Bad code may be to blame for $500M of cryptocurrency losses in seven months

I've been using cryptocurrency for over five years and haven't lost as much as a satoshi. It's no more difficult than keeping other sensitive data secure.

This is a really interesting perspective ... though, I'm sure it could be argued that, "it only makes them more rare, and thus valuable!!11!1!" ;)

Seems like sort of a theoretical argument, so I have to point out that I believe it's theoretically wrong. Caveat that I'm not a blockchain programmer so somebody may be able to correct me here, but I believe it's true. Bitcoin aren't individually identifiable, the "state" of ownership in the chain is stored as "unspent transactions." Meaning, once stolen are mixed with un-stolen, you can't differentiate them.

Obviously, the next step is we can reformulate your statement to say that the total number of Bitcoin lost or stolen will eclipse the total supply, given enough time. However, since the total supply is fixed, and time is not, that's not a very profound revelation.

Backing your coins up is very easy, most wallets support BIP32/39/44. Just write the mnemonic down and put it under your mattress. Or a safe if you have one. But seriously, for most people under the mattress is equally safe. I don't understand why anyone would keep a non-trivial amount of coins in a wallet and not have a backup. That's irresponsible.

Curious how that factor into the price of BTC?

Once the number of of Bitcoins approaches zero, the finite value of the Bitcoin ecosystem divided by zero coins approaches infinity. This will create a financial singularity that will open a payment gateway to the hell dimension. This dimension is a land of endless opulence and limitless transaction time ruled over by that vengeful daemon, Satoshi Nakamoto. Good luck, Bitcoin users, you're going to need it! jk lol

It's not that hard. Do what you would do with a large amount of cash or gold coins: put it in a safe deposit box. Or a private vault, if you're ideologically opposed to banks.

Unlike gold, you can also add redundancy and cryptographic protection, but even without that you can at least be as secure as you are with gold, which plenty of rich people store in vaults without issues.

Isn't a stolen coin still part of the supply? Do you mean to to mark them as stolen to prevent them from being used?

Ever heard the rumor that nearly every $20 bill in circulation has detectible residual cocaine on it? In other worlds, the probability that a bill has been involved in a drug deal approaches 1 over increasing timespans.

Interesting anecdote, but not really super informative.

My current favorite saying: "Cryptocurrencies are like poker. If you don't know who the sucker in the room is, you're the sucker."

Hmm. I'd say it's a combination of inside jobs and general poor coding/security practices. The inrush of customers has prompted lots of people to follow the "sell the shovels, not mine for gold" mentality and try to open up their own exchanges... and every exchange is a prime open target for any hacker because of the massive amounts involved.

Regulatory oversight isn't universally a good thing.

It's illegal to steal, regulated or not.

Yea but that's pretty much all hacks reported in the news. It's often social more than technological.

Is it this script? https://github.com/burjorjee/pyethrecover

That is atrociously bad. It appears to use a pure-python implemention of AES (!!!) [1]. Holy cow. This is going to be miserably slow. Using all the CPUs isn't going to help when it's going to be literally tens of thousands of times slower than better techniques.

You will literally have time to learn hashcat [2] from scratch, learn how to implement the plugin, test the plugin with some sample passwords, and run it yourself, and still save time over running the Python script, because even if you leave the Python script running during the entire, say, week you spend learning all this, the hashcat script will still outrun Python in the first minute or so, by my somewhat conservative estimate that it will run 10,000x faster. (I wouldn't consider 100,000x out of reach. Depends on your GPU. But hashcat will still be faster even just on the CPU alone.)

(Also hashcat shows some ethereum support, but neither of the two things it says say "aes". I don't know whether hashcat would support this out of the box, I'm just saying that you literally have time to implement this from scratch and still be faster than running that Python script.)

(I also want to be clear that this isn't GPU fanboying. It can't be, because I'm not one. GPU computing is very often oversold. But this is legitimately one of those cases where GPUs can smoke CPUs by multiple factors of magnitude.)

[1] https://github.com/burjorjee/pyethrecover/blob/master/aes.py

[2] https://hashcat.net/hashcat/

> If a coin is lost, it is out of circulation, and the net effect is that it is distributed to all the remaining holders of that cryptocurrency.

Meaning the value of the remaining coins increases a tiny bit because supply was reduced?

Both of those assume that desire to acquire a cryptocurrency is unaffected by trust in its exchange infrastructure and the integrity of others parties offering to make payments in that cryptocurrency. That doesn't seem like a reasonable assumption to make.

That's assuming the total number of coins still exists. I would not be surprised if 20% of all bitcoins have already been lost.

EX: Satoshi's coins could all have been lost at this point.

Not necessarily a reply.

Indeed, the vast majority of this cryptocurrency was not lost, but remains in circulation.

Lots of electricity was wasted.

> If $500MM of a coin is irrevocably lost or destroyed

But the examples in the article are about coins being stolen, not lost or destroyed. Someone somewhere still has it and is presumably able to spend it.