I just lost 1,400 BTC | Hacker News Reader

I just lost 1,400 BTC

github.com

146 pointsagirgelen157 comments

Open articleView on HN

As far as I can understand

1. The user had 1,400 BTC in an old wallet using this software

2. An old version of the software was vulnerable to phishing

3. The user attempted to use the software, and was phished

4. Massive payday for the scammers

Really unfortunate - and goes to show with software you manage yourself you need to be diligent about making sure it's updated. For all the shit coinbase gets, it's difficult to lose your coins in this manner.

> For all the shit coinbase gets, it's difficult to lose your coins in this manner.

Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are vulnerable to phishing. So no, Coinbase is not immune to losing coins in this manner. If Coinbase wanted to prevent being vulnerable to phishing they would i) only allow U2F 2FA, and ii) make U2F mandatory for all accounts.

1. AFACT the user was phished in a manner that was specific to this platform. It's not really comparable to clicking a nasty link in an email. Whether you chose to use U2F or TOTP, the risks is upfront. The user in this case was running official software - there was no URL to check.

2. The vector of the attack isn't important. The user ultimately lost his coins because he wasn't running the latest version of the software. He could have have easily lost his shirt from an RCE. That is much more difficult on a managed SaaS platform.

It was my understanding that the user had installed a version of the Electrum wallet that was not from the official source at electrum.org. (But agree - it was really difficult to identify the core issue from this string of GitHub comments.)

They were running an old official version which has a serious issue allowing the full node servers it connects to to pop up a message. e.g. "You need to upgrade - click here" - that led to the malware.

And there is no way to track down the node server that popped up this malicious message? Take it offline?

Yes, electrum.org maintains a blacklist. That won't stop a phisher that just made 16 million dollars though. Spawning a new server costs cents.

Also, I think it's just the reason that crypto-currency will fail.

If you trick me into an ACH transfer of 16 million, there will

a) Trigger some random human based audits at my bank before the money can leave (likely involve some phone calls)

b) Have actual recourse, like court orders to hold the funds at the other bank

c) Take some amount of time to happen, to allow for A & B

It's not perfect, and it has bugs.. but I would never store actual money of value in crypto anything.

This is exactly the reason why I don’t use crypto currencies.

unless a bank wouldnt serve you, like for sizable parts of the economy.

Sizable, like 2%?

I looked it up. 6% of Americans don’t have a bank account. Doesn’t say whether they could go ahead and get one, or they choose not to.

Sizable?

Correct me please if I'm wrong, but I'd say most of those folks not served by a bank wouldn't have the skills to manage bitcoins either.

The 6% of people without bank accounts are often the least wealthy, more sick part of our population (basically, the people that need protected).

They do NOT have the technical skill to manage a bitcoin wallet. If anything it points even MORE to why we should not use crypto.

Is this 6% of all USA-ians, or 6% of adults?

I don't expect most 10 year olds to have chequing accounts, and if we're talking about about all Americans I'm honestly surprised it's not higher, taking into account da yout, those who are mentally/physically infirm, and those folks who just don't trust banking.

Good reason to pull all crypto into fiat ASAP, store it in a real bank (or really, diversify it - user said that was the "vast vast majority" of their savings, that should never be all in one asset), and report it as other income on your taxes.

If you trick me into an ACH transfer of 16 million, there will

Fun recent case - Citibank claims they fatfingered $900 million over:

https://www.bloomberg.com/opinion/articles/2020-08-25/citigr...

And they're having some trouble getting all of it back although the commentaries suggest that they (eventually) will.

Yah, and this case is a lot different than someone hacked it. If it has been "hacked" it would have been a different story. More like a complex legal case + fatfinger.

Naysayers consistently say that "It will fail," without realizing the chain continues to work regardless of your faith or mainstream uses. It works, it will continue to work. It works via satellite and radio. It's unstoppable like BitTorrent. It is decentralized. Faith or not, Bitcoin is not going to fail and it works perfectly as intended.

Ah I remember when my bank app had a bug and someone stole $15 million dollars from me then when I asked for help they said not your keys not your dollars. Such is life!

How do we confirm this actually happened? Perhaps I am being cynical, but people have been know to embellish and lie on the internet before? Shouldn't we be able to follow these funds on the ledger?

https://news.ycombinator.com/item?id=24334393

Many folks shit on the modern financial system, with its centralization and Government-coupling, but things like this are actually trackable and reversible in that ecosystem. The safeguards have evolved over centuries.

