Tokyo-based cryptocurrency exchange hacked, losing $530M: NHK
reuters.com
reuters.com
The coins stolen are XEM (https://nem.io/) not Bitcoin. They're currently tracking the stolen coins to ensure they are not sold.
Preliminary evidence suggests that it was a private key stolen and not a network problem.
Disclaimer: Am somewhat associated with the team, and I hold a small amount of XEM.
Feel free to ask questions.
Source:
Here's the original tweet from Bloomberg Tech Reporter in Toyko, Yuji Nakamura. https://twitter.com/ynakamura56/status/956790270036619265
Tweet In English:
> Japanese crypto exchange Coincheck halts withdrawals, deposits, trading in NEM. Rumors is a big chunk was moved from their wallet. Also seems >$130m of XRP moved out too. I called Coincheck, but they wouldn't answer questions and asked me to email them
Here's the actual Ripple XRP Transaction that is moving the 101-ish Million XRP out of the Coincheck account. https://xrpcharts.ripple.com/#/transactions/FC32DBF1C0CE6780...
Here's a news page / story that is following this and updating it frequently. It mentions that XRP was also stolen in addition to NEM. https://bitpinas.com/news/coincheck-suspends-nem-trading-rum...
Also, 3 billion XRP means that they have 12% of all circulating XRP right now.
Can you please be more specific? It was almost not worth saying unless you'll be more specific IMHO.
[1] https://twitter.com/2017Lon/status/956880456154099712?s=17
I'm presuming that in this case (given the amount) that this was not a typical user. But is there some framework of dispute for lesser amounts?
Since the funds have moved (visible on the overall distributed blockchain system, where everything is public), either of the two scenarios must have happened. It really is that simple, there are no other "moving parts" or "possible human error" in other parts of the system here.
How does the exchange handle that? What’s the dispute mechanism?
But it’s still based around having the correct mathematical keys to unlock an address.
*held
:^)
Then they'd have to take those coins off the blacklist, or else prepare to deal with an increasingly intractable tracking problem. Ethically, that would be the less bad option, since the thief would be deprived off the income, even if it's not returned to the victim.
You can think of this as a "coin" that's pegged against prevailing currency (in my case, the yen). It's not a "cryptocoin" since there is no "crypto" involved, but as there is barely any "crypto" involved in cryptocoins anyway, I think that's a bit of a moot point.
There are problems with this model. First you have to trust the central authority with your money. They could do a runner and there would be nothing you could do about it. In fact, when I lived in the UK, I discovered that London Transport often mischarges - it forgets where you "tapped in" or "tapped out" and charges you the maximum possible charge for your journey. In order to get your money back, you have to register your card and apply within a specific time period to get refunded. If you don't know the procedure, don't want to give out your person information, don't realise you were mischarged or wait too long -- sorry, your money is gone (Really big piece of advice for anyone using an Oyster card: Register it and check the charges every day. Unless things have gotten better in the last few years, I'm sure you will be extremely surprised at the charges).
The problem here is that the payment processor has all the power in the transaction. They can just take your money if they feel like it. Also, they can refuse to pay for things if they feel like it. Finally, they are a single point of failure. If they have technical (or financial!) problems, then you may not be able to spend your money.
Whether or not you assume initiatives like Bitcoin were started as a scam, the implementation potentially solves a lot of the problems of these payment processors. Importantly, if you put your coins in a central exchange you are right back to square one! No amount of crypto goodness will save you from the exchange shenanigans because they control your wallet.
This is why things like the Lightning Network are interesting. It allows for centralised payment processors, but with distributed guarantees about who owns the coins and where and when they can spend them.
I find it incredibly unfortunate that "cryptocoins" endure such incredible hype and involve so much real (and imagined) money. So many power plays, so many scams, so much FUD. But at the centre of it, these are interesting real problems. Once the dust settles it will be quite nice to see what useful results actually emerge.
