Computer compromise leads to theft of bitcoins valued at $500,000 USD
forum.bitcoin.org
forum.bitcoin.org
More interestingly: are the features that let you set up a dollar-denominated bank features or bugs?
There were banks before the FDIC and people trusted them. The threat of insolvency can (but doesn't always) keep them honest.
AFAIK any of the online banks could be running out of a hole in the wall in Ukraine or Nigeria. Even paying online sites with credit cards is risky these days with the rampant fraud etc, I wouldn't trust anything online only enough to entrust my money unless backed by a big player.
That's part of how the market solves this sort of problem, traditionally. When trustworthiness is especially valuable, brands develop that have it. One way to bootstrap the process is to start with an existing brand that has it, like American Express. Companies that want to be seen as trustworthy can also do things like offering money-back guarantees and putting money aside in an escrow account held by a third party.
http://en.wikipedia.org/wiki/Federal_Deposit_Insurance_Corpo...
If you think that is honest behavior, then bury all your money for 10 years and then try to spend it. Suprise! You've been robbed.
If I'm not mistaken, there is an eventual limit on the amount of bitcoins that can ever be created.
How many joe sixpacks actually spend their money as quickly as possible because they're afraid of inflation? Hopefully it never comes to that.
> Deflationary spirals are no fun. $5/gallon of gas and $7/gallon of orange juice are no fun either.
That does induce people to spend,invest or save(savings in banks are loaned out to others by the banks) which drives the economy.
The problem with bitcoin right now is that it's being thought of an investment to hold on to, instead of a currency that must be exchanged for goods.
Imagine if the dollar was appreciating in value big time every week and month. People would stop spending and just hog them. The economy as we know if might collapse and lead to a full blown depression.
My prediction is the bitcoin market will correct itself, as markets without interference do. Bitcoins are intrinsically worthless, like the USD, unless it can be exchange for goods/services.
> Imagine if the dollar was appreciating in value big time every week and month.
As long as a central banking authority (Federal Reserve) can legally make dollars from thin air, this will never happen.
- Will the FDIC fulfill its obligations at all times?
- How does the FDIC have the resources to do so?
- Does the presence of the FDIC lead to better or worse behavior among banks?
It's especially interesting to look at the issue of non-trustworthy people. When S&Ls were semi-deregulated in the early 80's, they got extra FDIC protection and were allowed to lend to a wider variety of projects. Suddenly, the credit decisions of the bank didn't matter, because the FDIC backstopped their deposits. And that attracted some really non-trustworthy people.
Wikipedia says the total cleanup cost was $87.9 billion, which discounts the opportunity cost from building pointless malls and empty offices. Can you imagine a BitCoin-based system ever hitting that level of losses?
And following the train of logic, what prevents you from regulating a bitcoin bank?
Crypto-currency is kind of like cash. Yes, you're a fool to try and run an entire economy with cash, but that doesn't mean it should disappear!
(Obviously I'm simplifying, your money gets pooled with others and deposits and withdrawls happen from a pool of money, you don't get your own money back when you withdraw, but lets compare two hypothetical banks with only 1 customer each)
A dollar denominated bank takes your money and invests it. They use it for mortgages, or they put it in bond markets or equity markets. They make a profit. Some of that profit gets returned to you as interest. They also provide for safe keeping of the money. With interest rates near zero, we forget this, but thats the real reason for a bank. If it was just a safe place to keep money, we'd be paying them.
A Bitcoin bank couldn't work. You give them some Bitcoins. They transfer them to dollars, make some investments. Now you go to withdraw some money and they have to sell the investments. Since Bitcoins are deflationary, they can not make you whole without incurring a loss. There is no money to be made in operating a Bitcoin bank and giving interest so long as the exchange rate of Bitcoins to the real world keeps going the way its going. Everyone should just sit on their bitcoins and hold them.
Now if you just want to make a safe deposit box for Bitcoins, that's would work. And you would have to pay a fee. But there is a difference between a bank account and a safe deposit box, and I don't see bank accounts working with bitcoin any more so than they would have worked based on tulip bulbs in the 80s.
Below is an entertaining, albeit slightly alarmist, educational video on how the money system works today. This should be required viewing for anyone considering using money:
In particular, banks do not lend out deposits, at least not in any meaningful way, and the so-called money multiplier is non-existent.
To get up to speed on such things, I would recommend the blogs of economics professor Bill Mitchell. His style is a bit rambling without much polish, since he writes one entry every day, but I found it very worthwhile for getting a deeper understanding. Consider looking for entries with "money multiplier" in the title in the index here: http://bilbo.economicoutlook.net/blog/?page_id=1667
What most people don't realize is that banks don't have to actually have the money they lend out. That's the basis for our monetary system and while it has nice qualities, like spurring innovation, there are some undeniable drawbacks.
It should work just fine if they do the investments in Bitcoins.
Bitcoin has no "bank" equivalent.
I'm also fairly sure there are several brands trying to provide a "bitcoin banking service".
