10 ms·

I watched this over the weekend. As someone who has spent an absurd amount of hours following this case: it breaks new ground, has great depth, and is absolutel

I watched this over the weekend. As someone who has spent an absurd amount of hours following this case: it breaks new ground, has great depth, and is absolutely riveting. There are at least seven jaw dropping moments in it. One is explaining how Bitcoin wallets pre-cache the next 100 change addresses the wallet will use, so that if someone steals your wallet without you noticing it and continues to use it you will determinisically share the same change addresses on your next 100 transactions each, which both leaves a forensic trail and also resulted in Gox continuing to send money into accounts controlled by the attacker. Also, for bonus points: Gox allocated the new addresses as deposit addresses for new customers. So when the attacker moved stolen coins, their change appeared to be deposited on Gox into the accounts of hithertofore innocent people. (The attacker retained custody of it and Mt. Gox appears to not have swept it into e.g. offline storage, which we have fairly persuasive evidence did not really exist.) This being the Bitcoin community, what would you expect someone who suddenly has 1,000 BTC credited to their exchange account to do?

sillysaurus3 9y ago
The thing that sucks is, it was impossible to tell any of this was going on. I know people will say "Well, you should have known. The signs were all there." But there were no signs. Coinbase could be the same way right now. Any exchange could.
- nodamage 9y ago
  Is there anything stopping exchanges (or other parties) from manipulating the price of Bitcoin by having millions of bots repeatedly buy/sell coins amongst themselves? If not, is there any way of detecting whether this is or isn't happening right now?
  - iakh 9y ago
    Sure, the same as what prevents anybody from single handedly moving the price of any asset. Liquidity.
    - beagle3 9y ago
      No, there are many assets which are "cheap" to move singlehandedly, yet are not (often) moved that way because of regulation
    - ceejayoz 9y ago
      That doesn't always work. http://www.nytimes.com/2013/07/21/business/a-shuffle-of-aluminum-but-to-banks-pure-gold.html http://www.nytimes.com/2013/07/21/business/a-shuffle-of-alum... > The story of how this works begins in 27 industrial warehouses in the Detroit area where a Goldman subsidiary stores customers’ aluminum. Each day, a fleet of trucks shuffles 1,500-pound bars of the metal among the warehouses. Two or three times a day, sometimes more, the drivers make the same circuits. They load in one warehouse. They unload in another. And then they do it again.
    - nodamage 9y ago
      How sure are you about this? Karpeles has admitted at trial to running bots on Mt. Gox, and such bots are implicated in the rise of Bitcoin's price up to $1000 in 2013: https://cointelegraph.com/news/mt-gox-trial-update-karpeles-admits-willy-bot-existence https://cointelegraph.com/news/mt-gox-trial-update-karpeles-... https://cointelegraph.com/news/new-wizsec-report-points-to-definitive-insider-trading-at-mt-gox https://cointelegraph.com/news/new-wizsec-report-points-to-d... If Mt. Gox successfully manipulated the price of Bitcoin using bots how do we know other exchanges aren't doing the exact same thing right now?
- koolba 9y ago
  Isn't bitcoin in a unique position to show the balance held by the holding entity at any given time?
  - dmoy 9y ago
    Yea if you keep your own bitcoin wallet, which if it's in mtgox or a similar exchange is not the case. It'd be akin to buying up a bond fund vs. keeping a stack of treasury notes in your house. Only here the broker or whatever who is running the bond fund has only been up and running for <10 years, has basically no SEC oversight, and when your funds don't show up in the right amount of time your official method of recompense is "yea just wait awhile longer, we're going through a massive growth phase and are having difficulty dealing with the scale". Oh and in this hypothetical world, this is also the #1 broker in the world who handles >50% of all trades.
  - abecedarius 9y ago
    Yes, https://freedom-to-tinker.com/2015/10/26/provisions-how-bitcoin-exchanges-can-prove-their-solvency/ https://freedom-to-tinker.com/2015/10/26/provisions-how-bitc... (cryptocurrencies in general, I believe)
    - deleted 9y ago
      [deleted]
- patio11 9y ago
  It was not impossible to tell this was going on. https://twitter.com/patio11/status/370728763790594048 https://twitter.com/patio11/status/370728763790594048 Note the date. I only posted that after I was sure I could beat the libel suit; was pretty sure much earlier.
  - sillysaurus3 9y ago
    Then why doesn't it say "Mt. Gox is probably insolvent"? It's also not very helpful to say "Told ya so" rather than "These are the signs to look for in general."
    - patio11 9y ago
      The adjective I would have chosen was not "probably", but being any more explicit than I was might have earned me a "What did you know, when did you know it, and what was your part in this?" from either of two government agencies who could deport me by either pressing a button or failing to press a button.
      - sillysaurus3 9y ago
        Now that no one has the power to deport you, do you mind if we pose those questions? The answers would be informative for anyone who has to weigh which exchange to be using at any given time.
        jerf 9y ago
        I'm not patio11, but in all seriousness, it is true that just the inexperience and immaturity of the people building these exchanges is sufficient evidence on its own. Here's me telling someone not to build a BitCoin trading platform on September 11th, 2011: https://news.ycombinator.com/item?id=2974770 https://news.ycombinator.com/item?id=2974770 Here's how that went over the next couple of years: https://en.bitcoin.it/wiki/Bitcoinica https://en.bitcoin.it/wiki/Bitcoinica https://www.dailydot.com/business/bitcoin-exchange-bitcoinica-hack/ https://www.dailydot.com/business/bitcoin-exchange-bitcoinic... In a way, the issue here is that if you want to operate in this space, you do need to take the discussion about BitCoin being money seriously. (Even if you don't think it's "money", it's still definitely a money-like asset.)
