13 ms·

Frozen Funds

100 points by moe 13y ago

deleted 13y ago
[deleted]
- elliottcarlson 13y ago
  Completely unrelated to the discussion... And based on your previous submission of ponzidoge.com I am assuming self-promotion.
  - xdocommer 13y ago
    just trying to get the next "investor" in. But overall I am disappointed with exchanges I keep all the crypto in the wallet and take out what I consider risk/loss to play/pay someone. The whole Idea of crypto is not to keep it with a designated third party.
Bootvis 13y ago
My largest fear with cryptocurrency is that my luck will run out (nothing bad has ever happened to my holdings) and I will lose a significant chunk of money. Most of my holdings are in cold wallets but news like this makes me shiver and makes me realize cryptocurrency needs more grown ups fast.
- dcc1 13y ago
  The problem is the gateways between fiat and crypto, where centralisation occurs and due to AML/KYC policies and banking regulations all of the worst aspects of banking can affect users bitcoin itself as the protocol/platform has proven to be quite solid the trick is to not keep coins in exchanges unless you are into trading, but then you know that you are taking a risk
  - _delirium 13y ago
    You have considerable risk keeping the wallet locally, just of a different kind. The most common way people have lost money locally thus far is probably just losing the wallet file without having backups. A worm or trojan whose payload steals people's bitcoins is also plausible, though afaik there haven't been any yet.
    - Bootvis 13y ago
      Which indeed is my #1 fear, something nasty can be one `pip install` away.
      - maxerickson 13y ago
        If you have enough money tied up in it to make you uneasy it would seem sensible to be using dedicated hardware for your coin management (with only the bare necessities of software installed on it).
        Bootvis 13y ago
        Thanks for the tip, motivated me to dust off the old Pentium 4 I have here and install OpenBSD on it.
    - smtddr 13y ago
      >>A worm or trojan whose payload steals people's bitcoins is also plausible, though afaik there haven't been any yet. There have been a couple of these actually: http://www.pcworld.com/article/2109000/bitcoinstealing-malware-hidden-in-mt-gox-data-dump-researcher-says.html http://www.pcworld.com/article/2109000/bitcoinstealing-malwa... http://www.computerworld.com/s/article/9244772/Bitcoin_market_price_app_39_Bitcoin_Alarm_39_is_carefully_cloaked_malware http://www.computerworld.com/s/article/9244772/Bitcoin_marke... http://www.coindesk.com/cointhief-mac-malware-steals-bitcoins/ http://www.coindesk.com/cointhief-mac-malware-steals-bitcoin... And the most famous probably, cryptolocker - http://en.wikipedia.org/wiki/CryptoLocker http://en.wikipedia.org/wiki/CryptoLocker ...though this is more a ransom strategy than just out-right theft.
  - notahacker 13y ago
    It's disingenuous in the extreme to suggest that AML/KYC policies and banking regulations have anything to do with a significant proportion of all Bitcoins ever in circulation having disappeared from counterparties claiming they were hacked. Real, regulated banks do not simply lose significant fractions of dollars in circulation. It has a lot more to do with bad code, bad storage policies or bad intentions on the part of the exchanges, and most of them point to transaction malleability - a design flaw in the original protocol - as their excuse.
    - dcc1 13y ago
      The steep barriers to entry into becoming an exchange due to these laws/policies and the whole cloudy and non clear nature of what protocols to adhere in each country ensure that exchanges are not started by the most competent but by the most reckless and foolish, see magic the gathering. There are several exchanges in the works but they are bogged down with regulation and not able to open.
      - danielahn 13y ago
        So... you're saying its easy for the reckless and foolish to somehow overcome these steep barriers and understand what it takes to open while those who are competent are unable to do so?
        nhaehnle 13y ago
        He's saying that those who understand what it takes to build a secure service see the problem as so difficult that they prefer to use their talents for something else. As a consequence, the services that do exist have been built by reckless people who don't understand the issue. I don't know whether that's true, but that's what s/he wrote. It's an easy enough to understand and plausible notion.
        dcc1 13y ago
        You obviously never had to deal with bureaucrats, right now the 2nd biggest exchange BTC-e is runny by some shady eastern europeans who are simply ignoring all laws. The biggest exchange Mtgox was run by an incompetent fool who lost half a billion in the cushion of his couch or something. Bitstamp seem to be doing the right things but I doubt that they can legally operate in US or take transfers from/to US as they are doing.
  - deleted 13y ago
    [deleted]
- yetfeo 13y ago
  As long as you hold the private keys yourself and don't keep them on third party websites your holdings are safe. Safer than cash since you can encrypt and back up the keys.
macspoofing 13y ago
Urgh. They are insolvent, but in denial. Who in their right mind would even think to trade on this exchange now.
thinkcomp 13y ago
Until we get regulatory reform on a federal level, this will keep happening. http://www.plainsite.org/issues/index.html?id=2 http://www.plainsite.org/issues/index.html?id=2
- fennecfoxen 13y ago
  Which federal level were you thinking of? US? What about the rest of the world?
  - thinkcomp 13y ago
    I'm concerned about the United States first, and the rest of the world later.
- pdq 13y ago
  Nonsense. Regulatory reform does not prevent bank thefts, in the same way as it will not prevent digital thefts due to security vulnerabilities. Also note that banks are legally allowed to run as fractional reserves. This means your $100 deposit is only backed by a minimum of $10 in the vault at any time. Companies will be (and already are) getting smarter, by hiring security experts to audit software and detect vulnerabilities, and more transparent, by providing public accounting of funds to prove they are not running Ponzi schemes or fractional reserves.
  - thinkcomp 13y ago
    The point of regulation isn't to prevent bank thefts. It's to effectively protect depositors when bank thefts or other kinds of failures happen.
  - jellicle 13y ago
    > Regulatory reform does not prevent bank thefts Of course it does. Not 100%; but mostly. Your bank has multiple people handling all cash transactions, mandatory account balancing on at least a daily basis, all sorts of controls on its operations that you have no idea exist because the system facing you doesn't show them to you. It has these because they are required by law. Your bitcoin exchange has none of these.
nwh 13y ago
