Crypto exchange BitMart confirms hack resulting in loss of $150M | Hacker News Reader

Crypto exchange BitMart confirms hack resulting in loss of $150M

theblockcrypto.com

233 pointslxm278 comments

The great thing about crypto exchanges (and other sites that hold crypto for you) is that they're self-paying bug bounties.

Anything that holds value is a self-paying bug bounty.

> Anything that holds value is a self-paying bug bounty

Most valuables have means for recourse. Crypto’s pitch is that it circumvents these mechanisms.

I think hacking about any service will provide valuable data, which can be sold at darknet marketplaces. I read somewhere that there is a marketplace just for hacked server credentials as well.

>Most valuables have means for recourse

Most valuables? I think most financial assets have means for recourse, but if your gold bars/jewellery gets stolen, it's as good as gone.

> if your gold bars/jewellery gets stolen, it's as good as gone

Which is why society stopped storing meaningful quantities of value in gold generations ago.

One of the reasons. The ability to exchange cheaply and quickly is another reason, di visibility another one

Surely there is more value stored in gold now than generations ago, right?

On the list of reasons for why we switched away from the gold standard and gold coinage, this is probably not even in the top 10.

Vast quantities of gold hold value still in the same way as before, only that it's done by very large organisations. This too is a western phenomenon. Indian Households currently own 25,000 tons of gold( one of the largest reserves anywhere) - China isn't too far behind AFAIR.

That's because those countries have the largest populations of new money rubes to sucker into buying shiny objects.

Oh, the contemptuous disdain dripping in this comment.. somehow feels like the early 1900s pride of the British Empire.. just sounds very awful tbh.

No. That's why we created banks to store this gold. The reason we moved to paper and digital currencies was so governments and banks could create money out of thin air.

I thought we did it (actually the ancient Chinese did) so that we don't have to pay in bags, wheelbarrows and horse carts of heavy (as in mass) metals whenever larger transaction needed to be made?

But what do I know, conspiring about evil governments & banks trying to print money out of thin air is a much more sensible argument, right? Just as there is an article on the front page on Tether "minting" a billion USD equivalent Tether out of literally thin air ...

Well, partially correct. It was a quality-of-life thing until the banksters realized they could let out more IOUs than gold they had in the vault. From there on, it would only be a matter of time till the gold-standard becomes abolished, giving governments and banks the ability to print money at will.

Tether coins are basically the same thing. You still have to trust the neo-banks to still be holding your actual dollars somewhere in their vault. I don't, that's why I prefer not to buy bogus coins.

USA stopped storing meaningful quantities of gold in 1971, to be more precise. 50 years exactly.

https://wtfhappenedin1971.com/

What means for recourse do most financial assets have? If a business falls victim to a BEC scheme that money is gone and nobody will reimburse them.

If you as an individual fall for a craigslist scam, your money is gone.

If you have literal gold bars, they are almost certainly in an insured facility; actual risk to you, the owner of the gold bars, is limited.

I mean, if you have them on your _house_ then this applies, but people typically don't.

My stolen bicycles would like to have a word.

This only makes sense for smart contract run exchanges where the code, in theory, is always right. Otherwise this is no different from any other financial hack.

Oh, but it is, because with crypto you can simply drain the wallets anonymously. If you hack a regular bank and try to transfer the money to your accounts, you'll get caught and jailed ridiculously fast.

Maybe you should try to learn about how these schemes work before making such statements?

According to the FBI, BEC fraudsters took $1.8 billion in 2020 by stealing wire transfers from businesses into their own accounts https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pd...

I'm a relative newcomer to the crypto-space so please forgive me for any errors.

I see the point you are attempting to make but the number is rather useless, in the past week hackers took 20% of what was stolen by BEC in a year. And skimming through the report you sent it seems like there is a program to recover said funds that have been lost and it has an 82% success-rate.

The $1.8B only represents US losses known and properly classified by the FBI, the real number for global losses will be much higher.

Agreed, but that is simply cause-and-effect by virtue of the majority of the world using the current global financial system rather than crypto and many more hackers are targeting said folk.

Either way two wrong's don't make a right, there will be losses in both systems but I would argue that storing your money with a unregulated crypto-firm would be more dangerous than with a modern-day bank.

I think the main gripe that many people have including myself with crypto is that it doesn't even have the proper consumer protections so that a decent/strong chance of recovery is possible.

This trend of massive amounts of crypto currency being stolen is not even a relatively recent one, see Gerald Cotten's (Quadriga) death in 2019 which resulted in $150 million in assets going missing with no chance of recovery.

This reply has been a little-bit scatter-brainish, so my apologies for that.

> The great thing about crypto exchanges (and other sites that hold crypto for you) is that they're self-paying bug bounties.

That's a pretty crass and glib statement. So are home burglaries, I guess? Or, really, any kind of crime regarding the stealing of funds or valuables?

You're basically saying 'if you find a 'bug' that lets you get money, then it's a self-paying bug bounty.'

So, snatching someone's purse while they're in the toilet--boom, instant self-paying bug bounty.

Do you even know what a joke is?

Do you know what insensitivity is? Would you make the same joke about any of the other examples I mentioned?

No I wouldn’t because they aren’t topical to a website devoted to talking about dev and tech. It’s a joke, sensitivity isn’t always a priority, you don’t have to like it.

If explicitly people want to be independent of the regulated financial sector and sign-up to take these risks you cannot claim "oh, I've been wronged, pity me" -- sure they deserve justice, but this happening to them is part of the risk reward of working with crypto..

I'd wager that you shouldn't put any money you can't afford to lose into crypto, so your other examples are not really comparable.

> I'd wager that you shouldn't put any money you can't afford to lose into crypto

Again, you can just as easily say: I'd wager you shouldn't put any money you can't afford to lose into your wallet or purse.

You're just doing transparent victim-blaming right now. If someone gets robbed, it is not their fault.

Silly wager. Crypto is a wild punt, your wallet is not.

Calm down son, your emotions are getting the better of you.

It doesn't matter if they're being robbed of cash in their wallet or magic beans in their e-wallet. What matters is the action, and making light of it.

It was a joke - it’s not like he’s going around taking the piss out of the losers here - it was a joke about big bountys on a software engineering / IT focussed message board.

Hack a crypto exchange - self paying bug bounty - it’s just a Joke.

Take a chill pill, the stick up your arse must be massive.

Unless it's an inside job going high up.

Insider threat is a part of security considerations.

I wonder if a completely Wild West really makes for better security… doesn’t seem like it so far.

Probably a good lesson in there about incentives and consequences maybe not always going where you might think.

The invisible hand of the free market is in your back pocket lifting your wallet.

I mean, did anyone ever suggest it would? I don't think even the biggest bitcoin enthusiast would claim that these dodgy exchanges were especially secure.

Except these people can create their own bugs and rob their own clients and call it a hack and nobody can do anything about it because they're off shore and unregulated. You'd have to be pretty dense to put any money on the unregulated exchanges.

Yeah, what's the motivation for so many people going to these unregulated exchanges when there's so many regulated ones (or at least larger ones, I've never even heard of BitMart)?

Is it to trade coins/tokens that aren't normally listed?

At least in the US, exchanges aren't really regulated. Not as broker-dealers, anyways, in the same way a Fidelity or Schwab is regulated. They're regulated as money services businesses and money transmitters, a much weaker form of regulation designed explicitly to work around the "onerous" regulations in the rest of the system.

Yes, to speculate on a ponzi they know will fall but they think they can time.

In normal finance, it s just too crowded to make the same amount of margin short term.

I had a little bit in BitMart. It was to speculate on some iffy coin that was only listed there. With hindsight maybe not wise.

Crypto does not really provide anything new here. You can say that about traditional banking systems as well.

As usual, the trouble with cryptocurrency exchanges is that they mix multiple functions.

* They're an exchange, matching orders.

* They're a retail broker, taking orders from customers and holding funds.

* They're a custody institution, holding both fiat and cryptocurrencies.

* They're banks, lending to others and receiving interest, and borrowing from customers and receiving interest.

* They're traders themselves, for their own account.

Now, in the real world, all of those functions used to be done by separate companies. With "deregulation", there are banks which have brokerage, custody, and trading units, and they do get into trouble. Which is why those are all highly regulated industries with a lot of inspection, required disclosure, and insurance backup.

You'd think the "decentralized finance" people would have figured out a way to separate those functions by now. But no.

In fairness, BitMart is not "decentralized finance", it's a privately owned business that allows it's customers to trade crypto.

> You'd think the "decentralized finance" people would have figured out a way to separate those functions by now. But no.

But yes. I'm not sure how you've heard the term "decentralised finance" but haven't heard of decentralised exchanges, both traditional Ethereum DEXs and more novel cross chain ones. They successfully separate out:

- User funds by self custody

- protocol rules that are publicly verifiable.