The blockchain is an interesting Computer Science toy. But in the 10+ years since it was invented, the only real application that anyone has found for it is Massively Distributed Ponzi Schemes.
The problems that you point out with London Transport aren't solvable by a distributed blockchain, because London Transport is a single central authority. It's completely pointless creating a distributed ticketing mechanism for them where they don't have all the power, because the ticketing mechanism is for the trains that London Transport run and control completely. There's no point having a ticket that London Transport don't recognise as valid. They're always going to be a single point of failure because they run the whole system. Sorry to be so blunt about it.
The solution to this problem is not to add in MORE complexity, networking and distribution. It'll be in removing complexity and improving connectivity.
But, of course, your stock price doesn't increase by removing complexity. You need the blockchains to impress the idiots who buy shares.
It's interesting that you say that creating a payment processor for transportation fares that is not controlled by a monopoly is pointless. I currently live in a country that has at least 5 payment processors for train fares and it's taken them decades to figure out how to interoperate Even now I still can't use my rail card in Tokyo.
These are real problems. "Computer Science toys" seems like another word for "research" to me. That the research was done by some random guy on the internet with unknown motivations is completely beside the point. Yes, like most people, I could definitely do without the scams. I could definitely do without the "OMG! Blockchain" knee jerk reaction. But would it be too impolite to also complain about the "Blockchain? Pfft!" knee jerk reaction? Lightning is a great example of a useful protocol -- full stop. I don't care if it's implemented on top of Bitcoin or on top of some byzantine 18th century payment exchange based on carrier pigeons. We need more of this stuff, not less.
I totally agree about pure research giving us CS "toys" that eventually turn out to be useful. But we've had ten years to find some use for blockchain that isn't cryptocurrency, and as far as I'm aware, no-one's found one. My suspicion is that this is because the problems that the blockchain solve only rarely need solving. It's unlucky that one of those rare occurrences is currency, hence all the bullshit.
Can't this be done with something like git?
Dollar signs a person doesn't understand but sees as easy cash is the equivalent to a lightbulb being turned on amidst a swarm of insects.
(I think there are better ways to do this than a blockchain)
You could have a slightly decentralized governance like a consortium that votes on how to manage the mainframe. You could have a distributed network of computers all managed by a single entity. Each of those have elements of centralization and decentralization. Within those categories there is varying levels of decentralization. For instance there could be a completely democratic organization that votes on how to manage the mainframe or more of a republic style where members vote on a person to manage the mainframe for them.
So, when someone says something isn’t decentralized in the crypto world they typically mean some element is centralized or is slightly less decentralized. For bitcoin you will see people say this in reference to large mining pools that have the power to control consensus to a certain extent. For NEM, they’re probably referring to the fact that the nodes that control the network are closed source. Since they are closed source that means one entity can control the direction of the network, and one can’t simply fork what they’re building.
I’m of the opinion that there will never be complete decentralization, and every project will have some degree is centralization. We’ll get better with time, but I think decentralization is an inherently intractable problem.
XEM (the coin that was stolen) doesn't have plans to implement 0x, but there are other plans for decentralized exchange.
http://www.tristone-llc.com/omisego-the-global-standard-for-...
Someone needs to be the operator of exchange between fiat and crypto, at which point they and you will be subject to tax and regulation.
Anyone who operates an exchange is subject to money transmitter laws and KYC laws.
Anytime you convert from cryptocoins to fiat, you're subject to capital gains tax if you're a US citizen.
https://www.usatoday.com/story/tech/2014/01/27/bitcoin-deale...
No. It's more akin to an operating system of money rather than a proprietary siloed app.
There needs to be an endpoint distributor of physical cash, SWIFT, or wire transfers of real fiat and those end points are subject to regulation just like localbitcoins or ATM machines are subject to regulation.
Can you explain how a decenteralized exchange provides USD?
abstracted IOU "stable-tokens" like Tether are NOT USD, see the case of Liberty Reserve [1] or [2]
[1] https://en.wikipedia.org/wiki/Liberty_Reserve
[2] https://hackernoon.com/the-curious-tale-of-tethers-6b0031eea...
https://medium.com/@bitfinexed/are-fraudulent-tethers-being-...