They were compromised in Janurary 2013 and made this comment: > Before the wild speculations beginn, the service will be recovered and we pay the losses out of our own pockets.[0] From the forums it looks like they lost funds again in May 2013 due to the RoR code execution bug (CVE-2013-0156): > After investigating the security breach we have to come to the conclusion that the attacker has been able to get root access to the systems. By the sounds of things they've been insolvent for over a year after both breaches and at this time just happened to get more withdraws than deposits. Terrifyingly in January, they "cleaned up" the server and kept on using it afterwards[2]. [0]: https://bitcointalk.org/index.php?topic=135919.msg1448056#msg1448056 https://bitcointalk.org/index.php?topic=135919.msg1448056#ms... [1]: https://bitcointalk.org/index.php?topic=49383.msg2102708#msg2102708 https://bitcointalk.org/index.php?topic=49383.msg2102708#msg... [2]: https://bitcointalk.org/index.php?topic=135919.msg1448204#msg1448204 https://bitcointalk.org/index.php?topic=135919.msg1448204#ms...
- xdocommer 13y ago
  Blame ruby... Blame malleability Blame ... I wish a real security expert would publish good practices for using crypto wallets
  - FedRegister 13y ago
    There's not much to publish. If you can't view the source, and it doesn't run on your computer, and you can't easily migrate from one to another then you can't trust it and shouldn't use it.
    - kordless 13y ago
      Hear, hear! I agree. For context, I'm implementing a compute exchange: https://www.stackmonkey.com/ https://www.stackmonkey.com/ - whitepaper: https://github.com/StackMonkey/xovio-pool/blob/master/whitepaper.md https://github.com/StackMonkey/xovio-pool/blob/master/whitep... While I'm not implementing a crypto currency exchange, I will still have to disburse float based funds over short periods of time. As the site code will be responsible for this, there exists a hypothetical opportunity for a bad agent to break in and siphon off those funds. I'm toying around with making it impossible to withdraw funds once they are deposited by a user. If funds were limited to penny value drips to keep instances running, the site could be made aware of larger transfers of value out of given addresses. If that was noticed by the system, another secret system could 'pull the plug' on the API tokens for the Coinbase API. I'll need Coinbase to implement token revokes in their API... Better, if the code is Open Source, I can have more eyeballs on it to prevent such an eventuality. You can review my code here: https://github.com/StackMonkey https://github.com/StackMonkey. The pool controller is the one which will need to be closely scrutinized. The appliance can only watch incoming payments, so it's not really that venerable. I choose to make all this code Open Source because it will be in charge of customer funds and, more importantly, the infrastructure of the Internet. Moving forward, I don't think it's a good idea to use anything hooked up to your Bitcoin float that isn't Open. Still, it's a choice people can make freely, even if it's a poor one. Education matters.
aegiso 13y ago
I won't speak to this particular case, but look at the incentives for any service that stores people's coins: -You can cash out (steal) an arbitrary amount of people's coins, blaming it on a "hack". If technically competent you can make it look as legitimate as you like, even giving a detailed post-mortem. -This will probably tarnish your operation and possibly your internet rep if the Google juice flows that way. So how much is your internet reputation worth? Personally, there's probably a number that would sway me. Until these incentives are changed somehow, with regulation or otherwise, it will happen.
- DennisP 13y ago
  Instead of changing incentives, we could remove the technical ability for services to do this. One solution is m-of-n transactions, which Bitcoin already implements. Set things up so that any two of three keys can sign a transaction and spend your coins. The online service gets one key, you keep another on your computer, and a third goes in your safe deposit box. Normally, you spend by signing a transaction from your computer and asking the service to do the same. The service can't spend coins without hacking your computer. If the service goes away, you pull the third key out of your safe deposit.
  - kiba 13y ago
    Which will shift the burden to individuals to secure their safetyboxes and safe, and backup their computers. However, it's a hell lot better than losing everyone's coins in one fell swoop.
  - mschuster91 13y ago
    This protects you from a busted exchange but it does not protect the exchange against fraudulent users or criminals.
- logicallee 13y ago
  >Personally, there's probably a number that would sway me. Uncharitably, I could say "So we've determined you're a thief, now we're just haggling about the price." But actually I don't think that thinking that there is a number that would probably sway you, means that that number really would. I'd like to think you'd actually say no to any number, through to billions. At the end of the day, morality isn't nearly as elastic as people suppose. You either have it or you don't.
raverbashing 13y ago
"Distribution logic 50% of the amount will be distributed top down and the other 50% will be distributed bottom up. " This seems, even by their own example, awful! It penalizes the holders with an average number of coins What could be better: for example, take 50% and pay at least X BTC to the holders. If the user has less than X BTC they receive their balance. Then, from the other 50% pay proportional to the value. For example, 1BTC for each BTC in balance (minus what was payed in the first step)
- notahacker 13y ago
  You assume honest intent. This is the ideal scheme if you wish to selectively repay a few shills whilst advising others that they will just have to wait.
- bwilliams18 13y ago
  I don't understand why they don't go through and pay everyone in equal proportion to what they currently have. Eg. 100 in total liabilities, they have 25 currently, everyone gets 1/4 of their total balance. Seems like the most equitable way to do it.
panarky 13y ago
Once again, statements from an exchange are vague and inconsistent. large fund withdrawals in the last weeks which have lead to a complete depletion of our cold wallet balance versus We'll take the current available cold storage balance and distribute it based on the below described distribution logic Is the cold wallet completely depleted or isn't it? And why choose such a cockamaime distribution scheme? 50% to the largest accounts and 50% to the smallest accounts? Why not pro rata based on each account's balance? So the largest accounts will enjoy 100% recovery while those in the middle get less, or even zero? This gives preference to certain accounts while providing the illusion of fairness. Yet again, there's no disclosure of a balance sheet, no visibility to total assets and liabilities. Why do people continue to trust their funds to incompetents and fraudsters?
- kiba 13y ago
  Why to people continue to trust their funds to incompetents and fraudsters? Because they live in a world where they can trust the system. However, in bitcoin land, they still behave they can still trust the system. Bitcoin and the core developers are the only group you can trust to any extent, really.
- matt_heimer 13y ago
  >Why do people continue to trust their funds to incompetents and fraudsters? At this point its a gamble. You either give up and admit Vircurex has lost all of your wallet or you keep using them and hope the profit they generate from you will make its way back into your wallet while at the same time hoping they don't have any more security issues. Its not so much "trust" as it is hope.
- kordless 13y ago