I am curious when crypto will get there. Maybe 10 years or so?

the only way to get there is by reinventing the dreaded middlemen of governance, regulation and insurance that they attempted to replace, with the added feature of having produced a currency that burns the energy equivalent of a middle sized nation

98% of HN except for a vocal, small minority ever says anything positive about crypto or blockchain. The vast majority appreciate the benefits of the state apparatus being the conduit for financial services. So you posting this is not a surprising nor unique idea, you are representing 98% of HN commenters.

I'd say 98% of the population. There's a very small percentage of the population that even understands what fiat is, and what problems cryptocurrency solves.

For that matter, a sizable percentage of cryptocurrency advocates either don't know or care either; their only concern is how much fiat they can trade cryptocurrency for.

probably never, honestly. Many people still feel that the guard rails are bugs, not features and imagine that things like this will never happen.

Honestly would like to know how you see it would "get there". In my mind, the 'fiat' part of 'fiat currency' and government-coupling are what gives the financial system the safeguards, so...?

I mean, it is always the state, if you follow the string to the end, that oversees and enforce compensation, rollback and error correction.

What kind of fully-distributed non-autoritative algorithm can do that?

It is impossible by design. Adding that 'feature' takes away the core principle of decentralized currency. Allowing government to reverse transactions will also allow them to seize assets. Then it is just a regular currency (for better and worse).

Didn’t ethereum fork to rollback a hack they didn’t like?

Do you mean this?

https://www.bitdegree.org/tutorials/ethereum-vs-ethereum-cla...

This one:

https://www.coindesk.com/ethereum-executes-blockchain-hard-f...

It becomes a regular currency... that consumes huge amounts of electricity for no reason whatsoever.

https://www.vox.com/2019/6/18/18642645/bitcoin-energy-price-...

Cash transactions aren't reversible or easily tracked.

Which is why it's not used for important purchases. Except illegal ones.

And it's why you'll notice that bill denominations didn't follow inflation. If no legitimate transactions need $100M in cash, it follows there is no need to make it practical to actually move $100M in cash.

For a while there was a workaround, it lasted a long time in the United States and after it ended Hollywood kept it around (in fiction) partly by using plots that were written when it was real and partly just because it looks cooler even though it's not possible.

Bearer Bonds. You'll notice that's what they're stealing in Die Hard. When it was made, and when it was set, Bearer Bonds weren't a thing (adverse tax treatment ensured they had basically ceased to exist) but when the novel the screenplay is based on was written it is reasonable that a wealthy multinational might possess large sums of Bearer Bonds in a vault.

Bearer Bonds were bonds (duh) but they weren't registered anywhere, the owner of the bond was whoever was holding it, just like cash, except a briefcase full of bonds could be worth tens of millions of dollars.

That's a really good point. I recently transferred a few hundred k. It's a little bit of a hassle, but you know what, the system SHOULD look at that more closely. And it can, because that scales.

What we need is scalable micropayments, not ability to more easily lose $100M one transaction.

The people who do need to move $100M it's ok if we have a separate system for.

They first have to understand that reversibility is a feature. One of their core beliefs is that's it's a bug.

> but things like this are actually trackable and reversible in that ecosystem

I do not know about US, but in EU bank transfers are generally not reversible (except forced by courts). If you send money to wrong bank number, you cannot cancel the transaction in bank, you need to ask the owner of that account to send them back.

Compared to BTC, there are two differences - it is possible to identify an account holder and justice system can effectively force bank transfers.

It's not THAT hard to reverse transactions between EU banks.

E.g. when that pirate bay founder hacked a bank's mainframe and transferred money out internationally the banks sorted it out, sending it back, without a court.

Maybe you're thinking something specific about "reversing a transaction", but the main point here is that yes if needed a court can just make that reversing happen. Not the case for cryptocurrency. And no matter what the coiners say, irreversibility is very much a bug that society doesn't want.

Wire transfers are not reversible after about an hour - as I mentioned the other day a good friend lost a house down payment due to fraud.

But I generally agree with the advice that the service banks and fiat currency provide is probably worth the cost for almost everyone.

Could you share some general details about the friend that lost their down payment?

