Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 18 submissions in the queue.
posted by on Monday February 20 2017, @07:55PM   Printer-friendly
from the Zerocoin-day-vulnerability dept.

The Zcoin project announced yesterday that a typo in the Zerocoin source code allowed an attacker to steal 370,000 Zerocoin, which is about $592,000 at today's price. Zerocoin, also known as Zcoin or XZC, is a cryptocurrency protocol built on top of Bitcoin that implements Zero-Knowledge proofs to guarantee complete financial privacy and anonymity. Zerocoin is the precursor of Zcash and Monero, two similar cryptocurrencies that provide extra anonymity for their users, much more than the standard Bitcoin currency can provide.

According to the Zcoin team, one extra character left inside Zerocoin's source code caused a bug that an unknown attacker discovered and used to his advantage in the last few weeks. "The bug from the typo error allowed the attacker to reuse his existing valid proofs to generate additional Zerocoin spend transactions," the Zcoin team said yesterday. This allowed the crook to initiate one transaction but receive the money multiple times over.

According to the Zcoin team, the attacker (or attackers) was very sophisticated and took great care to hide his tracks. They say the attacker created numerous accounts at Zerocoin exchanges and spread transactions across several weeks so that traders wouldn't notice the uneven transactions volume. Nonetheless, as transactions piled up, the Zcoin team saw that the two sides of their blockchain weren't adding up.

The Zcoin team says they worked with various exchanges to attempt and identify the attacker but to no avail. Out of the 370,000 Zerocoin he stole, the attacker has already sold 350,000. The Zcoin team estimates the attacker made a net profit of 410 Bitcoin ($437,000).

Source:

https://www.bleepingcomputer.com/news/security/a-source-code-typo-allowed-an-attacker-to-steal-370-000-zerocoin-592-000-/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Monday February 20 2017, @08:14PM

    by Anonymous Coward on Monday February 20 2017, @08:14PM (#469413)

    guarantee complete financial privacy and anonymity.

    So, what's the problem? Oh right, maybe that this is pretty much tailor-made for criminals in the first place. There are very good reasons why you want to track monetary transactions and very few reasons you do not. Subtracting criminal activities (includes tax evasion!!), you end up with basically no reason as to not use untraceable currency.

    And don't bring up BS reasons like

      1. my gov't doesn't allow me to donate to Wikileaks or Muslim Brotherhood (assuming it's not banned in your country as terrorist organization yet) -- tough luck?
      2. I don't want gov't to know about the dildo I purchased -- use petty cash? or you know, if that's your idea of a problem, then maybe you need to grow up?
      3. I wear my aluminum hat with, shiny side out to stop the Mind Rays! -- you have other problems?

    So, working as intended. and HAHA!

  • (Score: 1, Insightful) by Anonymous Coward on Monday February 20 2017, @09:04PM

    by Anonymous Coward on Monday February 20 2017, @09:04PM (#469437)

    Oh ye of little imagination... when I was still a teenager I thought the same thing, so much would be fixed by complete financial transparency. However, that path leads to fascism. Your shitty examples are just that, shit.

  • (Score: 1, Funny) by Anonymous Coward on Monday February 20 2017, @09:40PM

    by Anonymous Coward on Monday February 20 2017, @09:40PM (#469452)

    I don't want my wife's religious fundamentalist parents to know about the penis extender I purchased on the advice of Ethanol-Fueled, because she would be devastated if they did that weird ritual where they erase her name from the Book of Life in Heaven (see Revelation, etc) and refuse to acknowledge that she exists ever again.

    FTFY

  • (Score: 3, Interesting) by tangomargarine on Monday February 20 2017, @09:58PM

    by tangomargarine (667) on Monday February 20 2017, @09:58PM (#469458)

    And don't bring up BS reasons like
        1. my gov't doesn't allow me to donate to Wikileaks or Muslim Brotherhood (assuming it's not banned in your country as terrorist organization yet) -- tough luck?

    Anonymous Coward has decreed that authoritarianism is well and good so I guess we can all go home now.

    Subtracting criminal activities (includes tax evasion!!), you end up with basically no reason as to not use untraceable currency.

    That something is illegal does not necessarily make it immoral/unethical. If you axiomatically believe that the government can't be wrong, that isn't a problem for you, though.

    --
    "Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
    • (Score: 2) by captain normal on Monday February 20 2017, @11:54PM

      by captain normal (2205) on Monday February 20 2017, @11:54PM (#469500)

      "axiomatically" I love that word! Did you just coin that, or did it just hang your brain waiting for a good time to use it?
      Just googled it and it seems to be a real word.
      Now I'm going for "axiomagically". Expecting something to happen or come true because you heard it or saw it on the interweb and it confirms your own unfounded beliefs.
       

      --
      When life isn't going right, go left.
      • (Score: 2) by art guerrilla on Tuesday February 21 2017, @12:35AM

        by art guerrilla (3082) on Tuesday February 21 2017, @12:35AM (#469512)

        speaking of favorite new words:
        pinxterflower
        in the context of an alternate common name (which it has a bunch) for the wild azalea...
        not sure why, but it just tickled me...

  • (Score: 1) by Scruffy Beard 2 on Tuesday February 21 2017, @05:38AM

    by Scruffy Beard 2 (6030) on Tuesday February 21 2017, @05:38AM (#469586)

    Cryptocurrencies need strong anonymity because the block-chain is public.

    Without it, any recipient can trace your entire transaction history. Sometimes, as in the case of political parties, this transparency is required by law. In other cases, such as paying your landlord or barrista, you may not want them to know exactly how much money you make and where you spend it.

  • (Score: 1) by terryk30 on Tuesday February 21 2017, @03:36PM

    by terryk30 (1753) on Tuesday February 21 2017, @03:36PM (#469716)

    ...with no reason as to not use untraceable currency

    *poof*

    Ah thanks, looks like I had a bug in wetware function Parse:Simplify:CancelDoubleNegative( )