Abstract
In this piece we examine the history of the Bitcoin forum, which Satoshi launched in November 2009 and is still around today. In particular we focus on various hacks which impacted the forum in the 2011 to 2015 period. We also focus on the forum’s finances, including donations it received of over 6,000 BTC and how these funds were spent. In early Bitcoin history, the forum was a treasure trove of comments and discussion and a hugely valuable resource. The story described in this piece can be considered somewhat similar to our article on the Bitcoin Foundation. In that the organisation was not able to sufficiently expand and improve the governance, controls, security practices and execution at a sufficient pace to keep up with Bitcoin’s rapid rise. However, all things considered the forum fared far better than the Bitcoin Foundation and those involved deserve at least a degree of praise.
Bitcoin Forum Origins
The bitcoin.org domain name was registered on 18th August 2008, the Bitcoin whitepaper was published in October 2008 and the Bitcoin network famously launched on 3rd January 2009. In addition to the above, in order to promote Bitcoin and facilitate discussion, a Bitcoin forum was required. As far as we can tell, the first Bitcoin forum was created in November 2008, hosted on Sourceforge, where the Bitcoin project code was based. The forum may have been generated automatically by Sourceforge as a result of the Bitcoin project. We do not know for sure if this forum was significantly used as a venue to discuss Bitcoin and the content appears to have been almost completely lost, apart from one original post saying “Welcome to Open Discussion”. However, it is likely this original Bitcoin forum was used to some extent, as there was a gap of a year until another forum was launched.
The original Bitcoin forum
On 22nd November 2009, Satoshi launched a new Bitcoin forum. This new forum was based at the URL forum.bitcoin.org. The bitcoin.org domain originally appears to have been owned by early Bitcoin developer Sirius (real name Martti Malmi), before being transferred over to “Cobra”. Cobra is a pseudonymous identity and the name remains active in the Bitcoin space to this day. However, the exact nature of the transition in ownership from Martti to Cobra is not entirely clear, and there may have been some interim partial owners before the transfer was complete.
At some point in 2011, the forum, complete with all the users and posts, was transferred over to a new dedicated domain, Bitcointalk.org. This new domain was registered on 24 June 2011. The domain is also owned by Cobra. “Theymos”, whose real name is Michael Marquart, quickly emerged as the lead administrator of the Bitcoin Forum. Theymos was also the lead administrator of the Bitcoin subreddit /r/bitcoin and the owner of the bitcoin.it domain for the Bitcoin Wiki. Theymos also produced Bitcoin’s first block explorer website, blockexplorer.com. During The Blocksize War Theymos became somewhat controversial for his moderation policy on some of these forums, however this piece is not about that. In this report we will cover the 2011 to 2015 period. In this earlier period, Bitcointalk was the dominant venue for discussion on Bitcoin. One could be occupied for hours trawling through thousands of fascinating posts. It is also worth noting that Theymos was very young at the time. In May 2013 Theymos mentioned that he was 21 years old, implying that he was only 19 years old in 2011, when he assumed the role of lead moderator of the forum.
Forum Hacks
The Bitcoin forum appears to have experienced several severe hacks. The most significant hacks and data breaches are described below:
September 2011
The first major hack appears to have taken place in September 2011. According to Theymos, a hacker obtained administrative access to the platform on 3rd September 2011. Then on 9th September 2011, the hacker inserted some JavaScript to the website, filling the website with images of American comedian, actor, and media personality, Bill Cosby.
It is possible the hacker may have had full database access and been able to view private messages and the hashes of user passwords. In response to this incident and to try to improve security, hosting was taken over by the CEO of the largest Bitcoin exchange at the time Mark Karpeles, CEO of MtGox. This is somewhat ironic as a few months earlier, there was a major security incident at MtGox. In response to the forum hack, a few weeks after the Cosby incident, Theymos made a post offering to pay some developers to improve the forum software. This is explained in more detail later on in this report.
October 2013
In October 2013 the forum suffered another major hack. This occurred a few hours after the FBI arrested Ross Ulbricht and shut down the darknet marketplace the Silk Road. Bitcointalk was down for around four days, from 3rd October 2013 to 7th October 2013. The attack was performed by a group calling themselves “The Hole Seekers” and there is a YouTube video which shows the result of the hack, complete with a humorous song about Bitcoin.
