CCEDK withdrawals impaired

[masterOfDisaster]

Taking the last exchange downfalls into consideration I wouldn’t consider it unwise to have some control over withdrawals.
It would just be nice - or should I call it necessary? - to know about it before you try to withdraw and it gets “stuck” and you wonder why that happened…

[JordanLee]

I just received this CC from Ronny Boesig:

C O N F I D E N T I A L
Dear Kiara,
We have a problem, a problem which we hope in co operation with you and perhaps some few involved Nubits members, are able to solve in a satisfactory way for you as well as the Nubits community in general in a way where no funds nor precious goodwill is lost in the process.
We ask you to please consider all of this of highest importance to keep
confidential in order to succeed for the benefit of you and the Nubits
community as well as making possible this way to have a partner like
CCEDK coming out even stronger as result as well.
Since December 14th and up untill recently with the DDOS attacks, as well as three other hacker attacks of different nature, we have experienced loss of Nubits of more than 120.000 and some additional 300 BTC and a further 3 million NuShares.
We have managed until now to recoup some of this, and since then achieved to bring back to the exchange some 40.000 Nubits of
which you have recently received some 30.000 in one request. We have due to mentioned loss of Nubits to hackers not at present time the
possibility to send you the remaining funds covering any of the other
three requests of some total 84.000 Nubits, I am very sorry to say.
With your request for pulling all Nubits for restructuring which I can fully understand as such, you have left us in a difficult situation as we had planned to bring back all lost in February and March.
Let’s make it very clear, it was our decision to not go out and say we were hacked and lost a good amount of money, as we thought this to be the best way at the time to secure the interest of CCEDK but also of Nubits community in general, as we thought something like this would create a setback in terms of the development inside Nubits.
Looking back at recent weeks, it is hard to say if it was the best possible decision or not, but we believe now that it is of the outmost importance to keep this situation out of the media and to the public in general, as it could not only force us to close our exchange as our success now and in future is to keep security issues at close arms length(we prefer to cover these losses, than to expose ourselves in the media and do our own processes against hackers), but it could also push Nubits in the wrong direction, something we wish to avoid in as many ways possible.
We wish to insure you that all funds still missing will be fully reimbursed by the end of March, and would like to send you amounts every week up untill
this time to fully cover all outstanding amounts. We are also ready to
accept this return as any normal transaction with a 2,5% interest added on any amount open from the time of you request until the time of full reimbursement.
All of above we wish for you to understand as our way of finding a solution to thi unfortunate situation, a solution which we hope at CCEDK could somehow be possible to accept. We accept that the loss is our responsibility to resolve, and ask you only for a limited amount of time to have the full amount returned to you, and in the end the Nubits community.
As I mentioned previously I am on vacation and will be back from Tuesday this coming week. I will however, be able to read any messages you leave on hipchat as they send me copy on e-mail.
I understand if you need to discuss this matter with someone inside
Nubits, but please keep it within a few people who is sure to be having
the interest to solve this matter in the interest of Nubits and
yourself, as we cannot foresee the events in future if this situation
came out in public forum whether it is Nubits or any other.
On top of our assurance of covering this outstanding within the next weeks up until end of March, we are willing to offer you our capital of some 5 million Nushares as a form of collateral which we will wish to have back again once all is settled.
We believe in Nubits and NuShares and will be here marketing and promoting NuShares worldwide now as well as in future, through our many pairs on CCEDK with both buy and sell wall on NuShares, this is of course if you will allow us this possibility by accepting our proposal to return the Nubits within a short time, and on top of this to kep this all very confidential. Sorry if I keep repeating myself, it is just so important for us, as we wish to be here also as active player in the years to come.
I will be awaiting your comments, and wish and hope for us to come to an understanding in the interest of a mutual future with both CCEDK and Nubits involved.
Yours sincerely
Ronny Boesing
CCEDK ApS

I don’t feel it is fair to users of CCEDK and NuShare holders to handle this in the way Ronny has suggested. These sorts of problems need to be discussed openly.

[tomjoad]

Let’s make it very clear, it was our decision to not go out and say we were hacked and lost a good amount of money, as we thought this to be the best way at the time to secure the interest of CCEDK but also of Nubits community in general, as we thought something like this would create a setback in terms of the development inside Nubits.

