21 ms·
Tokyo-based cryptocurrency exchange hacked, losing $530M: NHK
- cflewis 9y agoAs someone who knows very little about the blockchain, I was wondering if the Bitcoins are "known"? Like, they have a hash or something? Can't they be then blacklisted from use somehow? I thought the whole point of the blockchain was that all the transactions were all known?
- jbtule 9y agoYou'd need consensus of the miners to do so.
- tooop 9y agoNothing to do with miners. It is all about exchanges.
- ht85 9y agoMiners would be the correct level for such a thing. By blocking a specific address, it would effectively freeze all the funds held by it, preventing them from being transferred to anyone, including exchanges.
- sf_rob 9y agoThis happened with Ethereum early on. It's the cause of the Ethereum Classic fork since many oppose violating immutability. In addition, my understanding is that many cash exchanges will not accept funds that have previously been identified in major hacks because they could be forced to return the funds to their rightful owners in addition to the cost of compliance with law enforcement. There are "privacy"-focused cryptocurrencies that do not have this characteristic, the most well known of which is Monero. [I am not an expert, just a casual news consumer of the space]
- giancarlostoro 9y agoKnowing their history is good against faking the coins aka counterfeiting. If someone steals $50,000 from your bank account you may or may not ever see it again. Bitcoin will help you track it down to wherever it ends up, unlike your bank.
- tooop 9y agoYou can't fake (counterfeit) bitcoin...
- giancarlostoro 9y agoThat is what I just said.
- deleted 9y ago[deleted]
- larkeith 9y agoThey are known, but the point of a decentralized blockchain is that there is no central authority to 'blacklist' them. Furthermore, there are methods by which bitcoins can be anonymized once obtained: look up 'bitcoin tumbler'.
- cal5k 9y agoYes... all of the addresses involved should be known and can be blacklisted by major exchanges. Still - the question is why was it even possible for a "hack" to score so much cryptocurrency? This is a legendary score on par with Mt Gox... they should be holding all currency not required for immediate trading liquidity in cold storage and rebalancing as needed.
- UncleMeat 9y agoUh. Wasn't the whole goddamn point of blockchains "censorship resistance"? Now people are saying that we can just ban transactions from certain addresses?
- cal5k 9y agoYou can't ban them, but you could put together a "blacklist" on tokens from a particular origin that exchanges could agree to honour. It wouldn't stop anyone from trying to sell their coins in other ways.
- emiliobumachar 9y agoThat's basically forming a government. Who decides what goes in the list? Who ensures they'll keep honest? Who watches the watchers? What recourse does a user have against arbitrary measures?
- stale2002 9y agoIt is very difficult to blacklist coins with the current culture of Bitcoin. If 1 person refuses to accept the coins, there are thousands and thousands of others who knowingly WILL. And an even larger group of people who aren't even going to be aware of your blacklist and will do so unknowingly. In order to blacklist coins, it is not enough to just blacklist the 1 address. You have to black everyone who accepts those coins, and everyone who accepts coins from the people who accepted them and so on. And at that point you have blacklisted the entire network.
- deleted 9y ago[deleted]
- wampwamp 9y agoYes, bitcoin transactions are 'known' and are represented by a unique hash; however, It's impossible to 'reject' an incoming bitcoin transaction. Miners can implement custom software that can exclude blacklisted transactions from their list of mineable transactions, but requiring all miners to blacklist an address or transaction would require a hard fork.
- siberianbear 9y agoHow would you get everyone to agree on the blacklisting? How would be enforced? What if some clients accept nodes containing 'blacklisted' addresses, and some don't? When if then a client that 'blacklists' addresses sees a block that contains a transaction whose inputs are 99% 'legit' coins and 1% 'blacklisted' coins? Should it honor it? What you're really proposing is a hard fork, which is a morass of problems. And why should everyone suffer all this grief just because the security team on one exchange in Japan is staffed with people who don't know what they are doing?
- ReverseCold 9y agoThe accounts on the NEM network (XEM was stolen, not Bitcoin) can be marked with a non-transferable asset. That was just automated and all known hacker addresses are now tainted.
- larkeith 9y agoInteresting - I'm unfamiliar with XEM, I presume the non-transferable mosaic (that were used to mark the accounts to which the stolen funds were transferred) is signed in some manner such that a copy couldn't be spoofed onto an arbitrary account?
- ReverseCold 9y agoMosaics are a core feature of the platform. Think of it like an ERC20 token, but the creator of the token can impose fees (among other features). The fees are set to another token that the hacker doesn't/can't own - as such the account is stuck owning the asset.
