4 ms·

> You're asking people to prove a negative[1]. It's a common logical fallacy. No, he's asking for proof that there has been a non-internal Bitcoin hack. That'

> You're asking people to prove a negative[1]. It's a common logical fallacy. No, he's asking for proof that there has been a non-internal Bitcoin hack. That's a simple existence proof. If he were asking one to prove a negative, he'd have to ask something like "prove that there have been no internal Bitcoin hacks" (which is likely easily refuted but beside the point). (He may be implicitly claiming a negative proof, by implying that there isn't any evidence that these are non-internal hacks, and therefore they must be inside jobs. But that's merely asking others to disprove a negative, which is trivial with evidence.)

FatalLogic 11y ago
>he's asking for proof that there has been a non-internal Bitcoin hack. That's a simple existence proof. In reality it's not simple. How would you prove it? However you define this, a very serious problem with the OPs request for proof is the pseudonymous nature of Bitcoin, combined with the difficulty of definitively connecting a real life identity to an online action. The Cryptsy 'hack' is a neat example of this. The money was moved once, 18 months ago, and for observers, that transfer of money did not appear suspicious at the time. It looked just the same as an internal movement of funds for security or accounting purposes. The money even remains where it was moved. But now Cryptsy's owner has announced that the money was not moved by him. How can we prove or disprove his claim? We can say that he dishonestly hid the theft, but it seems impossible to prove that he stole it. Even if his ISP is ordered by a court to release logs that show his home IP address did the theft, he could claim that his computer was hacked. But for someone doing an inside job, anyway there are so many ways to hide their identity and IP address. Edit: So, should anyone offer evidence of a non-internal Bitcoin hack, the OP can simply make these arguments, to plausibly suggest that it may really have been an internal hack, disguised as an external hack
- jacquesm 11y ago
  Such deception is not that easy, to do this consistently after the fact is going to be an extremely dangerous thing to pull off. You not only will be facing a charge for the initial theft but another one for obstruction of justice and tampering with evidence and possibly a whole pile of others. Personally I'd be already more inclined to believe it was an outsider if they filed this breach with the authorities and if they turned over all their evidence. You'd have to be fairly cocky to do that if you were the one that made off with the loot (not that it wouldn't happen, but it would happen a lot less frequently).
  - FatalLogic 11y ago
    Yes, to create a convincing fake hack is not simple. In common crimes, managing a complex fake story is dangerous. The criminal can be revealed because they can't keep every detail consistent. They get tangled up in their own lies. But in the cryptocurrency space, judicial authorities lack expertise, geographic jurisdiction can be unclear, and invesigators may not be able to unearth the truth. The Bitcoinica thefts are an example of that, Mt Gox may be another. Every time, it would be easy to prove negligence, but definite proof of criminality is hard. It is true that if Cryptsy had reported the crime at the time, the story would have been more plausible, but even then there still would have been much doubt and a genuine possibility that it was fraud. At least the possible evidence, logs and whatnot, would have been fresh.
    - jacquesm 11y ago
      > It is true that if Cryptsy had reported the crime at the time, the story would have been more plausible To me this is an extremely important aspect and it moves the needle from 'could be fraud' to 'definitely fraud'. Nobody taking a hit like that would try to hide it from both their end users and the authorities if they weren't involved, no possible gain could come from trying to cover this up other than to see if they could do it again. Covering up a breach of this magnitude (which is simply the end for the company, assuming the funds won't be recovered, and which should be the end of the company even if the funds are recovered) is a much higher risk than being frank about it for the simple reason that the trail will be cold by the time the truth eventually comes out.
      - FatalLogic 11y ago
        > no possible gain could come from trying to cover this up Unfortunately, there is a possible gain, at least from the viewpoint of the owner: Simply keeping the business, and his normal life, running --- presumably hoping that a magical solution will appear from the clouds. (or to be try to be more charitable to him, maybe he hoped for a foolish new investor, or a dramatic change in bitcoin price) If that's what happened, it was irresponsible, very stupid, and certainly fraudulent, but many people have done similarly stupid things in similar situations. No matter what happened, that ridiculously long delay in reporting the theft is a most serious red flag, like you said.
jacquesm 11y ago
"Blame the Hacker" is a tried and true way of deflecting attention from internal issues to the outside. It's akin to claiming an act of god in old times, as soon as you cross that line you're supposedly in the clear because, after all, it wasn't you that was the problem. I suspect several of the higher profile data leaks and acts of vandalism that were blamed on outsiders but where subsequent follow up was never shown to actually prove that this was the case were in fact inside jobs, especially in those cases where the company did not file the issue with the authorities. I think that if a company claims 'a hacker did this' that they should provide conclusive evidence and absent that we should simply assume that it really was an inside job.

