Well just an FYI i am still loged in on my Ipad (not on computer) and can check my account balances/etc and shocker they didn't mess with my account address or payout , but i always have payout set at .001.. and i don't mine here anymore.. guess that helped a bit too

But i do hope you guys come back up.. competition is always a good thing.


Icon

yeah i didnt know because i have the coin balances page favorated and its only on the homepage

There is one thing that worries me seriously.   
The hack job was not a simple SQL insertion or whatever.
My auto-payout was switched off (never used it) -- I lost a balance of BTC 0.36 (ouch!).
What I noticed after the hack, was that the booking was a regular one, with the AT_DEBIT code and including the BTC 0.0001 fee.
The charge of the fee means that the hacker launched existing scripts, or stored procedures, to perform the transactions. And never mind passwords or PINs, his level of control was too high for that.
Also note the bookings were done in a short amount of time (thus automated). And at a moment everybody was busy with Christmas shopping to minimize the chance of getting caught.
The hacker certainly took his time to prepare all of this and has gain top-level access to the system.
I would suggest that aTriz and nearmiss study very closely what happened, and make sure the hacker lost his control.
Imagine him having access all over Christmas time and work on backdoors... horrible idea.

It was mentioned a few pages back that before the lockdown addresses were reverting to the attacker's address even after manually changing it. I have no idea about the veracity of that claim.

Cant register on the site either.

Possible... Probably behind the Dogecoin Christmas heist too: http://gizmodo.com/millions-of-meme-based-dogecoins-stolen-on-christmas-da-1489819762

It's the easiest most common attack vector.  99.9% of all attacks these days are SQL injection and/or XSS.  Zero day remote code execution (buffer overflows and the like) wouldn't be used for something like this.

https://blockchain.info/address/13R87ropkDKzDEuVeQoX64kkcLvPWVdTKH

Current balance is  40.78672487 BTC and every transaction for the address (755) was the 24th Dec by the looks of it.

lol last on the internet to know.

I agree with you however if the whole database is read only why are they still encouraging us to mine? This is the bit that is worrying me and the reason I have moved my one little miner elsewhere.

On your second point, it is the front end design that allows sql injection attacks to happen, not database design. The database just does whatever it is told to do by the website or a command line interface. If this was an injection attack then it was either a coding error in the website or an out of date/misconfigured PHP installation that allowed the "hackers" to most likely dump the database and then go through the tables to identify the payout addresses and the mechanism used to initiate manual payouts. They would have done this by manipulating the address bar in a browser by adding special characters or by experimenting with special characters or buffer overflows with very long entries in text entry fields on the website. All of this would be captured in the access logs for the website unless they were able to gain shell access and modify/delete the logs.

I suspect the reason the site is still locked down is because the guys are still working out how the attack happened and the best way to prevent it from happening again.

Note that the site code doesn't look particularly professional. Should we really be able to view the password policy?

 password1: {
          minlength: 6,
          maxlength: 20,
          required: true

Hmmm, nice use of language there!!

$('#accountTab a').bind('click', function (e) {
           e.preventDefault()
       /alert('fuuuuck');

And again..

$('#statsTab a').bind('click', function (e) {
           e.preventDefault()
       /alert('fuuuuck');