- jdietrich 9y ago
  As far as I'm aware, all the exchanges are being run by rank amateurs with effectively zero oversight or accountability. They're reinventing the wheel and re-learning all of the painful lessons that the real banking sector took centuries to learn. From what I've seen, they're applying the "move fast and break things" attitude to other people's money. I wouldn't trust any of them to look after my pocket change. I may revise my opinion if I start seeing cryptocoin exchanges founded by people whose LinkedIn profiles include job titles like "VP for Regulatory Affairs" or "Head of Risk and Compliance". Right now, I'm mainly seeing CS grads and people who spent a couple of years on a trading desk.
  - PhasmaFelis 9y ago
    "Dunning-Krugerrands."
    - deleted 9y ago
      [deleted]
    - banku_brougham 9y ago
      this is gold
  - deleted 9y ago
    [deleted]
  - contingencies 9y ago
    First employee of a major exchange here. You were correct a few years ago, but it's not strictly true anymore. Some oversight and accountability comes from the VCs that own them and sit on the boards, some from the compliance requirements of banks they work with to obtain financial connectivity, and some from people they outsource customer onboarding to or work with for additional financial settlement options. Also, third party penetration testing should be common by now. There is also something to be said for "zero legacy infrastructure", from a security perspective.
    - xiphias 9y ago
- leot 9y ago
  When MtGox's trade delay hit 30 mins+ (April 2013), and the price was crashing, I hopped on to IRC. I went to mtgox's channel and advocated in the strongest terms that they halt trading, like any sane exchange would do (the trade delay was a major factor in the crash). When Tux's #2 told me he couldn't do it because Mark was asleep (time zones! etc), it became pretty clear they didn't have a clue about what they were doing.
  - kakarot 9y ago
    I'm glad other people perceived the delays and realized they were unacceptable and indicative of something bad as well as bad management / development practices. Some people have tried telling me in the past that I'm full of shit for pointing out the delays and what they meant. I moved my coin away about a month or so before the big hack. Stay sharp, friend.
- InclinedPlane 9y ago
  What standard did you set in terms of deciding whether a BTC exchange was trustworthy or not? What did you do to determine whether Mt. GOX was trustworthy and had met that standard? How did they gain your trust?
  - quickthrower2 9y ago
    You can just assume zero trust. Transfer in what you can afford to lose. Split your big trades into a lot of small trades across exchanges keeping a maximum amount in flight at any time. Money is only safe if it confirmed in your crypto wallet, or in your bank account but beyond and period where the transaction could be reversed.
- kakarot 9y ago
  Oh, there were signs. Just because you couldn't see them doesn't mean they didn't exist. I moved my coin from Mt.Gox about a month before the last major hack because just the thought of using it made the hairs on the back of my neck stand up. Something was amiss and I felt it. The most glaring issue was that of inexplicable server load. When you are dealing with a service that handles money or valuable assets, things like this are very bad omens and should never be brushed off. It was clear that either A) the website was experiencing unusual traffic (in this case, I believe what came out was that the one of the attackers were testing their method.. supposedly this same method was used in the Silk Road hack) or B) the staff was not equipped to properly and securely run a server and were an attack to take place, they would not be ready to handle it. One bad security practice with such a critical service is indicative of generally bad security practices and lack of accountability. You have to pay attention to your gut. If something feels amiss, and the service is critical, you have to assume that something is indeed amiss.
- im3w1l 9y ago
  > 15 dollar arbitrage between bitstamp and gox right now??? 15 dollar arbitrage between bitstamp and gox right now??? thats ridiculous, anyone know why? > Because MtGox is a money black hole, absorbing all your money and refuse to pay back. The only way to exit is to buy bitcoins there and sent them elsewhere, this explains the consistent buying pressure there. An arbitrage is meaningless if your money cannot leave, right? https://bitcointalk.org/index.php?topic=273410.0 https://bitcointalk.org/index.php?topic=273410.0 People including me saw the signs and exited.
- pmorici 9y ago
  I strongly disagree. Comparing Coinbase to MtGox is insane. For starters MtGox had their US bank accounts seized a year prior to the company imploding.
- Meekro 9y ago
  I think you're mistaken when you say that there were no signs. There were many signs, and here are some of the worst. As a point of reference, Feb 7, 2014 is when Bitcoin withdrawals were frozen. May 2, 2013: CoinLab sues MtGox, says MtGox promised to let CoinLab operate its North American branch. This makes no sense -- why would MtGox surrender its most valuable territory to a virtual unknown? -- but MtGox doesn't explain what's going on and simply shrugs their shoulders. They will be doing this a lot. May 15, 2013: US Government seizes $5 million from a bank account held by MtGox. MtGox shrugs their shoulders. June 20, 2013: MtGox stops USD withdrawals; bitcoin and JPY withdrawals continue to operate normally. People ask when they'll be restored, MtGox shrugs their shoulders. July 4, 2013: MtGox says USD withdrawals are back to normal. This is a lie. When people ask why USD withdrawals are still not going through, MtGox.. well, you guessed it. They shrug their shoulders and just repeat the lie. By this point, alarm bells should have been blaring in people's heads. Anyone who claims that this kind of crap was the norm for the bitcoin world should keep in mind that Coinbase had launched in 2012 and was running a much tighter ship. By this point, people still had more than 6 months to get their bitcoins out.