- build/bring your own front end

- market making- AMM, order relayers + others

- lending and borrowing including the above stack in completely separate but composable protocols

Decentralized finance is a pipe dream. If it were truly decentralized we would have individuals managing all of the responsibilities you listed. Fraud would be EVEN MORE common.

I forgot where I read this, but someone said something like "Crypto advocates are learning in real time why finance/banks are centralized. They're playing out the history of finance reform at hyperspeed."

Soon they ll innovate by having government backed physical "coin" they ll call coin notes :D

I've literally had people at prop trading firms gush about how crypto exchanges work - "You're the exchange so you literally know where everyone's stop losses are!", it's absurd you're the exchange but you're also the largest market maker, flash crash through a load of stop losses and pick up a tonne of coins at below market rate.

I work in a bank, we could get robbed by social engineering (and are ridiculously paranoid, we even have phishing exercises when the bank send you a link, you click on it and they say "dude that could have been phishing, read xyz to learn how to stop clicking on every link you re shown"), but these 200M remote hacks look a bit too frequent and a bit too easy with crypto - you dont even need corruption and insider trading it seems now.

Gemini is FDIC backed up to US$250K per account. I think they are taking the regulation thing seriously. They are also fully backed stablecoin because they only have like $300MM in assets, so it is easier to back. Although I still have trouble getting my head around "Winklevoss Dollars".

Huh? Any broker I've dealt with had the following:

* Order matching (in-housing of orders so they can pocket the brokerage fee without actually incuring exchange fees as well as make money off their inventory)

* Placing orders and holding the funds I send to buy stocks with

* Custodian that holds both my stocks (in their name) as well as my fiat

* Banking, they allow opening of margin accounts where I can borrow fiat to speculate with, and all of the assets within such accounts can / are lent out (if you are big enough you will even get interest on these assets)

* Strictly speaking, most brokers aren't traders on their own platform... but in-housing of orders produces pretty much the same effect... so the distinction seems pretty meaningless. E.g. they buy stock at $x, internalize orders that are profitable when selling said stock at $x + $1 (but below or matching market rate), profit.

Several functions are intrinsicly linked there. You can't buy or sell anything without having them hold the asset / fiat... even if only for the T+2 days to settle.

> You can't buy or sell anything without having them hold the asset / fiat... even if only for the T+2 days to settle.

I thought DTCC and NSCC took care of that, for like, everyone. No?

All of my brokers have required funds in settlement account prior to settlement date, with some being fine with transfer of funds on t+2 if they could see enough money in an attached account.

A BlockChain is like giving people ACH access. It’s insane to think that people are ever going to be competent and experienced enough to run their own bank. Society needs banks and regulations. This can all happen at layer-2 on top of an auditable and objective root chain. There’s a very clear analogy where everyday people interface with Eltoo “banks” existing (and regulated) on-chain providing convenient “traditional” banking services. That’s where this is all going. Crypto anarchy is a farce; don’t fall for it.

It's almost like in the past the world did not have anyone who had the capability to print their own money, until the world said "this is madness, we need to put structure to this".

You can’t print gold. …

But you can go to 'India', conquer the Aztecs, steal all their gold and silver, and depress the European gold economy for the next century.

-----

You can also subtly alter the composition of your gold and silver coins to leverage your reputation and squeeze more money out of your gold reserves.

Turns out that most people don't have a habit of checking the density of gold coins. As long as they weigh the same, you can trick the scales.

500 years ago, they'd mix cheaper metals into their coins. Today, we'd just use tungsten, which has very similar density to gold.

You can do the first thing with a chain coin but I don’t think you can do the second.

For Blockchain, you just invent a new coin (DOGE, Shibu, whatever). Every new Blockchain is a new group of people printing a trillion / quadrillion crypto tokens and throwing into the market.

As long as cryptofans buy up new coins or NFTs, you can keep printing new tokens.

“A fool and his money are soon parted”

Fool’s gold has always been a thing. Similarly, there will always be some who cannot distinguish between Bitcoin and the latest dog coin. Few Bitcoiners are selling Bitcoin to buy NFTs or altcoins.

What are they selling it for?

Most are Hodling. The rest are selling for USD or USDT mostly is my guess

So basically, no one is actually buying the story of "digital gold" or "store of value". They are either playing the game of greater fool, or trying to cash out of it.

Call me back when Bitcoiners actually start using the thing as a currency. At least that was more interesting.

Call me confused, but my understanding is that pretty much everyone is currently using it as digital gold, a store of value, a powerful hedge against inflation.

Why is store-of-value not a valid use case, especially with central banks printing money so aggressively?

Who cares if it is used as currency? It is used by millions and that's what matters.

As long as governments insist on taxing Bitcoin as property, it will never be a medium of exchange. As long as it continues to grow at 10-20x the S&P500, it will not be used as a unit of account.

So what?

It is a $1 Trillion asset class that has proven itself as a store of value over the past 12 years. It offers unique technology, game theory and network effects relative to all alternatives and it is protected by a forcefield of hashpower called Proof-of-work that is impenetrable to even nation-state level attacks.

Bitcoin is amazing. I believe it is the most remarkable innovation of the 21st century. Prove me wrong. Tell me about a superior innovation invented this century.

> everyone is currently using it as digital gold, a store of value, a powerful hedge against inflation.

You and I have a different idea of "everyone" means, but anyway...

> Why is store-of-value not a valid use case

Because if it's value depends on a large number of people agreeing to its value, then it's not a store of value. All it takes is for the miners to decide to dedicate their resources to something more profitable, and suddenly the network is worth zero.

> It offers unique technology.

It's so unique, it has spun how many forks already?

> It is a $1 Trillion asset class that has proven itself as a store of value over the past 12 years.

You are literally using circular logic here.

> Tell me about a superior innovation invented this century.

"Blockchain, not Bitcoin". ;)

And even blockchain still needs to prove itself. I believe it can be very useful for some cases, and I am working to see it succeed. I just don't think that "digital gold" is one of those cases.

BTC was a good prototype. That's it. We should continue in the drawing board instead of pretending that we have a finished product in our hands.

BTC already failed as a currency, the activists and cypherpunks that first got into it would be mortified to see how now current proponents end up cheering for a dictator in a Banana Republic that is pushing "their" coin. The "digital gold" narrative switch was an attempt to save it and now we are all playing this game of "Emperor has no clothes" with something because some people are trying to be rich without building any wealth.

> You and I have a different idea of "everyone" means, but anyway...

I misspoke, everyone who is investing in Bitcoin, ~100 million individuala, is doing so because of it's store of value and inflation-hedge properties

> Because if it's value depends on a large number of people agreeing to its value, then it's not a store of value. All it takes is for the miners to decide to dedicate their resources to something more profitable, and suddenly the network is worth zero.

Can you tell me a single asset or commodity (including USD) whose value does not depend on a number of people agreeing to it? Yes the US gov determines that fiat has value by accepting it for taxes, but how much value it has to purchase real goods is determined by the market.

> It's so unique, it has spun how many forks already?

Often imitated, never replicated. No one has ever come close to replicating the hashpower that makes Bitcoin secure.

> You are literally using circular logic here.

It is a $1 Trillion asset that started out as a worthless technology experiment almost 13 years ago

> "Blockchain, not Bitcoin". ;)

No, just no. Blockchain without Bitcoin, meaning the game theory that led to the rise of the network and the supercomputer network that protects it, is just a nice academic theory. Other Blockchains do not enjoy the hashpower or the security budget of Bitcoin and are therefore not competitive. (Name one other Blockchain that is more secure than Bitcoin)

> BTC was a good prototype. That's it.

A prototype that is now worth $1 Trillion in market cap, moving more value than Visa every day.

How can we call that a prototype?

Are there any competitive blockchains that are aiming to replace this Bitcoin 'prototype' and providing a decentralized digital currency with a fixed a pre-determined monetary policy, protected by the most secure super-computer ever created?

> BTC already failed as a currency, the activists and cypherpunks that first got into it would be mortified to see how now current proponents end up cheering for a dictator in a Banana Republic that is pushing "their" coin.

I'm sorry Bitcoin didn't conform to your 'allowed' definition of a 'currency'. Bitcoin is no more a currency than the automobile was a mechanical horse. Bitcoin is a radically different way of solving the same problem traditionally solved with money. There is overlap, but it isn't going to be 100%.

I think you are overly focused on the medium of exchange and unit of account use case. These unfortunately are dead on arrival for any country that taxes Bitcoin as property rather than treating it like a currency. In El Salvador, Bitcoin can be a currency, not in the US or Europe.

> The "digital gold" narrative switch was an attempt to save it and now we are all playing this game of "Emperor has no clothes" with something because some people are trying to be rich without building any wealth.

I appreciate your perspective. Have fun staying poor.