- xorcist 9y agoSo in a sense you never truly own your XEM tokens? The creator can change the rules ex post facto.
- ReverseCold 9y agoThat's configurable. There's tokens where you want it to be centralized and able to change post creation (mutable) and then immutable ones. Companies using NEM really like the mutable ones.
- AlexCoventry 9y agoIs there a roadmap for weaning XEM off this centralized governance structure?
- deleted 9y ago[deleted]
- tn_ 9y agoI don't understand why news like this doesn't have that huge of an impact of bitcoin's price.. Bitcoin seems to be hovering around 11k~ as I'm writing this. It's been at the same price it seems for the past couple of days...
- empath75 9y agoBecause the price is driven by bitfinex printing tethers and pretty much nothing else.
- orthecreedence 9y agoI don't know why you're being downvoted. There is more and more evidence of this coming out. Bitcoiners' response is to censor. They should be selling instead.
- peoplewindow 9y agoYep. Whenever the price falls more Tethers appear and the price goes back up again. The Bitcoin price hasn't reflected fundamentals for years. The fact that the Bitcoin Conference stopped accepting bitcoins because the system is so broken, yet it had no impact on price, should be a hint.
- buttcoinslol 9y ago'Money ain't got no owners, only spenders' -Omar Little This quote applies to unregulated markets: drugs or cryptocurrencies.
- ssijak 9y agoI just finished watching all The Wire seasons for the first time and freaked a little when I saw your comment. I often see something on Hacker News that I just recently had contact with and is not that popular.
- blueline 9y agothe wire had something like 30M viewers at peak and was absurdly well received....
- gesman 9y agoConclusion: If you keep any cryptocurrency on an exchange or online service that can or is capable of controlling your private keys - MOVE all your cryptos to your own deterministic wallet YESTERDAY!
- simias 9y agoYou also have to take into account the probability of your exchange of choice being hacked vs. the probability that you'll get your own wallet compromised/destroyed/lost etc... Given that cryptocurrencies have become pretty mainstream and given the average level of technical literacy among the general public I can understand why some might prefer to keep their coins in somebody else's hands.
- notyourday 9y agoYou mean probability of people who run the exchange/work there deciding that they have a better use of your coinz?
- lumberjack 9y agoThere is risk either way, though. Say you want to sell fast because of something major (that is not just hype). If your monies aren't online you will be the last to try to cash out.
- wsc981 9y agoI agree, which is why I prefer to: - keep only (most of) my long term holds in my hardware wallets (e.g. NEO, OMG, ...) - spread my shorter term holds over several exchanges
- bkolobara 9y agoThe possibility of an exchange getting hacked is much lower than the possibility of users losing founds by transferring them to their own wallet. I run a cryptocurrency forum and in 99% of reported cases users lost their founds by moving money from an exchange to a local wallet or even a hardware wallet. I always recommend everyone to keep it on an exchange.
- monkmartinez 9y agoHow often do major banks get hacked and "lose" money?
- MR4D 9y agoI can’t remember seeing Schwab or Fidelity (or any others) hacked. At least not like this.
- krapp 9y agoHow often do cryptocurrency exchanges get "hacked" by someone besides the owners?
- s0rce 9y agoSeems like hacks do occur, often for customer info, but looks like money is sometimes stolen, considering the number of banks compared to BTC exchanges I'm guessing hacks are relatively more frequent in the crypto-space, especially considering how much money can be stolen and more easily moved. https://www.google.com/search?q=bank+hacked https://www.google.com/search?q=bank+hacked
- psychometry 9y agoThis was an exchange, not a bank. I'm sure that plenty of banks and stock/forex exchanges have been hacked, but trades can be reversed, money reimbursed by the FDIC, etc.
- deleted 9y ago[deleted]
- mrb 9y agoIt happens admittedly less often, but it does happen. For example $60 millions were stolen and never recovered from https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery
- jhwang5 9y agoThis is all you could come up with?
- s0rce 9y agoWow, didn't know Mt. Gox lost 850k BTC, thats 9B USD at the current price. Are these coins traced? Were they quietly sold or are hackers sitting on billions in BTC?
- deleted 9y ago[deleted]
- stuxnet79 9y agoKim Nilsson's group have been investigating the Mt Gox incident for years and he gave a presentation some time ago that summarized some of their findings (https://www.youtube.com/watch?v=l70iRcSxqzo https://www.youtube.com/watch?v=l70iRcSxqzo). One of the best summaries of the Mt Gox incident, as well as the fallout and subsequent investigations that I've watched.
- dmix 9y agoAny TLDW for the primary theory on who did it? Inside job?