  - patio11 9y ago
    Can I add: August ~13th, 2013: CEO blames issues on Mizuho bank; claims that Mt. Gox was greater than 50% of Mizuho's SWIFT volume (!) and DOSed their banking systems multiple times (!!); also says that Mizuho has limited them to ~10 outgoing wires per day. https://bitcointalk.org/index.php?topic=179586.msg2924021#msg2924021 https://bitcointalk.org/index.php?topic=179586.msg2924021#ms...
    - Elepsis 9y ago
      Given the USD ~1.64 TRILLION in assets Mizuho had in 2014, presumably this claim is beyond insane? Is there some mechanism to look up SWIFT transaction volumes by bank?
    - Meekro 9y ago
      Yeah, I forgot about that one! While we're on the subject of lies they told, my favorite was in Feb 2014 when bitcoin withdrawals got frozen. The claim was that they turned off withdrawals while they dealt with the bitcoin malleability issue that was in the news at the time. It was obviously a lie but they just stuck with it.
- tarsinge 9y ago
  As I remember it when first started getting interest in Bitcoin and looked for an exchange in November '13 the sentiment was unanimous in the community: Mt Gox will fail sooner or later, never put money/coins here. But it also looked like a lot of Americans didn't want to hear that because it was the only (as I remember it) exchange where depositing and withdrawing dollars for Americans was convenient. Edit: just saw that other comments say the same thing with more detailed informations, at least it add a data point that even an amateur saw it
- nikcub 9y ago
  > The thing that sucks is, it was impossible to tell any of this was going on. It was impossible to know the details of this exact bug - but it was possible to know that something was wrong at MtGox before the takedown. Of the two-dozen or so people I know who held Bitcoin at the time only one lost funds on MtGox - the rest had long left Gox or were never comfortable using it. The main administrative issues were withdrawal delays[0], MtGox not being able to prove their reserves satisfactorily[1] and having accounts seized[2]. ID verification was slow, and support was almost non-existent. If you read the forums in the ~12-18 months before MtGox went down there was a lot of conversation about what was wrong at MtGox. The tech issues were horrible code[3] (read the description of that repo and tell me if you would trust it with bitcoin), previous hacks[4], many more hack claims and the internal trading bot being traced by outside researchers. I don't blame anybody for not seeing these issues - there was a lot of FUD at the time and many who saw attacks on MtGox as attacks on Bitcoin. Nobody really wrote a good and concise "this is why you shouldn't use MtGox" post anywhere. Hearing after it was taken down that someone knew it was bad is useless and only self-serving. I don't think it is possible for a third party to hold your bitcoins for you in a secure way that is also convenient. You can pick any bitcoin company or exchange and claim its insecure and you'll eventually be right for many users. One of the only ways to avoid the problems and store your bitcoins safely but also still be able to use them is with a hardware wallet. There has been a lot of improvement since MtGox with "vault" products, better multisig implementations, better auth, and offline signing etc. but still some way to go. [0] https://bitcointalk.org/index.php?topic=179586.0 https://bitcointalk.org/index.php?topic=179586.0 [1] https://bitcointalk.org/index.php?topic=209362.0 https://bitcointalk.org/index.php?topic=209362.0 [2] https://techcrunch.com/2013/08/23/feds-seize-another-2-1-million-from-mt-gox-adding-up-to-5-million/ https://techcrunch.com/2013/08/23/feds-seize-another-2-1-mil... [3] https://github.com/MagicalTux/btclib https://github.com/MagicalTux/btclib [4] http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+Full+Story/article21942.htm http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+...
  - jomkr 9y ago
    I was in BTC from very early on. Ironically I didn't make much money but that's another story. I'm shocked, absolutely shocked that the Magic The Gathering Online Exchange wasn't suitable dealing with hundreds of millions of dollars. The signs were obvious that it was being run by amateurs for anyone that spend five minutes doing a google search. When I heard a friend had deposited more money than he could afford to lose on MtGox, I immediately jumped in the car and drove 2 hours to his house. I convinced him, basically at the point of physical violence to take his BTC out of MtGox and store them in a wallet on his computer, encrypted and backed up on several cloud sites. One month later MtGox was hacked. I received an apology and a very nice bottle of whiskey from my friend.
- rosege 9y ago
  as others have pointed out there were signs - but I would say that this is true for most financial institutions if you are paying attention. I remember before Lehman's went down I saw them having a Christmas party and I joked with a friend I didnt think they could afford that anymore - and sure enough not long after they were gone.
- mootothemax 9y ago
  >The thing that sucks is, it was impossible to tell any of this was going on. A few months before the big collapse, I lucked into some money and started looking at arbitrage opportunities on bitcoin exchanges. Want to know what stopped me? The cost benefit vs. risk ratio. Here's an exchange with a really dodgy past, and the price is just shooting up, and people are shouting, and damn this seems too good to be true! (edit: I did some trial runs, and had gone through their painful verification process - the above decision came about when I was starting with the "big boy" sums of money) Funnily enough, I have the exact same thoughts about the crypto ecosystem right now. I think it's probably unwise to hold coins right now, and whether the scam unfolds this year or not, I'm experiencing that very same spidey-sense this seems to good to be true worry from the Mt. Gox days.