A major part of the OmiseGo plan is full cash-in/cash-out capabilities via as many ATMs as they can get connected to.
They have access to quite a few thousand ATMs out the gate via strategic investments and partnerships with a number of very large banks in Aisia.
Their parent company is Omise (basically the Asian Stripe) already has a cashflow of $100-$500m/day. FYI They will be switching all their existing business to run on the new dex, so from the get go it will start with a large volume as the test case.
Checkout the OmiseGo white-paper for the main details.
https://makerdao.com/ https://coinmarketcap.com/currencies/dai/
That's what kids in my day called "a risky click".
All evidence points to USDT being just that - magic internet money, with nothing backing it.
Just because an exchange trades tether doesn't mean their reputation is staked on it. Exchanges do not vouch for the instruments that are being traded on them.
Tether is issued by Tether Limited, which is a shell corporation wholly owned and controlled by one exchange - Bitfinex. Not 'dozens of exchanges.'
Allegedly, when someone gives Tether Limited $1 USD, they give that person 1 USDT. In reality, Tether has never actually been audited, and for all we know, they just give themselves 1 USDT, and sell it on the market... Without keeping a 1:1 reserve.
Tether is a huge red flag to me..Enron level.
It's really not hard to believe when you consider how many millions of people are on these exchanges. Binance touts 3 million users, and has 425,819,642 tethers. 141$ average a user is completely believable.
Let's suppose I buy 100 USDT on an exchange.
What Tether claims happens:
0. Bob and I own $100. Tether and Bittrex own nothing.
1. Bob sends $100 to Tether Limited.
2. Tether limited sends Bob 100 USDT. They now have $100 in their bank account.
3. Bob transfers 100 USDT to bittrex.
4. I send $100 to bittrex. I buy 100 USDT using that $100 from Bob.
5. Bob withdraws his $100 from Bittrex. I withdraw my 100 USDT from Bittrex.
6. Now, I own 100 USDT, Bob owns $100, Bittrex owns nothing.
7. Tether Limited has to hold $100 in reserve. It's not their money - it's supposed to be backing USDT. In addition to having assets of $100, they also have $100 of liabilities.
The reality:
Steps 0-6 are the same.
Step 7: Tether Limited buys a vacation to the Bahamas with their $100, and ignores the $100 liability. They are actually insolvent, and I have no recourse against them, because the Tether TOS make it very clear that I cannot redeem my USDT for USD from them.
The whole point of tether is that it is supposed to be backed 1:1 with USD in Tether Limited's accounts. They have not proven to anyone that this is actually the case. For all we know, all that money went to the Bahamas, or a Swiss bank account, and they are just issuing USDT, pocketing what people pay them for it, and keeping none of it in reserve.
https://medium.com/@bitfinexed/spoiler-alert-the-institution...
https://www.coindesk.com/bitfinex-tether-break-silence-go-me...
There are some other decentralized exchanges in development however.
Surprises me that Komodo keeps going under the radar. Nearly 30,000 atomic swaps between btc/zcash protocol coins and a working decentralized exchange (BarterDex) with assetchains.
Just demonstrated one of the first implementations of a btc/erc20 swap as well.
https://news.ycombinator.com/item?id=14810008 https://news.ycombinator.com/item?id=14691212
This quote applies to unregulated markets: drugs or cryptocurrencies.
https://www.youtube.com/watch?v=AtoM9x-Bfu8
Omar robs drug kingpin Marlo who is at a card night, sat round the table, raking in winnings. Marlo claims the money is his, in response Omar says “Man, money ain’t got no owners, only spenders.” He then goes on to take Marlo's ring rather than just run off with the $$$.
So, in the context of the show, Marlo thinks he has just raked in all of these chips and made himself rich, there is the stack of these bits of plastic chips in front of him.