WHY would you implement the digital version of cash, as it seems you just stated -- WHY would you create a digital currency with no ability to really track and disable and refund?
The US government won't let you leave with more than $10k in physical cash without "declaring" it, but declaring exposes you to likely theft by the government in the form of civil forfeiture or tax seizure, as does carrying it past TSA. Your bank won't let you wire-transfer large amounts without having to file a bunch of CTRs, again exposing you to potential legal liability. Making transactions in smaller amounts to avoid notice of the big amounts - even if you're doing so to avoid private thieves - is a federal crime called "structuring". Credit card companies solve some of the problem but can randomly "put a hold" on your funds without your consent.
Digital cash is trying to fill the role that cash used to fill before the War On Some Drugs made everything insane. Back when the government printed $500 bills and $1000 bills and it wasn't deemed "suspicious" to use them. In the modern age, digital cash promises to let us buy things around the world, "no questions asked", without banks and governments and other middlemen getting in the way.
That's one thing about bitcoins. There's no FDIC or SIPC watching your back. It's the wild west with train robberies and stage coach heists in all.
There really should be additional checks. Having to sign your transfer requests and allow people to impose a voluntary delay on their transactions to allow time for cancellation would help significantly.
Gotta protect your data!!
Unless they install as a kernel extension, then you're screwed. But that requires a password.
Of course, I'd want all sorts of regulations on how you set this up; I might sell you some kind of extra-secure system for managing your balance, for example. At that point, the market would basically be putting a price on BitCoin security.
Obviously, my deposit insurance scheme could go broke, if I price it wrong. That's theoretically a risk with SIPC. It's not a risk with the FDIC, since that is ultimately backed by the government's ability to print an unlimited amount of money.
So it might make more sense to say that deposit insurance is a feature of unstable currencies: if anyone's dollar-denominated debt can be 100% guaranteed by the government, then the value of everyone's dollar-denominated assets will face an inflation tax to pay for this guarantee.
Plus, I'd bet that you could create an onion router-style arrangement with multiple off-shore banks in different jurisdictions.
This guy wasn't using a bank, he wasn't encrypting his wallet, so that is inevitable.
Then it's just a matter of running common exploits (or new ones, if you have them) in order to access the machine and the bitcoin wallet.
The main reason though is that new addresses aren't broadcast. The only time you know their location is when they send, and only if you were watching their traffic / the traffic of all nodes they sent to.
That's the account record of the address that supposedly stole the huge amount of bitcoin. The maximum balance I see it have is 400 blocks. Is it missing from the record or is a bitcoin block larger than 1 BTC?
I think, when parts of your currency start to resemble any part of INTERCAL, you have a big problem :-)
Are we prepared to live in that world?
Lojack makes it little less likely that any particular car will get stolen but increases the likelihood that a car thief will be caught.
The Club basically says, "Go steal someone else's car."
"Driver carries no cash" is well intentioned but says, "Go rob someone who does have cash." It has a local deterrent value perhaps, but is of limited value as a deterrent from robbing people who drive delivery trucks.
All of this gets me wondering? Does UPS still do COD? And if so, do they accept cash?
With bitcoin, things are not at all reversible.
Also I expect bitcoin to be shutdown because it could be a great way to fund terrorist activities. (There are major federal investments in anti-money laundering systems that monitor bank transactions, bitcoin transactions operate outside of this system and thus will be suspect.)
Kind of like "it's for the children". That phrase alone can be used to justify so many actions.
True of plenty of payment methods, e.g. CHAPS in the UK:
Unlike other forms of payment such as cheques, CHAPS payments are irrevocable
Bitcoin, though, is supposed to herald the awesome future of totally anonymous, totally untraceable transactions in which once your money's gone, you're fucked.
That worked really well for Wachovia...
http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-d...
So is cash :)
http://www.ehow.com/about_5445167_laws-bringing-cash-america...
Only if it hasn't been transferred elsewhere and laundered and whatnot. Then all the bank is doing is penalizing its other customers to make you whole.
I've witnessed stacks of cash far in excess of that.
However, when it is done, there is usually a fair bit of armament around the cash, and the kinds of people that keep that sort of cash on hand are also not the sort you want to commit an amateur robbery against.
When I was 12 y.o. I had that sort of money in my bedroom (years of saving money from my paper route job, and factoring inflation). Of course, I could prove that it was mine, but it seems like the bar is somewhat low if it's set at GBP1000. It's the kind of money that you use to pay to rent a cottage for your vacations, not ludicrous drug-traffic amounts ...
The only solution I'm coming up with would be to hand over control of your wallet to an anonymous-yet-trusted third party who's hidden behind Tor or such. The difficulty is in finding (or creating) an anonymous-yet-trusted party in the first place.
I'm not sure that's true. As I mentioned in another comment, the CHAPS payment system doesn't allow transactions to be reversed, and the other major system in the UK, Faster Payments, I believe has a 24 window for banks to request a reversal, usually in case they transmit something by mistake.
