Hacker News Reader

Comment by ronsor | Hacker News Reader

The great thing about crypto exchanges (and other sites that hold crypto for you) is that they're self-paying bug bounties.

View on HN

Except these people can create their own bugs and rob their own clients and call it a hack and nobody can do anything about it because they're off shore and unregulated. You'd have to be pretty dense to put any money on the unregulated exchanges.

Yeah, what's the motivation for so many people going to these unregulated exchanges when there's so many regulated ones (or at least larger ones, I've never even heard of BitMart)?

Is it to trade coins/tokens that aren't normally listed?

At least in the US, exchanges aren't really regulated. Not as broker-dealers, anyways, in the same way a Fidelity or Schwab is regulated. They're regulated as money services businesses and money transmitters, a much weaker form of regulation designed explicitly to work around the "onerous" regulations in the rest of the system.

Yes, to speculate on a ponzi they know will fall but they think they can time.

In normal finance, it s just too crowded to make the same amount of margin short term.

I had a little bit in BitMart. It was to speculate on some iffy coin that was only listed there. With hindsight maybe not wise.

I wonder if a completely Wild West really makes for better security… doesn’t seem like it so far.

Probably a good lesson in there about incentives and consequences maybe not always going where you might think.

The invisible hand of the free market is in your back pocket lifting your wallet.

I mean, did anyone ever suggest it would? I don't think even the biggest bitcoin enthusiast would claim that these dodgy exchanges were especially secure.

This only makes sense for smart contract run exchanges where the code, in theory, is always right. Otherwise this is no different from any other financial hack.

Oh, but it is, because with crypto you can simply drain the wallets anonymously. If you hack a regular bank and try to transfer the money to your accounts, you'll get caught and jailed ridiculously fast.

Maybe you should try to learn about how these schemes work before making such statements?

According to the FBI, BEC fraudsters took $1.8 billion in 2020 by stealing wire transfers from businesses into their own accounts https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pd...

I'm a relative newcomer to the crypto-space so please forgive me for any errors.

I see the point you are attempting to make but the number is rather useless, in the past week hackers took 20% of what was stolen by BEC in a year. And skimming through the report you sent it seems like there is a program to recover said funds that have been lost and it has an 82% success-rate.

The $1.8B only represents US losses known and properly classified by the FBI, the real number for global losses will be much higher.

Agreed, but that is simply cause-and-effect by virtue of the majority of the world using the current global financial system rather than crypto and many more hackers are targeting said folk.

Either way two wrong's don't make a right, there will be losses in both systems but I would argue that storing your money with a unregulated crypto-firm would be more dangerous than with a modern-day bank.

I think the main gripe that many people have including myself with crypto is that it doesn't even have the proper consumer protections so that a decent/strong chance of recovery is possible.

This trend of massive amounts of crypto currency being stolen is not even a relatively recent one, see Gerald Cotten's (Quadriga) death in 2019 which resulted in $150 million in assets going missing with no chance of recovery.

This reply has been a little-bit scatter-brainish, so my apologies for that.

Unless it's an inside job going high up.

Insider threat is a part of security considerations.

Anything that holds value is a self-paying bug bounty.

> Anything that holds value is a self-paying bug bounty

Most valuables have means for recourse. Crypto’s pitch is that it circumvents these mechanisms.

I think hacking about any service will provide valuable data, which can be sold at darknet marketplaces. I read somewhere that there is a marketplace just for hacked server credentials as well.

>Most valuables have means for recourse

Most valuables? I think most financial assets have means for recourse, but if your gold bars/jewellery gets stolen, it's as good as gone.

> if your gold bars/jewellery gets stolen, it's as good as gone

Which is why society stopped storing meaningful quantities of value in gold generations ago.

One of the reasons. The ability to exchange cheaply and quickly is another reason, di visibility another one

Surely there is more value stored in gold now than generations ago, right?

On the list of reasons for why we switched away from the gold standard and gold coinage, this is probably not even in the top 10.

Vast quantities of gold hold value still in the same way as before, only that it's done by very large organisations. This too is a western phenomenon. Indian Households currently own 25,000 tons of gold( one of the largest reserves anywhere) - China isn't too far behind AFAIR.

That's because those countries have the largest populations of new money rubes to sucker into buying shiny objects.

Oh, the contemptuous disdain dripping in this comment.. somehow feels like the early 1900s pride of the British Empire.. just sounds very awful tbh.

No. That's why we created banks to store this gold. The reason we moved to paper and digital currencies was so governments and banks could create money out of thin air.

I thought we did it (actually the ancient Chinese did) so that we don't have to pay in bags, wheelbarrows and horse carts of heavy (as in mass) metals whenever larger transaction needed to be made?

But what do I know, conspiring about evil governments & banks trying to print money out of thin air is a much more sensible argument, right? Just as there is an article on the front page on Tether "minting" a billion USD equivalent Tether out of literally thin air ...

Well, partially correct. It was a quality-of-life thing until the banksters realized they could let out more IOUs than gold they had in the vault. From there on, it would only be a matter of time till the gold-standard becomes abolished, giving governments and banks the ability to print money at will.

Tether coins are basically the same thing. You still have to trust the neo-banks to still be holding your actual dollars somewhere in their vault. I don't, that's why I prefer not to buy bogus coins.

USA stopped storing meaningful quantities of gold in 1971, to be more precise. 50 years exactly.

https://wtfhappenedin1971.com/

What means for recourse do most financial assets have? If a business falls victim to a BEC scheme that money is gone and nobody will reimburse them.

If you as an individual fall for a craigslist scam, your money is gone.

If you have literal gold bars, they are almost certainly in an insured facility; actual risk to you, the owner of the gold bars, is limited.

I mean, if you have them on your _house_ then this applies, but people typically don't.

My stolen bicycles would like to have a word.

Crypto does not really provide anything new here. You can say that about traditional banking systems as well.

> The great thing about crypto exchanges (and other sites that hold crypto for you) is that they're self-paying bug bounties.

That's a pretty crass and glib statement. So are home burglaries, I guess? Or, really, any kind of crime regarding the stealing of funds or valuables?

You're basically saying 'if you find a 'bug' that lets you get money, then it's a self-paying bug bounty.'

So, snatching someone's purse while they're in the toilet--boom, instant self-paying bug bounty.

Do you even know what a joke is?

Do you know what insensitivity is? Would you make the same joke about any of the other examples I mentioned?

No I wouldn’t because they aren’t topical to a website devoted to talking about dev and tech. It’s a joke, sensitivity isn’t always a priority, you don’t have to like it.

If explicitly people want to be independent of the regulated financial sector and sign-up to take these risks you cannot claim "oh, I've been wronged, pity me" -- sure they deserve justice, but this happening to them is part of the risk reward of working with crypto..

I'd wager that you shouldn't put any money you can't afford to lose into crypto, so your other examples are not really comparable.

> I'd wager that you shouldn't put any money you can't afford to lose into crypto

Again, you can just as easily say: I'd wager you shouldn't put any money you can't afford to lose into your wallet or purse.

You're just doing transparent victim-blaming right now. If someone gets robbed, it is not their fault.

Silly wager. Crypto is a wild punt, your wallet is not.

Calm down son, your emotions are getting the better of you.

It doesn't matter if they're being robbed of cash in their wallet or magic beans in their e-wallet. What matters is the action, and making light of it.

It was a joke - it’s not like he’s going around taking the piss out of the losers here - it was a joke about big bountys on a software engineering / IT focussed message board.

Hack a crypto exchange - self paying bug bounty - it’s just a Joke.

Take a chill pill, the stick up your arse must be massive.

Reply on news.ycombinator.com