- USD is not a commodity or an asset.

- "security by hashpower" assumes that PoW is the only way to go, when the important feature of blockchain is that it works to BFT consensus.

A security system that is expensive to maintain and consumes so much resources in a non-renewable fashion (and I am not talking about energy production, I am talking about energy itself) is a bad system, period.

We should not be looking at how much hashpower it is using and thinking "that's a good thing", we should be thinking "how can we have a consensus system that is more efficient and less wasteful".

- USD is not a commodity or an asset.

And yet the point stands. The value of the USD depends on a large number of people collectively agreeing that x dollars are worth y loafs of bread.

- "security by hashpower" assumes that PoW is the only way to go, when the important feature of blockchain is that it works to BFT consensus.

Yes, security by hashpower assumes that PoW is the only way to go because so far that is the only thing proven to be resistant to a wide range of attacks that made previous attempts to solve the Byzantine General's problem fail. Do you really believe that Satoshi Nakamoto didn't consider PoS as an option?

> A security system that is expensive to maintain and consumes so much resources in a non-renewable fashion (and I am not talking about energy production, I am talking about energy itself) is a bad system, period.

Bitcoin mining is one of the most concentrated sources of renewable energy demand in the world today. The game theory economics unlocked by the availability of a high demand for low-cost electricity without regard to it's location or proximity to a population center is a game changer. It will reshape nations and society over time.

> We should not be looking at how much hashpower it is using and thinking "that's a good thing", we should be thinking "how can we have a consensus system that is more efficient and less wasteful".

I agree. Until we find those solutions we have Bitcoin and PoW.

> USD depends on a large number of people collectively agreeing that x dollars are worth y loafs of bread.

Hum, no. That is horribly reductionist. USD is a currency, who has a central bank enacting monetary policies. It also has a very big government behind it that wants to have some oversight over the economy.

> PoW (...) is the only thing proven to be resistant

Again, no. PoS is doing just fine, it allows for a much larger and diverse pool of nodes. Meanwhile in PoW systems you have hardware manufacturers who "test" their equipment on mainnet before delivering to the buyers and quite frequently gets scared with the concentration of hashpower by one pool or another.

> mining is one of the most concentrated sources of renewable energy demand

Can you provide one example of a place where has cheap, renewable energy and that can make the energy distribution more profitable than bitcoin mining?

Do you understand that it doesn't matter if the energy production is 100% clean (which is not, and likely will never be given that energy is cheaper in countries with bad environmental records), the problem is that if mining is more profitable than selling the energy, any excess energy will always go to mining and all of the "advantage" you are talking about is ending up in a closed-loop system?

> Until we find those solutions we have Bitcoin and PoW.

Let's pretend for a moment that there are no better alternatives today: suppose that there will be one day in the future (2, 5, 10 years? Doesn't matter...) where there is a chain that demonstrated to be more efficient, can make more transactions and is just as secure as PoW. Let's for the sake of argument assume that the new tech is so undeniably superior, even BTC's core team announces plan to adopt it.

How do you think the transition will happen?

(a) BTC users will continue using only BTC's until the devs manage to create and implement a migration plan? (b) BTC users will slowly migrate away to the new chain? (c) BTC devs will just freeze the old chain and make a new genesis block on the new chain? (d) BTC users will panic-sell and move to the new currency on the new chain? (e) BTC users won't even be able to notice the new chain resurgence until it is too late?

For the question above: what about the miners? Are they just going to dump their mining rigs and get on board with the new system, or do you think that their operation is just too profitable for them to let it go?

What I am trying to show is that - if you assume today that there can be something better than BTC and can supplant it - then the future price of BTC is ZERO. Given that BTC does not pay any kind of dividends, and that the future price of BTC is ZERO, then there is no point of holding it. Every bag holder is just playing a game of chicken now.

Holds true as long as "cryptofans buy up new coins". But eventually, they won't. For these types of get-rich-quick gamblers, they usually shift their money around to the next thing, but an equal amount of them lose their money as well.

Those that invest in Bitcoin tend to be more conservative, and are more willing to hold their coins and use it as a long term investment/store of value. They aren't easily convinced a new coin can replace Bitcoin either.

Well, technically you can. You can "print" gold by using other elements with simply changing number of protons to match 79. I believe this has been done already, if my memory serves me right reading some article years ago. Its just that the cost of doing so even on small scale overweight the cost of the resulting gold, even if the price would be of a 10-fold what it is today.

tldr: its possible, just not worth it.

Ha, yeah technically you can grind the chain too, but it requires unreasonable amounts of resources.

But it's interesting, because it sets an upper limit for the gold price.

Yes very interesting. Gold was originally formed within supernovae, which is a sure sign that our planet is formed from molecules that have been through at least one or two supernovae already. Another fund gold fact, the reason gold appears in "veins" is that it's actually big blobs, but over time water runs through the blob, dragging along little bits of dust with it down the same channel. Those little bits of dust build up and become veins of gold.

During the gold standard central banks would engage in sterilising operations to prevent large fluctuations in the money supply, which was the equivalent of open market operations in modern central banking (what some people call "printing money")

You can't print bitcoin, but you can mine more gold.

Hello world from the first world

The main issue in third world countries is always corruption.

so 95% people in 3rd world countries are corrupted?

100% lives in a corrupt state, mafia, or militia.

Corruption is a huge first world issue too.

In the first world, it's always called a "lapse in judgment" ...

in UK politics it's called "sleaze" but that's a fair bit better than "lobbyism" in the US.

Bitcoin is a great lesson on why things are the way they are.

It’s not just evil banker man rules, there’s reasons.

Yes but there’s also real value in developing better technology and encoding transparency and accountability into our financial and social systems. Evil banker men and corrupt authorities do exist and people rightfully want to rebalance the power distribution to mitigate the damage manipulative people can do.

The question is whether any of the cryptocurrency companies are actually able to deliver that. Traditional MLMs always claimed to be doing something noble like being healthier or democratizing real-estate, too, and the cryptocurrency pitches notably revolve around people selling things which they know cannot solve the stated problem but promise that they’ll figure out how to built a viable system after you buy in and make them rich first.

I wouldn’t be surprised to find that if given the choice any given crypto company would gladly become “the man” they would seem to be fighting against.

I feel like an awful lot of the market could be summed up as “Wouldn’t it be great if <ordinary activity> had microtransactions like a pay-to-win mobile game?”

99% of all crypto companies are scams looking pump the price and sell their premine.

Bitcoin is the only crypto that matters.

and there is no Bitcoin "company"

And Chia.

Nah, another shitcoin that is run as a startup with a large premine.

I love how crypto is somehow morally superior bcs "technology". Somehow crypto enthusiasts can explain away the opportunist cesspool that surrounds crypto as isolated anomalies, while making corruption a characteristic exclusive to existing institutions.

Who said anything about morally superior?

There is no morals in regard to the technology. The tech itself has no morals, it is the people that use the tech for good or evil.

Not really, "evil" bankers are held accountable by the judiciary and regulators. If anything crypto-currencies hamper the ability of those authorities to hold them accountable, so they make things worse in that respect, not better.

> ..."evil" bankers are held accountable by the judiciary and regulators

...by the judiciary and regulators only so far as the (imperfect) legislation of the day allows.

You are forgetting the unelected central bankers who knowing refer to inflation as "transitory" when they know, and we know, it isn't.

You are forgetting the guys who decide to print 40% more US Dollars in 18 months without giving the electorate an opportunity to weigh in on this drastic decision.

These central bankers are the so-called "evil bankers" -- the Wall St types just want to make money and while that might be greedy, at least they're honest about it.

Managing the money supply according to a democratic mandate doesn't constitute "evil", sorry. I thought this was a serious discussion.

Note the word "so-called". And note the use of quotes citing the OP.

This is a very serious discussion.

On a side note, where is that "democratic mandate" of which you speak? Been looking for a while and can't seem to find it.

You can't find the mandate?

https://www.federalreserve.gov/aboutthefed/section2a.htm

> You are forgetting the unelected central bankers who knowing refer to inflation as "transitory" when they know, and we know, it isn't.

This is not true, that bankers refer to inflation as something "transitory" as you put it. Maybe they talk like that about current inflation rates but certainly not about inflation itself.

it's kind of beautiful that way though. fools and their money are soon parted, while others learn and do things the right way. it's like making banking accessible to hobbyists.

Tether is the next fucked example, they print money.. Out of thin air! No audit, nothing. They say they bake it with collateral. But some people think it's either nothing or they print tether to buy bitcoin. Either way. Its fucked.

Bitcoin is just a currency, there's nothing stopping traditional banks/institutions from using it or allowing customers to trade/keep it.

If this is it then I have to wonder what value the rules really provide. Because I'd rather 150M abruptly change hands every now and then than listen to a member of the PMC standing on their faux meritocracy tell me I'm too stupid to do A, B and C and then write regulations to make sure I can't.