  Addressing you questioning the payout scheme. They are paying off large accounts first. Once those accounts are clear, you move on down the stack. By resolving the lower end accounts, you end up with less total users who 'have a problem'. That serves a few purposes, including encouraging the customer base to continue using the service, which serves the purpose of funding the rest of the users, including those in the middle. It also allows you to effectively address the issue with the remaining people who have funds frozen - something difficult to do with all users. I think your overall argument is based on cognitive dissonance. You'd like everyone to be paid in full immediately. That makes perfect sense to me, but it remains they lost funds. With that fact at hand, you can no longer hold the expectation of everyone being paid in full immediately and the situation of lost funds getting resolved. This makes you angry, and so you lash out with blaming statements which are logically flawed. Simply put, you are attacking something with an approach that makes no sense. The reason it makes no sense is because you are having an unresolvable argument with yourself! Honestly, I see no way of fixing this in a better way than what they have implemented. To me, that indicates we should extend some amount of trust they'll resolve this in a way that gets people's money back to them. Your last statement is probably the most valid, but may not be 100% applicable to Vicurex. I agree they appear to have been incompetent (which implies they may still be incompetent) but they don't appear to be fraudsters. Mt. Gox was both, if you ask me, because they never did a decent job of disclosing. To your first point, Vicurex should come clean now they've frozen funds and give estimates of recovery time.
ColinDabritz 13y ago
Why the odd distribution? This means some users get everything back now, and some get nothing? Perhaps it's an attempt to keep some customers happy ("well, I got everything back so I guess its alright") so that exchange will keep running? How can they justify anything but equally sharing the burden of the loss? "We owe X total and have Y available, so all accounts will get Y/X of their owed funds unfrozen, and the rest remain frozen."? I'm really not following the logic.
- kordless 13y ago
  Minimization of impact to a larger group of customers which then serves the purpose of keeping the exchange running so it can make money to pay off the others. If you incrementally pay out to all customers, a large number will refuse to continue using the service. It's a trust issue, really.
cryptolect 13y ago
I'm so glad I moved on from them a few months ago. Now, to make sure I only have my minimum funds on the current exchanges I use... I suppose I should also delete my Vircurex api library while at it.
LeonM 13y ago
That's a shame, I actually quite liked Vircurex for automated trading purposes. Luckily for me I've only got like .3 BTC currently on Vircurex, still sucks to see your own money "frozen" on some website not being able to get it back. The whole problem here looks to me as a flaw in the design of current crypto currencies, because transfers take that long to complete you will always need escrow type services to make it useful.
hibikir 13y ago
Regulation will not help, because the problem that causes this kind of stuff is embedded in bitcoin, but called a feature: Transactions are not reversible, and nobody can make transactions on a wallet other than the owner. So in a system built around this, any hack, from good old Mitnick-style social engineering attacks, to something purely technica, will cause irreparable loss. Any computer , network, or even individual that has control of enough coins will have a huge target planted on their heads, because all thefts are final. The security systems on a regular bank do not put fraud avoidance as their number one priority: That's just number two. What they really care about is fraud detection, because for most forms of fraud, and especially the ones that could ruin a bank, early detection allows them to undo the damage. If I could take a billion from Bank of America, and there was nothing that could be done about it after the fact, there would be millions of people working on finding ways to do just that. The payoff would be too great for it not to happen multiple times a year. So the best the Bitcoin fanatics can hope for is for the major thefts to be rare. Still, they will happen, it's just unavoidable when the stakes are that high, and the rules so in favor of the thief.
- sigil 13y ago
  "Stop Saying Bitcoin Transactions Aren't Reversible" http://elidourado.com/blog/bitcoin-arbitration/ http://elidourado.com/blog/bitcoin-arbitration/ Other commenters here have mentioned n-of-m multisignature transactions. This article describes how multisig works, and how it can be used to implement better arbitration than what's been possible with traditional payment systems. Unfortunately we're in the early days of Bitcoin here: support for multisig isn't common, and neither is the awareness of just how important it is for large transactions. We'll get there though.
  - hft_throwaway 13y ago
    You're still at a point where you require someone's reputation to be worth more than they'd gain from fraud. Say A buys from B with C as arbitrator. A can pay C to claim B never sent the goods and both A and C will be better off (A gets goods for a fraction of what he would have paid B, C gets fees from both parties plus a bribe).
Alex3917 13y ago
If you store your money in an unregulated exchange then you deserve whatever happens to you. This is basically no different than when people who don't back up their hard drive complain about losing all their stuff. If you want to make a trade then sure, put a couple hundred bucks in or whatever, but realize that whatever you have in the exchange could disappear at any time.
deleted 13y ago
[deleted]
taylorwc 13y ago
> The freezing of the balances is a one-time action, it does not affect future deposits in any ways. This is laughable. No effect on future deposits? Who in their right mind would continue to use them after this?
- rsynnott 13y ago
  People were still pumping money into MtGox after all withdrawals ended. The bitcoin community tends to be... trusting. Very, very trusting.
  - taylorwc 13y ago
    Bitcoin user natural selection, I suppose.
  - smtddr 13y ago
    There were also people sending[1] money into Silkroad 2.0 after it was hacked and they knew it and sent anyway. 1. http://www.reddit.com/r/SilkRoad/comments/1ylnmd/btc_not_showing_up_on_sr_20_account/cflq5ad http://www.reddit.com/r/SilkRoad/comments/1ylnmd/btc_not_sho...
  - vertis 13y ago
    The bitcoin community tends to be...greedy. Very, very greedy.
pearjuice 13y ago
Bitcoin is the future! No regulation needed! Get your unsecured wallet here! Can't wait for this currency to completely fade into obscurity - that's where it belongs because surely it has proved to not be a viable currency at all.
ndarilek 13y ago
