Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

Openmonero : Monero | Torhoo darknet markets

From reddit

Apparently either yesterday or early today, someone was able to get into that site and stole about 55 XMR... Thats what ppl are discussing on reddit. Is this real actual shit or just bullshit on reddit?

Haveno isnt all that friendly so far with buying or selling, but openmonero seems very simple with cashapp and other payments on the site. Just kinda sucks when ya find a thread about that. And now another site to trade monero, just seems very odd how ppl are discussing a site that got broken into and then another site kinda just went on...

any input?

/u/OpenMonero

1 points

1 month ago

OpenMonero has lost 55-200 XMR yesterday and the vulnerability is not yet identified.

Login, registration and trading is disabled until I setup a new firewall. The vulnerability is probably opsec related. Anyways, I will setup a new monero node and only allow localhost (disable confirm-external-bind), but this is not bulletproof, if the hack is backend (nodejs) related. I have to release the backend code as well to allow bug-hunting races and community auditing. The good news: OpenMonero will become a community project.

3 new repositories will be released this month.

/u/ringct

2 points

1 month ago

The good news: OpenMonero will become a community project.

Should have always been in the first place. This is the signal to migrate to opensource and decentralized platforms (for the few still using your node trading site).

/u/OpenMonero

1 points

1 month ago*

decentralized platforms (multi-sig) can only protect funds that are already in escrow but it can't protect funded offers. However it can have a decentralized reputation system with a federated orderbook and client-side encryption to protect trade chat histories

/u/monero_desk_support

1 points

1 month ago

What about those who lost their XMR ? Did you generate enough profit to refund them ?
And why the wide range, you don't know exactly how many xmr the website held ?

/u/OpenMonero

1 points

1 month ago*

A wallet backup was downloaded right after the hack so I know exactly how much each user has lost, but I can't see the total amount bc the hacker has already withdrawn all funds, so I had to guess the total stolen amount based on the last monero-wallet-cli login 3 months ago

The hacker also stole my arbiter profit bc my settlement address was an internal OM address. I should have used a cold wallet to protect my profit (10 xmr)

/u/RusselAdler

1 points

1 month ago

A Classic Who-Dun-It Moment

/u/g63

1 points

1 month ago

I will say this:
Having delt with OM over past months 1) it seemed the owner/admin was honest & fair; both with funds & disputes/site scammers: Of course, this is unverifiable. 2) being active, it seem owner/adimn Did public anounce and disable immediately at first sign, and continues to provide info: we shall see?