Let’s make it clear @Ronny, that at no point would the Nu team advocate for keeping your exchange’s failure silent (whether it is truly a theft, or whether an insider has stolen the funds ala Mt. Gox). The silent approach you have taken is unethical for all your customers and tremendously disappointing.

A promise to pay funds back by the end of March is meaningless without a plan on how you intend to generate those funds. Until a credible plan is presented, those funds will be considered lost forever by the Nu community.

I applaud @JordanLee for presenting this in public. Nu has suffered greatly the past few weeks from the failings of our exchange partners. Shareholders deserve to be fully-informed about these things so that we can prepare alternative courses of action.

[creon]

I made a deposit of 0.1 BTC on CCEDK at 17:07 UTC and it is not available yet and shown as 1 confirmation transaction. Better don’t send any more coins to this exchange.

Posting this publicly was the correct decision. Let’s just continue to be professional now, we’re talking about some serious amount of money.

EDIT: In particular we should collectively decide if we take their offer or which kind of counter-offer we want to make.

[tomjoad]

Let’s just continue to be professional now, we’re talking about some serious amount of money.

I agree we should remain professional. However, I have still posted a warning on Twitter, Reddit, and Facebook about depositing funds with CCEDK for the time being. We have an ethical obligation to ensure that Nu users aren’t subsidizing a fractional reserve scheme to recover the funds, which should be the assumed method CCEDK is planning until a more substantive course of action is presented.

[woolly_sammoth]

Making this public was the right move @JordanLee and well said @tomjoad.
As always, I try to find the positive in the situation. Hopefully this will throw more weight behind the motion to auction off the remaining NSR. [Passed] NSR auction motion

[woodstockmerkle]

What’s the running total of known impact to Nu at this point across the exchange hacks?

I had:

CCEDK: ~$102k

• 3 MM NSR = ~$15k
• Ktm 87k NBT = 120k

BTER: $103k

• JordanLee’s 5k NSR = $5k
• Jmiller $48k buy side
• Jmiller $50k sell side

Excoin: $66k

• KTm’s 13.5k NSR = $5k
• KTm’s 253 BTC = $61k

Total = ~$271k

… and Nu is able to hold the peg with all that damage, plus loss of value of BTC? Wow; impressive.

EDIT: including Jmiller’s BTER impact, and Jordanlee’s clarification about CCEDK

[JordanLee]

Kiara decided to withdraw all funds because we discovered CCEDK and Ronny Boesing had pushed a lot of fraudulent (duplicate) open source motion votes to the blockchain. @creon made the following post:

Error in motion counting method found

I can confirm that only the open-source motion was affected and that the duplicate motions only appeared recently and most certainly on purpose. The first block that contained a duplicate version of the open-source motion was block 223951 with 4 duplicates. The “attacker” then increased the number of duplicates in a step-wise manner to up to 13 duplicates (with few outliers): [image] You can already see that this a quite a large block generation frequency, and the person who did this must …

SUKmDo6jyZ1RzFDCFRUGV6ex86x1LgjLhG was the NuShare address used for all deposits at CCEDK from November 2 until February 16. Two of the other addresses listed as pushing fraudulent duplicate open source motion votes are certainly addresses owned by Ronny Boesing. I know this because they were addresses used to transfer undistributed NuShares to Ronny. These addresses are SRciMBmxkDaZEaaCaU49F6yTzjhXCga6Fh and SVyyqpTjSLprUBhMX3FB1XtkgqBRvgozU3.

So, Kiara and I agreed it would be prudent to withdraw all funds from CCEDK before presenting this information to maximize the chances of retrieving shareholder funds from CCEDK (we had no knowledge of the hacks CCEDK had experienced at that time). Now that we know funds can’t be withdrawn, there is no reason to withhold this any longer.

[JordanLee]

What’s the running total of known impact to Nu at this point across the exchange hacks?

I had:

CCEDK: ~$135k

• 3 MM NSR = ~$15k
• 120k NBT = 120k

BTER: $5k

• JordanLee’s 5k NSR = $5k

Excoin: $66k

• KTm’s 13.5k NSR = $5k
• KTm’s 253 BTC = $61k

Total = ~$206k

… and Nu is able to hold the peg with all that damage, plus loss of value of BTC? Wow; impressive.

This does not include funds lost that were managed by @jmiller at BTER. We know the BTC was lost and NBT withdrawal is still being promised by BTER, but it is suspicious that the coins have not been released yet.

