11 ms·

Coinbase Insured

137 points by markmassie 12y ago

dsil 12y ago
Unless I'm misunderstanding, they're really saying they're now insured for ~3% of the BTC they hold. For security, they've always said they only store about that much online, the rest is offline cold storage, but this post says: "Coinbase is now insured against theft and hacking in an amount that exceeds the average value of bitcoin it holds in online storage at any given time." So you're still at the mercy of their offline storage security. Not saying there is a better option for most people, but this wouldn't protect you against a Gox-like breach.
- supermatt 12y ago
  That was the impression I also got from the post. It would be nice to have someone from coinbase clarify.
- NotAtWork 12y ago
  > The insurance covers losses due to breaches in physical or cyber security, accidental loss, and employee theft. I'm not convinced that this even protects the online wallet against Mt Gox style corporate malfeasance, where much of the damage was done as an intentional corporate decision by the leadership. (I'm conjecturing that's what happened at Mt Gox; regardless, this seems not to cover against them trying something intentionally with their coins related to trading, and then losing them all.) Additionally, as you pointed out, this only covers a very small portion of their holdings - a percentage smaller than the number of Mt Gox coins that were "recovered" (about 25%). Finally, Coinbase being insured against the value of the bitcoin loss doesn't translate in to you being covered, as Coinbase may accrue other debts they have to pay off before your holding in the event of a hack large enough to cause a serious business disturbance, such as paying off creditors with higher standing.
  - nostromo 12y ago
    That's key: Coinbase is insured. With FDIC, the depositor is insured, not the bank. This is the bank being insured, not the depositor.
    - ewoodrich 12y ago
      And in the case of FDIC, evidence of gross malfeasance on the part of the bank would likely result in a seizure of the bank and its assets. The FDIC then becomes the "receiver"[1], entrusted with ensuring as many of remaining funds can be returned, and any covered and outstanding amount paid by the insurance. [1] https://www.fdic.gov/about/strategic/strategic/receivership.html https://www.fdic.gov/about/strategic/strategic/receivership....
  - larrys 12y ago
    "Finally, Coinbase being insured against the value of the bitcoin loss doesn't translate in to you being covered" Additionally I'm very curious why they never disclosed this publicly before. It's a decent marketing and selling point so there must be some reason they decided (or were required) to keep it under wraps for so long.
- smtddr 12y ago
  >>So you're still at the mercy of their offline storage security. Not saying there is a better option for most people, but this wouldn't protect you against a Gox-like breach. Just FYI, Coinbase's staff is infinitely superior to the embarrassing shenanigans of MtGox. If you want to get an idea of what they're doing, jump to 12min30secs in this video https://www.youtube.com/watch?v=ZwG1roO70co https://www.youtube.com/watch?v=ZwG1roO70co Assuming that Bitcoins won't be FDIC insured in the foreseeable future, this is as good as it gets imho unless you feel better moving the majority of your coins to your own address and keeping the private-key yourself. _______ And as always, Disclaimer: Bitcoins are not FDIC insured and it's still wild-west out there. Don't play with money you cannot afford to lose without any recourse.
polarix 12y ago
How are premiums calculated for this kind of insurance? Are there software insurance tiers based on code & systems inspections?
NotAtWork 12y ago
The bitcoin insurance policy I want from an exchange is where they insure me against loss due to actions taken by the exchange and underwritten by a major underwriter, and not the exchange itself. Only then would I really believe that the exchange meant to protect my bitcoins fully, because they've essentially put themselves on the hook for the damages (by having to bear the cost of the insurance policy, recouped by some kind of holding fee or transaction fee). The exchange having insurance does relatively little to protect me against loss, even if it's a smart business move on their part to limit their losses to creditors in the event of a theft of inventory. That's only sane business, and it's a little crazy how long it took that to become normal in bitcoin. It seems (naively) reasonable that the exchange could float something like 10k-20k policies of some mixture of 0.1btc, 0.5btc, and 1btc protection, depending on the level of activity in an account, and require that anyone holding more bitcoin than that in their trading account take out a separate policy for that amount or else acknowledge that they're only protected up to 1btc. (An additional corporate policy against theft of inventory seems reasonable, and likely would lower the rate on these separate policies, since the underwriter would know you could cover some degree of loss already, through that policy.) Edit: Thinking about the numbers, it would only be ~$20 million of coverage to cover 50,000 customers (40,000 at 0.5btc and 10,000 at 1btc). This seems reasonable.
