cold wallet needs at least two people to make withdrawals from it though right? how did the hacker get those keys besides how did he hack the btc wallet itself ?or am i missing something here? i already pointed this out to them in their chat box that any claims that any coins are missing is a bare faced lie and their admins says no coins missing just withdrawal process messed up . so everyone that works at cryptsy is a criminal. and must be dealt with appropriatly.

yes they already made a statement long ago about how they can add any coins they feel like adding . so even if anything was stolen what has that got to do with anyones funds? it is the companies problem and responsibility . has of now we practically own that company all depositors . and why didn't he report the theft in the first place .i think this man is insane look at the stupid pathetic lie he expects us to believe.

I wholeheartedly disagree. If they're smart, they just sat and watched Paul and Mullick's workflow and learned how they fill hot wallets with cold wallet funds, manage the servers, and isolate wallets from each other (if they do/did). If they saw an way to get access to the cold wallets, either by moving horizontally within the Cryptsy internal network to some server that controlled cold wallet funds, or by setting up a trojan for Paul to download from the servers and use it to steal cold wallet keys from his computer, than that payoff would obviously be much better than stealing a hot wallet. If we are to believe they have monitoring set up to make sure the funds don't suddenly disappear, which I think is reasonable even for Cryptsy, and the thief saw evidence of that, then they'd know to go for the jackpot (cold wallet) instead of stealing 133 BTC and immediately setting off alarms, shutting off further access.

Here's another idea, by the way. They obviously have to have another wallet set up on (presumably) another computer to send the cold wallet funds. What if Paul downloaded the Lucky7Coin wallet there, either for personal use or for making a cold wallet for it? That's a MUCH easier and more likely way to pwn their cold wallets than moving horizontally within the network or dropping another payload for Paul to download and then break in.

Respect your opinion, but why didn't the retard spend a single satoshi in a year and half after going through all the trouble of stealing the coins in the first place?

Here's a theory: The thief is none other than Chen Jianhai and he plans on returning the coins any minute now. Also, check out this short video: https://www.youtube.com/watch?v=LlJkec-CQRM

Here's how it'll play out: https://bt.irlbtc.com/view/95795.0

is that his real picture? got more info on him ? post it for us we need real names and addresses

Well, to date nary a crypto-theme periodical has taken a few minutes to connect the dots like I have in what amounted to less than a minute of research on my part (took longer to pen it) to further prove that Paul Vernon is a Goddamn motherfuckin' serial liar just like Leroy Fodor and Marshall Long and John Fitzpatrick and Craig Wright.

For the backdoor to work it needs to be able to connect to the perp's server. If Vern - or whoever handled the cold wallet - would only sign TX on the unconnected cold wallet computer and then broadcast it from another machine then there would be no chance for a remote attack. Although a sufficiently sophisticated trojan could probably inject something in the TX being signed but that's incredibly unlikely and you have to be a total donkey to not double check if you're sending 13k to the correct address. Once you connect the "cold" wallet to the net though - it's not cold anymore.

Even the most basic privilege separation (i.e. not running multiple wallets as root on the same instance) and network filtering would have made it so much more complicated for the attacker. Doesn't look like that was the case here. Multiple major security blunders were needed for this to happen.

That's assuming the Cryptsy blog post was at least partially true. It's still quite likely that it's just a smoke screen. We haven't seen any post mortem analysis of the breach or anything like that.

Those are not options.. They are Step 1, Step 2, Step3...

15jYgRVym33hQyHBXiq1sjFdQLgLaU4udZ ty

oh shit fuck them ,
20 ltc lost and about 2 BTC . 
i need my money back fucktsy