Pretty sure it's just evil banker man rules.

It's both. You need some regulation, but only moral ones.

The banks are the ones getting hacked.

Yeah I’m including crypto banks in the set of things that need regulating. People rob banks, for sure. There should probably be op-sec regulations and e.g. on-chain multi-sig requirements for transactions out of the bank accounts and ability to revoke etc. Bank rolls up its L2 day-to-day into a smart contract address type of stuff.

> It’s insane to think that people are ever going to be competent and experienced enough to run their own bank.

It's also insane to think people are competent enough to vote (this was a real argument in the 1700s), and yet here we are. Also insane to think they're competent enough to use guns, or drive cars, or whatever.

I think that, throughout human history, the pattern here is that we'd rather prefer the tyranny of the masses as opposed to the tyranny of the aristocracy. That's why I think crypto is here to stay. It will be pseudo-regulated, but if DraftKings and Eaze/WeedMaps is any indication (who would've thought, just 15 years ago, that sports betting or marijuana would be legal in most US states?), people will have access to these risky financial instruments.

This libertarian argument is somewhat disingenuous. It hides the fact that the whales stand to benefit tremendously. The peons will still be peons.

You're asking for us to vote you into power, and so far all of the evidence says this is a bad thing. Power consumption, no restitution for hacks, pump and dump driving insane swings and pyramid scheme behavior, the emergence of ransomware, NFT artificial scarcity.

KYC and AML are good. Regulations are good. The cowboy wild west without these protections is a nightmare that will lead to increased lawlessness, hacks, and thefts that will harm the poorest among us.

I don't want the thought leaders in crypto being in charge. They've already shown what bad stewards they are by downplaying all of these points and continuing to ignore the problems. They're focusing on what they can gain rather than what others are losing.

> This libertarian argument is somewhat disingenuous.

I'm not really making any argument; in fact, I'm probably leaning towards the "philosopher king" ideal rather than the masses running the show (I mean, just look at how much of a societal disaster social media has been), but it seems to be where we're headed.

> It's also insane to think people are competent enough to vote

The last five years have made me seriously start reconsidering this premise

> It’s insane to think that people are ever going to be competent and experienced enough to run their own bank.

Not what happened here. A centralized exchange is the exact opposite of "running your own bank".

> Society needs banks and regulations.

Agreed about the principle, but I can bet we disagree about the scale. A lot of the problems in the past financial crisis are due to banks being "too big to fail" and regulatory capture that makes it basically impossible for small-scale banks to be sustainable. Open Banking and the fintechs that are cropping up are all based on the same idea of "winner-takes-all" dynamics that has been the bane of Big Tech.

> Crypto anarchy is a farce; don’t fall for it.

You are absolutely right. Just like goldbugs, there is this special type of crypto enthusiast that believes that their "money" will be of any use in an apocalyptic world, and simply forget that a world with failed institutions they will probably not even have internet, and even if they did they will lose pretty quickly to rubber-hose "hackers" than anything.

But crypto can be used as a hedge for the many dysfunctional institutions that we have today, and it can be a response to this hyper-globalized world that we live in. It's barely a paragraph on my description of Hub20 [0], but one of the reasons that I am working on it is that I hope that it can be used as a community-oriented bank, where each group of people can define how to operate it and how to manage the funds. I hope to make it something that can be a middle ground between the "welcome to the jungle" and the "resistance is futile" mindsets that seem to polarize the crypto-debate.

[0] https://hub20.io/about

More than a hedge against dysfunctional institutions, it hastens the downfall of those institutions by removing their leverage. Imagine if the US government had to collect more taxes and police the blockchains to enforce it instead of just printing money, it would push them to the brink. Grab your popcorn. Crypto is a self fulfilling prophecy of government failure.

Hmm curious to hear more about this, do you have any examples?

El Salvador? How else would you explain an authoritarian leader of a narco-sponsored state and paramilitary groups being so interested in promoting Bitcoin?

Crypto doesn't fix the failed state.

There are a lot more problems there then: "bought the dip" lol

Evolution does not work by "fixing" anything, just by removing what is not suitable for the environment.

Crypto is not going to "fix" anything. Crypto is just an alternative for those who live on places that the institutions are broken, and the more the institutions are broken the more compelling crypto will become.

The problem in the first place was internet access to rural areas to enable easy banking.

This is the type of comment that could've been taken out of an episode of Silicon Valley. It's like what happens when techbros who never left their homes think they can solve social issues with tech.

To have "easy banking", first you need to live in a place with healthy financial and banking institutions.

To have that, you need to have a government that is able to give confidence to investors that the money is not going to be misused or appropriated.

To have that, you need solid political institutions, corruption can not be systemic, and leadership needs to have a sense of stability in regards to social-economic policy.

El Salvador has none of that. Farmers can have smartphones and even good data connectivity, they still won't be able to get credit to invest on their work, they still will depend in large landowners for their livelihood, they will still be coerced to vote for the local baron who has the connection with higher officials and with the drug traffickers, etc.

Internet access is the lowest hanging-fruit and the least of the concerns.

Going to a bank requires a drive of 4 hours with public transport in El Salvador and is one of the many issues for rural areas.

But yeah, eg. Africa uses sms for lending and transferring money. Which is also perfectly fine and it works there.

Lookup 'mobile payment banking' and it works there, even with corrupt governements.

( I'm not saying the situation is perfect. But for access to money, borrowing, saving and banking, it's a solution)

I think we 100% agree. Thanks for elaborating. I am including banks/exchanges in the set of things that need regulation. I understand the way I worded my comment implies retail did something wrong, that was not the intention. I was more tying to highlight that this stuff is important and there’s a reason people lean on 3rd party entities to help them manage and trade their assets—it’s too complex to do alone for most. So we’re gonna need L2 institutions that handle large amounts of consumer assets and so we’re going to need to impose regulatory requirements surrounding e.g. key storage and access. Deploy root-chain-enforced multi-signature requirements, perhaps entertain transaction revocation for sufficiently large sums, etc.

> so we’re going to need to impose regulatory requirements surrounding e.g. key storage and access

This is the part that I said I knew I'd disagree about scale. ;)

Instead of hoping for any kind of "imposed" solution, I'd rather prefer a myriad of different providers and wait to see what patterns emerge and what becomes the best practices. Bottom-up, evolutionary approaches always beat top-down designs in the long run.

> A centralized exchange is the exact opposite of "running your own bank".

I assume the argument is that if a large company with this much money on the line can't figure out how to securely run a bank, how would I be able to?

I disagree with that argument, though, as I think it is in fact the large amount of money on the line managed by a large number of people that makes running an exchange difficult.

The comments defending crypto seem to all anchor on the argument on what crypto "can" be. Anything "can" be anything. Maybe it is what it is and it has to be something totally different to be different.

The "can" is not hypothetical. There are plenty of times and people who have used crypto as a way to get around dysfunctional institutions. It's just that those stories get drown-out by the ones looking for a quick way to be rich, the scammers and all the chaos that always come with any new technology.

Edge cases don't make much of an argument.

They are not edge cases for the people who use it out of need.

Feel free to provide details.

Try making an international transfer to a country that does not use USD/EUR/GBP without losing more than 5% of the total value to exchange fees ("official vs parallel") and government taxes on finance operations. Brazil not until long ago had a tax of 0.38% on every bank transfer (both ways!) and they have been talking about bringing it back.

Try working as a service provider with international customers, receive a payment from the client but getting notice from the bank saying it will take them 60 days to clear the money order, or that you can take it right away if they skim some of it.

Try living in Venezuela and seeing the government confiscating whatever property they can if you happen to be in the opposition. Try to keep up with hyperinflation while all of those in the elites can park their cash offshore.

Try to withdraw more than 600€ from your bank in Greece.

Try using an international contract as proof-of-income in a bank, in case you want to get a loan for your business. Try searching for a micro-credit solution that is not going to charge you usury rates.

Try running a business that is deemed "offensive" and see how you can not accept credit card payments. Not illegal. Just "offensive".

It's amazing that crypto has solved all of these problems, I wonder why people still have them.

It's not a problem anymore for those that are using crypto.

Why is it so hard for you to accept that you don't have a valid argument? Do you think that playing dumb and taking cheap jabs at what other people do gives you any moral superiority?

It's because you don't care if you're actually right. The proposals you're presenting are obviously not solved nor does Bitcoin solve them. If you have a problem paying 5% transaction fees than why would use Bitcoin (not to mention every transaction is subject to tax which gov'ts haven't been aggressive at collecting now, but can choose to collect it retroactively at any point having a public ledger to reference whenever they need it).

- I don't use Bitcoin, not anymore anyway. Stop assuming that crypto = Bitcoin, or that everyone that sees the value in blockchain believes in or depends on BTC.