I’ve heard of this happening to others and have argued that the money is lost and cannot be recovered. People think it’s crazy the money is lost and cannot be recovered. From what I’ve heard it cannot be recovered.

Is your friend able to recover the funds?

How did it happen? Did the instructions for transfer get altered by someone?

Thanks.

Typical scam is: hack into a real state agency, observe all emails with customers, send email to customer to deposit some funds on some account on the day of the downpayment, 4-5 hours before the real state agency worker would have done the same. Collect 1 day worth of downpayments, and run.

The well publiced Pexa fraud is an example. The money was wired off-shore and lost. https://www.propertyobserver.com.au/forward-planning/advice-...

It should be somehow made possible to reverse transactions (like theft) with some sort of distributed consensus.

While this is largely true, it is pretty common for large amounts of money to be irreversibly lost in an untraceable manner. Wirecard comes to mind this week but a simple search for 'financial fraud' will bring up typical losses much larger this guys lost 14k BTC at least once a month.

Tell that to North Koreans.

https://www.nytimes.com/interactive/2018/05/03/magazine/mone...

I can't believe someone would even allow a system with that balance to even connect to the internet. It's like filling a car with gold bars, driving it around town, and hoping nothing bad happens. He could have created another wallet, preferably a multisig, created the transaction with the software wallet offline, copied the signed transaction off and broadcast it from another system.

What he did was reckless. Some people are going cry that Bitcoin is unsafe because of this. It's not. You must handle large amounts of cash or gold or other valuables with care.

Bitcoin is all online. The analogy doesn't work: your gold bars are being driven around town all day and night in public view, already.

In this case, it's just the fact that the access was granted at the application level when the user logged into their wallet, which is like giving someone keys to your car by mistake.

No. One can store keys offline. That's what hardware wallets do.

In order to do anything with Bitcoin, which appears to be what the author wanted, you would have to be connected to the Internet. Keys being stored in hardware wallet sure, but the gold bars are still in public view.

Hardware wallets aren't without their flaws. With an application-level vulneravility in a hardware wallet, you are still screwed. Here is just one example: https://www.ledger.com/improving-the-ecosystem-disclosure-of...

You can sign transactions offline and hand deliver the file if you felt so inclined.

Signed transactions cant be modified.

Someone needs to make sure nodes see it that transaction and add it to the database, eventually.

This user experience has not been refined, but is very possible. A system with fewer nodes, like if the internet was attacked and not available, would still work for this currency.

> You can sign transactions offline and hand deliver the file if you felt so inclined.

How big is that signature/file? Can it be encoded in a QR code or something simpler to bridge the airgap?

It's usually less than 300 bytes. A comically huge QR code could handle that.

The specific transaction this post refers to was 1813 bytes. It had 12 inputs that had to be signed for making it larger than average. For $10M I'd be willing to manually type out the 3626 hex digits, or if feeling lazy splurge on a $10 USB stick. Only 3 inputs account for almost all of the balance, so really it could have been moved for under 1000 bytes, which I happily write longhand on paper with a quill in triplicate before I'd even consider exposing the secret key to the internet.

Like the Coldcard wallet where you can choose to only transfer the transaction via an air gap on a MicroSD.

It just doesn't work that way. The wallet has a secret which can be used to sign a transaction to spend the balance. It doesn't need to be connected to do this. The transaction is a serialized piece of data which can be broadcast to the network. The size varies depending on certain factors, but it's usually about 250 bytes. Electrum can create this transaction and show you a hex dump of it which you could copy off and submit to the network from a different system that is online. An attacker who controls the online system would be unable to modify the transaction. With more than $10M at stake it is prudent to do that, just like it would be best to use an armored truck to move $10M in cash.

From looking at the transaction history, looks like it was an actively used account, even.

You have to keep them in an encrypted container.... Then you can email a backup to yourself

This looks like the relevant transaction: https://www.blockchain.com/btc/tx/ef600c380a239d9b929c6c964d...

If I had that much in an old wallet, no way would I touch that myself or allow it anywhere near the internet. I would hire a team of experts and get the transaction over to my bank insured.

Do any big banks offer a BTC account?

Its kind of crazy that the phishing attack people are still operating those servers for all these years! But since they pay for themselves no reason to turn them off.