drcode 12y ago
For people not experienced with bitcoin: For some types of bitcoin wallets the user retains their own private key, whereas with other wallets they have to trust a 3rd party (like coinbase) with their keys. This second type isn't really a wallet any more, per se... it's more like a bank that you are trusting with your money. Of course, bitcoin startups really want to use the second model, where THEY control the money, which gives them many more avenues for profit: As any salesman knows, the closer you are to the money in a business, the more money you're likely to make yourself. This means bitcoin companies are bending over backwards to say "look how safe your money is!" However, be aware if you ever buy bitcoins, it is much better to store your own bitcoins or use a wallet that allows you to manage your own private keys, or use a (now trendy) multisig wallet where the wallet company can't move money without your permission. If a bitcoin bank says "We insure our bitcoins" your best response is "No thanks, I'd rather not have to trust you with my money in the first place." The whole raison d'être of bitcoin is that such trust isn't necessary.
- imaginenore 12y ago
  You actually didn't give a single good reason not to trust insured 3rd party storage. You just jumped to conclusion while shitting on companies that are improving bitcoin security.
  - wehadfun 12y ago
    Mt. Gox provided a very good reason not to trust a 3rd party
    - jeremyjh 12y ago
      Though it was it was not the first (or second, or third) such example.
    - imaginenore 12y ago
      Mt. Gox didn't offer insured storage.
  - drcode 12y ago
thinkcomp 12y ago
Regardless of whatever private insurance it has, Coinbase does not have a money transmission license in California or a surety bond as required by federal and state law. They know they need one; they have applied in other states, such as Florida. See https://archive.org/download/coinbasefloridamtl/20140415.coinbaseflorida.pdf https://archive.org/download/coinbasefloridamtl/20140415.coi.... Interestingly, Coinbase appears to offer false information to the State of Florida in item 6(A)(2) of its application, which has since been withdrawn. Coinbase did receive a subpoena in the NY DFS's investigation of various Bitcoin companies in August, 2013. See http://www.reuters.com/article/2013/08/12/us-digitalcurrency-subpoena-bitcoin-idUSBRE97B03720130812 http://www.reuters.com/article/2013/08/12/us-digitalcurrency....
- aidenn0 12y ago
  I don't know how anyone who reads your experience with facecash could come to any conclusion other than the only way to innovate in payments is to brazenly break the law and never even try to deal with the California DFI.
  - thinkcomp 12y ago
    One difference between my experience with regulators and Coinbase's is about $31.7 million in venture capital funding. Compliance is expensive, but they can afford it.
    - wmf 12y ago
      I'm reminded of the old saying that rich people didn't get rich by being loose with their money.
      - polarix 12y ago
        I would hardly consider negotiating with authorities "being loose with their money"...
        12y ago
jordanbrown 12y ago
Off topic, but why does it still take 4 days to buy bitcoins from the site?
- drcode 12y ago
  Same reason as always: The existing payment system used in the world has a weird system of "chargebacks" which mean that it's hard to know that any transaction is ever "final" and can be considered completed. This flaw in the traditional payment infrastructure makes it hard for coinbase to hand you over your coins even if they received a perfectly valid bank wire or credit card payment.
  - ewoodrich 12y ago
    Whether it's a "flaw" is in the eye of the beholder. I have confidence buying from questionable online merchants using a credit card because I know I have a recourse if they are deceptive. I would say it's more of an issue of incompatibility between the systems rather than a real "flaw" in either.
  - orteipid 12y ago
    This reply is so bitcoin.txt that I honestly don't even know where to begin.
  - jdong 12y ago
    Except waiting 4 days really wont help you against chargebacks.
tszming 12y ago
>> Our users, of course, won’t be charged for this insurance. So, where the money came from?
- prolixus 12y ago
  Insurance is a cost of doing business. Coinbase generates their revenue from fees on the purchase and sale bitcoin, and from fees on merchant services. That's where the money comes from.
easyfree37 12y ago
"Our users, of course, won’t be charged for this insurance." Of course. For now.