I also don’t think that CCEDK losses are the same as the funds held by Kiara on CCEDK. We will need clarification from @KTm, but I believe based on a post a couple days ago from @KTm it is 87,000 NBT.

And yes, it is impressive that the peg has held with all these exchange defaults. If we stop using shareholder funds for liquidity operations and we move most liquidity down to tier 3 and lower (which are off exchange), we can be even more confident about the peg going forward.

[Chronos]

This is shocking. Unbelievable. My heart goes out to all who have been affected by the tragic exchange failures over the past weeks.

Ronny made the following statements less than two weeks ago.

• “All funds are safe”
• “There is a reason why we have always kept a low amount in hot wallet”
• “We caught it in time to avoid any damages”
• “I hope the hackers will find out eventually that they are trying to open the wrong gate. It’s a waste of time”

[creon]

So what happens now?

[willy]

[polemic]
tl;dr:
please accept our bribe to remain silent, or Nu could suffer
[/polemic]

also:

I’m not an expert on international insolvency laws but the term “failure to file for insolvency in due time” comes to mind reading this, which is a crime in most countries.

[crypto_coiner]

These statements are subject to each and everyone’s subjective interpretation and truth/lie detection ability.

[ronny]

1. @tomjoad You mentioned that we were acting unethically making a nice and open request to you. What is really unethical is publishing open what was confidential without asking us, if you are all that ethical, you were supposed to invite us to open public discussion in form of QA or smth.

We also have private conversations with your community, and we could also put this in public if you like, and some info that users definitely won’t like.

@Jordanlee You could have asked me to go public and make an open announcement/claim, instead you decide to act behind our back, seemingly pretty easy from someone staying anonymous and apparently for reasons like this, never did think of that, as I thought of you more as someone who wanted the best possible for Nubits community, but I am starting to think it digs deeper than that!!

Why have you not gone public with any of your negotiations and conversations with Bter or Excoin?

Now, you went all public, making worse to yourself. Perhaps you do not understand that but it influences negatively in economic way, so now we cannot promise anything about March. There is no time frame anymore.

We felt sure this was in any way better then announcing bankruptcy and shot down the exchange and then tell you to contact your lawyer if that’s what you want.

We are still going to keep our word and do our best to return any outstanding debt.

We can offer you to pay our outstanding in NSR, as is stated in letter number two you know we have the amount. And that is it. You keep develop and do what you do. And we will continue work and develop the exchange

All those losses and situation you face, only prove that NBT has a weak position and no value overall in comparison to e.g. BTC.

2. Concerning NSR blocks and me, Ronny. First of all it’s kind of irrelevant, and seems like you are trying to accuse me of smth. We have no idea what you talking about those blocks You made yourself a renovation in secret code, that was like a signal, and sure that will cause problems. That was expected.

You know more than us, how much trouble this closed NBT code caused to users, our exchange, everyone, but instead of support from your side, now we face unnecessary discussion.

You make difficulties for yourself and now you face problems more than any other crypto community.

I would like to resent these allegations against me that I should have known it was wrong to post numerous times these hash addresses. I thought in my way that if I posted numerous times, every time a new block would come one of these hashes would follow that, and had only good intention with my votes believing in this open code as essential to Nubits success. Instead you go out and accuse me of mal doing, trying to do badly.

The ones doing bad here are the ones who have lacked the knowledge to develop a wallet were such a thing could in fact happen. As I consider myself a novice in dealing with the wallet, so how is it possible that I could harm this in such a way unless the flaw I to be found within NBT itself. It seems to me that’s where you have to look for the sinner, but again it is so much easier to blame it on someone from the outside, but hey, did you forget that I am one of the people you are supposed to convince that Nubits is a great thing. I am no longer sure of this, and all my efforts in promoting Nubits you will see clearly in coming months that it will be deeply missed.

3. After your decision to bring our confidential letter out in the open, we are over the point of a soon solution and do not offer you any plan. We will have a look at consequences after your “NU discussion” for our business. If we go bankrupt, you will not get any funds back. But we will do our best to prevent this to happen in spite of your clear desire of that. CCEDK and I personally, did not get too much into your projects, but we always found them interesting. So why you did this?

4. Statements or “suggestions” not to deposit to CCEDK any coins are completely irrelevant as we do not have any problems with any other coin/currency. We have been working perfectly fine with all, still working and will keep working with them all.