Meanwhile, the $$$ gets handed to Omar straight from where it is kept in the back of the room, the 'bank' off table. All the money for all the chips that are on the table is kept in this one area that Omar is able to head off with, leaving Marlo with his useless chips on the table. At the instant that Omar takes the money all the chips on the table are rendered useless for all players and no longer of value. It is apparent for all that the chips will not be exchanged for USD at the 'bank'.
Marlo doesn't just lose the 'fiat' $$$ that he thought he was winning, he also loses the ring on his finger. Although the money may be just money and he may not have lost as much as the prize pot, the ring is an item that cannot be so easily replaced. It has value beyond nominal gold value, sentimental value.
Before Omar rocks up the card game is being played in an unregulated way with the players having to trust but verify each other. Nobody cheats at the game. The card deck has its own blockchain technology.
The Wire was a long time ago and now Omar has realised that it is more lucrative to move into crypto. So in the 2018 remake Omar does not need a gun to steal all the money from all of the gamblers using a set of chips. He uses chips he printed earlier and limits the available chips so new players wanting to win big in the unregulated card game have to pay more for their chips.
Not all players play every game, most just hold on to their chips hoping others wanting to play will want to buy their chips. So they tell others to play the game. The value of their chips goes up so notionally the chips are now worth millions even though there is only a huge but nonetheless smaller pile of money in the 'bank'.
Because any one player can cash out at any time they do not care if there is less than the sum total of all play money in the 'bank'. So long as there is a multiple of what their chips are worth they have no real concern, unless everyone else starts cashing out.
Because the bank is quite slow and everyone has to queue, some players start to sell their own tokens. These can be placed as side bets on the major games. These coins are copies of the original coins but are super lightweight and have an alleged advantage of being totally anonymous, nobody can track them.
Some of these players are making good business on this side betting and they tell their customers that their coins will one day be able to be useful for more things than side bets. One day they will be able to do every day things with the tokens like get a shopping trolley at a supermarket with one, thereby not needing a 'fiat currency coin'.
So Omar rocks up and rather than use a gun he simply takes his position on the coin to run off with all the money. The people with the chips thought they were the lucky ones owning all the money but no, Omar goes and spends it for them.
[0]: https://www.damninteresting.com/the-baader-meinhof-phenomeno...
Or did you have a different meaning for 30M than per episode? Usually that’s what people mean for tv so I am assuming that.
This however might have potentially positive impact on prices of truly anonymous cryptos - typical direction of thiefs to "lose tails"
Surely the point was more: "Why doesn't the obvious risk events like this represent affect the price of the commodity?"
I mean, at this point I have to believe that the likelihood of a given dollar-equivalent of crypto currencies being stolen is much, much higher that it is for literal paper money. And paper is uniformly considered too risky to use as an asset.
It's insanity. This is the way bubbles look before they pop. I can't tell you when it'll happen, but it'll happen.
This isn't just some investment play-thing of otherwise well-off individuals in developed countries. A lot of dumb money has flowed in, and it's from people who probably can't really afford to lose it without taking a serious hit to their net worth.
Interesting times, maybe 50 years from now historians will be talking about the crypto-bubble and rising nationalism as the precursors to the next big war.
Keep in mind that statistically speaking, you and I live in an echo chamber. Hacker News is a bubble of engineers with a penchant for business and finance (startups, the main thing here, are where geeks who also like money gravitate towards). My subjective experience in meatspace is similar to yours: a lot of people around me are involved somehow with cryptos, but I think that is likely caused by me fitting the aforementioned demographic.
I think (and surveys validate) that the general penetration in the general population is still low. Total market cap for cryptocurrencies is 500B as we speak. Actual capital involved is much less.
This is peanuts when compared to any measure of the global financial system. Most people have heard and operate by the mantra "this is crazy, don't put anything in that you are not willing to lose".