  - 3pt14159 9y ago
    Disclaimer: I bought into Bitcoin about 7 years ago. I'm mostly out now, but I hold a small amount of Sia, BTC, and Dash. Especially for ICOs and Eth more generally, but also for Bitcoin, Litecoin, Dash, etc. We use our financial system to combat international crime. Why on earth would governments allow unregulated blockchains and currency transfers to circumvent their controls?
    - ameister14 9y ago
      They won't remain unregulated for long. It's similar to the late 19th century markets, except the regulatory environment already exists - the SEC will go after low hanging fruit for a while to build precedent and then take down a whale, then apply all existing securities regulations to all ICO's and their advisors. That'll cut out a lot of the scammers and introduce traditional investment banks because they are licensed. The licensing process requires sponsorship, so they'll be able to push out and keep out the early players and reap the benefits.
- cm2187 9y ago
  That's pretty much the rule in software. Which is why you have so much software that appears to be working but behind the scene is made of horrible hacks by devs who have no idea of what they are doing.
- lordnacho 9y ago
  I disagree. The presence of a persistent arb premium was what made me back off Gox. As a quant trading guy it just seemed too fishy that a one-way arb could persist. I wrote an arb engine to take advantage of the price difference but I concluded there was too much credit risk in it. Which turned out to be correct. At best the arb was explicable as slow operations getting money out of the bank, but that would in the very best case be total incompetence. Plus the forums were saying a lot of not nice things about the management, so definitely failed the sniff test. Remember it's not the balance of probabilities that matters; it's the worst case. Coinbase, by contrast, has VC backing that you would think means they'd find someone who understood regulatory issues. They'd also have links to proper tech people who understood security and exchange coding, a pretty small subset of coders since it's quite specialised. They may not have started with everything required but chances are they've found the money to buy it by now.
- olegkikin 9y ago
  Some exchanges prove their reserves from time to time. https://www.bitstamp.net/article/Bitstamp-BTC-Proof-of-Reserves-May-2014/ https://www.bitstamp.net/article/Bitstamp-BTC-Proof-of-Reser...
  - AlexCoventry 9y ago
    I see how that shows their assets, but does it reflect their liabilities too? If not, it's not necessarily a proof of solvency.
gruez 9y ago
>There are at least seven jaw dropping moments in it. One is explaining how Bitcoin wallets pre-cache the next 100 change addresses the wallet will use, so that if someone steals your wallet without you noticing it and continues to use it you will determinisically share the same change addresses on your next 100 transactions each, which both leaves a forensic trail and also resulted in Gox continuing to send money into accounts controlled by the attacker. hence why if your wallet is compromised you're supposed to move all of your existing funds to a new wallet. generating new keys every time sucks because it creates a problem of having to constantly back up your wallets (every time you make a transaction), which sucks from a usability point of view.
- AgentME 9y ago
  Bitcoin Core now uses deterministic wallets by default for new users (like most other Bitcoin software), so all keys are generated from the initial seed in the wallet and a single backup is enough to cover them for all time.
  - jandrese 9y ago
    Does this mean if your wallet (or backup) is stolen the hacker will be able to deterministically guess your keys for all time?
    - joecool1029 9y ago
      Yes.
      - abritinthebay 9y ago
        Jesus, really? That’s awful. Are there no ways to mitigate or fix this?
        AgentME 9y ago
        You could not use a deterministic wallet instead. But by default, non-deterministic wallets have the next 100 addresses pre-generated. That's a lot for people not making a lot of bitcoin transactions. The "protection" that non-deterministic wallets give in case you're hacked is probably no use to most people. If you ever notice funds from your wallet are stolen, even if you were using a non-deterministic wallet, your thought should be to reinstall your OS and move any remaining funds to a fresh new wallet. Not to keep using that wallet while the attacker keeps grabbing from it and telling yourself the problem will go away 100ish transactions later. I guess there's attack vectors where an attacker gets hold of an ancient backup of yours that a non-deterministic wallet could have helped. If you think that type of attack is likely against you, you should just manually swap out to a new wallet (synced up to your backup schedule) instead of depending on the non-deterministic wallet's keypool being depleted occasionally.
benmmurphy 9y ago
so if you buy an exchange that uses the standard wallet not only do you have to transfer all your coins to new addresses you also have to generate new wallets for those addresses
olegkikin 9y ago
I spent some time messing with Bitcoin libraries, not an expert by any means. Generating a new private key (and the corresponding address) is trivial. Generating a transaction is a bit less trivial, but not that hard. As far as I understand, you don't need a change address to send the money to another, the change can go straight back to the original address. Random example: https://blockchain.info/tx/07b9371e03bdbb33b5f57a032c1475354061abcdcd6962936ddcf890974fbae5 https://blockchain.info/tx/07b9371e03bdbb33b5f57a032c1475354... So all that mess with the deterministic change addresses is simply due to the laziness of the developers, who didn't bother to generate addresses and transactions using relatively simple crypto, and instead chose to use the existing software, which they didn't really understand. On the other hand, if the servers were hacked, almost nothing would help them. They should have kept most of their deposits in cold storage.
deleted 9y ago
[deleted]