The knowledge gulf is so wide in cryptocurrency that schemes are resurrectable every bull market

Like, some people will use this to reinforce their juvenile binary argument about why “crypto bad”, and then they enter next bull market after someone they respect shows them something they didn't consider. But then they are still a decade late in knowledge while chasing every new shiny thing. If people want to learn its there, permissionless, lucrative.

Here [1] is the explanation:

    I had 1,400 BTC in a wallet that I had not accessed since 2017. I foolishly installed the old version of the electrum wallet. My coins propagated. I attempted to transfer about 1 BTC however was unable to proceed. A pop-up displayed stating I was required to update my security prior to being able to transfer funds.
    
    I installed the update which immediately triggered the transfer of my entire balance to a scammers address.

[1] https://github.com/spesmilo/electrum/issues/5072#issuecommen...

With big money comes big responsibility. Storing $16M should be taken very seriously and probably most people have no clue about that.

I think the point is that you can store $16M in a bank and take need to take no precautions against casual theft (and often can recover the money via person-to-person interactions, if theft does occur).

is it fair to say he could put that $16M in a digital equivalent of his mattress? Had he placed in a reputable exchange, or spread the coins across multiple exchanges, he would have been safer?

I completely disagree, only the first $250k is insured. I would never store $16M cash in a bank. You aren't protected against the bank becoming insolvent.

Isn't it 250k per account?

No. FDIC is per depositor, per bank, per ownership category.

So if you have $300k in Bank A, and $180k in Bank B, and then suddenly both Bank A and Bank B fail, the US Federal Government promises you'll get $250k from Bank A and $180k from Bank B, and pretty quickly - but the remaining $50k from Bank A depends on what happens when they try to wind up Bank A, if it's a complete wreck you may see nothing or almost nothing back or it may take years to get 10¢ on the dollar for the remaining amount.

In some cases you may be able to create multiple ownership categories that help you, and I guess if you really had $16M you might do stuff like set up a multi-beneficiary trust fund that can have $1M in it with four beneficiaries for an additional $250k per person FDIC insured.

FDIC is presently $250,000 lifetime limit.

Okay... where would you store 16m?

Whats wrong with random hole on random private place you own ?

Probably in US Treasury Bills?

In an investment account with a reputable brokerage.

What's the difference between that and a bank?

Well the fun part is that the way it's different is that there would be a bank account with your money in it, that the brokerage isn't allowed to touch. So, you're protected from the brokerage going bankrupt - your money is still yours if that happens.

But it's still in a bank account, so if the bank goes under you're screwed. See my other comment in this thread though...

SIPC isn't unlimited, though:

The Securities Investor Protection Corporation (SIPC) was created to protect against the loss of customer assets at brokerage firms. SIPC offers protection of up to $500,000, including a $250,000 limit for cash, if a brokerage firm fails, and covers most types of securities, such as stocks, bonds, and mutual funds. [0]

[0] https://www.schwab.com/public/file/P-3042070/Asset_Protectio...

My holdings accumulate capital gains and are insured by market forces rather than the FDIC. I can put them in volatile holdings like stocks, or fixed income or even just money markets. That's pretty much what banks are doing and just keeping a bigger percentage of the returns for themselves.

AFAIK, the underlying assets in investment accouns are owned by their account holders, the broker just manages them. If the broker becames insolvent, these assets are not part of insolvency proceeding.

For regular bank account, there are no other underlying assets, it is just the sum bank owes to the account holder. If the bank becames insolvent, outside of insurance limits, these are just claims against the bank.

More than one place.

Not all in the same wallet/bank/stock/currency/...

That way if something goes awry, I still have the rest.

64 banks, or treasuries

Some in stocks, some in banks, some in bonds, some in real estate, some in precious metals, etc.

I would use the bank owned by my government, the National Savings and Investment bank. And I do.

The reason is that since the government owns this bank, and the government issues the money, if the bank fails the government fails too and the money is now worthless anyway.

MSCI ACWI IMI, FTSE ALL-WORLD, etc.

For that to fail, the whole world economy would need to fail as well, and at that point, no money on any currency is worth anything.

To store $16M you definitely need to take precautions. Someone could steal your identity or compromise your account. It seems like different vulnerabilities rather than one that only exists for crypto.

While not guaranteed, it's pretty likely that you'll be able to get your $16M back if you lose it to identity theft or a compromised online account. You may have to escalate from customer service to legal action, but there are usually ways to reverse fraudulent transactions in the traditional banking system.