- I am not in the US, so what you are talking about taxes make absolute zero sense. Stop assuming that everyone lives like you.

- Transaction fees are fixed, so while you certainly don't want to use it (at the moment) for transfer if small value, it is certainly an advantage to use for larger sums. Also, you can use a middleman who will take obviously less than banks.

But anyway, please continue telling me how the problems that I and others managed to solve or alleviate through crypto were not real.

They tend to be edge case for HN users. That is, male, educated, well off/affluent and living in a first world country. All the benefits of cryptocurrency are already available in their privileged position and they cannot understand that others do not have the same options/access to financial instruments.

One trip to Argentina is all it takes for someone to get crypto.

Thanks for the details. I guess we'll have to go to Argentina to learn more.

So it's not an edge case for female, uneducated, poor people from third world countries?

I guess this is the "you won't get it" defense. Maybe the real problem is that we do get it.

>>>So it's not an edge case for female, uneducated, poor people from third world countries?

When a Philippine friend of mine lacked capital to purchase inventory for her business at the start of lockdowns last year, I sent her some Bitcoin. She didn't fully understand how crypto worked but I talked her through the basics (wallets, etc...) She converted the BTC to pesos locally, and paid me back in Bitcoin, with interest. She got the capital injection she couldn't find elsewhere, and I added to my BTC pile (at a time when BTC was just under $10k, as I knew it would go up again).

Disingenuous much?

That's called a strawman argument, I never made the claim yet you are making a statement as if I had said that.

Either you understand my point and are being deliberately obtuse or you need to re-read my comment and go away and think about it. Either way you are not adding any value to the conversation. So please don't respond to me again.

I'm helping you reconsider a weak argument. You're hoping your statements are self explanatory.

Also don't direct the behavior of people on a comment board. There's other places to go where you can feel good about yourself.

Bitcoin already acts as a hedge against inflation, since its supply is relatively fixed (90% of all the maximum supply of Bitcoin has been mined).

Taleb would like to have a word with you.

(Or probably not, he would just call you a Bitidiot for parroting this argument and block you on Twitter)

It's a hedge against economics in general.

Absolutely I agree. People will always be stupid and stupid.

Uh no, this is (one reason) why you want to use a (well written) decentralized exchange.

>is like giving people ACH access

I use ACH, I know nothing about it, and I'm sure I can lose all my money from using it wrong, as banks love systems that are impossible to operate securely. I don't have this problem with bitcoin, and never will.

As for the tech side, you know nothing. The bugs are simply because of the demographics behind decentralized tech:

- Before snowden: script kiddies, slightly educated hobbyists

- After snowden: all kinds of idiots

> Crypto Anarchy is a farce

Your post is a farce. Wanting basic control over your own money (and removing horrible bank insecurity and UX as a side effect) is not anarchy or anything remotely resembling it. Your post only sounds reasonable from the perspective of $current_world which is basically hyperstatist, people are literally afraid to have sex and cross the street without government approval.

What are some examples of well-written decentralized exchanges?

Uniswap (v2) has simple contracts, has been audited multiple times, holds billions of USD and it has not faced any kind of systemic attack. The only issue that I can think of is that pools with low liquidity can suffer from front-running.

Even the fees are not a "problem", if you consider that there are already roll ups (loopring, zkswap) that run pretty much the same version of those contracts and cost fractions of a penny.

Curious to hear more about this as well. How is Uniswap?

Uniswap, pancakeswap, 1inch, apeswap, sushiswap, traderjoes, Crono, quickswap, paraswap and those are just off the top of my head.

All of these projects have hundreds of million to billions in tvl and have been running fine for years.

Dexes are the backbone of the defi community and share very little in common with centralized exchanges.

> All of these projects have hundreds of million to billions in tvl and have been running fine for years.

Oh if only you knew.

ACH is reversible for 30 days IIRC, though technically forever through court orders. Checks are essentially giving everyday people ACH access.

You’re right and I’ve said it before, the only place crypto is going is going to be boring and indistinguishable besides minor details from traditional services.

There is a lot between a check and an entry in the Fed’s FTP server, notably a bank. You do not have credentials to drop your own transactions there, I think anyway XD

I like the option to be my own bank. It's a little insane for everyone to just hand all power over to The Citadel just because it's easier.

And that’s what’s cool. You can participate at L1 if you want, but transactions will be expensive and you’ll be responsible for your own security guards. If you want to handle others’ money though, then there should be some standards.

This is how banking regulations happened, once enough people lost their money, the law had to step in.

My concern is that “the law” is incompetent in this domain.

And possibly incompatible.

That’s sort of humorous that the law is the problem after $10 billion+ has been lost to crypto theft and fraud. Maybe the tech is the problem?

“Maybe I’m out of touch with the rest of the developed world? Impossible, it’s everyone else demanding the enforcement of laws and regulations around value transfer, storage, and ownership who are the problem.” (Not you personally, crypto folks in general)

Then its not lost and isn't a problem, to the current owners.

The prior owners were hodling it wrong.

That’s not how common and property law work, and the enforcement of the law is catching up. I think that’s the real problem crypto proponents have; that the law is recognizing digital assets as assets, and the property rights that go along with that.

Tangentially, I support my tax dollars being spent pursuing these threat actors for as long as it takes, with sentencing guidelines in line with the value stolen.

I would support my tax dollars being spent on standardized smart contract development and standardized authentication and custodial relationships, analogous to the IETF which started out with US federal government funding and laid the frameworks for internet usefulness.

There's nothing in contract law preventing parties to agree on the automated execution of software when certain criteria are met.

It's just that it doesn't trump contract law and it's not generally a barrier for implementing contracts digitally.

Right, insightful for some but I don’t think it disagrees or adds to anything I wrote?

I’ll try again: I would like my taxpayer dollars going to smart contract development, auditing, and promulgating industry standards in a collaborate way. Just an additional signer for industry participants to consider or lean on the opinion of. Conditional execution on a distributed ledger with standardized conditions could easily get its own legal carveout to trump the analogous contract law, no different than someone someone agreeing to arbitration, but even as far as the local law invalidating private sector legalise when a parallel smart contracts is involved to limit possible behaviors already.

The standard smart contracts are published by OpenZeppelin. Looking into these hacks, however, there are shockingly vulnerable unexpected and otherwise useless “features” in them. I don’t think that the government could standardize contracts, but they could and really ought to be in the lead over threat prevention, incident response, and notification, because they are the only entity that can link on-chain to off-chain data.

I’ve held this opinion from before OpenZeppelin existed, and I am glad they have helped tremendously.

Governments can be a collaborative coding participant as we use this technology to re-evaluate the concept of governance and what redundancies the world actual needs to handle disputes or control behaviors with the pooled capital of taxpayers and the credit markets.

Right now this conversation has been limited to “adversary or not”, and that’s also shortsighted. Fortunately they’ve all moved too slow and there is enough capital within the crypto ecosystem to capture them. So I dont think it will be an organic growth from here to this reality, just consensus flippenings as wealthy backers direct public agencies and legislatures to “do the needful”.

As you might imagine, this was a much more extreme position to publicly have 6 years ago. But less absurd now, still not something to say on TV or in a web 2.0 office setting but at a bar or conference its understandable by people now, yay speculation driving innovation.

So for $800 they go to prison for 3 years, and for anything over $50,000,000 they get a commuted sentence and parole? That’s generally how it works in the US legal system.

I wish this was more of a joke, but this is exactly how the US “justice” system works. You must buy your freedom, or you will suffer a disproportionate and unjust sentence. Remember, they are not courts of “truth” and “justice”; they are Courts of Law.

This person below stole $1.6 million in PPP loans and is going to jail for 9 years. The system can and does work, although outliers can be unfortunate. Overall, arguably, the US justice system functions and rule of law is needed for a functioning society.

https://www.mercurynews.com/2021/11/30/houston-man-spent-ppp...

Common and property law rely on locating the assets and the owner and then establishing jurisdiction to sanction and recover the assets.

Decade old best practices for using crypto assets circumvents all of this. Ignoring the best practices leads to the assets being seized in the first place as well as persecution of the thief.

Using the best practices prevents seizure from an independent private thief or the state actor thief, so you see its not even about the government and its inflated sense of relevance.

Both can be true.

The law isn’t perfect but we aren’t seeing banks getting robbed or hacked and people losing their money, also I’m sure all the people with money in that exchange would be loving from FDIC insurance right now, sure it’s only $100k but a whole lot better than nothing.

We aren't seeing banks being hacked and people losing money? Sorry, what?

Here is one comparable hack[0] I remember which followed another series of SWIFT hacks. Further, people lose money all the time to more minor exploits that target just specific accounts, credit cards are always sold (less of a fault of the banks directly but tied to how the system is set up), Robinhood had a data breach recently, etc.