500B is a little over half what Apple alone is worth on NASDAQ. The difference being most people don't invest in Apple directly. A lot of people are probably exposed to Apple stock, but I don't think any mutual/hedge funds have significant positions in cryptocurrencies where a crash would affect the common folk.
That is very different from a subprime mortgage used to buy a house you live in. No one that I know sells during dips or crashes, because cryptos are to some extent "play money". This, I think, explains the resiliency of the market to its wild fluctuations: no one expects anything else but crazy volatility.
That being said, I am certain that cryptos will take a page in the history books. I have personally witnessed people doing and saying things that immediately make me think I should probably be working on the script for the cryptocurrency edition of The Big Short.
Source: I have a bit of skin in the game.
I hope these numbers aren't in any way accurate or representative, because they are absurdly high. If 40% of the population has invested in cryptocurrencies, that can't be anything but dangerous.
Where I'm from, discussing with friends and acquaintances in real life, I haven't been able to find anybody at all who owns any cryptocurrencies whatsoever. So, there certainly might be a bubble (price market exceeding utility), but at this stage it would affect a very insignificant percentage of the overall population.
If this would have happened after a month of two of a bull run, then yeah, I could see some panic selling and a significant price correction then.
The Bitcoin price hasn't reflected fundamentals for years. The fact that the Bitcoin Conference stopped accepting bitcoins because the system is so broken, yet it had no impact on price, should be a hint.
If there was some secure way to do password recovery that was built into the currency that might be a game changer. That might be impossible by definition, not sure.
When sending coins to your storage address, you'd say "anyone can use this money if they have this private key OR if they get a digitally-signed certificate from 3 out of 4 of these keys (A, B, C, D)". Those keys could belong to different institutions (or persons) that would declare they vouch for your identity.
Then if you lost your key, you'd go to each of them to get your certificate signed and could then use the coins again.
--
Of course, this means that if those institutions colluded, or all got hacked, you could still lose your coins, but it'd be harder than just keeping them in an exchange.
Instead of doing what you suggested, normally it's 2 of 3 where it's your cold wallet, your hot wallet, and the online wallet provider.
Shamir's secret sharing algorithm can be applied over many groups other than GF(2^N). In particular, you can generate a polynomial of degree N where F(0) is your ECDSA private key, and for 1 < x < M, tell trusted party number x that they're party x and F(x) = y. Cooperation/collusion among any N of the M parties is sufficient to reconstruct the polynomial and calculate F(0). However, N-1 collaborators learn nothing about F(0), as long as you've generated all of your coefficients randomly and uniformly over the size of the subgroup generated by your elliptic curve's generator.
You can even have N parties each generate their own secret random polynomial f of degree N, and publicly share f(0)*G and privately share f(x) with party x. You add up all of the publicly shared elliptic curve points to get a public key for which no one party knows the secret key. Each party remembers the sum of the f(x) secrets they've been told. For polynomials, f(x) + g(x) + h(x) = (g+g+h)(x), so any N of the participants can collaborate to calculate the previously unknown polynomial for which f(0) is the private key. You need to first share Pedersen commitments of the public f(0)G values, perform a sanity check on those, and then reveal the f(0)G values and perform some more sanity checks in order to rule out cheating. See https://duckduckgo.com/?q=gennaro+distributed+key+generation
Once you have your public key for which nobody knows the private key, you can perform the same procedure to generate the random R value of the (R,S) pair of a Schnorr signature. Each party can then perform a Schnorr signature on H using their secret share of R and their secret share of the public key. They each reveal their signatures, and any N of those signatures can be used to reconstruct a polynomial where F(0) is the S value in the (R,S) signature on H. At the end, all of the sub-signatures and the final signature can be made public without anyone learning anything about the secret values. This is called a threshold signature scheme. (There are other threshold signature schemes. I had to implement threshold RSA in Rivest's 6.857 class.)
Unfortunately, ECDSA isn't a Schnorr signature scheme, but Ed25519 is. Any coin built using Schnorr signatures for wallets would allow you to construct threshold wallets where any N of M parties can collaborate to spend from the wallet, but generating transactions doesn't leak information to anyone about how to generate transactions alone.