We have written up some of the lyrics to the song below:
Bitcoin hits new high! Before losing US$160 in value one day! Digital currency spikes at US$266, before plunging to US$105, on Wednesday. In a wild ride, possibly linked to the Euro crisis. With Europe wrecked by economic uncertainty following the banking crisis in Cyprus. There have been fears that a bubble is being created with speculators piling into digital currency. There are around 11 million Bitcoins in circulation.
At the time, Theymos explained the vulnerability which resulted in the Hole Seekers hack as follows:
After the 2011 hack of the forum, the attacker inserted some backdoors. These were removed by Mark Karpelles in his post-hack code audit, but a short time later, the attacker used the password hashes he obtained from the database in order to take control of an admin account and insert the backdoors back in.
Because the backdoors were first planted in late 2011, the database could have been secretly accessed any time since then.
Source: https://bitcointalk.org/index.php?topic=306878.msg3290091#msg3290091
Given the tension and uncertainty in the community at the time over the Silk Road shutdown and the intervention by the US authorities, some in the Bitcoin community blamed the hack on the US government. Although this may be an unlikely cause and there is no evidence of this.
December 2013
In December 2013, the Bitcointalk website appears to have been hacked again. This time an attacker was able to gain control over the website’s DNS setting and route the domain to a new IP address. On 2nd December 2013 Theymos explained the situation as follows:
8-14 hours ago, an attacker used a flaw in the forum’s AnonymousSpeech registrar to change the forum’s DNS to point to 108.162.197.161 (exact details unknown). Sirius noticed this 8 hours ago and immediately transferred bitcointalk.org to a different registrar. However, such changes take about 24 hours to propagate. Because the HTTPS protocol is pretty terrible, this alone could have allowed the attacker to intercept and modify encrypted forum transmissions, allowing them to see passwords sent during login, authentication cookies, PMs, etc. Your password only could have been intercepted if you actually entered it while the forum was affected.
Source: https://bitcointalk.org/index.php?topic=354365.msg3793661#msg3793661
May 2015
In May 2015 the forum was hacked yet again. This time the website’s security was breached, however the user experience was not interrupted. Theymos described the hack as follows:
On May 22 at 00:56 UTC, an attacker gained root access to the forum’s server. He then proceeded to try to acquire a dump of the forum’s database before I noticed this at around 1:08 and shut down the server. In the intervening time, it seems that he was able to collect some or all of the “members” table. You should assume that the following information about your account was leaked: – Email address – Password hash (see below) – Last-used IP address and registration IP address – Secret question and a basic (not brute-force-resistant) hash of your secret answer – Various settings
Source: https://bitcointalk.org/index.php?topic=1067985.msg11445725#msg11445725
As a result of the above hack, it appears as if a nefarious entity managed to get hold of the forum database and was looking to sell it on a darknet market, for a price of 1 BTC.
BitcoinTalk’s database is going for 1 BTC ($614.67 USD). The file contains 514,408 accounts, including email address, personal text number, date of birth, username, gender, website title, password and location. The passwords are encrypted. There are 469,540 passwords encrypted with the SHA-256 algorithm, plus 44,868 passwords encrypted with the SMF password encryption.
Hacked Database Sample Data
Forum Finances
Fundraising
The Bitcoin forum received donations from the community to help run and manage the forum, as well as to develop and improve the forum’s code and security. There were several benefits for the donors, which are explained on the forum’s donation page:
the vast majority of income after expenses is either saved for future expenses or reinvested into the forum or the community. Long ago, we collected donations. People who donated 10 BTC have a special “Donator” title and a green “who’s online” [colour]. People who donated 50 BTC have a special VIP status and the ability to create a custom title for themselves. Both Donators and VIPs also have access to an exclusive forum section. It may seem incredible now, but even though there are many Donators and VIPs, the total donations collected in terms of USD value at time of donation is less than $70 000!
Source: https://bitcointalk.org/donate.html
The forum’s donation page lists 38 donors who gave at least 50 BTC and 115 donors who gave at least 10 BTC. We have calculated the implied minimum from these totals is 3,050 BTC. Although the forum had collected funds in excess of this.
Forum Funds
In around late 2013, Theymos disclosed the forum had Bitcoin reserves of around 6,800 BTC. Custody was shared among several individuals, with Theymos himself holding the vast majority of the funds.