>also I’m sure all the people with money in that exchange would be loving from FDIC insurance right now

Plenty of big exchanges like Binance and Coinbase do have similar insurance and have made users whole after a hack[1]..

0. https://en.m.wikipedia.org/wiki/Bangladesh_Bank_robbery

1. https://www.wired.com/story/hack-binance-cryptocurrency-exch...

The Bangladesh hack would have been much worse if the Fed hadn't been custodian of much of the money: "The Federal Reserve Bank of New York blocked the remaining thirty transactions, amounting to US$850 million, due to suspicions raised by a misspelled instruction" and much of the other money was recovered: "All the money transferred to Sri Lanka has since been recovered. However, as of 2018 only around US$18 million of the US$81 million transferred to the Philippines has been recovered"

Yeah, I wouldn't want to rely on the Federal Reserve Bank noticing a misspelled instruction before my billion dollars were released, but at least there's someone with a brain looking at the transfer before it happens!

From the BBC:

>The RCBC bank branch in Manila to which the hackers tried to transfer $951m was in Jupiter Street. There are hundreds of banks in Manila that the hackers could have used, but they chose this one - and the decision cost them hundreds of millions of dollars.

>"The transactions… were held up at the Fed because the address used in one of the orders included the word 'Jupiter', which is also the name of a sanctioned Iranian shipping vessel," says Carolyn Maloney.

>Just the mention of the word "Jupiter" was enough to set alarm bells ringing in the Fed's automated computer systems. The payments were reviewed, and most were stopped. But not all. Five transactions, worth $101m, crossed this hurdle.

FDIC insurance is 250k now, but your point still stands.

But we are seeing banks getting hacked and losing huge amounts of money.

Not to mention the billions lost to BEC schemes.

Actually, banks do get robbed and hacked. Here is one example:

https://www.reuters.com/article/us-cyber-heist-swift-special...

Unlike the crypto exchanges, which are paragons of competence.

>which are paragons of competence.

Yes, actually. If I had to trust one entity to safeguard something digital, I'd trust the security team at a major crypto exchange, than the police department at a major city. The problem isn't really that they're incompetent, it's that they're the juiciest targets.

Yea, the law should be programmed by random front end devs using house of card custom scripting engines instead.

The concern should be about how "the law" can't be applied here

By what measure??

As in, they could have easily stopped many of these hacks, even after they were discovered, but they have zero clue about what to do about them, so they let the money escape, which means crypto to cash through the normal banking system.

Short story:

I had a job offer from one of these financial law enforcement agencies, specifically focused on preventing and tracking crypto hackers. It was rescinded by the new administration due to a mission change in the organization, refocusing on revenue through regulatory enforcement and surveillance rather than protecting Americans from theft and violence.

In reality, calling them incompetent may be charitable. The simplest explanation is that they are profit-driven, and frankly don’t care about any actual harm.

The money from these hacks often goes toward torturing the North Korean people, funding terror against American interests, or supporting violent drug cartels. One of the few things that angers me is that the only thing they are doing about it, is using it to further their surveillance agenda against Americans.

That’s the measure I use.

> This is how banking regulations happened, once enough people lost their money, the law had to step in.

Technically crypto corporations are already regulated the same way banks and financial businesses are. It's just that most of these exchanges exist outside US jurisdiction, and will often not accept US customers.

Well they'll pinkie swear they don't take US customers, whilst ignoring VPNs and other mechanisms of appearing not to be in the USA, at least...

There was an article in the NYT literally a few days ago about how Kyiv, Ukraine has become an absolute unregulated wild west of crypto.

What kind of regulation would help, exactly?

Penalties for insufficient security controls, for starters.

What exactly is “sufficient security controls”? This is the type of thing that sounds good on the surface, but becomes nightmarish when you start to think about how it might work in practice.

Experts disagree on how to do security. For instance, there’s still some people who insist that complex password rules are a genius idea that makes the world far safer, yet they’re unambiguously bad for security because they knowingly decrease the number of possible password combinations.

Whose idea of best practices wins? I’d hate that the decision now becomes a dictate by some bureaucracy that likely barely knows what the hell is going on.

You're acting like there are no established security controls for financial institutions. There are.

Maybe so.

But my bank still does 2 Factor Authentication only through SMS and doesn’t even offer some kind of Authentication App as an option.

Additionally they have strict password rules in place, a basically broken password reset form, and a comically short maximum password limit.

Color me not impressed with whatever rules do exist.

It's not "maybe so", it's a matter of fact.

And we're not talking about outdated user-facing login authentication procedures, we're talking about securing the back-end.

When is the last time your bank had $150 million stolen?

I don’t know how my bank implements their backend. Based on the parts I can see that I mentioned, I’m not very impressed with their interpretation of best practices.

That’s a good question. I don’t know how often banks get robbed of cash due to digital intrusions. I have gotten credit card info stolen before and that happens with many people, so maybe errors in the banking system more commonly take the form of lots of small fraud rather than a few big events.

So if you don't know, how can you be unimpressed?

As I said, I don't have proof about parts I can't see and never claimed so. But the parts I can see are IMO bad, so it's reasonable to be skeptical about the parts I can't see.

Also, I haven't worked with my actual bank, but I've done multiple bits of consulting in the past on some other national bank's technology, and my time there was such a disorganized mess that I have to doubt the quality of all of their systems and practices.

Also as an additional followup comment, the legal structure surrounding banks probably impacts how digital robberies are targeted as well.

A cyber-criminal organization who wants to rob some big player like Goldman Sachs, BlackRock, or Citibank of 9+ figures probably knows that they're going to have a devil of a time getting away with any big-time theft. The US government is actually going to go after anybody who tries to pull money out of big banks accounts to the point that they might even be willing to go to war in the right circumstance. If you're a cyber criminal, even if you could hack into some big bank systems and force a transfer, how would you get away with the cash in most cases? If they really target you with their full weight, you're probably completely screwed.

In comparison, random Crypto Financial Agents are on many power-players "Naughty List". Depending on the exact circumstances of some crypto-robbery, the full weight of the US Government probably isn't going to be deployed against some cyber criminal organization who manages to take out a crypto firm's assets in the same way that they would if you targeted the existing banks. So maybe relatively more cyber attacks happen against crypto than other types of assets because it's known as a safer target. (I have no clue, this is just a reasonable hypothesis to me)

Yet they seem to prevent banks from having all their stored value exfiltrated. of all my worries about my credit union, them having all their money shipped of to an anonymous crypto wallet obfuscator is not one. I can manage the risks of systems i interact with directly, but some non zero chance of the assets disappearing i cannot manage

User-facing security is just the tip of the iceberg for bank security, and IMO one of the less important factors.

You have regulations like CPI on how to store credit card credentials, transaction history, and audit logging.

You have regulations on physical access and who's allowes to touch production.

There's enormous amounts of regulation on auditing and software that's permitted to generate bank transactions.

Having worked in the space I am definitely impressed; it's taken very seriously, there are real, concrete consequences for not taking is seriously, and you generally don't see retail banks failing because someone messed around with ACH transactions, for example.

So one example, in the UK if my bank goes bust then up to £75k I get my money back. This is funded by a levy on all the banks.

OK but so far most countries don't have that many crypto exchanges.

Ok another one. In the UK we have a Financial services ombudsman https://www.financial-ombudsman.org.uk/ which can mediate in any dispute a customer has with a bank.

So if a bank takes funds or won't release funds, there's a route you can use to get that back. One look at the sub-reddits for most crypto exchanges will show quite a few posts from people who can't get withdrawals and the exchanges are just stonewalling them.

Hm, I don't think that amounts to a guarantee that you get your money back? Surely you can also sue a crypto exchange already? But if they don't have your money, it won't help - likewise with the banks.

Were customers even affected in this Bitcoin heist? Just because some crypto was stolen from the exchange, doesn't mean they won't pay their customers? 150M loss might not be that much in the greater scheme of things. A bank could also make losses of 150M by investing their customers money?

You can also lose your money on the stock exchange, with regular banks as brokers.

If a bank defrauds you in the UK you generally get the money back, there have been multiple cases.

As to them having your money, that's what capital adequacy controls (another form of regulation) are for. banks are required to keep a percentage of their assets in low/no risk securities to mitigate the risk of insolvency due to bets going wrong.

Many many many customers have been affected by hacks on crypto coin exchanges. To take one recent example I think the customers of Cream finance basically lost it all after cream were hacked for the 3rd time in a year.

You can ofc lose money on the stock exchange, and in the UK there are regulations about what products can be offered to retail customers. things like leveraged investing are restricted.