BitCoin, at present, only supports ECDSA signatures, which aren't linearly composable.
Traders take a risk in putting funds, fiat or otherwise, on an exchange. Many use domestic exchanges that have higher fees in an attempt to mitigate this risk. They are all well aware, but see the reward to be worth it.
On Ethereum this ecosystem is much more developed, and you can choose between EtherDelta, IDEX, 0xProject and Radex.
These exchanges eliminate counterparty risk because you control your funds at all times. They essentially act as matchmakers between those creating buy/sell orders and those who fill them.
Why would I want to put my money into something "decentralized" when my bank does a fine job?
Cryptocurrencies are complicated and nonsensical at times. I have yet to see anything in this space that makes me actually think it's the future of anything. It's far too risky.
Because you trust that your money will still be in the bank, in full, when you want to withdraw it. People in Cyprus, Venezuela, and Zimbabwe don't have that trust because it's been broken by bailouts and hyperinflation.
As long as the economy doesn't hyperinflate, and the banks don't haircut your accounts, and the IRS doesn't freeze your funds, and the government doesn't use civil forfeiture to take your money because they suspect you could be involved in criminal activity, your money is safe.
Therefore, many people see holding cryptocurrency as a hedge against that type of stuff.
Centralized exchange: send your FBI to exchange's wallet -> exchange updates your balance in its database, i.e. postgres -> trade for NSA -> withdraw NSA, which causes the exchange to send you NSA tokens (if they have them) and update another record in its DB.
The problem is in "if they have them". While normal banks are FDIC insured and a run on the bank won't prevent them from giving you your money, crypto exchanges provide no such guarantees. If the money is stolen from the exchange, like in the case of the OP, then you are SOL. Basically, you have to trust the exchange as much as you trust your bank. And clearly one entity is way more trustworthy than another.
In the decentralized exchange case, instead of trusting an organization to keep money safe through operational processes and tight regulation, you trust a smart contract. Provided that the smart contract has no bugs, this pretty much eliminates the need to trust the exchange. You trust it just as much as you trust mathematics.
Hope my explanation is not too verbose and makes sense.
When hundreds of millions of dollars worth can disappear in the blink of an eye like that, it adds a new element of risk aside from the risk of normal price drops. So it only stands to reason that investors would factor that into the value they place on bitcoin and the price would go down.
Have you ever noticed that currencies issued by corrupt and/or unstable governments tend to be worth little relative to the currencies of stable, well-governed countries?
To the crime victim, they just disappeared. Owning bitcoin is a very risky proposition for those who aren't extremely savvy in protecting themselves from thieves.
Personally, I would like to understand what it really means to say "the current price of BTC is ___." It's not like stocks where you can see actual bid/ask and daily volume numbers. And since transaction costs and times make arbitrage impractical, the price is not even the same across exchanges.
Actually, it's exactly like that.
> And since transaction costs and times make arbitrage impractical, the price is not even the same across exchanges.
Arbitrage across crypto-currencies is happening constantly. As with stocks, bonds, futures, etc. the average person is unable to take advantage. Effective arbitrage requires large sums of money and the ability to execute quickly. Quick execution often means having a preferential agreement with one or more exchanges. This is true in or out of crypto. Price differences reflect friction and risk.
Then why doesn't it have the effect of equalizing prices across exchanges, as it does with traditional currencies across traditional currency exchanges?
I'm not arguing, I'm just asking. If I don't know what I'm talking about, I'm happy to be enlightened.
Yes it is. Cryptocurrency exchanges have orderbooks like regular exchanges do.
Can you show me a current bid on bitcoin? IOW, where someone has obligated themselves to purchase N BTC at a price of $P, if someone is willing to sell that many at that price? Is that information posted publicly as it is with stocks?