Honestly, I think we place too much faith in banks sometimes.
Western Union is irreversible, and would probably have been shut down if it wasn't so well-established. Most other US payment systems are reversible, which is why you have holds on getting the money out of those systems - they want time to detect fraud and reverse the fraudulent transaction. This requirement for reversibility seeps through the system, which makes anonymity very difficult, and causes a lot of friction on anything that changes a reversible payment into a non-reversible payment, since that's where you eat the fraud. Now you know why it's hard to get cash equivalents out of the system, especially to a remote party.
The point here is that once the money is in a non-reversible network, you can accept a payment and know that it's good very very quickly. If you make bitcoin reversible, you might as well just use one of the old payment systems, where the money might disappear later (and you'll be out your privacy, goods, cash and services), or you'll be paying transaction fees based on your charge-back rates, and unable to charge more for the reversible payments than the non-reversible ones due to contracts you have to sign to be part of the payment network - and thus the non-reversible payers subsidize the reversible payers. What a racket.
As we used to say, "there's no good guys in payment processing, only bad guys and less-bad guys".
Of course, this would effectively require an insurance corp also set up in such a fashion that integrity of the bank could be configured.
/hmm... maybe I should do this!
> If only the wallet file was encrypted on the HD.
Yep. Anyone who doesn't do this is stupid.
Its Open Source and you can interact via JSON so it would be that hard to build a good client that does this kind of stuff.
On the other end it's a good cautionary tale. I'm quite curious about this bitcoin thing, but this reminds me I definitely don't want to secure all my money myself without any insurance or guarantees. A stupid mistake and shazam you lost all your money.
Regarding the issue of whether the application should encrypt the wallet by default, it'd probably be a good thing to have but I'm not sure it would have helped in this case. The wallet would have to be decrypted in order to mine or execute any transaction and the attacker was obviously targeting the bitcoin wallet specifically, so it could just have installed a keylogger or whatever to catch the passphrase, like they do with banking sites (or wait until the walled is decrypted and dump it then, or install a backdoored version of the bitcoin client...).
If so, that's a lot easier to deal with than losing everything outright, but not risk proof.
Hi everyone. I am totally devastated today. I just woke up to see a very large chunk of my bitcoin balance gone to the following address:
1KPTdMb6p7H3YCwsyFqrEmKGmsHqe1Q3jg
Transaction date: 6/13/2011 12:52 (EST)
I feel like killing myself now. This get me so f'ing pissed off. If only the wallet file was encrypted on the HD. I do feel like this is my fault somehow for now moving that money to a separate non windows computer. I backed up my wallet.dat file religiously and encrypted it but that does not do me much good when someone or some trojan or something has direct access to my computer somehow.
The transaction sent belongs rightfully to this address: 1J18yk7D353z3gRVcdbS7PV5Q8h5w6oWWG
Block explorer is down so I cannot even see where the funds went.
I tried restoring an earler backup of my wallet but naturally that does not work because the transaction has already been validated.
Needles to say I feel like I have lost faith in bitcoin.
Anyone have any ideas what I can do besides just jump off a bridge?!
--------------- [snipping out posts that don't contribute much] --------------- Re: I just got hacked - any help is welcome! June 13, 2011, 09:05:04 pm allinvain
First thing that I noticed is that my slush's pool account got hacked into and someone changed the payout address to this:
15iUDqk6nLmav3B1xUHPQivDpfMruVsu9f
I then changed the password and proceeded to run some antivirus and anti malware scans. Some stuff was found, but they were all cleaned up and they were all in my windows user profile temp dir which I deleted all the temp files. God I can't even type properly. Sorry folks I'm a bit emotional now.
I then left another virus scanner running and went to sleep. When I woke up I check my bitcoin wallet. I leave the client running to help the network, and I notice -25,000 (and a transaction fee) gone.
Fuck, I really should've moved the coins to a vmware linux session I have running. But the question is was it already too late? Could someone had my access to my wallet.dat for a long time and now just decided to "cash out"
On June 12th, $3,5M were exchanged on MtGox. For 8 of the last 10 days, the daily volume has been above $1M. I think that you could get these $500K in small chunks in a few days, provided you do it full time.
Edit -- Source: http://bitcoincharts.com/charts/mtgoxUSD#rg30zigDailyzvzcvzl...
Without an unbiased third party auditing of their accounts I would be loath to place too much trust in data they themselves produce to say how awesome they are. Especially with such a significant amount of capital allegedly at stake and nothing to lose for bending the truth.
That said, I think you're overstating the impact this would have. The recent downswing from ~$30 to ~$10 in a period of a couple days was speculated to be due to MtGox consolidating 20 times this amount.
The Merchant trade in Europe came up with three valued things:
1. Corporations 2. Insurance 3. Banks
Those three items are related to one another. While its true that due to the anonymous nature BitCoin is biased towards illegal mafia-like formation of banks and such for illegal activities as soon as legal activities start using them as trade banks, insurance, etc will form as a nature evolution.