On the other hand there's basically no way for this user to get their bitcoin back.

I have more faith in the banking system but even there it can get tricky: https://news.ycombinator.com/item?id=24222045.

Until you can't https://en.wikipedia.org/wiki/Corralito

Yeah that's because it's a bank not a pseudo-facsimile of a bank.

I keep hearing that, and yet see mailbox hacks where the attacker tells accounts payable to update the payee's account and the money goes bye bye. Seems to turn into an insurance matter. I'm not sure why, but apparently just getting the bank to get the money back isn't so simple. Nobody talks about it in public. Haven't personally seen 8 figure amounts, but have seen amounts around a million dollars.

Stuff like this is why you shouldn't use a lightweight wallet and should use the official wallet, or at least host a full node.

Lightweight nodes: https://en.bitcoin.it/wiki/Lightweight_node

What about an hardware wallet like Ledger?

I would simply recommend hosting a full node and using the latest release of the official Bitcoin Core wallet.

Hardware wallets are relatively new and uncommon, so not much is known about their security risks. That said, there are no glaring, obvious issues and you could use one if you want.

Read: https://en.bitcoin.it/wiki/Hardware_wallet#Security_risks

As always, do not take advice from strangers on the internet about storing your crypto without doing extensive research on your own. The Bitcoin wiki is a great starting point: https://en.bitcoin.it/

The popular Trezor wallet has a hardware vulnerability, where, if you physically have the hardware it can be exploited. Hardware wallets are a vast improvement but not without issues. Large scale fraud, where the money goes missing is much more common so far.

I'm not an expert in BTC storage, but as far as I understand such an attack could have been prevented if the owner invested in a hardware wallet for $100-200. As the final step in a transaction would be to sign it on your ledger/trezor device, and would be much harder to phish.

This was my first thought too. Hardware wallets show transactions on their own screen so the amount and destination address can be confirmed on-device before the device signs the transaction, which seems like a great tool to avoid this kind of issue. Anyone that owns more cryptocurrency than a hardware wallet costs really needs to have a hardware wallet.

Reading these threads I always have to wonder.

Is the report of being scammed a scammer trying to make extra money on a sale? How would anyone know?

Bitcoin being a public ledger, it's fairly easy to see if 1,400 BTC was moved recently: https://www.blockchain.com/btc/tx/ef600c380a239d9b929c6c964d...

I mean they definitely could have seen that transaction and just acted like it was their stolen money.

Serious question. Not trolling.

Would it have been possible to exchange that much BTC for US dollars? Ignoring taxes for a few seconds. Would it have actually been possible to get real fiat money for the 1,400 BTC?

I’ve always heard of complete incompetence trying to get an account set up on any exchange. Getting verified, etc.

If he acquired them legal of course he can sell them an get fiat withdrawn to his bank, assuming hes not in a place where bitcoin is illegal. Doing this all at once without informing your bank will probably instantly freeze the funds and trigger some kind of investigation. That doesn't mean you eventually get access to it. Also there are exchanges withdraw limits so its not on your bank account in 1-2 working days. If you want to sell all at once and withdraw you would have to register on different exchanges to circumvent daily limits and do the KCY which that can take days to get verified.

Why would someone holding 1400 BTC use a software wallet instead of an offline hardware wallet? SMH

Yeah this is what blows my mind. I would be paranoid if I had 14 BTC, let alone 1400. When I had (as much as) 19 BTC some while ago I stored them on a Trezor, with the seed on a paper (three copies in different places) in a form that no one would realize it actually was a seed.

Be careful... sometimes we end up making things so complicated that we forget how it works. Think why comments are so crucial after looking at your own code from a year ago and having no clue what you meant. :-)

Even a single hardware wallet would have been risky - loss or damage, or theft. For high values, set up multi signature hardware wallets, at least a 2 of 3 scheme, each stored in different geographic locations.

That's overly complicated. A single hardware wallet in a fire proof safe or a safe deposit box in a bank vault is sufficient for this use case. If a hardware wallet were stolen, the thief would still have to guess the password. q.v. https://xkcd.com/538

A single hardware wallet is not sufficient for any use case because no matter how safely you store it, it can fail anytime.

I've said this time and time again: 'be your own bank' is a terrible design error, not a feature, for 99.99% of users.

