Art By: Jing Jin
Back in September, we reported on a blackmailer/hacker who had been DDOS attacking the popular bitcoin sports book Nitrogensports.eu and then blackmailing them into paying a ransom for it to stop.
Today, we have been informed by Bitalo.com, a “multi-signature wallet and decentralized exchange” with that they are the latest victim of attacks by the same hacker. The site was offline for two days before coming back online shortly before publishing. Bitalo.com's owners have informed us that rather than give into the hacker's demands, they will be putting up a bounty on the hacker who goes by the pseudonym “DD4BC”. Information leading to his identity will win the bounty, worth 100 BTC.
This would make it the largest escrow-powered Bitcoin bounty put on find the identity of anyone person. Roger Ver's Bounty hunters site currently lists bounties for the identity of four people, the largest of which are of the Satoshi and Roger Ver email hacker and whoever has control of the lost Mt. Gox funds. Those bounties currently sit at 37.6 and 2.1 BTC respectively. This bounty is significantly higher than both.
Bitalo.com is a German based decentralized multi-service platform that acts as more than just an exchange (also has a marketplace and airbnb funcationality) and gives users full control over their own funds via multi-signature wallets and presigned backup transactions. Because users, and not Bitalo, keep control of user's keys, user funds are completely safe under virtually any circumstance. The site came back online during the writing of this article, but the site owners are still upgrading their DDoS protection. If they site goes down again, users can still access their funds by moving them to the backup wallet they designated when they signed up for the site via a backup transaction.
We have received email messages from the alleged hacker to Bitalo, confirming that the attempt at blackmail took place. As was the case in the Nitrogenspot.eu situation, the hacker has been taking down sites and then demands a tribute to teach the site how to prevent DDoS attacks. As was in the case in those communications, DD4BC claims to perform similar attacks on other Bitcoin sites, who he (or she, or they) claim pay the ransom. It is unknown at this time if his claims are true.
The anonymity careful actors are able to obtain using the Internet and Bitcoin, combined with the relative lack of law enforcement in the Bitcoin space, has resulted in a bit of a wild west feel. That feeling is amplified with blackhat hackers attempting to appear like a whitehat hacker by claiming that their actions are actually a service to the community. Whatever argument some may make about semi-malicious hackers (or “gray hats”) improving security overall, DDoS attacks do not demonstrate any vulnerability when it comes to securing consumer funds, or anything other than the site's ability to withstand a DDoS attack. Since Bitalo was designed to keep users in control of their funds, DD4BC's contribution to the community at this point seems to be nil.
In any case, he now has at least 100 BTC hanging over his head. According to the email conversation he had with Bitalo, DD4BC is confident that his identity will not be revealed online. But 100BTC, or roughly USD $32,764 at the current exchange rate, will be a powerful motivator for any real whitehat hackers out there.
We have been told that they have filled out the proper forms to get the bounty on Roger Ver's bounty site. In the meantime, anyone with information on DD4BC's identity is encouraged to email [email protected].