Maybe naive, but here's what I wonder. Why doesn't someone write an exchange, open source the code, and build transparency in from the beginning? Publish every wallet address with no associated info so users can watch transactions on the blockchain. Publish cold wallet addresses too and automatically route, say, 90% of deposited BTC into those. With such a system, you could transfer in BTC and watch 90% of it go to an address the exchange claimed was a cold wallet (I don't know how to verify that other than by trust, but this level of transparency is at least more than what we have today.) Just to be clear on what I'm not saying, I don't claim this will solve all problems. I also don't claim that it is preferable to keep a significant amount of one's currency in a remote account. But people are going to do it anyway, angry/snarky/intelligently-worded arguments not withstanding. Why not embrace the transparency these platforms offer to buoy user confidence? Even if you could start your own exchange using this codebase more easily, most of the value from such a service comes from professionally maintaining quality infrastructure, providing trustable guarantees on security, etc. The alternative is a series of crappily-coded exchanges that will continue failing due to poor code and lack of transparency. I don't know how to solve the problem of nefarious parties starting exchanges with this code, but solving that problem isn't my intent.
nilnullzip 13y ago
Their example distribution is buggy. Users 3-6 all have the same 3BTC balance, yet they receive different distributions (users 3&4 get zero, user 5 gets 2BTC, and user 6 get 3BTC.)
e3pi 13y ago
"So following their academic study, Moore and Christin calculate a 1/3 failure rate for Bitcoin exchanges." "Just one year ago, a study by Computer scientists Tyler Moore Southern Methodist University in Dallas, Texas) and Nicolas Christin (of Carnegie Mellon University) found 40 exchanges offering bitcoin services. Of those 40, 18 went out of business — 13 without warning, including five that collapsed instantly following cyber attacks. Almost all of the exchanges that collapsed took their investors funds with them. They estimated that: “Exchanges handling 275 Bitcoins’ worth of transactions each day have a 20 percent chance of being breached, exchanges handling 5570 Bitcoins have a 70 percent chance of failure” It was calculated that in 2013 the median lifespan of any Bitcoin exchange is 381 days, with a 29.9 percent chance that a new exchange will close within a year of opening. So following their academic study, Moore and Christin calculate a 1/3 failure rate for Bitcoin exchanges…" http://www.cryptocoinsnews.com/2014/03/22/bitcoin-foundation-time-step/ http://www.cryptocoinsnews.com/2014/03/22/bitcoin-foundation...
zvanness 13y ago
Anyone here use Bitcoinity? The creator of the site, Kacper, has asked the bitcoin community to put pressure on the exchanges to: TL;DR exchanges can prove that: -they own specific amount of bitcoins -and that your bitcoins on their exchange are included in this amount https://bitcointalk.org/index.php?topic=22929.msg5286474#msg5286474 https://bitcointalk.org/index.php?topic=22929.msg5286474#msg... These stories are a bit alarming and can have some of us wondering if the exchanges we are using actually have the amount of coins they claim to have...
- jackgavigan 13y ago
  I don't understand why Bitcoin businesses don't simply exercise full transparency about their holdings through the blockchain.
  - foobarqux 13y ago
    How do you do that without bringing cold wallets online regularly?
    - jackgavigan 13y ago
      A wallet doesn't need to be online for to be identifiable and its balance verifiable through the blockchain.
      - foobarqux 13y ago
        It needs to come online to prove that you haven't lost the keys.
        jackgavigan 13y ago
        Or you could use the key to digitally sign a message (that contains something like a newspaper headline or football scoreline) periodically? Besides, I don't think losing the keys is the root cause of many exchanges' solvency issues.
jowiar 13y ago
So tonight I'm gonna party like it's 1929... Most US Financial regulation stemmed from Depression-era screwups. Thankfully, people-who-say-fiat are in their own little world that I can mostly ignore, but in the real, we're not doing much better with regards to forgetting the lessons of the depression. The 1999 Glass-Steagall repeal, for instance, was a major cause of the issues of the past decade.
3pt14159 13y ago
Bitcoin wallets shouldn't be accessible from the exchange's code base. When a user wants to transfer funds out there should be a small fee and a human should process it from an secured computer. The verification step should include signing either with a cryptographic key, logging on with a hard to hack account, like gmail, or by sms verification. None of this passport / utility bill bullshit. It's fucking amateur hour here.
- eropple 13y ago
  If there was such a fee, nobody would use your exchange. That's the beauty of this whole thing. The users self-select exchanges that are insecure because they're easy.
  - FootballMuse 13y ago
    Vircurex does charge a withdrawal fee. https://vircurex.com/welcome/help?locale=en https://vircurex.com/welcome/help?locale=en
    - eropple 13y ago
      Wow. Sorry, then: that's just indefensible.
      - yetfeo 13y ago
        Exchanges usually charge a withdrawal fee to cover transaction fees. BTC-e also charge a fee for example. Bitcoin software doesn't provide (an easy if possible at all) means to compute the fee up front to pass on to the receiver. So exchanges charge a fee that to cover the average cost per transaction.
brianmcdonough 13y ago
Where there are banks, there will always be bank robbers. This will never cease to be the case and the banks will always lose money this way. It's inevitable. So, the problem becomes one of scale. For example, a bank can survive a small unauthorized withdrawal, but large thefts are what kills the business. Limit the withdrawal sizes and shut down everything at a core level when that security is breached. The ability to move massive amounts around securely is a pipe dream.
- xdocommer 13y ago
  Excellent Ideas. Delays on large withdrawals, daily limits, monthly limits etc.
nraynaud 13y ago
Sometimes I get confused. Am I reading Argentina's banking history or am I reading bitcoin stories? I guess that's it for all the technologists giving simplistic lessons to some States about how they should manage their economies/banking systems.
troels 13y ago
I don't know much about the whole BTC protocol, but why aren't there any exchanges where funds are kept in the individual account holders wallets and the exchange only touches the money in a split second while transferring the funds? Or if this is already possible on some exchanges, why doesn't it happen more?
- josephagoss 13y ago
  If the exchange can automatically move money from an address, the hackers can get to those keys if they gain the same type of access that they are gaining in these hacks. The only way would be to use multisig, and have a trusted third party allow the coins to be moved if it was not suspicious.
tlrobinson 13y ago
FYI, it appears you can still exchange the frozen currencies (BTC, LTC, TRC, FTC) for unfrozen ones (DOGE, etc) and withdrawal that way. Naturally there's about a 25% premium for DOGE on Vircurex over other exchanges right now.
deleted 13y ago
[deleted]
bschwab 13y ago
Sold BTC for DOGE, then withdrew
jgalt212 13y ago
It's downright amazing to me how these exchange thefts/hacks have made barely a dent in the price of bitcoin. Or maybe the converse is true, if there were none of these massive swindles, would the price of bitcoin be much higher than it is right now? 2000 USD? 4000?