This guy is most likely somewhat technically literate, and this happened to him.

The virtues people often use for crypto (trustless, irreversible, untraceable) are almost always user-hostile. Banks aren’t great, but at least it’s harder to phish $16million.

> somewhat technically literate

But doesn't know what IRC or freenode is, as illustrated by a comment in that thread.

Is that really your bar for being "somewhat technically literate"? Being familiar with decentralized chat protocols and services? What a world...

Once in a while, I refer to Hacker News in a job interview, just to understand the cultural fit of the hire.

Same here.

yes

In general I'd say that most "higher functioning" Bitcoin users are fairly decent with C++, using CLI/TTY only wallets, and familiar with the cypherpunk movement, culture, and history. If you are not familiar with IRC it makes it sound like you just started using a computer the last couple years.

There is no mandate in Bitcoin to 'be your own bank' - its just an option. It is a feature and a very good one for people who are afraid of government intrusion into how they use their money. If you don't care about this "feature" you can turn it off by putting your crypto in Coinbase or other exchanges where it will be insured.

This feature is the whole point of Bitcoin and blockchain in general. If we just wanted to be able to have balances in banks, the current banking system does it far cheaper with a lot more legal protections.

The problem with such a new, unproven, and completely unregulated system, many alternatives to 'be your own bank' are also not good options. Plenty of exchanges have lost a lot of people's money. It's hard to tell which wallet or exchange is reliable and which isn't. Instead of trusting a system that's tightly regulated in order to protect people's money, you're expected to trust a system that's completely unregulated, that's filled with crooks and cowboys and idiots who keep creatively or accidentally figuring out new ways to lose your money.

It's a good example of why regulation is necessary in banking.

I would have to disagree on both main points;

BTC is nearing 12 years old and time tested.

BTC also proves that no regulation at all is necessary.

It also proves that even folks who think they're technically literate, are hardly capable of making proper backups and or properly using Bitcoin. It's too sophisticated for most. You shouldn't keep multiple bitcoin in one private key. There is no reason at all Bitcoin should have KYC or regulation. It exists outside the government monetary systems and it is your risk you take to use it. Crying about using it because it's risky just means you shouldn't be using it.

12 years is a lot in the world of tech, but absolutely nothing in the world of banking. Or banking system and its regulatory systems have evolved over centuries. And frankly, I'm not sure what bitcoin has actually proven in those 12 years; it's barely being used for any kind of serious commerce. It's mostly a speculation rollercoaster that goes up and down based on whether people expect it may or may not prove itself eventually.

People constantly losing bitcoin like this, or through exchanges falling over, is terrible for trust in bitcoin. Banking regulation exists exactly to prevent this kind of thing. At the end of the day, people trust their government a lot more than they trust a bunch cowboys. It may be cool, but it's no basis for a financial system.

> Satoshi Nakamoto stated in his white paper that: "The root problem with conventional currencies is all the trust that's required to make it work. The central bank must be trusted not to debase the currency, but the history of fiat currencies is full of breaches of that trust."

https://en.wikipedia.org/wiki/Bitcoin

It's clear that the purpose of Bitcoin is to replace existing banking institutions by providing a trust-less alternative. This means that using an exchange to store Bitcoin is essentially useless. If your purpose is to protect your money by handing it over to a trusted institution, then you're better off putting it into a bank that's FDIC insured.

Of course, the real reason that people store their Bitcoin on Coinbase is so that they can easily profit from speculation by exchanging their coin for USD.

Bitcoin does not provide a trust-less alternative, at best, it requires you to trust yourself.

The internet is full of people that have lost their wallets due to hardware failures and no backups, scams, phishing, ...

Was Mt Gox insured? Why should I trust anything after that?

Haha. That's funny. That's like asking if the neighborhood gang member is FDIC insured before they come ask you to "invest".

Users may use one of the many wallets that suddenly vanishes, along with the bits. Neither online or offline is very secure, from bitrot, hackers and viruses. So no.

This is untrue. The entire design of Bitcoin was never to have exchanges, to entirely be your own money's keeper. You would have to actually read the whitepaper, have talked to Satoshi and Hal Finney and paid attention to it's purpose. What you said was an opinion. Not your code/node instance, not your keys, not your money. Bitcoin was not designed to custody your money to a bank, it was designed __against__ doing just that. It is very unfortunate when something like this happens but it's very foolish to have more than 1-2 BTC in one privatekey. This guy should've gone through the painstaking process of putting one BTC, or even less, into 1400 privatekeys and new cold wallets.