- stuxnet79 9y agoWell worth watching IMO. TLDW, MtGox was compromised more than a dozen times and if 'MagicalTux' and Co would have done their due diligence and notified users the scale of the theft wouldn't have been as high as it ended up being.
- ReverseCold 9y agoThe coins stolen are XEM (https://nem.io/ https://nem.io/) not Bitcoin. They're currently tracking the stolen coins to ensure they are not sold. Preliminary evidence suggests that it was a private key stolen and not a network problem. Disclaimer: Am somewhat associated with the team, and I hold a small amount of XEM. Feel free to ask questions.
- cal5k 9y agoInteresting. So is the implication here that it was probably an "inside job"? Were the private keys held in cold storage?
- x775 9y agoOuch. Something like this is incredibly regrettable, and a large amount of presumably novice investors have no doubt burnt their fingers. Yet, incidents like this once again underscore the importance of controlling your private keys. Until you do that, you do not really own your coins. I suppose this also highlights the need for decentralised exchanges.
- joelbondurant 9y agoThieves are better than tax parasites.
- matt_wulfeck 9y agoIf only there was some trust built into the system. Then that money could all be recovered.
- m3kw9 9y agoA lot of people take for granted of a bank guarantees from govt. In a bank you are protected if the bank burns down or gets robbed empty. Unlike the Wild West here
- buttcoinslol 9y agoFor US accounts, you even get 500k of coverage thru SIPC in case your brokerage goes bankrupt. You don't even need to be a US resident for this protection.
- antocv 9y agoYou are not protected when the bank robs you. Accounts frozen, inflation, using your money for dubious corruption and money laundering schemes - see Nordea.
- coralreef 9y agoKind of an incorrect analogy. Exchanges aren't banks, they're more like open bazaars. Your own cold wallet is the bank. Once you take the money to the bazaar, it becomes possible to be pick pocketed.
- JumpCrisscross 9y ago> Exchanges aren't banks, they're more like open bazaars I believe the SIPC guarantee covers losses incurred as a result of an exchange failure. Practically, I have a hard time understanding how an exchange failing would cause customers to lose funds (outside capital losses). Securities markets segregate exchange and settlement, e.g. the NYSE from the DTCC [1]. The latter is guaranteed, indirectly, by the federal government. [1] https://en.wikipedia.org/wiki/Depository_Trust_%26_Clearing_Corporation https://en.wikipedia.org/wiki/Depository_Trust_%26_Clearing_...
- fpgaminer 9y agoI remember naively believing that FDIC covered theft. There are little notes and placards posted all over banking websites and physical locations advertising that your funds are insured by FDIC. I'll bet most people who see those signs believe the same thing I believed: that "insured" in that context meant your funds were protected. Against theft; fire; fraud; etc. Right? But FDIC _doesn't_ cover theft. Or anything else. It only covers bank failure. Bank runs were a real problem back in the old days, and the fear of it drove most people to leave their cash in mattresses. So FDIC was created to alleviate those fears and get cash back into the banks. That was, and is, its only purpose. Not that that isn't a useful thing. It certainly came in handy again during our last recession. But this knowledge raises an important question. If FDIC is the only insurance I've seen advertised by banks, and it only covers bank failure ... what covers everything else? I assume, hopefully, that banks have private insurance policies or something. Maybe they're legally required to have a private insurance policies. I just don't know. I bet most people don't know. Very interesting stuff.
- LAMike 9y agoThe 0x protocol will allow for decentralized exchanges, so hacks like this would be a thing of the past if it gains adoption. https://0xproject.com/ https://0xproject.com/
- ReverseCold 9y agoIt's still impossible to have a decentralized exchange convert between USD and a coin. XEM (the coin that was stolen) doesn't have plans to implement 0x, but there are other plans for decentralized exchange.
- csomar 9y agoWhy not? By using a usd-token like usdt it become possible. Bitshare usd also has been very stable lately and it is fully decentralized.
- vkou 9y agoA usd-token requires trust that the token issuer isn't just printing magic internet money. You've just moved your point of failure from the exchange, to the token issuer. All evidence points to USDT being just that - magic internet money, with nothing backing it.
- cryptonitez 9y agoDozens of exchanges risking their reputation on it suggest otherwise.
- conanbatt 9y agoDo you honestly believe Tether has 2.2 billion dollars in a bank account? Tether is a huge red flag to me..Enron level.