sillysaurus3 9y ago

The thing that sucks is, it was impossible to tell any of this was going on. I know people will say "Well, you should have known. The signs were all there." But there were no signs. Coinbase could be the same way right now. Any exchange could.

nodamage 9y ago
Is there anything stopping exchanges (or other parties) from manipulating the price of Bitcoin by having millions of bots repeatedly buy/sell coins amongst themselves? If not, is there any way of detecting whether this is or isn't happening right now?
- iakh 9y ago
  Sure, the same as what prevents anybody from single handedly moving the price of any asset. Liquidity.
  - beagle3 9y ago
    No, there are many assets which are "cheap" to move singlehandedly, yet are not (often) moved that way because of regulation
  - ceejayoz 9y ago
    That doesn't always work. http://www.nytimes.com/2013/07/21/business/a-shuffle-of-aluminum-but-to-banks-pure-gold.html http://www.nytimes.com/2013/07/21/business/a-shuffle-of-alum... > The story of how this works begins in 27 industrial warehouses in the Detroit area where a Goldman subsidiary stores customers’ aluminum. Each day, a fleet of trucks shuffles 1,500-pound bars of the metal among the warehouses. Two or three times a day, sometimes more, the drivers make the same circuits. They load in one warehouse. They unload in another. And then they do it again.
  - nodamage 9y ago
    How sure are you about this? Karpeles has admitted at trial to running bots on Mt. Gox, and such bots are implicated in the rise of Bitcoin's price up to $1000 in 2013: https://cointelegraph.com/news/mt-gox-trial-update-karpeles-admits-willy-bot-existence https://cointelegraph.com/news/mt-gox-trial-update-karpeles-... https://cointelegraph.com/news/new-wizsec-report-points-to-definitive-insider-trading-at-mt-gox https://cointelegraph.com/news/new-wizsec-report-points-to-d... If Mt. Gox successfully manipulated the price of Bitcoin using bots how do we know other exchanges aren't doing the exact same thing right now?
koolba 9y ago
Isn't bitcoin in a unique position to show the balance held by the holding entity at any given time?
- dmoy 9y ago
  Yea if you keep your own bitcoin wallet, which if it's in mtgox or a similar exchange is not the case. It'd be akin to buying up a bond fund vs. keeping a stack of treasury notes in your house. Only here the broker or whatever who is running the bond fund has only been up and running for <10 years, has basically no SEC oversight, and when your funds don't show up in the right amount of time your official method of recompense is "yea just wait awhile longer, we're going through a massive growth phase and are having difficulty dealing with the scale". Oh and in this hypothetical world, this is also the #1 broker in the world who handles >50% of all trades.
- abecedarius 9y ago
  Yes, https://freedom-to-tinker.com/2015/10/26/provisions-how-bitcoin-exchanges-can-prove-their-solvency/ https://freedom-to-tinker.com/2015/10/26/provisions-how-bitc... (cryptocurrencies in general, I believe)
  - deleted 9y ago
    [deleted]
patio11 9y ago
It was not impossible to tell this was going on. https://twitter.com/patio11/status/370728763790594048 https://twitter.com/patio11/status/370728763790594048 Note the date. I only posted that after I was sure I could beat the libel suit; was pretty sure much earlier.
- sillysaurus3 9y ago
  Then why doesn't it say "Mt. Gox is probably insolvent"? It's also not very helpful to say "Told ya so" rather than "These are the signs to look for in general."
  - patio11 9y ago
    The adjective I would have chosen was not "probably", but being any more explicit than I was might have earned me a "What did you know, when did you know it, and what was your part in this?" from either of two government agencies who could deport me by either pressing a button or failing to press a button.
    - sillysaurus3 9y ago
      Now that no one has the power to deport you, do you mind if we pose those questions? The answers would be informative for anyone who has to weigh which exchange to be using at any given time.
      - jerf 9y ago
        I'm not patio11, but in all seriousness, it is true that just the inexperience and immaturity of the people building these exchanges is sufficient evidence on its own. Here's me telling someone not to build a BitCoin trading platform on September 11th, 2011: https://news.ycombinator.com/item?id=2974770 https://news.ycombinator.com/item?id=2974770 Here's how that went over the next couple of years: https://en.bitcoin.it/wiki/Bitcoinica https://en.bitcoin.it/wiki/Bitcoinica https://www.dailydot.com/business/bitcoin-exchange-bitcoinica-hack/ https://www.dailydot.com/business/bitcoin-exchange-bitcoinic... In a way, the issue here is that if you want to operate in this space, you do need to take the discussion about BitCoin being money seriously. (Even if you don't think it's "money", it's still definitely a money-like asset.)
jdietrich 9y ago
As far as I'm aware, all the exchanges are being run by rank amateurs with effectively zero oversight or accountability. They're reinventing the wheel and re-learning all of the painful lessons that the real banking sector took centuries to learn. From what I've seen, they're applying the "move fast and break things" attitude to other people's money. I wouldn't trust any of them to look after my pocket change. I may revise my opinion if I start seeing cryptocoin exchanges founded by people whose LinkedIn profiles include job titles like "VP for Regulatory Affairs" or "Head of Risk and Compliance". Right now, I'm mainly seeing CS grads and people who spent a couple of years on a trading desk.
- PhasmaFelis 9y ago
  "Dunning-Krugerrands."
  - deleted 9y ago
    [deleted]
  - banku_brougham 9y ago
    this is gold
- deleted 9y ago
  [deleted]
- contingencies 9y ago
  First employee of a major exchange here. You were correct a few years ago, but it's not strictly true anymore. Some oversight and accountability comes from the VCs that own them and sit on the boards, some from the compliance requirements of banks they work with to obtain financial connectivity, and some from people they outsource customer onboarding to or work with for additional financial settlement options. Also, third party penetration testing should be common by now. There is also something to be said for "zero legacy infrastructure", from a security perspective.
  - xiphias 9y ago
leot 9y ago