None of this is to say that financial regulations are perfect, they're very much not, but that there are reasons why they have evolved in the way they have, generally in response to the kind of things happening to the crypto market right now.

financial independence means not using money

What I’ve been curious about this week along with the $120 million badger DAO hack is what does one then do with these hundreds of millions? Do you launder it through NFT’s, divide it between dozens of wallets and dump it on some other exchange? If you do end up selling it can you expect legal troubles beyond taxes (e.g. the original wallet holders press charges)?

Some amount of the “hot money” — maybe not millions, that’s too unwieldy, but a good amount — can be used to purchase closed-loop gift cards, on websites that allow purchase with BTC. If those cards are from major retailers like Target or Amazon or Walmart, the cards can be used to buy merchandise which is in demand and holds its value well, most likely electronics, which can then be sold on eBay or through Buyers’ Clubs for most of their retail price. But that’s a lot of work and a lot of inventory to manage, so it’s more likely the gift cards would then be sold for about 70-80% of their face value, usually on a site like Raise.com or GiftCardGranny or similar, or even at the automated kiosks that are starting to be available in some chain stores, with the laundered funds being delivered by ACH a few weeks later.

It depends. There's plenty of hacked funds that are blacklisted and useless. Otherwise you typically go through a tumbler, and then use ineficent methods to cash out like buying gold bars at markup, selling for cheap to associates who will use services like localbitcoins/localmonero/giftcard buying. If you do get caught you can definitely expect legal troubles though.

Could you trade it for Monero, move it around in monero wallets, then trade out of Monero into ether and then fiat?

Just another day for Bitcoin exchanges. The sad thing is the technology exists for fully decentralized exchanges (and has for a while.) There are actually multiple 'smart contracts' that allow money to move directly between peers without the need for centralized deposits. E.g:

- micropayment channels -- send money a piece at a time

- cross chain contracts -- bind simultaneous release of funds to a shared secret

- lightning channels -- cross-blockchain stateful commitments

- reputation -- not great but can still work

The order book is another part that can be decentralized. It's a little harder to do this due to the need for high speed communication but I believe its possible. Newer blockchains like Solana have different consensus algorithms that allow for a 'global clock' to be created with minimal bottlenecks. It wouldn't be as fast as everything sitting on a server but its performance would be adequate for traders, IMO.

Bonus section: dark pools could be created with SGX or MPC protocols. There are some popular decentralized exchanges at the moment. But IMO they will need more features that traders are familiar with to be competitive (there's more than just currency pairs and limit orders tbh.)

Also: big shout out to https://www.projectserum.com/

I guess most people use exchanges for the possibility to interface with non-crypto currencies, right? I don't think you can set up a dollars-Bitcoin exchange without centralized exchanges.

Well, everyone has their own bank account. There's a lot of potential there to just transact directly. You would have to design the deposit layer to be someone efficient though so traders can still use credit. But I think its possible.

To give you an example there is this application called https://bisq.network/ that uses double-sided collateral in contracts to trade fiat currencies. There might be the potential to link this up with SSL, too. I've seen this application that can provide proofs that a page was in your browser https://tlsnotary.org/. Use that to prove a bank transfer happened on an SSL page and you've got yourself a dex that can work trustless with oracles.

> can work trustless with oracles

Isn't that a contradiction in terms?

The amount of trust will be limited to trusting that the bank is showing your balance correctly and that nobody stole their SSL keys.

Or, more likely than stealing their SSL keys, found a “vulnerability” that caused whatever string the smart contract is looking for to appear in a signed request from the server. I put vulnerability in quotes because it's not clear to me that that is not something banks would consider part of their threat model.

It's kind of like how SMS messages worked fine until “if I can read an SMS sent to your number I can withdraw from your account” became part of the threat model.

Sounds technically interesting. However, it seems that they can't accept credit cards and transactions take some time, so I guess that most users will end up flocking to centralized exchanges for a better experience.

>Well, everyone has their own bank account. There's a lot of potential there to just transact directly

The technical problems with that are much less important than the legal problems.

It's likely that the IRS will maul users (unless they report every transaction as a tax event!), and the bank may refuse transactions. Users may even ask the bank to refuse transactions, and then your collateral isn't really a collateral.

> the technology exists for fully decentralized exchanges

Don’t these DeFi projects have an even worse track record than the centralised exchanges?

Uniswap works. Just the fees are too high.

Uniswap governance just voted ~two weeks ago to deploy UniswapV3 to Polygon . I've never paid more than a penny for any Polygon fees so hopefully this along with wrapped version of coins will reduce my need for Ethereum. Other DeFi exchanges such as SushiSwap have already gone multi-chain to multiple chains as well. Mark Cuban recent talked about the BCT (Base Carbon Tonne) token which unless you mint yourself (via staking a real carbon credit in the real world) you must get via SushiSwap on Polygon at this time - I think he just invested another 50k into it

I will say one thing about Mark Cuban - he's deep into the DeFi/dApp world and seems to actually know his stuff on a deep level.

NO. Uniswap does not work. There are too much details but. In short it just works when there isn't volatility and there aren't many people trading so their trades doesn't invalidate each others trades because of high slippage which has to be set low because otherwise arbitrage bots exploits slippage tolerance.

I've been curious about decentralized exchanges. When you say they have a bad track record, can you share some examples? Uniswap is the one I know of, as far as I know it has a fine track record.

Check out rekt.news if you want a long list of defi hacks, including many decentralized exchanges.

Of course, the code running a DEX is fully auditable by anyone, unlike the code powering a centralized exchange.

https://app.osmosis.zone is a fully decentralized exchange with zero fees where you can trade any token including stable coins like (UST e EEUR)

Would there be much benefit? Hacks happen because of two reasons:

1. Bugs 2. Social engineering

In a decentralised exchange you increase your vulnerability to 1 trying to get rid of 2 on the exchange side, and I'm unsure you can offer the features that the bulk of traders want on a decentralised exchange. Actually, I'm sure (enough to bet 50 $ on it if there is a way to properly specify it) that the most important thing cannot be offered by decentralised exchanges: cashing out to pay your taxes in fiat.

On a decentralized exchange, users custody their own funds. So if a user gets hacked, it's not on the exchange. The only exception is liquidity providers, who give money to a contract.

Yeah, but what if the contract implementing the decentralised exchange has a bug?

Well, then any LP funds in the contract are in jeopardy, as are any transfers to the contract. That's a lot less painful than all users of the exchange getting robbed.

So the theoretical "bug bounty" is way lower on a decentralized exchange. Decentralized exchanges have a smaller attack surface than centralized exchanges, and be publicly & professionally audited. That's why they don't usually get hacked.

These hacks won't stop until people understand they don't need to / they mustn't keep their coins in an exchange. Single click trading looks pretty appealing to many, but that's not how things should work. The whole idea of transaction fee is a corrupted idea supported by cybercriminals turned into startups.

Keeping your wallet local is a gigantic PITA and most definitely something that only a minority of users want.

It’s amazing to me anyone uses crypto. If banks or exchanges were this bad at holding on to your money, no one would use them…ever.

This is a random small exchange that I've never heard of. I don't think a popular exchange hasn't been hacked for years now.

People who trade crypto they don't see it as an alternative to banks or real money they just use it as gambling platform with really good odds than casino.

This looks and smells like an inside job.

or: https://dailyhodl.com/2019/04/01/inside-job-19-million-bithu...

The timing seems suspicious too. When most of crypto land was crashing. My theory is that this exchange simply didn't have enough liquidity when the price crashed and they simply siphoned off the hot wallet. Lots of people wanted to sell at once. Bitmart did not have these funds. A hack at the same time is just too convenient.

Watching the Ether address get drained in real time yesterday was surreal to see, like out of a movie: https://etherscan.io/address/0x4bb7d80282f5e0616705d7f832acf...

This whole space is full of scams and exchanges that know everything about you in terms of what limits you've set to buy/sell, the order book, liquidity, etc. And worse, they can bet against you. Alameda admitted yesterday that they ended up profiting quite a bit being short BTC Futures (long spot) because the spread collapsed (Source: https://twitter.com/AlamedaTrabucco/status/14672197504891412...)

Only tight regulations can save investors because these "hacks" are way too common. And don't even get me started on Tether ( who conveniently printed another billion after the liquidations were done: https://twitter.com/whale_alert/status/1467155858228494353 )

Edit: rofl, they just printed another $1 billion, on a weekend!

https://twitter.com/whale_alert/status/1467504581571751940

It's funny how brazen they've become.

Not to mention Bitfinex and Tether CTO implying the dip was done after they printed: https://twitter.com/paoloardoino/status/1467053381072138240

Everything in this space seems so shady. But the regulators don't seems to give a damn and keep kicking the can for eternity. It's the wild wild west out there.

Moral of the story: Not your keys, not your coins. Do not keep your coins on exchanges.

The cyber equivalent of arson at a money-losing business, except no third-party is needed.

>Only tight regulations can save investors because these "hacks" are way too common. and don't even get me started on Tether.

