The latest incarnation of the Silk Road underground market says it lost all of its Bitcoin reserves (estimated to be worth two to three million dollars) in a fraud attack.
A site administrator said on Wednesday that a group of hackers appear to have exploited the Bitcoin "transaction malleability" loophole to withdraw funds from the site just as admins were conducting maintenance work that required funds to be placed in a vulnerable location.
The result, according to administrator "Defcon" was the complete loss of all Bitcoin funds the site had in its escrow holdings.
"This attack hit us at the worst possible time. We were planning on re-launching the new auto-finalize and Dispute Center this past weekend, and our projections of order finalization volume indicated that we would need the community's full balance in hot storage," Defcon said in announcing the attack.
The administrators believe that the attackers were able to exploit a transaction malleability flaw similar to those spotted in the MtGox exchange. Such errors allow attackers to manipulate hash information and spoof transactions before they are processed by the vendor. In the case of Silk Road redux, the administrators say that the attackers performed such operations many times over until all funds it controlled were drained.
Despite the headlines and attention afforded to the transaction malleability flaw, the condition has been known about since 2011, and experts say that sites and exchanges using best practices could eliminate the vulnerability from their bitcoin services.
"I have failed you as a leader, and am completely devastated by today's discoveries. I should have taken MtGox and Bitstamp's lead and disabled withdrawals as soon as the malleability issue was reported," Defcon said.
"I was slow to respond and too skeptical of the possible issue at hand. It is a crushing blow."
The admin also posted a series of accounts believed to have been used by an individual or individuals involved in the attack. The majority of the funds, says Defcon, went to an individual in France, while two others in Australia are also believed to be involved. The admin has asked users to contribute any information they may have which could lead to the recovery of the funds.
The theft is the latest misfortune to strike the Silk Road family of underground market sites. Once seen as a haven for users to anonymously trade in information and goods (okay, drugs) the original Silk Road was dismantled last year and its creator, and a San Francisco man who went by the alias Dread Pirate Roberts now faces a lengthy stretch in federal prison.
Subsequent efforts to re-launch successors to Silk Road have similarly been met with police takedowns and arrests, though that has not prevented the establishment of a number of other smaller anonymous markets. ®