Frozen Funds

100 points by moe 13y ago

deleted 13y ago

[deleted]

elliottcarlson 13y ago
Completely unrelated to the discussion... And based on your previous submission of ponzidoge.com I am assuming self-promotion.
- xdocommer 13y ago
  just trying to get the next "investor" in. But overall I am disappointed with exchanges I keep all the crypto in the wallet and take out what I consider risk/loss to play/pay someone. The whole Idea of crypto is not to keep it with a designated third party.

Bootvis 13y ago

My largest fear with cryptocurrency is that my luck will run out (nothing bad has ever happened to my holdings) and I will lose a significant chunk of money. Most of my holdings are in cold wallets but news like this makes me shiver and makes me realize cryptocurrency needs more grown ups fast.

dcc1 13y ago
The problem is the gateways between fiat and crypto, where centralisation occurs and due to AML/KYC policies and banking regulations all of the worst aspects of banking can affect users bitcoin itself as the protocol/platform has proven to be quite solid the trick is to not keep coins in exchanges unless you are into trading, but then you know that you are taking a risk
- _delirium 13y ago
  You have considerable risk keeping the wallet locally, just of a different kind. The most common way people have lost money locally thus far is probably just losing the wallet file without having backups. A worm or trojan whose payload steals people's bitcoins is also plausible, though afaik there haven't been any yet.
  - Bootvis 13y ago
    Which indeed is my #1 fear, something nasty can be one `pip install` away.
    - maxerickson 13y ago
      If you have enough money tied up in it to make you uneasy it would seem sensible to be using dedicated hardware for your coin management (with only the bare necessities of software installed on it).
      - Bootvis 13y ago
        Thanks for the tip, motivated me to dust off the old Pentium 4 I have here and install OpenBSD on it.
  - smtddr 13y ago
    >>A worm or trojan whose payload steals people's bitcoins is also plausible, though afaik there haven't been any yet. There have been a couple of these actually: http://www.pcworld.com/article/2109000/bitcoinstealing-malware-hidden-in-mt-gox-data-dump-researcher-says.html http://www.pcworld.com/article/2109000/bitcoinstealing-malwa... http://www.computerworld.com/s/article/9244772/Bitcoin_market_price_app_39_Bitcoin_Alarm_39_is_carefully_cloaked_malware http://www.computerworld.com/s/article/9244772/Bitcoin_marke... http://www.coindesk.com/cointhief-mac-malware-steals-bitcoins/ http://www.coindesk.com/cointhief-mac-malware-steals-bitcoin... And the most famous probably, cryptolocker - http://en.wikipedia.org/wiki/CryptoLocker http://en.wikipedia.org/wiki/CryptoLocker ...though this is more a ransom strategy than just out-right theft.
- notahacker 13y ago
  It's disingenuous in the extreme to suggest that AML/KYC policies and banking regulations have anything to do with a significant proportion of all Bitcoins ever in circulation having disappeared from counterparties claiming they were hacked. Real, regulated banks do not simply lose significant fractions of dollars in circulation. It has a lot more to do with bad code, bad storage policies or bad intentions on the part of the exchanges, and most of them point to transaction malleability - a design flaw in the original protocol - as their excuse.
  - dcc1 13y ago
    The steep barriers to entry into becoming an exchange due to these laws/policies and the whole cloudy and non clear nature of what protocols to adhere in each country ensure that exchanges are not started by the most competent but by the most reckless and foolish, see magic the gathering. There are several exchanges in the works but they are bogged down with regulation and not able to open.
    - danielahn 13y ago
      So... you're saying its easy for the reckless and foolish to somehow overcome these steep barriers and understand what it takes to open while those who are competent are unable to do so?
      - nhaehnle 13y ago
        He's saying that those who understand what it takes to build a secure service see the problem as so difficult that they prefer to use their talents for something else. As a consequence, the services that do exist have been built by reckless people who don't understand the issue. I don't know whether that's true, but that's what s/he wrote. It's an easy enough to understand and plausible notion.
      - dcc1 13y ago
        You obviously never had to deal with bureaucrats, right now the 2nd biggest exchange BTC-e is runny by some shady eastern europeans who are simply ignoring all laws. The biggest exchange Mtgox was run by an incompetent fool who lost half a billion in the cushion of his couch or something. Bitstamp seem to be doing the right things but I doubt that they can legally operate in US or take transfers from/to US as they are doing.
- deleted 13y ago
  [deleted]
yetfeo 13y ago
As long as you hold the private keys yourself and don't keep them on third party websites your holdings are safe. Safer than cash since you can encrypt and back up the keys.

macspoofing 13y ago

Urgh. They are insolvent, but in denial. Who in their right mind would even think to trade on this exchange now.

thinkcomp 13y ago

Until we get regulatory reform on a federal level, this will keep happening. http://www.plainsite.org/issues/index.html?id=2 http://www.plainsite.org/issues/index.html?id=2

fennecfoxen 13y ago
Which federal level were you thinking of? US? What about the rest of the world?
- thinkcomp 13y ago
  I'm concerned about the United States first, and the rest of the world later.
pdq 13y ago
Nonsense. Regulatory reform does not prevent bank thefts, in the same way as it will not prevent digital thefts due to security vulnerabilities. Also note that banks are legally allowed to run as fractional reserves. This means your $100 deposit is only backed by a minimum of $10 in the vault at any time. Companies will be (and already are) getting smarter, by hiring security experts to audit software and detect vulnerabilities, and more transparent, by providing public accounting of funds to prove they are not running Ponzi schemes or fractional reserves.
- thinkcomp 13y ago
  The point of regulation isn't to prevent bank thefts. It's to effectively protect depositors when bank thefts or other kinds of failures happen.
- jellicle 13y ago
  > Regulatory reform does not prevent bank thefts Of course it does. Not 100%; but mostly. Your bank has multiple people handling all cash transactions, mandatory account balancing on at least a daily basis, all sorts of controls on its operations that you have no idea exist because the system facing you doesn't show them to you. It has these because they are required by law. Your bitcoin exchange has none of these.