Here is an example with GDAX:
https://www.gdax.com/trade/BTC-USD
Here is an example of an API supporting public access through Gemini:
https://docs.gemini.com/rest-api/
Here is another (clunkier) one from Kraken:
Usually there’s a UI accessible with an account and an API that allows faster, direct access to the feed.
There are more APIs there, publically accessible, small rate limit, have fun.
GDAX == Coinbase API. Trading on Coinbase makes, AFAIK, a market buy/sell through GDAX.
This can be mitigated. Exchanging to a less congested coin can be done quickly for fast, low-cost transfers. Keeping a buffer at each exchange will lower overall rate of return but also reduce the frequency of transfers required.
Eventually they will get wiped out, become completely largely non-liquid and end up in jail which would cause a cool off. But not yet. We have not yet reached critical mass.
>In Mt. Gox's bankruptcy -- as is generally the case in bankruptcy -- claims against it were reduced to yen amounts shortly after the bankruptcy (in April 2015, when bitcoin was mostly in the $400s), and creditors are entitled to recover up to 100 percent of the yen amount of their claims, but no more. But there is more:
>>The bankruptcy estate for Mt. Gox holds 202,185 bitcoins worth about ¥169 billion or $1.5 billion at current rates. Meanwhile, the trustee has recognized claims by exchange customers of ¥46 billion based on the April 2014 bitcoin price, a procedure that lawyers say has a sound basis in bankruptcy law.
https://www.bloomberg.com/view/articles/2017-11-14/bitcoin-b...
One of the best summaries of the Mt Gox incident, as well as the fallout and subsequent investigations that I've watched.
Preliminary evidence suggests that it was a private key stolen and not a network problem.
Disclaimer: Am somewhat associated with the team, and I hold a small amount of XEM.
Feel free to ask questions.
But FDIC _doesn't_ cover theft. Or anything else. It only covers bank failure. Bank runs were a real problem back in the old days, and the fear of it drove most people to leave their cash in mattresses. So FDIC was created to alleviate those fears and get cash back into the banks. That was, and is, its only purpose.
Not that that isn't a useful thing. It certainly came in handy again during our last recession. But this knowledge raises an important question. If FDIC is the only insurance I've seen advertised by banks, and it only covers bank failure ... what covers everything else?
I assume, hopefully, that banks have private insurance policies or something. Maybe they're legally required to have a private insurance policies. I just don't know. I bet most people don't know.
Very interesting stuff.
Your own cold wallet is the bank. Once you take the money to the bazaar, it becomes possible to be pick pocketed.
I believe the SIPC guarantee covers losses incurred as a result of an exchange failure. Practically, I have a hard time understanding how an exchange failing would cause customers to lose funds (outside capital losses). Securities markets segregate exchange and settlement, e.g. the NYSE from the DTCC [1]. The latter is guaranteed, indirectly, by the federal government.
[1] https://en.wikipedia.org/wiki/Depository_Trust_%26_Clearing_...
And yes, you could spread your money among multiple banks, but then you have manage multiple accounts.
I thought the whole point of the blockchain was that all the transactions were all known?
What you're really proposing is a hard fork, which is a morass of problems. And why should everyone suffer all this grief just because the security team on one exchange in Japan is staffed with people who don't know what they are doing?
Companies using NEM really like the mutable ones.
If 1 person refuses to accept the coins, there are thousands and thousands of others who knowingly WILL. And an even larger group of people who aren't even going to be aware of your blacklist and will do so unknowingly.
In order to blacklist coins, it is not enough to just blacklist the 1 address. You have to black everyone who accepts those coins, and everyone who accepts coins from the people who accepted them and so on.
And at that point you have blacklisted the entire network.
In addition, my understanding is that many cash exchanges will not accept funds that have previously been identified in major hacks because they could be forced to return the funds to their rightful owners in addition to the cost of compliance with law enforcement.
There are "privacy"-focused cryptocurrencies that do not have this characteristic, the most well known of which is Monero.
[I am not an expert, just a casual news consumer of the space]
By blocking a specific address, it would effectively freeze all the funds held by it, preventing them from being transferred to anyone, including exchanges.
