4 ms·

Bitfinex used to keep BTC in cold storage, but replaced that system with segregated multi-sig (2 of 3) wallets for each user account, backed by BitGo. In that s

Bitfinex used to keep BTC in cold storage, but replaced that system with segregated multi-sig (2 of 3) wallets for each user account, backed by BitGo. In that scenario BitGo held one key, and Bitfinex held 2 keys for each account (one online and one offline). Supposedly BitGo should have enforced some limits on withdrawals to prevent such events, but for some reason that was bypassed.

chollida1 10y ago
Sure, I think I understand that, and I appreciate your answer. My question is why do you need any bitcoins at all in hot storage? What's wrong with netting until the end of the day and then put the required amount of coins in a hot wallet to do settlement say 24 hours after a trade? Wouldn't this cooling off period give software and risk managers a chance to find invalid transactions and keep funds from being stolen out of a hot wallet?
- zekevermillion 10y ago
  Bitfinex was required by US regulators to switch from cold storage to segregated per-user wallets. Something to do with margin requirements for commodities exchanges.
  - jessaustin 10y ago
    Can you link to more detail about this? This doesn't seem like a requirement that would be enforced for other "commodities" exchanges? Also, it doesn't seem impossible to set up "per-user" cold storage?
  - mrb 10y ago
    Correct. Here is the source: "CFTC Regulation Prevented Bitfinex From Using Cold Storage" http://imgur.com/O46UNix http://imgur.com/O46UNix
    - onestone 10y ago
      Actually it is incorrect. Source - Zane Tackett (Director of Community and Product Development at Bitfinex): https://np.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfinex_down_due_to_bitcoin_security_breach/d62v468 https://np.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfi...
      - zekevermillion 10y ago
        I think you are probably right, the CFTC is not going to mandate a specific technical approach. Still, an exchange could very well make a poor choice in an attempt to comply with regs whose intent is focused on something very different from the risks of wallet theft.
  - paavokoya 10y ago
    This reminds me of when Mt. Gox was hacked and it was later found out that US Homeland Security officers (who were undercover) stole coins and laundered them through another exchange. Seems like someone in the CFTC wanted some coins for themselves..
- onestone 10y ago
  > My question is why do you need any bitcoins at all in hot storage? In the Bitfinex case essentially all bitcoins were in hot storage. Why they switched to that system I don't know. Perhaps they were convinced by BitGo marketing brochures that this would be more secure. Or, they were forced to do that by regulators. In the general (not Bitfinex) case, you need hot storage in order to process withdrawals quickly. No one is going to use a cryptocurrency exchange which makes you wait 24h to withdraw, this is unacceptable in such dynamic markets.
- rabbyte 10y ago
  You're making too much sense to work in cryptocurrency.

chollida1 10y ago

Sure, I think I understand that, and I appreciate your answer. My question is why do you need any bitcoins at all in hot storage? What's wrong with netting until the end of the day and then put the required amount of coins in a hot wallet to do settlement say 24 hours after a trade? Wouldn't this cooling off period give software and risk managers a chance to find invalid transactions and keep funds from being stolen out of a hot wallet?

zekevermillion 10y ago
Bitfinex was required by US regulators to switch from cold storage to segregated per-user wallets. Something to do with margin requirements for commodities exchanges.
- jessaustin 10y ago
  Can you link to more detail about this? This doesn't seem like a requirement that would be enforced for other "commodities" exchanges? Also, it doesn't seem impossible to set up "per-user" cold storage?
- mrb 10y ago
  Correct. Here is the source: "CFTC Regulation Prevented Bitfinex From Using Cold Storage" http://imgur.com/O46UNix http://imgur.com/O46UNix
  - onestone 10y ago
    Actually it is incorrect. Source - Zane Tackett (Director of Community and Product Development at Bitfinex): https://np.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfinex_down_due_to_bitcoin_security_breach/d62v468 https://np.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfi...
    - zekevermillion 10y ago
      I think you are probably right, the CFTC is not going to mandate a specific technical approach. Still, an exchange could very well make a poor choice in an attempt to comply with regs whose intent is focused on something very different from the risks of wallet theft.
- paavokoya 10y ago
  This reminds me of when Mt. Gox was hacked and it was later found out that US Homeland Security officers (who were undercover) stole coins and laundered them through another exchange. Seems like someone in the CFTC wanted some coins for themselves..
onestone 10y ago
> My question is why do you need any bitcoins at all in hot storage? In the Bitfinex case essentially all bitcoins were in hot storage. Why they switched to that system I don't know. Perhaps they were convinced by BitGo marketing brochures that this would be more secure. Or, they were forced to do that by regulators. In the general (not Bitfinex) case, you need hot storage in order to process withdrawals quickly. No one is going to use a cryptocurrency exchange which makes you wait 24h to withdraw, this is unacceptable in such dynamic markets.
rabbyte 10y ago
You're making too much sense to work in cryptocurrency.