nwh 13y ago

They were compromised in Janurary 2013 and made this comment: > Before the wild speculations beginn, the service will be recovered and we pay the losses out of our own pockets.[0] From the forums it looks like they lost funds again in May 2013 due to the RoR code execution bug (CVE-2013-0156): > After investigating the security breach we have to come to the conclusion that the attacker has been able to get root access to the systems. By the sounds of things they've been insolvent for over a year after both breaches and at this time just happened to get more withdraws than deposits. Terrifyingly in January, they "cleaned up" the server and kept on using it afterwards[2]. [0]: https://bitcointalk.org/index.php?topic=135919.msg1448056#msg1448056 https://bitcointalk.org/index.php?topic=135919.msg1448056#ms... [1]: https://bitcointalk.org/index.php?topic=49383.msg2102708#msg2102708 https://bitcointalk.org/index.php?topic=49383.msg2102708#msg... [2]: https://bitcointalk.org/index.php?topic=135919.msg1448204#msg1448204 https://bitcointalk.org/index.php?topic=135919.msg1448204#ms...

xdocommer 13y ago
Blame ruby... Blame malleability Blame ... I wish a real security expert would publish good practices for using crypto wallets
- FedRegister 13y ago
  There's not much to publish. If you can't view the source, and it doesn't run on your computer, and you can't easily migrate from one to another then you can't trust it and shouldn't use it.
  - kordless 13y ago
    Hear, hear! I agree. For context, I'm implementing a compute exchange: https://www.stackmonkey.com/ https://www.stackmonkey.com/ - whitepaper: https://github.com/StackMonkey/xovio-pool/blob/master/whitepaper.md https://github.com/StackMonkey/xovio-pool/blob/master/whitep... While I'm not implementing a crypto currency exchange, I will still have to disburse float based funds over short periods of time. As the site code will be responsible for this, there exists a hypothetical opportunity for a bad agent to break in and siphon off those funds. I'm toying around with making it impossible to withdraw funds once they are deposited by a user. If funds were limited to penny value drips to keep instances running, the site could be made aware of larger transfers of value out of given addresses. If that was noticed by the system, another secret system could 'pull the plug' on the API tokens for the Coinbase API. I'll need Coinbase to implement token revokes in their API... Better, if the code is Open Source, I can have more eyeballs on it to prevent such an eventuality. You can review my code here: https://github.com/StackMonkey https://github.com/StackMonkey. The pool controller is the one which will need to be closely scrutinized. The appliance can only watch incoming payments, so it's not really that venerable. I choose to make all this code Open Source because it will be in charge of customer funds and, more importantly, the infrastructure of the Internet. Moving forward, I don't think it's a good idea to use anything hooked up to your Bitcoin float that isn't Open. Still, it's a choice people can make freely, even if it's a poor one. Education matters.

aegiso 13y ago

I won't speak to this particular case, but look at the incentives for any service that stores people's coins: -You can cash out (steal) an arbitrary amount of people's coins, blaming it on a "hack". If technically competent you can make it look as legitimate as you like, even giving a detailed post-mortem. -This will probably tarnish your operation and possibly your internet rep if the Google juice flows that way. So how much is your internet reputation worth? Personally, there's probably a number that would sway me. Until these incentives are changed somehow, with regulation or otherwise, it will happen.

DennisP 13y ago
Instead of changing incentives, we could remove the technical ability for services to do this. One solution is m-of-n transactions, which Bitcoin already implements. Set things up so that any two of three keys can sign a transaction and spend your coins. The online service gets one key, you keep another on your computer, and a third goes in your safe deposit box. Normally, you spend by signing a transaction from your computer and asking the service to do the same. The service can't spend coins without hacking your computer. If the service goes away, you pull the third key out of your safe deposit.
- kiba 13y ago
  Which will shift the burden to individuals to secure their safetyboxes and safe, and backup their computers. However, it's a hell lot better than losing everyone's coins in one fell swoop.
- mschuster91 13y ago
  This protects you from a busted exchange but it does not protect the exchange against fraudulent users or criminals.
logicallee 13y ago
>Personally, there's probably a number that would sway me. Uncharitably, I could say "So we've determined you're a thief, now we're just haggling about the price." But actually I don't think that thinking that there is a number that would probably sway you, means that that number really would. I'd like to think you'd actually say no to any number, through to billions. At the end of the day, morality isn't nearly as elastic as people suppose. You either have it or you don't.

raverbashing 13y ago

"Distribution logic 50% of the amount will be distributed top down and the other 50% will be distributed bottom up. " This seems, even by their own example, awful! It penalizes the holders with an average number of coins What could be better: for example, take 50% and pay at least X BTC to the holders. If the user has less than X BTC they receive their balance. Then, from the other 50% pay proportional to the value. For example, 1BTC for each BTC in balance (minus what was payed in the first step)

notahacker 13y ago
You assume honest intent. This is the ideal scheme if you wish to selectively repay a few shills whilst advising others that they will just have to wait.
bwilliams18 13y ago
I don't understand why they don't go through and pay everyone in equal proportion to what they currently have. Eg. 100 in total liabilities, they have 25 currently, everyone gets 1/4 of their total balance. Seems like the most equitable way to do it.

panarky 13y ago

Once again, statements from an exchange are vague and inconsistent. large fund withdrawals in the last weeks which have lead to a complete depletion of our cold wallet balance versus We'll take the current available cold storage balance and distribute it based on the below described distribution logic Is the cold wallet completely depleted or isn't it? And why choose such a cockamaime distribution scheme? 50% to the largest accounts and 50% to the smallest accounts? Why not pro rata based on each account's balance? So the largest accounts will enjoy 100% recovery while those in the middle get less, or even zero? This gives preference to certain accounts while providing the illusion of fairness. Yet again, there's no disclosure of a balance sheet, no visibility to total assets and liabilities. Why do people continue to trust their funds to incompetents and fraudsters?