When MtGox's trade delay hit 30 mins+ (April 2013), and the price was crashing, I hopped on to IRC. I went to mtgox's channel and advocated in the strongest terms that they halt trading, like any sane exchange would do (the trade delay was a major factor in the crash). When Tux's #2 told me he couldn't do it because Mark was asleep (time zones! etc), it became pretty clear they didn't have a clue about what they were doing.
- kakarot 9y ago
  I'm glad other people perceived the delays and realized they were unacceptable and indicative of something bad as well as bad management / development practices. Some people have tried telling me in the past that I'm full of shit for pointing out the delays and what they meant. I moved my coin away about a month or so before the big hack. Stay sharp, friend.
InclinedPlane 9y ago
What standard did you set in terms of deciding whether a BTC exchange was trustworthy or not? What did you do to determine whether Mt. GOX was trustworthy and had met that standard? How did they gain your trust?
- quickthrower2 9y ago
  You can just assume zero trust. Transfer in what you can afford to lose. Split your big trades into a lot of small trades across exchanges keeping a maximum amount in flight at any time. Money is only safe if it confirmed in your crypto wallet, or in your bank account but beyond and period where the transaction could be reversed.
kakarot 9y ago
Oh, there were signs. Just because you couldn't see them doesn't mean they didn't exist. I moved my coin from Mt.Gox about a month before the last major hack because just the thought of using it made the hairs on the back of my neck stand up. Something was amiss and I felt it. The most glaring issue was that of inexplicable server load. When you are dealing with a service that handles money or valuable assets, things like this are very bad omens and should never be brushed off. It was clear that either A) the website was experiencing unusual traffic (in this case, I believe what came out was that the one of the attackers were testing their method.. supposedly this same method was used in the Silk Road hack) or B) the staff was not equipped to properly and securely run a server and were an attack to take place, they would not be ready to handle it. One bad security practice with such a critical service is indicative of generally bad security practices and lack of accountability. You have to pay attention to your gut. If something feels amiss, and the service is critical, you have to assume that something is indeed amiss.
im3w1l 9y ago
> 15 dollar arbitrage between bitstamp and gox right now??? 15 dollar arbitrage between bitstamp and gox right now??? thats ridiculous, anyone know why? > Because MtGox is a money black hole, absorbing all your money and refuse to pay back. The only way to exit is to buy bitcoins there and sent them elsewhere, this explains the consistent buying pressure there. An arbitrage is meaningless if your money cannot leave, right? https://bitcointalk.org/index.php?topic=273410.0 https://bitcointalk.org/index.php?topic=273410.0 People including me saw the signs and exited.
pmorici 9y ago
I strongly disagree. Comparing Coinbase to MtGox is insane. For starters MtGox had their US bank accounts seized a year prior to the company imploding.
Meekro 9y ago
I think you're mistaken when you say that there were no signs. There were many signs, and here are some of the worst. As a point of reference, Feb 7, 2014 is when Bitcoin withdrawals were frozen. May 2, 2013: CoinLab sues MtGox, says MtGox promised to let CoinLab operate its North American branch. This makes no sense -- why would MtGox surrender its most valuable territory to a virtual unknown? -- but MtGox doesn't explain what's going on and simply shrugs their shoulders. They will be doing this a lot. May 15, 2013: US Government seizes $5 million from a bank account held by MtGox. MtGox shrugs their shoulders. June 20, 2013: MtGox stops USD withdrawals; bitcoin and JPY withdrawals continue to operate normally. People ask when they'll be restored, MtGox shrugs their shoulders. July 4, 2013: MtGox says USD withdrawals are back to normal. This is a lie. When people ask why USD withdrawals are still not going through, MtGox.. well, you guessed it. They shrug their shoulders and just repeat the lie. By this point, alarm bells should have been blaring in people's heads. Anyone who claims that this kind of crap was the norm for the bitcoin world should keep in mind that Coinbase had launched in 2012 and was running a much tighter ship. By this point, people still had more than 6 months to get their bitcoins out.
- patio11 9y ago
  Can I add: August ~13th, 2013: CEO blames issues on Mizuho bank; claims that Mt. Gox was greater than 50% of Mizuho's SWIFT volume (!) and DOSed their banking systems multiple times (!!); also says that Mizuho has limited them to ~10 outgoing wires per day. https://bitcointalk.org/index.php?topic=179586.msg2924021#msg2924021 https://bitcointalk.org/index.php?topic=179586.msg2924021#ms...
  - Elepsis 9y ago
    Given the USD ~1.64 TRILLION in assets Mizuho had in 2014, presumably this claim is beyond insane? Is there some mechanism to look up SWIFT transaction volumes by bank?
  - Meekro 9y ago
    Yeah, I forgot about that one! While we're on the subject of lies they told, my favorite was in Feb 2014 when bitcoin withdrawals got frozen. The claim was that they turned off withdrawals while they dealt with the bitcoin malleability issue that was in the news at the time. It was obviously a lie but they just stuck with it.
tarsinge 9y ago
As I remember it when first started getting interest in Bitcoin and looked for an exchange in November '13 the sentiment was unanimous in the community: Mt Gox will fail sooner or later, never put money/coins here. But it also looked like a lot of Americans didn't want to hear that because it was the only (as I remember it) exchange where depositing and withdrawing dollars for Americans was convenient. Edit: just saw that other comments say the same thing with more detailed informations, at least it add a data point that even an amateur saw it
nikcub 9y ago
