3 ms·

>As I understand it, people logged into Blackwallet through Blackwallet’s website on Blackwallet’s domain to view and mainipulate their funds. Blackwallet was

>As I understand it, people logged into Blackwallet through Blackwallet’s website on Blackwallet’s domain to view and mainipulate their funds. Blackwallet was a web wallet. They hosted javascript code that the users "unlocked" a key held in localstorage on their own PC, signed transactions on their own PC, and sent the signed transactions on the stellar network from their own PC. This hack was a malicious actor including javascript which would then steal the private keys and send them to a hacker controlled server so they could steal the funds using them. Pre-hack, the private key never was in control of "blackwallet" off the user's PC at any time, therefore they did not have a KYC obligation. Blackwallet's servers were simply serving up the static software which was used entirely locally. Things get a little strange when cryptocurrencies are involved, but the closest analogy I can come up with is a personal piggy bank. The manufacturing company of the piggy bank has no KYC obligation because at no point does the manufacturing company ever have "control" or deal with other people's money. Now i'm not a lawyer, but this is how I understand the laws here. And I just can't fathom a way in which a piggy bank in my own home doesn't need to follow KYC laws, but a software wallet running on my own personal PC needs to. >It would be comically stupid to file a report about stolen property you evaded taxes on. I completely agree, but I pay my taxes, and if I were impacted in this, I would be filing reports, and I would be very upset if my reports were ignored because other don't file taxes...

JumpCrisscross 9y ago
> I just can't fathom a way in which a piggy bank in my own home doesn't need to follow KYC laws, but a software wallet running on my own personal PC needs to Your relationship with the piggy bank manufacturer ends at the point of sale. That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. > if I were impacted in this, I would be filing reports And I would fully support you. I just don’t think authorities have an obligation to proactively investigate cryptocurrency crimes.
- Klathmon 9y ago
  >That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. No, it didn't. For starters, again nothing went "through" blackwallet servers. It's a one way communication of javascript from blackwallet to the user, then the user holds the data and signs transactions and sends it directly to the stellar network. I don't know the internals on how that last step happened, but even if it went back to blackwallet servers, they would be acting as nothing more than a proxy to enable broadcasting this transaction to the network from JavaScript. And if that makes you require KYC laws then verizon is about to have a really bad time because my encrypted credit card transaction went through their servers. Just like how your relationship with the piggy bank manufacturer ends at point of sale, your relationship with blackwallet ends once you downloaded the JS. They do not hold any currency, they do not have access to any currency, they do not route any currency, they do not have any KYC obligations.

JumpCrisscross 9y ago

> I just can't fathom a way in which a piggy bank in my own home doesn't need to follow KYC laws, but a software wallet running on my own personal PC needs to Your relationship with the piggy bank manufacturer ends at the point of sale. That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. > if I were impacted in this, I would be filing reports And I would fully support you. I just don’t think authorities have an obligation to proactively investigate cryptocurrency crimes.

Klathmon 9y ago
>That Blackwallet users routed through a Blackwallet domain to transmit money through the Stellar network (a) made this hack possible and (b) creates a KYC liability. No, it didn't. For starters, again nothing went "through" blackwallet servers. It's a one way communication of javascript from blackwallet to the user, then the user holds the data and signs transactions and sends it directly to the stellar network. I don't know the internals on how that last step happened, but even if it went back to blackwallet servers, they would be acting as nothing more than a proxy to enable broadcasting this transaction to the network from JavaScript. And if that makes you require KYC laws then verizon is about to have a really bad time because my encrypted credit card transaction went through their servers. Just like how your relationship with the piggy bank manufacturer ends at point of sale, your relationship with blackwallet ends once you downloaded the JS. They do not hold any currency, they do not have access to any currency, they do not route any currency, they do not have any KYC obligations.