Bitcoin Forum Funds in around late 2013
| Person | Amount (BTC) | Bitcoin Address |
| John K. | 0 | 1Kf1nT7jQnFC7N3tSdgg5qKGTV4MucfpBg |
| paraipan | 250 | 1PFkqgBBrSKikyyUGDerZMfzvCNPgKrR3o |
| Garr255 | 0 | 15HpBoo2DqaeJPW28ATzZMNnUTfqZQYA9H |
| Ian Knowles (CIYAM Open) | 50 | 1BuANiueZAiNashSCfGV5Gmj9P8ReG1D8N |
| Rassah | 750 | 1HQ8WaKVRYXLBtVdMcYr5SHQ3X9BsLyxa1 |
| OgNasty | 500 | 1Eog8UqRFLufC71rBLt2nYgfUDskgxAyVF |
| Ryland R. Taylor-Almanza | 250 | 17WmKCPdbu1GRUdPRJ1wNAMEr7F5HhnUU1 |
| Theymos | 5,000 | 1M4yNbSCwSMFLF9BaLqzoo2to1WHtZrPke, et al. |
| Total | 6,800 |
Source: https://web.archive.org/web/20140329004415/https://bitcointalk.org/index.php?topic=155000.0
One of the custodians, paraipan, may have died in 2014 and therefore the forum may have lost 250 BTC of funds. Today, as at May 2023, the Bitcoin forum appears to have around 1,250 BTC of funds at two addresses:
Based on the current spot Bitcoin price of US$27,000, this Bitcoin is worth around US$34 million. As far as we can tell, this 1,250 BTC balance has remained pretty much unchanged since 2017. This is because donations may have stopped and the value of the forum’s income and expenses may be low compared to the value of reserves.
Of course the value of the donations at the time they were given was far lower than this. Most of the donations may have been given towards the end of 2011 and into 2012, after the price spike and crash in the summer of 2011. Theymos has estimated that the value of the funds when they were provided may be as low as US$70,000, which seems reasonable as the Bitcoin price in much of this period was around US$10.
In late 2017 Theymos commented on the increasing value of the forum’s reserves:
The increased-value reserve and massive 2017 income (which may well have been just a weird temporary trend) came pretty suddenly. I’m not sure yet how best to handle it. I’ve been thinking of maybe allocating some of the money toward creating a registered non-profit which would have a similar mission as the forum, but would focus more on things like free-speech legal battles and the development of true decentralized forum software. I also need to figure out ways of delegating more, since I am absolutely swamped as things are right now. Perhaps I could hire someone with a business degree or something who can act more like a proper CEO. Suggestions publicly or via PM are welcome, but please focus more on structural improvements rather than lists of things to throw money at. This has already been the case to a large extent, but especially now, the limiting factor is mostly time/people/skill/trust rather than money.
Source: https://bitcointalk.org/index.php?topic=2659454
Forum Financials
The donations were provided by the Bitcoin community. Afterall a forum to discuss Bitcoin was necessary if Bitcoin were to succeed. Theymos appeared to take his responsibility as forum administrator quite seriously and therefore he was keen to provide a high degree of transparency with regard to the finances of the forum. Indeed, in a way ultimately the forum belonged to the community and he was managing it on their behalf.
A key challenge for Theymos and the forum was responding to the forum’s security problems following the September 2011 hack mentioned above. In November 2011, Theymos posted a tender offer for developers to improve the forum. This item of expenditure, known as the “forum software project” was to be the largest expenditure item for the donated funds over the next few years.
The forum’s software has proven to be insufficient for our needs. In particular, the general architecture of the code is both insecure and difficult to modify, and the moderation facilities are limited. Therefore, the forum is accepting bids for the job of delivering software that meets the requirement. The forum has about
650 760 920 1120 1720 2267 30005500 BTC on hand at this moment, but you can bid more than that. If your bid is the best, I’ll just wait until the forum has collected the required amount of money.
Source: https://bitcointalk.org/index.php?topic=50617.0
Theymos did go to the effort of producing very basic summary financial information for the forum for each year from 2011 to 2018. We have provided all this information in the below table. It should be noted that the data excludes all gains and losses related to Bitcoin price movements, both realised and unrealised. This is pretty important as these gains and losses would have been far more significant than any other income or expenditure items. It is perhaps understandable why the financial disclosures are so limited, given that Theymos was only 19 years old when he started this volunteer task in a semi-formal manner and he only received what was at the time a few thousand dollars in donations. Theymos was paid a fee to be a forum moderator, however his role as forum adminstrator was unpaid. However, the quality of disclosure, financial reporting and governance may be inadequate considering the value of 6,800 BTC today.
