A good majority of this could have been avoided.

Exchange owners need to quit relying on their databases and start using the wallets features to their advantage.

Trader creates an account on the website: web server either assigns them a unique customer id number or uses their email address or other unique identifier, calls getaccountaddress "userid" and tells the customer to send to that address to fund their account.

Trader receives coins to fund their account: web server isn't involved.

Trader is shown their current balance: getbalance "userid" 6 to get their 'confirmed' balance, and subtracts it from getbalance "userid" 0 to get their 'unconfirmed' balance.

Show the trader a list of transactions: listtransactions "userid"

Trader sends coins to another bitcoin address: sendfrom "userid" <address> <amount> - This prevents the server wallet balance from getting drained by an individual user, ask Cryptsy or Coinex about that one.

Trader transfers coins to another trader: move "userid1" "userid2" <amount>

Trader is charged a fee for use of the service: move "userid" "FEES" <amount> (using special accounts like "FEES" can make your application's logic much simpler)

This way when your database takes a shit but you still have the wallet you will be able to correlate user account names and their account balances.

I've seen it happen several times and I have seen the damage from sending funds from the server wallet using "sendtoaddress" AKA sending from their main wallet instead of using "sendfrom" which will only allow people/users to move/withdraw available funds.

Using "sendtoaddress" is what caused a lot of exchanges to get their entire server wallet drained, when if they would have used "sendfrom" the most that could ever be sent/withdrawn from a user account is what was actually in their account.

This would be helpful in this situation because even if you didn't know the trades that occurred you would know that all the users balances are correct.

The data is in the process of being transferred to the new server... 160gb... may take some time

I have a suggestion for the future. Kind of a rough patch for last-case backup of account data. Why not allow users to export a copy of their personal ledgers, GPG-signed by Atomic Trade. Most people wouldn't bother, but folks with larger balances might. Then we have the comfort of holding some tangible proof of AT's obligations to depositors.

That said, anything that encourages people to be lazy and not withdraw balances from the account is potentially dangerous. No matter how trustworthy the operator, there is *always* a possibility for data loss. I just don't think it is possible to protect fully against damage from possible wallet loss or theft. Any representation to the contrary is irresponsible.

Maybe it's time to go a step further, and actively encourage fund withdrawals. Say, for any balance over some de minimis amount, the site would charge "interest" on deposits (except for deposits that are subject to an open order). Ouch, I know. But it would sure get people to w/d their funds in a timely fashion.

I'm sure M$ has there ass covered but first thing tomorrow the dogs will be on it anyway as it is due diligence on my part to pursue them.