> The thing that sucks is, it was impossible to tell any of this was going on. It was impossible to know the details of this exact bug - but it was possible to know that something was wrong at MtGox before the takedown. Of the two-dozen or so people I know who held Bitcoin at the time only one lost funds on MtGox - the rest had long left Gox or were never comfortable using it. The main administrative issues were withdrawal delays[0], MtGox not being able to prove their reserves satisfactorily[1] and having accounts seized[2]. ID verification was slow, and support was almost non-existent. If you read the forums in the ~12-18 months before MtGox went down there was a lot of conversation about what was wrong at MtGox. The tech issues were horrible code[3] (read the description of that repo and tell me if you would trust it with bitcoin), previous hacks[4], many more hack claims and the internal trading bot being traced by outside researchers. I don't blame anybody for not seeing these issues - there was a lot of FUD at the time and many who saw attacks on MtGox as attacks on Bitcoin. Nobody really wrote a good and concise "this is why you shouldn't use MtGox" post anywhere. Hearing after it was taken down that someone knew it was bad is useless and only self-serving. I don't think it is possible for a third party to hold your bitcoins for you in a secure way that is also convenient. You can pick any bitcoin company or exchange and claim its insecure and you'll eventually be right for many users. One of the only ways to avoid the problems and store your bitcoins safely but also still be able to use them is with a hardware wallet. There has been a lot of improvement since MtGox with "vault" products, better multisig implementations, better auth, and offline signing etc. but still some way to go. [0] https://bitcointalk.org/index.php?topic=179586.0 https://bitcointalk.org/index.php?topic=179586.0 [1] https://bitcointalk.org/index.php?topic=209362.0 https://bitcointalk.org/index.php?topic=209362.0 [2] https://techcrunch.com/2013/08/23/feds-seize-another-2-1-million-from-mt-gox-adding-up-to-5-million/ https://techcrunch.com/2013/08/23/feds-seize-another-2-1-mil... [3] https://github.com/MagicalTux/btclib https://github.com/MagicalTux/btclib [4] http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+Full+Story/article21942.htm http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+...
- jomkr 9y ago
  I was in BTC from very early on. Ironically I didn't make much money but that's another story. I'm shocked, absolutely shocked that the Magic The Gathering Online Exchange wasn't suitable dealing with hundreds of millions of dollars. The signs were obvious that it was being run by amateurs for anyone that spend five minutes doing a google search. When I heard a friend had deposited more money than he could afford to lose on MtGox, I immediately jumped in the car and drove 2 hours to his house. I convinced him, basically at the point of physical violence to take his BTC out of MtGox and store them in a wallet on his computer, encrypted and backed up on several cloud sites. One month later MtGox was hacked. I received an apology and a very nice bottle of whiskey from my friend.
rosege 9y ago
as others have pointed out there were signs - but I would say that this is true for most financial institutions if you are paying attention. I remember before Lehman's went down I saw them having a Christmas party and I joked with a friend I didnt think they could afford that anymore - and sure enough not long after they were gone.
mootothemax 9y ago
>The thing that sucks is, it was impossible to tell any of this was going on. A few months before the big collapse, I lucked into some money and started looking at arbitrage opportunities on bitcoin exchanges. Want to know what stopped me? The cost benefit vs. risk ratio. Here's an exchange with a really dodgy past, and the price is just shooting up, and people are shouting, and damn this seems too good to be true! (edit: I did some trial runs, and had gone through their painful verification process - the above decision came about when I was starting with the "big boy" sums of money) Funnily enough, I have the exact same thoughts about the crypto ecosystem right now. I think it's probably unwise to hold coins right now, and whether the scam unfolds this year or not, I'm experiencing that very same spidey-sense this seems to good to be true worry from the Mt. Gox days.
- 3pt14159 9y ago
  Disclaimer: I bought into Bitcoin about 7 years ago. I'm mostly out now, but I hold a small amount of Sia, BTC, and Dash. Especially for ICOs and Eth more generally, but also for Bitcoin, Litecoin, Dash, etc. We use our financial system to combat international crime. Why on earth would governments allow unregulated blockchains and currency transfers to circumvent their controls?
  - ameister14 9y ago
    They won't remain unregulated for long. It's similar to the late 19th century markets, except the regulatory environment already exists - the SEC will go after low hanging fruit for a while to build precedent and then take down a whale, then apply all existing securities regulations to all ICO's and their advisors. That'll cut out a lot of the scammers and introduce traditional investment banks because they are licensed. The licensing process requires sponsorship, so they'll be able to push out and keep out the early players and reap the benefits.
cm2187 9y ago
That's pretty much the rule in software. Which is why you have so much software that appears to be working but behind the scene is made of horrible hacks by devs who have no idea of what they are doing.
lordnacho 9y ago
I disagree. The presence of a persistent arb premium was what made me back off Gox. As a quant trading guy it just seemed too fishy that a one-way arb could persist. I wrote an arb engine to take advantage of the price difference but I concluded there was too much credit risk in it. Which turned out to be correct. At best the arb was explicable as slow operations getting money out of the bank, but that would in the very best case be total incompetence. Plus the forums were saying a lot of not nice things about the management, so definitely failed the sniff test. Remember it's not the balance of probabilities that matters; it's the worst case. Coinbase, by contrast, has VC backing that you would think means they'd find someone who understood regulatory issues. They'd also have links to proper tech people who understood security and exchange coding, a pretty small subset of coders since it's quite specialised. They may not have started with everything required but chances are they've found the money to buy it by now.
olegkikin 9y ago
Some exchanges prove their reserves from time to time. https://www.bitstamp.net/article/Bitstamp-BTC-Proof-of-Reserves-May-2014/ https://www.bitstamp.net/article/Bitstamp-BTC-Proof-of-Reser...
- AlexCoventry 9y ago
  I see how that shows their assets, but does it reflect their liabilities too? If not, it's not necessarily a proof of solvency.

