Hacker News Reader

Comment by onestone | Hacker News Reader

Bitfinex used to keep BTC in cold storage, but replaced that system with segregated multi-sig (2 of 3) wallets for each user account, backed by BitGo. In that scenario BitGo held one key, and Bitfinex held 2 keys for each account (one online and one offline). Supposedly BitGo should have enforced some limits on withdrawals to prevent such events, but for some reason that was bypassed.

View on HN

Sure, I think I understand that, and I appreciate your answer.

My question is why do you need any bitcoins at all in hot storage?

What's wrong with netting until the end of the day and then put the required amount of coins in a hot wallet to do settlement say 24 hours after a trade?

Wouldn't this cooling off period give software and risk managers a chance to find invalid transactions and keep funds from being stolen out of a hot wallet?

Bitfinex was required by US regulators to switch from cold storage to segregated per-user wallets. Something to do with margin requirements for commodities exchanges.

Can you link to more detail about this? This doesn't seem like a requirement that would be enforced for other "commodities" exchanges? Also, it doesn't seem impossible to set up "per-user" cold storage?

Correct. Here is the source: "CFTC Regulation Prevented Bitfinex From Using Cold Storage" http://imgur.com/O46UNix

Actually it is incorrect. Source - Zane Tackett (Director of Community and Product Development at Bitfinex): https://np.reddit.com/r/BitcoinMarkets/comments/4vtv1m/bitfi...

I think you are probably right, the CFTC is not going to mandate a specific technical approach. Still, an exchange could very well make a poor choice in an attempt to comply with regs whose intent is focused on something very different from the risks of wallet theft.

This reminds me of when Mt. Gox was hacked and it was later found out that US Homeland Security officers (who were undercover) stole coins and laundered them through another exchange. Seems like someone in the CFTC wanted some coins for themselves..

> My question is why do you need any bitcoins at all in hot storage?

In the Bitfinex case essentially all bitcoins were in hot storage. Why they switched to that system I don't know. Perhaps they were convinced by BitGo marketing brochures that this would be more secure. Or, they were forced to do that by regulators.

In the general (not Bitfinex) case, you need hot storage in order to process withdrawals quickly. No one is going to use a cryptocurrency exchange which makes you wait 24h to withdraw, this is unacceptable in such dynamic markets.

Reply on news.ycombinator.com