FatalLogic 11y ago

>he's asking for proof that there has been a non-internal Bitcoin hack. That's a simple existence proof. In reality it's not simple. How would you prove it? However you define this, a very serious problem with the OPs request for proof is the pseudonymous nature of Bitcoin, combined with the difficulty of definitively connecting a real life identity to an online action. The Cryptsy 'hack' is a neat example of this. The money was moved once, 18 months ago, and for observers, that transfer of money did not appear suspicious at the time. It looked just the same as an internal movement of funds for security or accounting purposes. The money even remains where it was moved. But now Cryptsy's owner has announced that the money was not moved by him. How can we prove or disprove his claim? We can say that he dishonestly hid the theft, but it seems impossible to prove that he stole it. Even if his ISP is ordered by a court to release logs that show his home IP address did the theft, he could claim that his computer was hacked. But for someone doing an inside job, anyway there are so many ways to hide their identity and IP address. Edit: So, should anyone offer evidence of a non-internal Bitcoin hack, the OP can simply make these arguments, to plausibly suggest that it may really have been an internal hack, disguised as an external hack

jacquesm 11y ago
Such deception is not that easy, to do this consistently after the fact is going to be an extremely dangerous thing to pull off. You not only will be facing a charge for the initial theft but another one for obstruction of justice and tampering with evidence and possibly a whole pile of others. Personally I'd be already more inclined to believe it was an outsider if they filed this breach with the authorities and if they turned over all their evidence. You'd have to be fairly cocky to do that if you were the one that made off with the loot (not that it wouldn't happen, but it would happen a lot less frequently).
- FatalLogic 11y ago
  Yes, to create a convincing fake hack is not simple. In common crimes, managing a complex fake story is dangerous. The criminal can be revealed because they can't keep every detail consistent. They get tangled up in their own lies. But in the cryptocurrency space, judicial authorities lack expertise, geographic jurisdiction can be unclear, and invesigators may not be able to unearth the truth. The Bitcoinica thefts are an example of that, Mt Gox may be another. Every time, it would be easy to prove negligence, but definite proof of criminality is hard. It is true that if Cryptsy had reported the crime at the time, the story would have been more plausible, but even then there still would have been much doubt and a genuine possibility that it was fraud. At least the possible evidence, logs and whatnot, would have been fresh.
  - jacquesm 11y ago
    > It is true that if Cryptsy had reported the crime at the time, the story would have been more plausible To me this is an extremely important aspect and it moves the needle from 'could be fraud' to 'definitely fraud'. Nobody taking a hit like that would try to hide it from both their end users and the authorities if they weren't involved, no possible gain could come from trying to cover this up other than to see if they could do it again. Covering up a breach of this magnitude (which is simply the end for the company, assuming the funds won't be recovered, and which should be the end of the company even if the funds are recovered) is a much higher risk than being frank about it for the simple reason that the trail will be cold by the time the truth eventually comes out.
    - FatalLogic 11y ago
      > no possible gain could come from trying to cover this up Unfortunately, there is a possible gain, at least from the viewpoint of the owner: Simply keeping the business, and his normal life, running --- presumably hoping that a magical solution will appear from the clouds. (or to be try to be more charitable to him, maybe he hoped for a foolish new investor, or a dramatic change in bitcoin price) If that's what happened, it was irresponsible, very stupid, and certainly fraudulent, but many people have done similarly stupid things in similar situations. No matter what happened, that ridiculously long delay in reporting the theft is a most serious red flag, like you said.

jacquesm 11y ago

"Blame the Hacker" is a tried and true way of deflecting attention from internal issues to the outside. It's akin to claiming an act of god in old times, as soon as you cross that line you're supposedly in the clear because, after all, it wasn't you that was the problem. I suspect several of the higher profile data leaks and acts of vandalism that were blamed on outsiders but where subsequent follow up was never shown to actually prove that this was the case were in fact inside jobs, especially in those cases where the company did not file the issue with the authorities. I think that if a company claims 'a hacker did this' that they should provide conclusive evidence and absent that we should simply assume that it really was an inside job.