137 points by markmassie 12y ago

dsil 12y ago

Unless I'm misunderstanding, they're really saying they're now insured for ~3% of the BTC they hold. For security, they've always said they only store about that much online, the rest is offline cold storage, but this post says: "Coinbase is now insured against theft and hacking in an amount that exceeds the average value of bitcoin it holds in online storage at any given time." So you're still at the mercy of their offline storage security. Not saying there is a better option for most people, but this wouldn't protect you against a Gox-like breach.

supermatt 12y ago
That was the impression I also got from the post. It would be nice to have someone from coinbase clarify.
NotAtWork 12y ago
> The insurance covers losses due to breaches in physical or cyber security, accidental loss, and employee theft. I'm not convinced that this even protects the online wallet against Mt Gox style corporate malfeasance, where much of the damage was done as an intentional corporate decision by the leadership. (I'm conjecturing that's what happened at Mt Gox; regardless, this seems not to cover against them trying something intentionally with their coins related to trading, and then losing them all.) Additionally, as you pointed out, this only covers a very small portion of their holdings - a percentage smaller than the number of Mt Gox coins that were "recovered" (about 25%). Finally, Coinbase being insured against the value of the bitcoin loss doesn't translate in to you being covered, as Coinbase may accrue other debts they have to pay off before your holding in the event of a hack large enough to cause a serious business disturbance, such as paying off creditors with higher standing.
- nostromo 12y ago
  That's key: Coinbase is insured. With FDIC, the depositor is insured, not the bank. This is the bank being insured, not the depositor.
  - ewoodrich 12y ago
    And in the case of FDIC, evidence of gross malfeasance on the part of the bank would likely result in a seizure of the bank and its assets. The FDIC then becomes the "receiver"[1], entrusted with ensuring as many of remaining funds can be returned, and any covered and outstanding amount paid by the insurance. [1] https://www.fdic.gov/about/strategic/strategic/receivership.html https://www.fdic.gov/about/strategic/strategic/receivership....
- larrys 12y ago
  "Finally, Coinbase being insured against the value of the bitcoin loss doesn't translate in to you being covered" Additionally I'm very curious why they never disclosed this publicly before. It's a decent marketing and selling point so there must be some reason they decided (or were required) to keep it under wraps for so long.
smtddr 12y ago
>>So you're still at the mercy of their offline storage security. Not saying there is a better option for most people, but this wouldn't protect you against a Gox-like breach. Just FYI, Coinbase's staff is infinitely superior to the embarrassing shenanigans of MtGox. If you want to get an idea of what they're doing, jump to 12min30secs in this video https://www.youtube.com/watch?v=ZwG1roO70co https://www.youtube.com/watch?v=ZwG1roO70co Assuming that Bitcoins won't be FDIC insured in the foreseeable future, this is as good as it gets imho unless you feel better moving the majority of your coins to your own address and keeping the private-key yourself. _______ And as always, Disclaimer: Bitcoins are not FDIC insured and it's still wild-west out there. Don't play with money you cannot afford to lose without any recourse.

polarix 12y ago

How are premiums calculated for this kind of insurance? Are there software insurance tiers based on code & systems inspections?

NotAtWork 12y ago

The bitcoin insurance policy I want from an exchange is where they insure me against loss due to actions taken by the exchange and underwritten by a major underwriter, and not the exchange itself. Only then would I really believe that the exchange meant to protect my bitcoins fully, because they've essentially put themselves on the hook for the damages (by having to bear the cost of the insurance policy, recouped by some kind of holding fee or transaction fee). The exchange having insurance does relatively little to protect me against loss, even if it's a smart business move on their part to limit their losses to creditors in the event of a theft of inventory. That's only sane business, and it's a little crazy how long it took that to become normal in bitcoin. It seems (naively) reasonable that the exchange could float something like 10k-20k policies of some mixture of 0.1btc, 0.5btc, and 1btc protection, depending on the level of activity in an account, and require that anyone holding more bitcoin than that in their trading account take out a separate policy for that amount or else acknowledge that they're only protected up to 1btc. (An additional corporate policy against theft of inventory seems reasonable, and likely would lower the rate on these separate policies, since the underwriter would know you could cover some degree of loss already, through that policy.) Edit: Thinking about the numbers, it would only be ~$20 million of coverage to cover 50,000 customers (40,000 at 0.5btc and 10,000 at 1btc). This seems reasonable.