- cryptonitez 9y ago
- snissn 9y agodecentralized exchanges and cross chain atomic swaps are looking really interesting lately
- larkeith 9y agoBitcoin and other cryptocurrencies remain in technological infancy relative to the absurd amount of investor interest they hold. Hacks of this scale will likely continue to occur for the forseeable future, until exchanges develop and deploy techniques to limit potential lossage to hacks (e.g. minimal networked wallets), and will require several more years to provide a secure track record. In the interim, the convenience of exchange bitcoin storage will continue to come at an increase in risk.
- ReverseCold 9y agoThis seems to be exchange incompetence, their only wallet as a hot wallet. Disclaimer: I hold some XEM, have contributed to source, etc.
- larkeith 9y agoIIRC the only thing remotely close to breaking a crypto we've seen is the DAO hack; otherwise, it's generally incompetency somewhere along the chain, so that's not at all surprising to hear. Rather astonishing in magnitude (a single hot wallet?), but such is tech.
- baby 9y agocrypto has been broken a lot over the past, look at MD5, RC4, DES, SHA1, ...
- cal5k 9y agoWell, technically only their altcoins were kept in a hot wallet - still, unbelievable incompetence. This is where regulation is sorely needed.
- krapp 9y ago> This is where regulation is sorely needed. The need for financial regulation and trusted authority is supposed to be the problem cryptocurrencies exist to solve - free market forces and reputation alone should be sufficient.
- ReverseCold 9y agoPosting this as a top level comment as well (probably a better idea): The coins stolen are XEM (https://nem.io/ https://nem.io/) not Bitcoin. They're currently tracking the stolen coins to ensure they are not sold. Preliminary evidence suggests that it was a private key stolen and not a network problem. Disclaimer: Am somewhat associated with the team, and I hold a small amount of XEM. Feel free to ask questions.
- onewhonknocks 9y ago'Am somewhat associated with the team' Can you please be more specific? It was almost not worth saying unless you'll be more specific IMHO.
- ReverseCold 9y agoSorry, I'll clarify. I'm in the chat group quite a bit and have contributed to the wallet source code. I said partially as I'm not involved as an "official" capacity.
- onewhonknocks 9y agoThank you for responding!
- VMG 9y agoany calls for a hardfork yet?
- larkeith 9y agoThe president of the NEM.io Foundation is against it [1] [1] https://twitter.com/2017Lon/status/956880456154099712?s=17 https://twitter.com/2017Lon/status/956880456154099712?s=17
- ReverseCold 9y agoNope, they're against hardforking. The current measure being taken is just tainting the hacker's accounts and blocking them at exchanges.
- ezoe 9y agoWhen do the people learn? If you hand over the control of your crypto-currency to the central trade authority, it completely ruins the value of crypo-currency. You should rather use traditional nation-backed currency at regulated trade authority.
- edshiro 9y agoThis kind of news is the reason why people should seriously consider buying a hardware crypto wallet if they plan to put significant sums at risk. I've started trading in this space with a modest amount, but as I plan to increase some of my investments I am definitely considering purchasing a wallet. I would sleep better if I knew my coins were not held within the exchange.
- anigbrowl 9y agoWhy not just carry gold coins back and forth to a casino in a strongbox? At least you know what the odds are when you gamble.
- Leader2light 9y agoWhat happens when your hardware fails or is destroyed? Or someone just forces you to give up the info?
- makemoniesonlin 9y agoYou store the seed phrase securely as well somewhere, and if the hardware wallet fails, you can still access your coins.
- fermienrico 9y agoSo then the chain continues: You need another hardware wallet to secure the seed phrase? As someone said earlier in this thread - Hardware wallets are simply another computer that stores your private key. There is nothing inherently different about its "Hardware".
- glitch003 9y agoThe seed phrase is 24 words. You write it on paper, you don't need another hardware wallet to secure it. You can import that seed phrase into any number of wallet programs if you lose your hardware wallet.
- 9y ago
- hartator 9y agoThey are tainting the stolen coins to avoid them to be sold. What’s the point of having a decentralized currency if a centralized entity make the decisions anyway at the end of day?
- CryptoPunk 9y agoNEM (the cryptocurrency that was stolen) isn't decentralized.
- viach 9y agoWhy not using a web site built on postgres or mysql database to track balances then, instead of using blockchain and call the thing "cryptocurrency"?
- xaqfox 9y agoOne could argue that it offers more transparency.
- vec 9y agoOkay, then why not using a web site built on a SQL database with a read-only public login?
- optimuspaul 9y agothe transparency is this case is more than just being seen, but also that it can be proven to not have been altered. (I think there are better ways to do this than a blockchain)
- gowld 9y agoWhy is "Statistics" called "Machine Learning" ? $$hype$$
- make3 9y ago
- draw_down 9y agoHow many, at this point? This should be the expected outcome for a crypto exchange.