That’s how I’ve been pronouncing it all this time.
As a bitcoin enthusiast, my response to this debacle is good, it’s about bloody time, MtGox were a ridiculously unprofessional outfit that now appears to be rather sleazy as well. It’ll do wonders for Bitcoin in the long term to have them out of the game. That said I feel sorry for anyone who still has sizeable amounts of money, either fiat money or bitcoins, with MtGox. Unlikely they’ll see any of it again. Then again, no one in their right mind should store a lot of money with an exchange over a long period. You keep your money in your wallet or your bank until you want to trade it. Then you send it to the exchange, do the trade, and send the other money straight back out again.
The ‘flaw’ that MtGox purports to have found is called ‘transaction malleability’ by the boffins. It’s an irritating design flaw that cannot be easily removed, but CAN very straightforwardly be accounted for and sidestepped, and it’s inexcusable that MtGox failed to do so properly. It isn’t something that Joe Schmo sending bitcoins to his aunt Flo would need to worry about. The developers knew about it for two years, it was on the bitcoin wiki. Joe Schmo shouldn’t have to read the bitcoin wiki. Mark Karpeles, MtGox CEO, definitely SHOULD have to read it.
[… if anyone cares…]
Basically (and somewhat simplistically), when you broadcast a bitcoin transaction, it’s got a ‘from’ address, a ‘to’ address, an amount of bitcoins, and a transaction id. For example, from Joe Schmo to Flo Schmo, 3.25 BTC, transaction ID 84395673.
The important details - how much, who from, who to - cannot be altered in transit. The transaction ID can. This means two versions of the transaction will circulate. This in itself is NOT a problem. Only one of them will confirm, and once it has, the other will be rejected as invalid.
So, suppose a nefarious person wants to withdraw 5 BTC from their MtGox account to their own wallet. They do the transfer, they look at the first version of the transaction that comes out: “MtGox to E. Doer, 5BTC, ID 89247976”. They rebroadcast with a modified ID: “MtGox to E. Doer, 5BTC ID 27461120”. Either version could win the race, but only one will. The evildoer can only do the scam if the second ID wins the race. Assuming it does, the evildoer emails MtGox support, “Hey, I withdrew 5 BTC but nothing’s come up, please send me my coins”.
Here’s where it gets cretinous. MtGox helpline, or MtGox badly-programmed software or whatever, says, “Huh well we sent it out, ID 89247976, let’s have a look for it… oh, it doesn’t seem to be there. Weird. Let’s send out another transaction: MtGox to E. Doer, 5BTC, ID 92400425”
:smack: :smack: :smack:
So it’s a scam, where the person who has a legitimate request to get paid, changes the transaction ID, claims they didn’t get paid, and the IDIOT payer pays them a second time. Whereas if the idiot payer had any idea what they were doing they would NOT say “let’s look for transaction ID 8924796”, they’d say “let’s look for a transaction where we paid 5 BTC to E.Doer just now”. Or rather they’d START by asking the first question, and if the transaction didn’t come up, they’d ask the second question. This would also show that someone had changed the ID, which is not an innocent thing to do. It might not necessarily be the payee, it could be a third party wanting to cause mayhem, but at least it would highlight that somebody somewhere is being naughty.