drcode 12y ago

For people not experienced with bitcoin: For some types of bitcoin wallets the user retains their own private key, whereas with other wallets they have to trust a 3rd party (like coinbase) with their keys. This second type isn't really a wallet any more, per se... it's more like a bank that you are trusting with your money. Of course, bitcoin startups really want to use the second model, where THEY control the money, which gives them many more avenues for profit: As any salesman knows, the closer you are to the money in a business, the more money you're likely to make yourself. This means bitcoin companies are bending over backwards to say "look how safe your money is!" However, be aware if you ever buy bitcoins, it is much better to store your own bitcoins or use a wallet that allows you to manage your own private keys, or use a (now trendy) multisig wallet where the wallet company can't move money without your permission. If a bitcoin bank says "We insure our bitcoins" your best response is "No thanks, I'd rather not have to trust you with my money in the first place." The whole raison d'être of bitcoin is that such trust isn't necessary.

imaginenore 12y ago
You actually didn't give a single good reason not to trust insured 3rd party storage. You just jumped to conclusion while shitting on companies that are improving bitcoin security.
- wehadfun 12y ago
  Mt. Gox provided a very good reason not to trust a 3rd party
  - jeremyjh 12y ago
    Though it was it was not the first (or second, or third) such example.
  - imaginenore 12y ago
    Mt. Gox didn't offer insured storage.
- drcode 12y ago

thinkcomp 12y ago

Regardless of whatever private insurance it has, Coinbase does not have a money transmission license in California or a surety bond as required by federal and state law. They know they need one; they have applied in other states, such as Florida. See https://archive.org/download/coinbasefloridamtl/20140415.coinbaseflorida.pdf https://archive.org/download/coinbasefloridamtl/20140415.coi.... Interestingly, Coinbase appears to offer false information to the State of Florida in item 6(A)(2) of its application, which has since been withdrawn. Coinbase did receive a subpoena in the NY DFS's investigation of various Bitcoin companies in August, 2013. See http://www.reuters.com/article/2013/08/12/us-digitalcurrency-subpoena-bitcoin-idUSBRE97B03720130812 http://www.reuters.com/article/2013/08/12/us-digitalcurrency....

aidenn0 12y ago
I don't know how anyone who reads your experience with facecash could come to any conclusion other than the only way to innovate in payments is to brazenly break the law and never even try to deal with the California DFI.
- thinkcomp 12y ago
  One difference between my experience with regulators and Coinbase's is about $31.7 million in venture capital funding. Compliance is expensive, but they can afford it.
  - wmf 12y ago
    I'm reminded of the old saying that rich people didn't get rich by being loose with their money.
    - polarix 12y ago
      I would hardly consider negotiating with authorities "being loose with their money"...
      - 12y ago

jordanbrown 12y ago

Off topic, but why does it still take 4 days to buy bitcoins from the site?

drcode 12y ago
Same reason as always: The existing payment system used in the world has a weird system of "chargebacks" which mean that it's hard to know that any transaction is ever "final" and can be considered completed. This flaw in the traditional payment infrastructure makes it hard for coinbase to hand you over your coins even if they received a perfectly valid bank wire or credit card payment.
- ewoodrich 12y ago
  Whether it's a "flaw" is in the eye of the beholder. I have confidence buying from questionable online merchants using a credit card because I know I have a recourse if they are deceptive. I would say it's more of an issue of incompatibility between the systems rather than a real "flaw" in either.
- orteipid 12y ago
  This reply is so bitcoin.txt that I honestly don't even know where to begin.
- jdong 12y ago
  Except waiting 4 days really wont help you against chargebacks.

tszming 12y ago

>> Our users, of course, won’t be charged for this insurance. So, where the money came from?

prolixus 12y ago
Insurance is a cost of doing business. Coinbase generates their revenue from fees on the purchase and sale bitcoin, and from fees on merchant services. That's where the money comes from.

easyfree37 12y ago

"Our users, of course, won’t be charged for this insurance." Of course. For now.