kiba 13y ago
Why to people continue to trust their funds to incompetents and fraudsters? Because they live in a world where they can trust the system. However, in bitcoin land, they still behave they can still trust the system. Bitcoin and the core developers are the only group you can trust to any extent, really.
matt_heimer 13y ago
>Why do people continue to trust their funds to incompetents and fraudsters? At this point its a gamble. You either give up and admit Vircurex has lost all of your wallet or you keep using them and hope the profit they generate from you will make its way back into your wallet while at the same time hoping they don't have any more security issues. Its not so much "trust" as it is hope.
kordless 13y ago
Addressing you questioning the payout scheme. They are paying off large accounts first. Once those accounts are clear, you move on down the stack. By resolving the lower end accounts, you end up with less total users who 'have a problem'. That serves a few purposes, including encouraging the customer base to continue using the service, which serves the purpose of funding the rest of the users, including those in the middle. It also allows you to effectively address the issue with the remaining people who have funds frozen - something difficult to do with all users. I think your overall argument is based on cognitive dissonance. You'd like everyone to be paid in full immediately. That makes perfect sense to me, but it remains they lost funds. With that fact at hand, you can no longer hold the expectation of everyone being paid in full immediately and the situation of lost funds getting resolved. This makes you angry, and so you lash out with blaming statements which are logically flawed. Simply put, you are attacking something with an approach that makes no sense. The reason it makes no sense is because you are having an unresolvable argument with yourself! Honestly, I see no way of fixing this in a better way than what they have implemented. To me, that indicates we should extend some amount of trust they'll resolve this in a way that gets people's money back to them. Your last statement is probably the most valid, but may not be 100% applicable to Vicurex. I agree they appear to have been incompetent (which implies they may still be incompetent) but they don't appear to be fraudsters. Mt. Gox was both, if you ask me, because they never did a decent job of disclosing. To your first point, Vicurex should come clean now they've frozen funds and give estimates of recovery time.

ColinDabritz 13y ago

Why the odd distribution? This means some users get everything back now, and some get nothing? Perhaps it's an attempt to keep some customers happy ("well, I got everything back so I guess its alright") so that exchange will keep running? How can they justify anything but equally sharing the burden of the loss? "We owe X total and have Y available, so all accounts will get Y/X of their owed funds unfrozen, and the rest remain frozen."? I'm really not following the logic.

kordless 13y ago
Minimization of impact to a larger group of customers which then serves the purpose of keeping the exchange running so it can make money to pay off the others. If you incrementally pay out to all customers, a large number will refuse to continue using the service. It's a trust issue, really.

cryptolect 13y ago

I'm so glad I moved on from them a few months ago. Now, to make sure I only have my minimum funds on the current exchanges I use... I suppose I should also delete my Vircurex api library while at it.

LeonM 13y ago

That's a shame, I actually quite liked Vircurex for automated trading purposes. Luckily for me I've only got like .3 BTC currently on Vircurex, still sucks to see your own money "frozen" on some website not being able to get it back. The whole problem here looks to me as a flaw in the design of current crypto currencies, because transfers take that long to complete you will always need escrow type services to make it useful.

hibikir 13y ago

Regulation will not help, because the problem that causes this kind of stuff is embedded in bitcoin, but called a feature: Transactions are not reversible, and nobody can make transactions on a wallet other than the owner. So in a system built around this, any hack, from good old Mitnick-style social engineering attacks, to something purely technica, will cause irreparable loss. Any computer , network, or even individual that has control of enough coins will have a huge target planted on their heads, because all thefts are final. The security systems on a regular bank do not put fraud avoidance as their number one priority: That's just number two. What they really care about is fraud detection, because for most forms of fraud, and especially the ones that could ruin a bank, early detection allows them to undo the damage. If I could take a billion from Bank of America, and there was nothing that could be done about it after the fact, there would be millions of people working on finding ways to do just that. The payoff would be too great for it not to happen multiple times a year. So the best the Bitcoin fanatics can hope for is for the major thefts to be rare. Still, they will happen, it's just unavoidable when the stakes are that high, and the rules so in favor of the thief.

sigil 13y ago
"Stop Saying Bitcoin Transactions Aren't Reversible" http://elidourado.com/blog/bitcoin-arbitration/ http://elidourado.com/blog/bitcoin-arbitration/ Other commenters here have mentioned n-of-m multisignature transactions. This article describes how multisig works, and how it can be used to implement better arbitration than what's been possible with traditional payment systems. Unfortunately we're in the early days of Bitcoin here: support for multisig isn't common, and neither is the awareness of just how important it is for large transactions. We'll get there though.
- hft_throwaway 13y ago
  You're still at a point where you require someone's reputation to be worth more than they'd gain from fraud. Say A buys from B with C as arbitrator. A can pay C to claim B never sent the goods and both A and C will be better off (A gets goods for a fraction of what he would have paid B, C gets fees from both parties plus a bribe).

Alex3917 13y ago

If you store your money in an unregulated exchange then you deserve whatever happens to you. This is basically no different than when people who don't back up their hard drive complain about losing all their stuff. If you want to make a trade then sure, put a couple hundred bucks in or whatever, but realize that whatever you have in the exchange could disappear at any time.

deleted 13y ago

[deleted]

taylorwc 13y ago

> The freezing of the balances is a one-time action, it does not affect future deposits in any ways. This is laughable. No effect on future deposits? Who in their right mind would continue to use them after this?

rsynnott 13y ago
People were still pumping money into MtGox after all withdrawals ended. The bitcoin community tends to be... trusting. Very, very trusting.
- taylorwc 13y ago
  Bitcoin user natural selection, I suppose.
- smtddr 13y ago
  There were also people sending[1] money into Silkroad 2.0 after it was hacked and they knew it and sent anyway. 1. http://www.reddit.com/r/SilkRoad/comments/1ylnmd/btc_not_showing_up_on_sr_20_account/cflq5ad http://www.reddit.com/r/SilkRoad/comments/1ylnmd/btc_not_sho...
- vertis 13y ago
  The bitcoin community tends to be...greedy. Very, very greedy.

pearjuice 13y ago

Bitcoin is the future! No regulation needed! Get your unsecured wallet here! Can't wait for this currency to completely fade into obscurity - that's where it belongs because surely it has proved to not be a viable currency at all.

ndarilek 13y ago

Maybe naive, but here's what I wonder. Why doesn't someone write an exchange, open source the code, and build transparency in from the beginning? Publish every wallet address with no associated info so users can watch transactions on the blockchain. Publish cold wallet addresses too and automatically route, say, 90% of deposited BTC into those. With such a system, you could transfer in BTC and watch 90% of it go to an address the exchange claimed was a cold wallet (I don't know how to verify that other than by trust, but this level of transparency is at least more than what we have today.) Just to be clear on what I'm not saying, I don't claim this will solve all problems. I also don't claim that it is preferable to keep a significant amount of one's currency in a remote account. But people are going to do it anyway, angry/snarky/intelligently-worded arguments not withstanding. Why not embrace the transparency these platforms offer to buoy user confidence? Even if you could start your own exchange using this codebase more easily, most of the value from such a service comes from professionally maintaining quality infrastructure, providing trustable guarantees on security, etc. The alternative is a series of crappily-coded exchanges that will continue failing due to poor code and lack of transparency. I don't know how to solve the problem of nefarious parties starting exchanges with this code, but solving that problem isn't my intent.