Still - the question is why was it even possible for a "hack" to score so much cryptocurrency? This is a legendary score on par with Mt Gox... they should be holding all currency not required for immediate trading liquidity in cold storage and rebalancing as needed.
Furthermore, there are methods by which bitcoins can be anonymized once obtained: look up 'bitcoin tumbler'.
https://www.investopedia.com/news/new-bitcoin-malware-change...
Looks like he copy-pasted a corrupt version of the address. There are three transactions to this destination, from different exchanges.
- keep only (most of) my long term holds in my hardware wallets (e.g. NEO, OMG, ...)
- spread my shorter term holds over several exchanges
Storing your coins might be the best solution in theory, but in practice unless you're very savvy about the whole stack - hardware, OS, software and blockchain tech, it's hard to be sure you're not making a dumb mistake and exposing your whole stack.
Even hardware wallet can have vulnerabilities, and any form of "paper wallet" can be physically lost or destroyed.
My opinion is that you should hedge to make any loss tolerable, instead of trying to prevent it completely.
You're right on with your approach -- I think the answer is multiple wallets -- even multiple brands of hardware wallets, multiple exchanges, multiple computers, multiple different types of paper wallets stored in different places, even multiple cryptocurrencies in case one has a catastrophic issue.
The idea that one must download the entire blockchain makes maintaining a wallet very difficult
Electrum, Multibit to name a few.
As such, the wallet is super lightweight and easy for an average user.
Doesn't protect you from exchange hacks though.
Given that cryptocurrencies have become pretty mainstream and given the average level of technical literacy among the general public I can understand why some might prefer to keep their coins in somebody else's hands.
Something like this is incredibly regrettable, and a large amount of presumably novice investors have no doubt burnt their fingers. Yet, incidents like this once again underscore the importance of controlling your private keys. Until you do that, you do not really own your coins.
I suppose this also highlights the need for decentralised exchanges.
https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery
The nature of the banking system allowed much of that to be blocked/retrieved, though.
In the interim, the convenience of exchange bitcoin storage will continue to come at an increase in risk.
Disclaimer: I hold some XEM, have contributed to source, etc.
Rather astonishing in magnitude (a single hot wallet?), but such is tech.
The need for financial regulation and trusted authority is supposed to be the problem cryptocurrencies exist to solve - free market forces and reputation alone should be sufficient.
I've started trading in this space with a modest amount, but as I plan to increase some of my investments I am definitely considering purchasing a wallet.
I would sleep better if I knew my coins were not held within the exchange.
This gets repeated over and over, but people just don't listen until it is too late. Keeping money on an exchange is the antithesis of why crypto-currencies were invented in the first place.
Most people getting into cryptocurrency at this point aren't going to be able to spin up a secure debian box, download and run zcashd, run it until it syncs with the network, construct a transparent address, round-trip a test portion of their exchange funds through the address, park their on-exchange zcash there, and put the wallet.dat file somewhere secure from hacking or destruction. But my understanding is that Ledger can handle transparent zcash transactions, which potentially massively simplifies matters.
Or someone just forces you to give up the info?
As someone said earlier in this thread - Hardware wallets are simply another computer that stores your private key. There is nothing inherently different about its "Hardware".
You can import that seed phrase into any number of wallet programs if you lose your hardware wallet.
Their absolutely is. A hardware wallet can take unsigned transactions and sign them internally, and output a signed transaction. Your private key never leaves the hardware wallet.
Compare this to signing a transaction with a private key on a computer. Your computer can have spyware that can snoop on the key and steal your coins.
The hardware wallet has a burned ROM with a firmware that is signed and verified every time you use it.
So could a hardware wallet. [0]
[0] https://en.bitcoin.it/wiki/Hardware_wallet - see under "Security Risks", both the "compromised production process" and "compromised shipping process" items are places where this could occur.
You should rather use traditional nation-backed currency at regulated trade authority.