)

I guess no operator of any financial service feels safe, and the reward for that missing feeling of safety compared to normal person is the profits that the business makes.

[–]Anduckk [スコア非表示]  (0子コメント)

How were you hacked?

[–]elfer90 [スコア非表示]  (0子コメント)

Big Ups to Shape Shift

[–]MinersFolly [スコア非表示]  (1子コメント)

A bit interesting that we've had the panama papers release, then a service that has a panama connection compromised.

[–]JediMasterMinchYoda [スコア非表示]  (0子コメント)

Just don't go to any company functions at Crystal Lake.

[–]aknalid [スコア非表示]  (0子コメント)

This is the proper way to handle data breaches. Take note.

[–]FUDfinder [スコア非表示]  (0子コメント)

Not great timing for the company.

They were/are in the middle of a fund raise.

Anyway, good luck and hope you find the attack vector.

[–]winlifeat [スコア非表示]  (0子コメント)

How much was lost?

[–]theswapman [スコア非表示]  (0子コメント)

"a portion" of your funds? How many coins did you lose? Just fess up.

[–]elux [スコア非表示]  (0子コメント)

our server infrastructure was compromised and threatened. We made the decision to scrap that infrastructure

Agh! Hackers! Cut the phoneline. Light the building on fire.

[–]metamirror [スコア非表示]  (5子コメント)

Has user data been compromised?

[–]super3 [スコア非表示]  (4子コメント)

What user data?

[–]ebaley [スコア非表示]  (3子コメント)

IP and crypto adresses presumably he means.

[–]db2 [スコア非表示]  (2子コメント)

Stuff that isn't secret to begin with.

[–]ebaley [スコア非表示]  (1子コメント)

If you someone can link IP addresses to crypto addresses...

[–]one_line_commenter [スコア非表示]  (0子コメント)

If people worried about that they should have used TOR.

[–]Beer-Warrior [スコア非表示]  (2子コメント)

Exit scam in 3...2...1...

[–]evoorhees [スコア非表示]  (1子コメント)

ShapeShift can't "exit scam." It doesn't hold any customer money.