Hacker News Reader

Comment by blakesterz | Hacker News Reader

I know soooo very little about crypto currency, but his idea here makes sense, at least to me, but what do I know. Is it possible to create a registry like this, or is this never going to work?

"Given bitcoin traceability and the ease of getting an injunction, one can imagine that it might make sense for insurers, bitcoin exchanges, and over-the-counter traders to build some sort of private "ransom registry". The moment that an insurer pays a ransom to a hacker, that insurer simultaneously announces the offending address to the registry. A verified OTC trading desk can now protect itself from potential bankruptcy by always checking the registry to make sure that any bitcoins offered to it are "good" bitcoins. Exchanges too would likewise cross-check incoming bitcoin deposits against the registry."

View on HN

What stops fraudulent reports?

e.g. 1. I pay you 1 BTC 2. Wait until I receive whatever I paid for 2. Now I tell you to send me 0.5BTC or else I'll report the entire 1BTC as ransom payment.

The blacklist is just a new and very powerful tool for additional fraud!

Presumably the registry could also have some mechanism of identifying those making the reports (maybe limited to insurance companies), and not just accept random reports of ransom payments. That makes it less ideal, sure, but it could help prevent the scenario you posed.

What if someone gave you change in cash, then you went to deposit it at a bank, and they refused to take it because those bills were in a registry?

You could check the registry yourself before accepting change, but what if those bills weren't in the registry when you checked?

Such a system could be implemented for bitcoin but there are crypto currencies with stronger privacy guarantees for which this would be practically impossible (those guarantees could maybe be cracked in the future, people are working hard on both sides).

The hackers don't even need to add a whole sentence to get around that.

"When we receive our 96 BTC, we'll release your data."

Becomes:

"When we receive our 96 BTC without it being reported to the fraud registry, we'll release your data."

The problem with all schemes like this are political: Who defines what is "good" versus "bad?" What happens when the hackers use social engineering to muck with the people running the registry?

Such services exist and are in use by many bitcoin organisations: https://www.elliptic.co/

The thing is that 96 bitcoin could be thrown through a mixer of sorts.

Take the 96 bitcoin, split it into 96 different addresses with 1 bitcoin, then mix those 96 individual addresses to multiple new addresses and then reassemble them elsewhere. This is a horrible explanation, but explains the general idea. You could also mix from Bitcoin to Monero or another currency and back again through various pairs.

There are lots of things out there to attempt to trace the bitcoins back to the source since every transaction is always logged, however if people keep rearranging coins on various addresses it does make it harder.

Having a blacklist registry of all bad/stolen coins would be great if implemented, however I don't know how feasible it would be.

> 96 bitcoin could be thrown through a mixer

One, mixer output could be, by default, added to the registry as laundering proceeds. Or two, the subunits could be traced through the mixer, thus retaining their black marks.

This may result in tainting large part of bitcoin in circulation.

If someone buys a coffee with tainted coins, is the cafeteria now responsible for querying the registry to reject the transaction? Or it risks to have whole daily turnover, if spent together, end up tainted?

I'not saying that it's going to happen, but it certainly seems plausible to have laws that merchants who violate some blacklist forfeit their daily turnover, there are existing laws with much, much harsher consequences.

Many upstanding people—and even large companies like payment processors!—process their received funds through a mixer “just to be safe”, i.e. to escape any coincidental untoward paper-trail that attaches to their funds two or three steps back.

You know how they say that every US dollar bill has a little cocaine on it? Using your suggestion, every dollar bill would be marked tainted as drug proceeds.

That's as dumb as laundering clean money “just to be safe” or covering up a crime you didn't commit “just to be safe” (hey Reiser). If your coins are clean, mixers make them dirtier and this has been known all along.

They're not trying to hide the proceeds of a crime, they just want to protect their privacy from anyone snooping on the transactions. The government is not the only party interested in how people are spending their money, and criminals are not the only ones with a legitimate reason to want to keep their financial dealings private.

If you're e.g. a retailer, you can maybe know your coins are clean one step out, but you can't know if they're clean for their whole traceable history without standing up a fancy Network Analysis OLAP cluster and hitting it with some really high-cost queries.

Let me put it this way: what would you do with your float if you run a convenience store in a bad part of town, and know that there are marked bills floating around in the local economy, and that the police might pop in at random one day and take them out of your till? Well, you'd probably deposit your float in your local bank at the end of each day, and then get new, guaranteed-unmarked bills from the bank. That's mixing! It's not money laundering, just mixing. You're removing the potential liability of being blamed for what your customers' employers' customers' employers did.

If we follow the stolen-property example, if a stolen car is broken up and sold as parts, and I buy a widget from it, the fact the car was broken into 96 bits doesn't make the widget any less stolen, no matter how many hands it passes through.

The analogy doesn’t hold.

A car with a stolen part does not, itself, become a stolen car, because there’s a clear division between the part and the car itself. The only thing the police would want to seize as stolen property from you is the stolen part—they’d get you to take it out of your car, and be on their way.

Cryptocurrency is less like car parts, and more like gold: putting the crypto through a mixer is like melting some (unknowingly) stolen gold jewellery into a batch of non-stolen gold, forming new gold bars, and then selling those. Is the whole batch of gold now “tainted” by the stolen gold? Does it all need to be seized as stolen property? If not, then what does need to be seized? An equal shaving of gold from each buyer’s new bar?

If it were possible to figure out which mixer recipient was the original jewellery thief, you could just seize their mixed assets, since those assets should be equal in value to the stolen input assets. But the whole point of a mixer is to destroy that linkage, such that you have no idea who any of the recipients are.

Not a cryptocurrency expert either but I suspect there will always be someone willing to launder the cryptocoins for a large enough commission.

How can you launder something with a traceable serial/transaction number? I don’t think it’s possible. The best you can do is mix it with enough other transactions that it becomes murky as to the final destinations.

Ex: If half of the bitcoins used to buy a car were fraudulent, would you need to return half the car?

So, it is slightly more complicated than a serial number. In some sense, everytime you make a transaction, you burn all the input coins and creates new coins for the same value, each assign to the respective recepient. Tracking them is not straight forward. Most OTC are not very tech savvy and I can imagine one either being criminal but stupid for bringing it to Bitfinex or simply non criminal but did not do their due diligence and KYC the seller (which is very surprising knowing the space)

If bitcoin is not treated as legal currency, then the person you bought the car from would be required to return half the coins you have them to the original owner as they would qualify as stolen property.

This risk would have to be managed by contracts, insurance, and/or quick exchange for safer assets.

The point isn't to make the coins themselves clean, it's to exchange them for something clean.

So a laundering service could specialize in buying tainted coins and to sell them off to other unsuspecting people, pocketing the difference. In return they could provide clean coins for their customers.

you can pay bitcoin to mine bitcoin or other cryptos. Thus getting "clean coin"

Reply on news.ycombinator.com