MobileCoin: A New Cryptocurrency from Moxie Marlinspike
MobileCoin is backed by XLM&#x2F;Stellar, which is not decentralized, and so I feel I should note here that I signed up during Stripe&#x27;s giveaway of Stellar Lumens years ago - and I did indeed get my wallet credited.<p><a href="https:&#x2F;&#x2F;stripe.com&#x2F;blog&#x2F;stellar" rel="nofollow">https:&#x2F;&#x2F;stripe.com&#x2F;blog&#x2F;stellar</a><p>I was given 6000 XLM and I left it in their official wallet for years. On May 12th, 2017 I wrote them an email asking why my wallet, now converted to some newer official wallet, was empty. I did not receive a reply for 2 months, at which point I followed up and received a reply within a day, which was:<p><i>&quot;I have investigated your account and it looks like an account merge operation occurred some time ago merging your lumens with another account. If you did not commit this action, it could be possible that someone was able to obtain your account information.<p>You can see the merge operation here:
<a href="https:&#x2F;&#x2F;horizon.stellar.org&#x2F;accounts&#x2F;GD2CPSK2E3TUNC2N5NGGQJQYOHJNFW42YZ55MPQKPQ5BGI2ZPD72G3H3&#x2F;operations" rel="nofollow">https:&#x2F;&#x2F;horizon.stellar.org&#x2F;accounts&#x2F;GD2CPSK2E3TUNC2N5NGGQJQ...</a><p>Unfortunately there is nothing we can do to retrieve your lumens at this point.<p>Apologies we cannot be of further help.&quot;</i><p>I have pretty damn good security of my various accounts using hardware 2FA and such, and I also transact in cryptocurrency and have wallets with far more fiat value in them than 6000 XLM had at the time ($120-150 USD if I recall), with absolutely no issue - and I hadn&#x27;t even logged into their official wallet. The developers were 100% quick to blame this merge on me. I replied with a flat: &quot;I highly doubt you are correct that it is my fault&quot; email and it went back and forth with them asking the basic &quot;well, did you get spearphished somehow&quot; as if anyone even knew what XLM were or cared.<p>The process dragged on for a month while I bothered people in their Slack channel since email communication dropped out and they finally came back with:<p><i>&quot;Our team has investigated and checked for multiple different types of issues and have not found anything on our end that shows any type of security compromise in our system.<p>Unfortunately this means at this moment I do not have a concrete answer to how your account was compromised. I’ll follow up again to check if there is anything on your end they would recommend you do.&quot;</i><p>I investigated on my own and found a number of accounts who were &quot;hacked&quot; and sent XLM coins to the wallet that I had merged with, all that just kind of sat there, indicating a software error on their end of a bunch of accounts that were randomly emptied. I provided all documentation to their team and spent a solid 15-20 hours doing so.<p>Their response to all of this bug bounty-type work?<p><i>&quot;They have identified one potential issue in the past that affected only a small number of accounts, possibly yours. This bug was fixed once discovered back in 2014, but users who may have been vulnerable to the bug were still impacted during the upgrade process to the new network even after it was resolved.<p>Although we think this was the cause of what happened, we cannot be 100% sure if this was what impacted your account considering you had a strong password and none of your other accounts were compromised.&quot;</i><p>And:<p><i>&quot;Although we cannot recover you original lumens from your account, we’d like to award you 3000 lumens as part of our Bug Bounty Program because you have helped us in identifying a possible issue that happened in the past.&quot;</i><p>So they basically gave me half the XLM back instead of the full amount despite it being entirely their fault and them having no idea how to investigate while I exposed a serious flaw in how XLM were assigned and paid to their wallets, all while blaming me the entire time and with atrociously slow customer response times.<p>Forgive me if I&#x27;m not the biggest XLM&#x2F;Stellar Lumens fan; their team is both terrible at support and suggests that at least their frontline investigators are technically incompetent since they couldn&#x27;t figure out the merge situation before I did with simple API poking around and enumerating.