4 ms·
Can someone who really knows this help fix my ignorance? How does someone actually steal from an exchange? As I understand most of the funds(80-90+%) are kept
by chollida1 10y ago
Can someone who really knows this help fix my ignorance?
How does someone actually steal from an exchange?
As I understand most of the funds(80-90+%) are kept in cold storage. Was the exchange not following this "best practice"? Is this not a best practice?
The way the cash equities markets work is you make a trade to buy or sell shares and they get delivered in 3 days time. Why does a bitcoin exchange need to have any bitcoins at all in a wallet accessible to any machine connected to the internet? Could they not work in a manner like this?
Why not net all trades and do settlement at the end of the day. If people want to withdraw bitcoins batch the requests up until the end of the day and then you can have a person or software review all requests before they are put into a hot wallet and sent out.
I've written my fair share of risk systems over the past 15 years. I think I understand how to manage risk, and delaying transaction settlement is considered part of risk management. You can trade as fast as you want but the actual settlement, by design, lags trading to allow for errors to be caught.
- onestone 10y agoBitfinex used to keep BTC in cold storage, but replaced that system with segregated multi-sig (2 of 3) wallets for each user account, backed by BitGo. In that scenario BitGo held one key, and Bitfinex held 2 keys for each account (one online and one offline). Supposedly BitGo should have enforced some limits on withdrawals to prevent such events, but for some reason that was bypassed.
- chollida1 10y agoSure, I think I understand that, and I appreciate your answer. My question is why do you need any bitcoins at all in hot storage? What's wrong with netting until the end of the day and then put the required amount of coins in a hot wallet to do settlement say 24 hours after a trade? Wouldn't this cooling off period give software and risk managers a chance to find invalid transactions and keep funds from being stolen out of a hot wallet?
- zekevermillion 10y agoBitfinex was required by US regulators to switch from cold storage to segregated per-user wallets. Something to do with margin requirements for commodities exchanges.
- jessaustin 10y agoCan you link to more detail about this? This doesn't seem like a requirement that would be enforced for other "commodities" exchanges? Also, it doesn't seem impossible to set up "per-user" cold storage?
- mrb 10y agoCorrect. Here is the source: "CFTC Regulation Prevented Bitfinex From Using Cold Storage" http://imgur.com/O46UNix http://imgur.com/O46UNix
- onestone 10y agoActually it is incorrect. Source - Zane Tackett (Director of Community and Product Development at Bitfinex): https://np.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfinex_down_due_to_bitcoin_security_breach/d62v468 https://np.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfi...
- zekevermillion 10y agoI think you are probably right, the CFTC is not going to mandate a specific technical approach. Still, an exchange could very well make a poor choice in an attempt to comply with regs whose intent is focused on something very different from the risks of wallet theft.
- paavokoya 10y agoThis reminds me of when Mt. Gox was hacked and it was later found out that US Homeland Security officers (who were undercover) stole coins and laundered them through another exchange. Seems like someone in the CFTC wanted some coins for themselves..