Bitcoin Forum Summary Financial
Source: Theymos forum posts, BitMEX Research
Note: Excludes realised & unrealised gains and losses from Bitcoin price movements
We have also provided some basic financial charts which show the large deficits in 2014 and 2015, caused by the spend on the “forum software project”. The total spend on this software project over the entire period eventually reached US$2.7 million, almost all of which occurred in 2014 and 2015, as the below charts illustrate.
Bitcoin Forum Summary Financial (US$)
Source: Theymos forum posts, BitMEX Research
Note: Excludes realised & unrealised gains and losses from Bitcoin price movements
Bitcoin Forum New Software Project Spend (US$)
Source: Theymos forum posts, BitMEX Research
Bitcoin Forum Total Expenses (2011 to 2018 – US$)
Source: Theymos forum posts, BitMEX Research
Unhappy Donors
In around 2013, a degree of dissatisfaction was growing in the community about the state of the forum. There appeared to be no improvement in the forum and the user interface appears not to have changed or improved. Indeed, to this day the user interface appears almost exactly the same as it did in 2011. At the same time security did not appear to have improved either, with incidents still occuring. Therefore some in the community were dissatisfied, especially given the donations provided and that the value of the donated funds had increased significantly. At the end of 2013 Theymos had barely spent any of the donated Bitcoin.
In June 2013 one forum user said:
12 months ago I donated 10 BTC to you to make a new forum. You have since then collected over 6000 BTC and continue to collect on a regular basis, under the guise of “creating a new forum”, yet you have yet to create a new forum.
Source: https://bitcointalk.org/index.php?topic=236325.0;all
At the time, 6,000 BTC was worth around US$600,000. Many considered this plenty of money to pay a developer to improve the forum. Theymos defended himself as follows:
There is unfortunately no magical machine which takes money and creates excellent software or hires a team of competent people. I’m not quite sure how best to turn the money into a good software product. I originally intended to give someone a bunch of money and have them handle the whole thing. I talked with dozens of people interested in doing this, but none of them made me totally confident. A while ago I decided that I will probably never be confident in any one person/company handling the entire project because I’ve thought about it much longer than they have (2 years), and I have many details about how it should work in my mind. So I probably need to get closer to the development process. My current plan is to write some detailed up-to-date specifications and do some of the high-level architectural work (DB tables, primarily) and then lead a team to do the rest. I have a little more time now, but the forum software project is a somewhat low priority. I have several high-priority things to fix with the current software.
In response to some of the above pressure and frustration from users, Theymos appeared to begin spending the funds on developers in 2014 and 2015. As this spend occurred, in 2014, almost US$100,000 per month, others in the community, quite predictably, now complained about the high level of expenditure. Again Theymos was active and defended the spend:
If you think that $100,000 per month for 4 highly-skilled full-time developers is a completely ludicrous rate, then you don’t know anything about this business. It would be fair to argue that it’s a high rate, though I’m not even sure that this is true. You probably walk past a dozen cheaper developers every day, but their skills/experience would be very different, so it’s difficult to compare. The goal of this project is to create forum software that directly competes with stuff like phpBB and SMF. This is a massive project that will be helpful not only for bitcointalk.org or Bitcoin, but for the Web community as a whole. The expense is justified. Before I started this project, people complained constantly about the money just sitting around. Now people are complaining that I’m spending too much!? Make up your mind.