>all digital currency that Coinbase holds online is insured. ...

>Coinbase holds less than 2% of customer funds online

So you're not really insured against some human getting the offline key https://help.coinbase.com/en/coinbase/other-topics/legal-pol...

There's a reason why any site dealing with crypto has a dozen labels begging people to double-check addresses, divulge no information to strangers, don't trust anyone, etc. However, warning labels come on any product and people still manage to misuse them. No matter how many labels you plaster about being more careful with bitcoin, people will keep losing it to things like this.

Yeah agreed. If everyone was a developer and a security expert, Bitcoin is great, but instead its a massive hobby that has serious risk like what happened to this poor guy.

If you can't hold it in your hot little hand, it does not exist. This also applies to your money and other valuables held by third parties such as Banks or Trusts, or wealth stored as numbers in a computer.

Unless you hold and control it personally, it's not yours at all.

While it's definitely convenient in good times for your wealth storage to be in the hands of others, you're completely dependent on the goodwill of those others. In bad or difficult times, you're not going to keep that wealth for very long.

Pointing out that you don't technically own the money in your conventional bank's chequing account is a mere distraction from the fact that in the real world, it's easier to permanently lose access to your cryptocurrency than it is to permanently lose access to your bank account.

This is fascinating.

Honestly , while I found BlockChain & Immutable Ledger disruptive technology , I have zero trust in cryptos.

The amount of scam in this industry is just obscene, unlike banking , there is no such thing as insurance for your wallet or legal recourse to get back your assets, your pretty much on your own and I'm fairly convinced he won't get back his 1.5M$ Bitcoin .

I feel bad for him , but there is very little surprise playing with unregulated stuff.

There is a lot more scamming in those legal recourse systems, they have the benefit of not being masqueraded as international news every time!

The user experience where you personally still have your money might be something you like.

Also it was $16m bitcoin

Reading this, I feel compelled to repost this old but still largely relevant blogpost:

http://trilema.com/2013/the-story-of-pointless-and-witless/

It's not crypto-currencies and it's not crypto currencies. It's simply cryptocurrencies. At least learn to spell the word correctly before giving your absolutely ignorant opinion on it.

Given that the first post in tracker mentions "0,09", I think the comment here may actually be using a Euro standard decimal notation.

So the author may have lost 1.4 BTC, or ~16k. Still a loss, but not 16m.

Nope: https://www.blockchain.com/btc/address/bc1qcygs9dl4pqw6atc4y...

Address mentioned here: https://github.com/spesmilo/electrum/issues/5072#issuecommen...

That's why getting a hardware wallet is important!!! The guy have 17 million USD and don't even bother to heighten up the security.

Fools and their bitcoin are easily parted. Perhaps this man has lost his only chance at possessing millions. What an expensive lesson.

This is why we need, order > Community > Society > Government > Banks

We are at the community stage with crypto.

This structure is just one form of security implementation and not flawless at that, and I would dare say biased towards the richer parties.

Scams, in and outside of banks happen really frequently, so turning to traditional structures of control just because new ones failed at some point is defeatist. We can have nice things, but they need time to evolve properly.

Don't disagree, always happy to see the alternative. Another one that we had earlier in India was Rta (natural order) > Rna (debt on non conformist) > Karma > Gods.

But as we understood the world better, this one went out of fashion

The whole point of cryptocurrency on is that they don't believe in ANY of those institutions.

Maybe in the beginning, it looks like gold rush now.

I still keep reading about the cryptocoin utopia fantasy. Where Bitcoin somehow starts being used as currency for some reason.

I keep reading about how bad fiat currency is, and how it's backed by nothing (except, you know, literally superpowers who have nukes).

But yes, there are tulip speculators too.

This story is kinda like:

"I got pickpocketed once and lost all my cash. This means that cash is inherently unsafe and should not be used by anyone ever."

No, more like "I got pickpocketed of all my life savings, therefore maybe I shouldn't walk around with my life savings in my back pocket".

The negative comments on HN about crypto give me confidence RE: it's eventual success in dethroning fiat currency.

And somebody gained 1400 BTC.

Caveat fucking emptor.

Reply on news.ycombinator.com