So do not frighten users please, with some information you have zero knowledge about.

To conclude, we explained ourselves pretty clear in our letter number two. We have spent a lot of time and effort to find “weak” spots and we did not have enough time to find out hackers history.
We want to move on, that is why, so please stop harming us and yourself, propagandizing our problems, which are not only ours, as they are in fact big questions whose they are.

To add, as was mentioned, we can give you back a good amount of NSR right away in the value of some 11 million NSR(8 million of these bought as special deal with Nubit as future investment and other three purchased to offer liquidity for our nsr pairs) to cover the significant amount of YOUR loss. We do not feel that we can have anything Nubits related in our possession now when you face current situations, and feel no longer really any interest in promoting or marketing Nubits. I am sure there are some currencies out there with a much more different approach to what means confidentiality, finding solutions together, and supporting each other instead of backstabbing to suit own interests, whatever they may be.

You have opened the box Pandora with the permission in public to allow all confidential talks to be made public, and I do not believe this is a healthy way of running a business, but it is your choice not mine, as I have clearly stated so many places.

Best regards to all

[willy]

You make difficulties for yourself and now you face problems more than any other crypto community.

I am no longer sure of this, and all my efforts in promoting Nubits you will see clearly in coming months that it will be deeply missed.

Maybe a motion to cease operation on CCEDK would be a suitable way to determine, whether the shareholders think the same way about your exchange.

[ronny]

Why do you think we would want to keep Nubits as a traded currency on our exchange after this attack on our integrity and the exchange as a whole? CCEDK was the only exchange after months of searching for one, willing to accept adding a currency without an open source code and yes we did it also because we believed it was of interest obviously, but the breach our developer experienced directly caused due to the source code not being open clearly showed us why none of the bigger exchanges had any interest at this early stage. So if you feel like this by all means, make another of your so many votes, so you can all feel you have gotten rid of the reason for all of this mess.

[ronny]

I am not an expert in legal matters, but presenting a letter clearly stating confidential, comes to my mind as a criminal act in most countries, and accusations as you so well present them comes under another term under criminal act as well, so why not present your real name and adress here and we can take the battle all the way to court, and see who has the most to say about all of this?

[tomjoad]

What is really unethical is publishing open what was confidential without asking us, if you are all that ethical, you were supposed to invite us to open public discussion in form of QA or smth.

No, Ronny. Hiding a loss of customer funds is unethical. Jordan Lee has made the correct judgement call in sharing that email. We have a responsibility to warn all Nu users if their deposits might be used to secretly try and recoup losses. The lessons of Mt. Gox should be ingrained in all of our minds by this point. CCEDK has failed in this regard, and I don’t expect much sympathy from those users who have been impacted. It’s surprising you don’t feel the same way.

The rest of your reply is an emotional attack on NuBits filled with vague threats and references. It’s understandable you are frustrated, given that we are well aware that NuBits and NuShares have comprised 99% of CCEDK’s volume the past few months. At this point in time we are simply interested in how you plan on repaying the stolen funds. The future viability of CCEDK likely depends on your ability to make shareholders whole.

[creon]

@ronny please calm down a bit. Confidentiality of course can only legally be ensured by signing an NDA, that’s basic stuff and everyone knows that who worked for a larger company.

but the breach our developer experienced directly caused due to the source code not being open

Can you elaborate on that? Was it a wallet bug that lead to the breach or a misunderstanding of the wallet RPC functionality? In what way was the Nu source related to the breach?

As I consider myself a novice in dealing with the wallet, so how is it possible that I could harm this in such a way unless the flaw I to be found within NBT itself.

Yes I agree that you did nothing wrong with it, but from the data it is clear that you were aware of what was happening by adding multiple motions. You knew this motion would have passed without that, so why not just report this error and establish additional trust? In fact, it was those votes that encouraged @JordanLee to remove the funds from your exchange.

Statements or “suggestions” not to deposit to CCEDK any coins are completely irrelevant as we do not have any problems with any other coin/currency.

I still don’t have my 0.1 BTC on your exchange I sent 8 hour ago, showing at 1 confirmation, so that’s what I reported here.

[willy]

Where did I accuse you exactly?
I voiced my opinion, that I thought about a certain felony reading your text. I never claimed you fulfilled it.