gruez 9y ago

>There are at least seven jaw dropping moments in it. One is explaining how Bitcoin wallets pre-cache the next 100 change addresses the wallet will use, so that if someone steals your wallet without you noticing it and continues to use it you will determinisically share the same change addresses on your next 100 transactions each, which both leaves a forensic trail and also resulted in Gox continuing to send money into accounts controlled by the attacker. hence why if your wallet is compromised you're supposed to move all of your existing funds to a new wallet. generating new keys every time sucks because it creates a problem of having to constantly back up your wallets (every time you make a transaction), which sucks from a usability point of view.

AgentME 9y ago
Bitcoin Core now uses deterministic wallets by default for new users (like most other Bitcoin software), so all keys are generated from the initial seed in the wallet and a single backup is enough to cover them for all time.
- jandrese 9y ago
  Does this mean if your wallet (or backup) is stolen the hacker will be able to deterministically guess your keys for all time?
  - joecool1029 9y ago
    Yes.
    - abritinthebay 9y ago
      Jesus, really? That’s awful. Are there no ways to mitigate or fix this?
      - AgentME 9y ago
        You could not use a deterministic wallet instead. But by default, non-deterministic wallets have the next 100 addresses pre-generated. That's a lot for people not making a lot of bitcoin transactions. The "protection" that non-deterministic wallets give in case you're hacked is probably no use to most people. If you ever notice funds from your wallet are stolen, even if you were using a non-deterministic wallet, your thought should be to reinstall your OS and move any remaining funds to a fresh new wallet. Not to keep using that wallet while the attacker keeps grabbing from it and telling yourself the problem will go away 100ish transactions later. I guess there's attack vectors where an attacker gets hold of an ancient backup of yours that a non-deterministic wallet could have helped. If you think that type of attack is likely against you, you should just manually swap out to a new wallet (synced up to your backup schedule) instead of depending on the non-deterministic wallet's keypool being depleted occasionally.

benmmurphy 9y ago

so if you buy an exchange that uses the standard wallet not only do you have to transfer all your coins to new addresses you also have to generate new wallets for those addresses

olegkikin 9y ago

I spent some time messing with Bitcoin libraries, not an expert by any means. Generating a new private key (and the corresponding address) is trivial. Generating a transaction is a bit less trivial, but not that hard. As far as I understand, you don't need a change address to send the money to another, the change can go straight back to the original address. Random example: https://blockchain.info/tx/07b9371e03bdbb33b5f57a032c1475354061abcdcd6962936ddcf890974fbae5 https://blockchain.info/tx/07b9371e03bdbb33b5f57a032c1475354... So all that mess with the deterministic change addresses is simply due to the laziness of the developers, who didn't bother to generate addresses and transactions using relatively simple crypto, and instead chose to use the existing software, which they didn't really understand. On the other hand, if the servers were hacked, almost nothing would help them. They should have kept most of their deposits in cold storage.

deleted 9y ago

[deleted]