4 ms·

>Rough rule of thumb: if you handle and hold others’ money for them, you have to know your customers [1]. Wallet services have KYC obligations. Cryptocurrency

>Rough rule of thumb: if you handle and hold others’ money for them, you have to know your customers [1]. Wallet services have KYC obligations. Cryptocurrency wallets don't hold others' money unless they are custodial wallets, which blackwallet wasn't. Blackwallet was just like a personal safe, which has no KYC obligations. >This is closer to Al Capone’s money laundering operation being burgled. And yet the basic idea behind your sentiment is that you think the government shouldn't investigate these incidents because you believe a portion of the users are doing something else illegal without any concrete proof or trial?

JumpCrisscross 9y ago
> Blackwallet was just like a personal safe, which has no KYC obligations If I open a service which advertises personal safes held on my property that hold other peoples’ cash, I have a KYC obligation. If Blackwallet simply made available open-source wallet code, you might be correct. As I understand it, people logged into Blackwallet through Blackwallet’s website on Blackwallet’s domain to view and mainipulate their wallets’ contents. > you think the government shouldn't investigate If some files a report with the police and sends that to their Attorney General, and then the government doesn’t follow up, I would say that is wrong. (It would be comically stupid to file a report about stolen property you evaded taxes on.)
- Klathmon 9y ago
  >As I understand it, people logged into Blackwallet through Blackwallet’s website on Blackwallet’s domain to view and mainipulate their funds. Blackwallet was a web wallet. They hosted javascript code that the users "unlocked" a key held in localstorage on their own PC, signed transactions on their own PC, and sent the signed transactions on the stellar network from their own PC. This hack was a malicious actor including javascript which would then steal the private keys and send them to a hacker controlled server so they could steal the funds using them. Pre-hack, the private key never was in control of "blackwallet" off the user's PC at any time, therefore they did not have a KYC obligation. Blackwallet's servers were simply serving up the static software which was used entirely locally. Things get a little strange when cryptocurrencies are involved, but the closest analogy I can come up with is a personal piggy bank. The manufacturing company of the piggy bank has no KYC obligation because at no point does the manufacturing company ever have "control" or deal with other people's money. Now i'm not a lawyer, but this is how I understand the laws here. And I just can't fathom a way in which a piggy bank in my own home doesn't need to follow KYC laws, but a software wallet running on my own personal PC needs to. >It would be comically stupid to file a report about stolen property you evaded taxes on. I completely agree, but I pay my taxes, and if I were impacted in this, I would be filing reports, and I would be very upset if my reports were ignored because other don't file taxes...
  - JumpCrisscross 9y ago
    > I just can't fathom a way in which a piggy bank in my own home doesn't need to follow KYC laws, but a software wallet running on my own personal PC needs to Your relationship with the piggy bank manufacturer ends at the point of sale. That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. > if I were impacted in this, I would be filing reports And I would fully support you. I just don’t think authorities have an obligation to proactively investigate cryptocurrency crimes.
    - Klathmon 9y ago
      >That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. No, it didn't. For starters, again nothing went "through" blackwallet servers. It's a one way communication of javascript from blackwallet to the user, then the user holds the data and signs transactions and sends it directly to the stellar network. I don't know the internals on how that last step happened, but even if it went back to blackwallet servers, they would be acting as nothing more than a proxy to enable broadcasting this transaction to the network from JavaScript. And if that makes you require KYC laws then verizon is about to have a really bad time because my encrypted credit card transaction went through their servers. Just like how your relationship with the piggy bank manufacturer ends at point of sale, your relationship with blackwallet ends once you downloaded the JS. They do not hold any currency, they do not have access to any currency, they do not route any currency, they do not have any KYC obligations.

JumpCrisscross 9y ago

> Blackwallet was just like a personal safe, which has no KYC obligations If I open a service which advertises personal safes held on my property that hold other peoples’ cash, I have a KYC obligation. If Blackwallet simply made available open-source wallet code, you might be correct. As I understand it, people logged into Blackwallet through Blackwallet’s website on Blackwallet’s domain to view and mainipulate their wallets’ contents. > you think the government shouldn't investigate If some files a report with the police and sends that to their Attorney General, and then the government doesn’t follow up, I would say that is wrong. (It would be comically stupid to file a report about stolen property you evaded taxes on.)

Klathmon 9y ago
>As I understand it, people logged into Blackwallet through Blackwallet’s website on Blackwallet’s domain to view and mainipulate their funds. Blackwallet was a web wallet. They hosted javascript code that the users "unlocked" a key held in localstorage on their own PC, signed transactions on their own PC, and sent the signed transactions on the stellar network from their own PC. This hack was a malicious actor including javascript which would then steal the private keys and send them to a hacker controlled server so they could steal the funds using them. Pre-hack, the private key never was in control of "blackwallet" off the user's PC at any time, therefore they did not have a KYC obligation. Blackwallet's servers were simply serving up the static software which was used entirely locally. Things get a little strange when cryptocurrencies are involved, but the closest analogy I can come up with is a personal piggy bank. The manufacturing company of the piggy bank has no KYC obligation because at no point does the manufacturing company ever have "control" or deal with other people's money. Now i'm not a lawyer, but this is how I understand the laws here. And I just can't fathom a way in which a piggy bank in my own home doesn't need to follow KYC laws, but a software wallet running on my own personal PC needs to. >It would be comically stupid to file a report about stolen property you evaded taxes on. I completely agree, but I pay my taxes, and if I were impacted in this, I would be filing reports, and I would be very upset if my reports were ignored because other don't file taxes...
- JumpCrisscross 9y ago
  > I just can't fathom a way in which a piggy bank in my own home doesn't need to follow KYC laws, but a software wallet running on my own personal PC needs to Your relationship with the piggy bank manufacturer ends at the point of sale. That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. > if I were impacted in this, I would be filing reports And I would fully support you. I just don’t think authorities have an obligation to proactively investigate cryptocurrency crimes.
  - Klathmon 9y ago
    >That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. No, it didn't. For starters, again nothing went "through" blackwallet servers. It's a one way communication of javascript from blackwallet to the user, then the user holds the data and signs transactions and sends it directly to the stellar network. I don't know the internals on how that last step happened, but even if it went back to blackwallet servers, they would be acting as nothing more than a proxy to enable broadcasting this transaction to the network from JavaScript. And if that makes you require KYC laws then verizon is about to have a really bad time because my encrypted credit card transaction went through their servers. Just like how your relationship with the piggy bank manufacturer ends at point of sale, your relationship with blackwallet ends once you downloaded the JS. They do not hold any currency, they do not have access to any currency, they do not route any currency, they do not have any KYC obligations.