Perhaps regulators have been tardy because they find it difficult to determine what of value was stolen. It may not be clear to them that crypto has value worth protecting by regulation.

That's not to say there is no value in crypto, or that crypto transactions do not deserve being regulated to protect the public. It's simply that regulators may not understand, or believe, that there is value worth regulating. I confess to the same lack of understanding.

>It may not be clear to them that crypto has value worth protecting by regulation.

That ship has sailed.

It's really not a question of what anyone thinks of intrinsic value when the two top coins alone have a market cap of over $1T and easily do north of $60B in transactions over a 24-hour period.

The number of people and amounts involved are the consideration.

The taxman is happy to collect their percentage on crypto capital gains so I’m not sure the value too hard to spot. It doesn’t matter if crypto isn’t really valuable in some cosmic sense.

Why does the "from"[1] say "Bitmart Hacker 2"?

[1] https://etherscan.io/address/0x4bb7d80282f5e0616705d7f832acf...

Etherscan puts that kind of label on the address, not the attacker themselves. It's standard protocol in such hacks.

From the site: 'all withdrawals are suspended until "further notice."'

That sounds like an inside job.

They claim to be operating from the Cayman Islands and are not offering services to US persons, since they are not registered with the US SEC. However, it's actually run by someone from New Jersey.

> And don't even get me started on Tether ( who conveniently printed another billion after the liquidations were done: https://twitter.com/whale_alert/status/1467155858228494353 )

Tether is one of the most maddening scams out there.

Who really believes that Tether had a cool billion dollars conveniently transferred into their banks so they could mint a huge chunk of synthetic dollars to inject into the cryptocurrency world? That's a suspiciously round number for such a large transaction.

Yet people who are heavily invested in crypto will find any excuse to ignore the absurdity of this whole operation, mostly because admitting the Tether problem would be admitting that the value of cryptocurrency everywhere is artificially inflated.

Last I heard tether only had about 2% of total tethers backed by dollars. Yikes.

I don't think you understood what Sam was saying, being short BTC futures is NOT the same as having a net short exposure to bitcoin prices. And what does Tether have to do with BitMart, an exchange I had never even heard of before this "hack"?

They weren't net short by design since they have to stay delta neutral. They were long spot and short futures. However when the liquidations started happening, the futures to spot premium went outta whack.

https://twitter.com/AlamedaTrabucco/status/14672197436901416...

So instead of locking in some spread they target, they ended up benefitting with a much larger profit.

And BitMart has no option to trade in USD. They trade exclusively in USDT. Tether might not have a hand in the hack, but they definitely have a hand in providing liquidity to exchanges which they print out of thin air with no actual 1-to-1 USD backing.

The Tether part was to highlight how this space is rife with scams, both on the shadow banking side and on the exchange side of things.

But how is being delta neutral a scam? If they weren't taking the other side of the long futures trade, someone else would at an even worse price. And if they weren't buying it back lower, someone else would at a worse price.

The idea that Tether just prints out of thin air is a conspiracy theory, I've seen large traders confirm they can do create/redeems and there was some information released about their holdings of commercial paper, settlement with NYAG, etc. And they have frozen stolen funds in the past, in the case of the Poly network hack. USDT routinely trades at a premium to USD, the market does not seem worried.

Of course Binance and Tether and a lot of other unregulated crypto companies are shady, but it's more interesting to focus on the particular shady company in the original post.

Tether has regularly been sued and settled, never won.

CFTC: https://www.cftc.gov/PressRoom/PressReleases/8450-21

NYAG: https://www.cnbc.com/2021/02/23/tether-bitfinex-reach-settle...

DOJ: https://www.bloomberg.com/news/articles/2021-07-26/tether-ex...

They have been evading an audit for almost 7 years now. They are required to provide an attestation every 3 months and yet they delayed the last one. Their current attestation raises more questions than answers: https://twitter.com/dee_bosa/status/1466826912781590529

Their attestations have never been independently verified.

Their commercial paper holdings are all murky and they have never provided an actual breakdown. Who knows if they are holding large quantities of commercial paper tied to Chinese real estate?

I mean, for a legit org, they tend to get sued quite a lot (and never win).

An audit for a stablecoin shouldn't really be hard to do.

And no, it's not really a conspiracy theory when there is so much evidence against Tether and Bitfinex. The burden of proof is on them. They can have all the "conspiracy theories" go away with an audit. 7 years. Still waiting. Accusations against Theranos were labeled as conspiracy theories up until 2015. They were until they weren't.

Regards Alameda and being delta neutral, I edited my comment. I never claimed it was a scam. It's just that firms can profit off crashes which may embolden others to take similar positions. The whole space is highly manipulated by big players, its as simple as that.

I remember back in the day (2010's) a hack would trigger gigantic price drop. It's good to know that this does not affect the price much now days.

Hacks and scams are priced in. Jk but not really joking! This whole thing is utter madness.

BitMart raised a Series B less than a week ago [1]. What are the odds this was an inside job?

[1] https://www.marketwatch.com/press-release/bitmart-announces-...

They always felt shaky to me. First, I was never able to transfer from/to using Litecoin. Their system said "wrong wallet format". Tech support never replied (its been probably close to a year now).

It also shocked me when I wanted to remove 2FA (Google Auth). It was just not worth it considering small amount I kept. So since you cannot do it thru their portal, I opened the ticket. I never got any response but Google Auth disappeared from my account some 2 weeks later. So technically only sending email was sufficient.

"People complain about the weather but nobody does anything about it" ~ anon

"It rained in Seattle today and in other news a crypto exchange was compromised for hundreds of millions of dollars"

It's weird how this keeps happening and a lot of people shrug their shoulders and move on. I don't buy that we're still in the wild west phase of crypto. We've had enough time to figure this out. If I was conspiratorial minded I'd think it was an intentional weakness built into the system.

Is it possible to move bitcoin between wallets through tumbling or other means so as to make it impossible to trace back to the original wallet? If not with bitcoin alone, would it be possible going through other coins as intermediates or even ending up in another cryptocurrency so long as the trail was impossible to follow?

Yes. See https://wasabiwallet.io/

Thanks!

Nothing new, it happen before and it will continue to happen in future.

In other news, Ledger and Trezor sold a few more units today.

I lost about $10k+ there. Lame. Now, to figure out how to mark this as a realized loss.

Actually, it’s in an obscure shitcoin so it’s probably going to zero anyway haha.

So does this mean if this happened to an FDIC-insured cryptoexchange like Gemini everyone gets their investments/monies back?

I might be too sentimental (and left leaning) but I always love a story that ends with a company losing money

crypto exchanges and getting hacked go together like chocolate and peanut butter.

The joke that crypto is a libertarian speed-run to regulated banking is somewhat apt.

(I do own some crypto)

What does this mean?

(Libertarian here asking)

Libertarians often stand by the 'small govt' ideal, where the ideal size of a govt. is a set of the minimum and necessary regulations needed for basic functioning.

Crypto started off with zero govt, and is speed running towards the same level of regulations that banks operate under. The implication is that libertarians usual complaint about overegulation in legacy systems may be misguided, and that legacy systems are adequately libertarian. Phrased another way, the seemingly crippling regulation in legacy financial systems might actually be the 'minimum' amount of regulations necessary to enable a financial system of the size we operate in today.

A more charitable reading would be that during this speed run, we reach a much earlier and smaller set of regulations that are sufficient for functionality equal to todays legacy system. Crypto can simply 'stop' adding regulation at that point, and achieve the libertarians dream of a leaner and more effective regulatory body. To some degree, it will also accomplish some of original goals of Crypto pioneers of 'low regulation' finance.

Oh I see. You're saying that crypto inverts the problem libertarians want to address with the financial system. Which is nifty!

I think you might find libertarians would be split about this... In my case I'm against anything that would throw out the existing system to start over from scratch, I'd rather work from the existing system and tactically remove things when they can't be justified.

I expect most libertarians have identified the direction in which they wish to move the needle and would be content with a gradual, conservative reform programme towards that direction - rather than overnight revolution.

> libertarian speed-run to regulated banking

Ha! This is perfectly put.

Immutable ledger means nobody can fix things like this

That’s not what ‘immutable ledger’ means. An equally weighted credit can balance out a debit on an immutable ledger. I think ledgers are generally supposed to be immutable.

Indeed. One corrects a mistake, one does not go back and erase it.

https://www.cliffsnotes.com/study-guides/accounting/accounti...

meh, there have been multiple occasions where either rollbacks have happened (maker DAO https://levelup.gitconnected.com/how-ethereum-reversed-a-50-...)

or exchanges have frozen stolen coins.

I thought crypto was supposed to be more secure

You should put your savings in crypto. Lol.

only $150? netflix and chill

Hahahahaha

Reply on news.ycombinator.com