<story><title>US Attorney Announces $3.36B Cryptocurrency Seizure in Connection with Silk Road</title><url>https://www.justice.gov/usao-sdny/pr/us-attorney-announces-historic-336-billion-cryptocurrency-seizure-and-conviction</url></story><parent_chain><item><author>miohtama</author><text>The originally hack was caused by the fact that Silk Road was running PHP on MySQL without transaction isolation. Many early crypto exchanges had similar withdrawal bugs as they were running on LAMP stacks - MySQL has been notoriosly famous for having lax transaction isolation. Sometimes you could overwithdraw just by hitting refresh fast enough in a web browser.&lt;p&gt;If you deal with money use PostgreSQL + SERIALIZABLE transaction isolation level to be sure.&lt;p&gt;More in PostgreSQL documentation &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.postgresql.org&amp;#x2F;docs&amp;#x2F;current&amp;#x2F;transaction-iso.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.postgresql.org&amp;#x2F;docs&amp;#x2F;current&amp;#x2F;transaction-iso.html&lt;/a&gt;&lt;p&gt;Also Zhong was 22 years old script kiddie when he hacked Silk Road. Any smart criminal would have left United States long time ago if you sit on the top of $3B stash.</text></item></parent_chain><comment><author>swalsh</author><text>A lot of the early Bitcoin stuff was toys which became something more than toys faster than the people running it could transform the toy infrastructure at it&amp;#x27;s core.  In most cases, they didn&amp;#x27;t have the experience necessary to make it something better.  Mt Gox was just a reused domain and was origionally an exchange for Magic the Gathering!</text></comment>
<story><title>US Attorney Announces $3.36B Cryptocurrency Seizure in Connection with Silk Road</title><url>https://www.justice.gov/usao-sdny/pr/us-attorney-announces-historic-336-billion-cryptocurrency-seizure-and-conviction</url></story><parent_chain><item><author>miohtama</author><text>The originally hack was caused by the fact that Silk Road was running PHP on MySQL without transaction isolation. Many early crypto exchanges had similar withdrawal bugs as they were running on LAMP stacks - MySQL has been notoriosly famous for having lax transaction isolation. Sometimes you could overwithdraw just by hitting refresh fast enough in a web browser.&lt;p&gt;If you deal with money use PostgreSQL + SERIALIZABLE transaction isolation level to be sure.&lt;p&gt;More in PostgreSQL documentation &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.postgresql.org&amp;#x2F;docs&amp;#x2F;current&amp;#x2F;transaction-iso.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.postgresql.org&amp;#x2F;docs&amp;#x2F;current&amp;#x2F;transaction-iso.html&lt;/a&gt;&lt;p&gt;Also Zhong was 22 years old script kiddie when he hacked Silk Road. Any smart criminal would have left United States long time ago if you sit on the top of $3B stash.</text></item></parent_chain><comment><author>xyzzy4747</author><text>As someone who very briefly poked around Silk Road at the time (just created an account), and as someone who has used PHP with the LAMP stack occasionally over the years, I am completely unsurprised. Race conditions can be pretty tricky to prevent in PHP, since the state is contained within different threads that can’t trivially communicate with each other. You need to be proficient with global state mutation such as via Redis or SQL.</text></comment>