Theymos also pointed critics to the GitHub page as to where the project was worked was conducted. Jake Smith, who would shortly emerge as a prominent “large blocker” in the blocksize war and staunch critic of Theymos’ “censorship” of Bitcoin forums, them chimed in to the debate:
Okay, sure, if you are hiring super-top-of-the-line poached from Google engineers. Let’s take a look at the team of four who are getting paid $25k A MONTH, EACH to “build new forum software” (that’s three years in the works, mind you.) Let’s take a look at Theymos’ proud A-Team of coders: http://slickage.com/ Whoa, hey, what’s this? No contact info? No portfolio? Something fishy is going on. The only two links on the webpage are to a github page and a twitter profile. The twitter profile, curiously enough, only has 46 followers. For these guys to be commanding $300k/year salaries, they would have to be at the top of their field, right? Wouldn’t that come with more uh, social standing and observable networking/references? Let’s take a look at the guys behind Slickage. I found them through the github page. https://www.linkedin.com/pub/anthony-kinsey/55/141/17a – This guy’s only credentials are a bachelor’s degree and a consultant position at “eWorldES,” a Honolulu-based “enterprise solutions” firm that boasts such prestigious clients as The Honolulu Advertiser and Catholic Charities Honolulu. Remember guys, this guy gets paid $300k a year. https://github.com/FFAxKenny This guy, who is currently earning his bachelors degree at the University of Hawaii at Manoa. His personal website makes no mention of Slickage anywhere. I’m sure he writes great code for $300k a year, but I wonder why one of his most popular github repositories is of a Java implementation of the game Hangman. Next up, we have “SomeoneWeird” https://github.com/SomeoneWeird He seems to have a bit more experience and more followers on Twitter, but still, no mention of Slickage anywhere. The last guy, “WangBus” https://github.com/wangbus actually does mention Slickage on his page, but nothing stands out to me to indicate that this guy is somehow a top-coder. Also lives in Manoa, Hawaii. Are we really to believe that these four not-particularly-remarkable guys in their early twenties, one not even out of college, and only one of the four apparently even employed at “Slickage”, are each contributing enough to command a $300k/year paycheck?
Source: https://www.reddit.com/r/Bitcoin/comments/2mcdb4/thermos_is_spending_100000_worth_of_his_donated/
Theymos then responded:
Slickage was recommended by Warren Togami, who has himself done important technical work for the forum and Bitcoin Core. I trust him. After talking to James, I was satisfied that Slickage would be able to do the job. There are many software development firms. I probably could have found one that’s cheaper and better. But I don’t have time to research this (I’m a full-time college student), I don’t really know how to determine whether one firm is better than another anyway, and few trustworthy people were willing and/or able to help me find one. So I picked the first firm I found that was capable of doing the job well (after several years of looking). The main factors that convinced me that Slickage would be able to do a good job were: When I talked with him, James convinced me that he was very familiar with all of the relevant technical issues. Like myself, James wants this software to become the premier forum software on the Web. He wants to sell custom modifications and support for this software in the future. Therefore, he has a strong interest and incentive in creating something really wonderful and having it used very successfully on bitcointalk.org. Slickage was recommended by Warren, and Warren is in Hawaii and able to directly supervise them to some degree.
From the US$100,000 monthly spend in 2014 and 2015 and the price of Bitcoin at around US$200 to US$300 in the period, it is easy to see where the bulk of 6,000 BTC reserves ended up. This contract with Slickage drained the forum’s reserves to around the 1,250 BTC level it is today. By the end of 2022, around US$4.7 million had been spent on the new forum.
It does not appear as if Theymos was dishonest with the donated forum funds. As Theymos appears to honestly and openly admit in the above comment, this software spend might not have been as effective as it could have been. Theymos was still in college at the time and didn’t have experience in hiring expensive software developers. This is something even seasoned professionals fail to effectively do, especially in the cryptocurrency industry. At the same time, building new forum software like this was very ambitious and risky, it was always reasonably unlikely to succeed. As far as we can tell, the work Slickage conducted did not materially improve any aspect of the Bitcoin forum. There is also the additional problem that forum users have become accustomed to the layout and style of the existing forum over many years, if there was a switch to a new forum format, there would likley be many complaints and many unhappy users. It does not appear as if the forum’s funds obtained from donations were misappropriated or lost, it is just that the execution on the software project was not as strong as it could have been.
Conclusion
The story described in this piece can be considered somewhat similar to that of the Bitcoin Foundation. In that the organisation was a core pillar of the community, received donations in Bitcoin and as the value of the coins rapidly appreciated and the space grew, the governance and controls in place were inadequate given the value involved. On the other hand, the Bitcoin forum does appear to have been managed far better than many other organisations in the space, which often involved dishonesty and resulted in scandalous failures.
The main online venue for discussing Bitcoin appears to have shifted over the years. From the Bitcoin forum from 2010 to 2013, the subreddit from 2013 to 2017 and then finally onto Twitter. However, despite all the hiccups mentioned in this piece, the Bitcoin forum is still around and somewhat popular to this day. The forum is still vastly wealthy, in terms of Bitcoin reserves. It is quite remarkable that it survived the way it has despite the turbulence of operating in this space and the challenges of holding and managing funds. Despite his lack of experience and controversial reputation, notwithstanding whatever your view is on the blocksize war related moderation, Theymos appears to have done a somewhat reasonable job with his stewardship of the forum.
Related
The post appeared first on Blog BitMex
