More than 61,000 usernames, email addresses and hashed passwords used by traders on the BitCoin virtual currency exchange Mt.Gox have been stolen and uploaded to the internet.
The list has been uploaded to cyberlockers and contains a mix of salted and unsalted passwords that appear to be encrypted with the MD5 cryptographic hash function. Some users claimed to have already broken unsalted passwords.
MD5 is considered “cryptographically broken” by the US Computer Emergency Response Team.
The Mt.Gox exchange, the most popular means by which online users trade between physical currency and online currency 'BitCoin', intends to reset weaker passwords in response.
But some users have already labelled the Bitcoin exchange as “toast”.
“Leaked information includes username, email and hashed password, which does not allow anyone to get to the actual password, should it be complex enough,” wrote Mark Karpeles, the chief executive of Tibanne Co of Tokyo which operates Mt.Gox, in a blog post.
“If you used a simple password, you will not be able to login on Mt.Gox until you change your password to something more secure. If you used the same password on different places, it is recommended to change it as soon as possible.”
Users had posted links to the list on a BitCoin forum which has since been locked.
An alleged hacker had offered to sell the details on a Pastebin page claiming to have "hacked into mtgox database" and "got a huge number of logins password combos".
In another blow to Mt.Gox, the exchange was forced to rollback all trades made after $1000 worth of Bitcoins were dumped on the market using funds from a suspected hacked account.
He said the funds were dumped overnight (3am JST) from “an account with a lot of coins” that was accessed from a Hong Kong based IP address. The account had a $1000 BitCoin withdrawal limit.
“Due to the large impact this had on the Bitcoin market, we will rollback every trade which happened since the big sale, and ensure this account is secure before opening access again.”
Users set to lose out from the rollback on the blog threatened class action and dozens more have promised to cease trading over the exchange.
Copyright © SC Magazine, Australia
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.