3 ms·
The legal case about whether the insurer must pay the claim is pretty interesting. The insurer's position is that hack was pure social engineering and that no s
by dbot 11y ago
The legal case about whether the insurer must pay the claim is pretty interesting. The insurer's position is that hack was pure social engineering and that no systems were compromised - everything operated as it should.
That's correct, but the effect was the same as a system hack.
- em3rgent0rdr 11y agoSeems like someone needs to develop a "Social Engineering" insurance.
- aianus 11y agoOops, I got socially engineered and sent all my money to this Bitcoin account that totally doesn't belong to me or my brother in law wink. Please double me up, Mr. Insurer. Come on.
- eli 11y agoInsurance fraud is a crime. They already insure against technical hacks, which I would think would not be much harder to fake if you wanted to.
- aianus 11y agoCrime or no crime, if you make something profitable and easy to get away with, people will do it. For all we know, this was an instance of insurance fraud. I wouldn't touch insuring Bitcoin hot wallets with a twelve foot pole. Cold storage, maybe, but only if I had my experts set it all up and maintained control over all private keys.
- zekevermillion 11y agoBig moral hazard problem. I'm sure someone would write a policy that covers social engineering attacks (and I would say arguably the Hartford policy also should cover this loss). But the loss limit, as with the Hartford policy, would be so low compared to the risk as to render it largely useless. I mean come on, I have a higher loss limit on my freakin car insurance than BitPay has to cover their hot wallet balance. To date, as far as I am aware, insurers will only write policies to cover small losses on hot wallet balances. Most of the big exchanges and processors are probably well-capitalized enough that they could in effect self-insure against such a loss. And the larger magnitude risk of a deeper-level intrusion, or flat out physical robbery of the private key components for cold wallets, is not insurable.
- zekevermillion 11y agoThe insurer made some arguments that seem weak, for example that the policy protects against the theft of money from "inside" the building but that the stolen bitcoin was stored "on the web" and therefore not in the building and not a covered loss. This shows to me that buying insurance on bitcoin hot wallet balances is more of a marketing ploy than any substantive protection. The coverage amount is negligible, and the insurer has no intention of paying out in the most likely type of breach (social engineering attack).
- flatline 11y agoIt could very well be an exit scam - I wouldn't want to cover it as an insurer, either. "Hey, I screwed up and sent this money to the wrong party!" without any way to show that you are not in fact still in control of the money through some means. Hacking into your own system puts a much higher barrier on orchestrating such a scam.