nilnullzip 13y ago

Their example distribution is buggy. Users 3-6 all have the same 3BTC balance, yet they receive different distributions (users 3&4 get zero, user 5 gets 2BTC, and user 6 get 3BTC.)

e3pi 13y ago

"So following their academic study, Moore and Christin calculate a 1/3 failure rate for Bitcoin exchanges." "Just one year ago, a study by Computer scientists Tyler Moore Southern Methodist University in Dallas, Texas) and Nicolas Christin (of Carnegie Mellon University) found 40 exchanges offering bitcoin services. Of those 40, 18 went out of business — 13 without warning, including five that collapsed instantly following cyber attacks. Almost all of the exchanges that collapsed took their investors funds with them. They estimated that: “Exchanges handling 275 Bitcoins’ worth of transactions each day have a 20 percent chance of being breached, exchanges handling 5570 Bitcoins have a 70 percent chance of failure” It was calculated that in 2013 the median lifespan of any Bitcoin exchange is 381 days, with a 29.9 percent chance that a new exchange will close within a year of opening. So following their academic study, Moore and Christin calculate a 1/3 failure rate for Bitcoin exchanges…" http://www.cryptocoinsnews.com/2014/03/22/bitcoin-foundation-time-step/ http://www.cryptocoinsnews.com/2014/03/22/bitcoin-foundation...

zvanness 13y ago

Anyone here use Bitcoinity? The creator of the site, Kacper, has asked the bitcoin community to put pressure on the exchanges to: TL;DR exchanges can prove that: -they own specific amount of bitcoins -and that your bitcoins on their exchange are included in this amount https://bitcointalk.org/index.php?topic=22929.msg5286474#msg5286474 https://bitcointalk.org/index.php?topic=22929.msg5286474#msg... These stories are a bit alarming and can have some of us wondering if the exchanges we are using actually have the amount of coins they claim to have...

jackgavigan 13y ago
I don't understand why Bitcoin businesses don't simply exercise full transparency about their holdings through the blockchain.
- foobarqux 13y ago
  How do you do that without bringing cold wallets online regularly?
  - jackgavigan 13y ago
    A wallet doesn't need to be online for to be identifiable and its balance verifiable through the blockchain.
    - foobarqux 13y ago
      It needs to come online to prove that you haven't lost the keys.
      - jackgavigan 13y ago
        Or you could use the key to digitally sign a message (that contains something like a newspaper headline or football scoreline) periodically? Besides, I don't think losing the keys is the root cause of many exchanges' solvency issues.

jowiar 13y ago

So tonight I'm gonna party like it's 1929... Most US Financial regulation stemmed from Depression-era screwups. Thankfully, people-who-say-fiat are in their own little world that I can mostly ignore, but in the real, we're not doing much better with regards to forgetting the lessons of the depression. The 1999 Glass-Steagall repeal, for instance, was a major cause of the issues of the past decade.

3pt14159 13y ago

Bitcoin wallets shouldn't be accessible from the exchange's code base. When a user wants to transfer funds out there should be a small fee and a human should process it from an secured computer. The verification step should include signing either with a cryptographic key, logging on with a hard to hack account, like gmail, or by sms verification. None of this passport / utility bill bullshit. It's fucking amateur hour here.

eropple 13y ago
If there was such a fee, nobody would use your exchange. That's the beauty of this whole thing. The users self-select exchanges that are insecure because they're easy.
- FootballMuse 13y ago
  Vircurex does charge a withdrawal fee. https://vircurex.com/welcome/help?locale=en https://vircurex.com/welcome/help?locale=en
  - eropple 13y ago
    Wow. Sorry, then: that's just indefensible.
    - yetfeo 13y ago
      Exchanges usually charge a withdrawal fee to cover transaction fees. BTC-e also charge a fee for example. Bitcoin software doesn't provide (an easy if possible at all) means to compute the fee up front to pass on to the receiver. So exchanges charge a fee that to cover the average cost per transaction.

brianmcdonough 13y ago

Where there are banks, there will always be bank robbers. This will never cease to be the case and the banks will always lose money this way. It's inevitable. So, the problem becomes one of scale. For example, a bank can survive a small unauthorized withdrawal, but large thefts are what kills the business. Limit the withdrawal sizes and shut down everything at a core level when that security is breached. The ability to move massive amounts around securely is a pipe dream.

xdocommer 13y ago
Excellent Ideas. Delays on large withdrawals, daily limits, monthly limits etc.

nraynaud 13y ago

Sometimes I get confused. Am I reading Argentina's banking history or am I reading bitcoin stories? I guess that's it for all the technologists giving simplistic lessons to some States about how they should manage their economies/banking systems.

troels 13y ago

I don't know much about the whole BTC protocol, but why aren't there any exchanges where funds are kept in the individual account holders wallets and the exchange only touches the money in a split second while transferring the funds? Or if this is already possible on some exchanges, why doesn't it happen more?

josephagoss 13y ago
If the exchange can automatically move money from an address, the hackers can get to those keys if they gain the same type of access that they are gaining in these hacks. The only way would be to use multisig, and have a trusted third party allow the coins to be moved if it was not suspicious.

tlrobinson 13y ago

FYI, it appears you can still exchange the frozen currencies (BTC, LTC, TRC, FTC) for unfrozen ones (DOGE, etc) and withdrawal that way. Naturally there's about a 25% premium for DOGE on Vircurex over other exchanges right now.

deleted 13y ago

[deleted]

bschwab 13y ago

Sold BTC for DOGE, then withdrew

jgalt212 13y ago

It's downright amazing to me how these exchange thefts/hacks have made barely a dent in the price of bitcoin. Or maybe the converse is true, if there were none of these massive swindles, would the price of bitcoin be much higher than it is right now? 2000 USD? 4000?