Bitfloor Hacked, $250,000 Missing | Hacker News Reader

Bitfloor Hacked, $250,000 Missing

bitcoinmagazine.net

And therein lies the problem with non-traceable, uninsured currency.

One of the benefits of using a major bank (in the United States, for this example), is that your money is federally insured. You'll always see little logos or blips of text advertising that the bank is a "member, FDIC."

People take this for granted -- after all, if your bank is robbed, why should it be your loss? It's a little harder when the currency is anonymous and completely uninsured.

Many bitcoin exchanges will do their best to dip into their profits to reimburse users after they were hacked. I know that several major exchanges have already dipped into their own coffers to reimburse their users. However, they need to pay for this completely out-of-pocket, and even then there's nothing that indicates that they have to do so.

I think that bitcoin is an interesting idea, and certainly has gained a lot of traction for more privacy-minded individuals. Those that want to active day-trade it, though, should stick to standard forex markets, in my opinion. In fact, there is nothing to guarantee that the organizers of an exchange won't simply steal your money and disappear -- there'd be no way to prove that it was them, short of seizing their machines and hoping an incriminating bitcoin wallet was sitting there.

It seems there is a market for an insurer of Bitcoin exchanges. Carry out extensive physical, procedural and offensive reviews against a set of standards, in exchange for certifying the exchange as "not easy to break", and insure its accounts up to a certain % of reserves.

The problem is people don't want to pay a storage fee for leaving value on an exchange; they think they're getting ripped off because they're not earning interest like they would at a bank engaged in fractional reserve banking. Since the exchanges don't make money on deposits, it's tough for them to spend money to protect the deposits.

It would be reasonable for individuals to purchase insurance against loss of bitcoins held by an exchange. The insurance would be much less expensive for exchanges who have agreed to an audit (and possibly other controls) by the insurance company.

As a sidenote, the previous comment trumping up the FDIC is kind of misplaced. Government is needed for some things (like police), but not insurance.

What would be interesting is if there were real online bitcoin banks that leant or invested the bitcoins to both make a profit themselves and offer their customers some interest on their savings.

I heard there's one called Bitcoin Savings & Trust.

Jokes aside, there are a number of people doing this "for real" (or at least, "not obviously a ponzi"). They can be found on bitcointalk.org.

Since bitcoin is defined to deflate over time as use grows but eventually no more bitcoins are circulated, banks should be expected to charge for storage. You're paying for the privilege to hold onto the money, since the optimal strategy in a permanently deflating economy is to hold on to your money as long as possible.

One could argue that it's still in the interests of Bitfloor and similar exchanges to pay for such a service. Where will they be left off financially if such an event occurs?

From the article:

"BitFloor may take one of two options. They may either take the loss and continue running in an attempt to eventually earn the money back or, in the worst case, shut down entirely and begin an account partial refund process out of the available funds."

Oh it is traceable, just unstoppable and ungoverned.

I assumed that "federally insured" was code for inflation, but the wikipedia article revealed that it is actually insurance: banks pay insurance fees to be in the FDIC.

Your sense of security is somewhat unfounded. In the US if someone breaks into your online bank account and steals all your money, legally you're on the hook for the loss unless you can prove the breach occurred on the bank's side.

  > if someone breaks into your online bank account and steals all
  > your money, legally you're on the hook unless you can prove the
  > breach occurred on the bank's side.

Right, but that's not a valid comparison to what happened.

If someone broke into your account, yes, you'd need to dispute the charges and prove that you did not drain the funds to your new Swiss bank account.

In this case, though, it's not an account that was broken into, but the exchange itself. If someone robs your bank at gunpoint or hacks into its backend servers, either way, you're not liable for the loss -- they're insured.

Individual security vs. organizational security are different in this respect. In fact, I'd argue that the individual security of bitcoin exchange accounts are even riskier than the exchange itself getting hacked: if your bitcoin wallet is compromised in any way, that money is gone forever. No one can do anything to get it back, and if the exchange wasn't compromised, they probably don't care about your terrible password (or malware-infested laptop, or compromised Internet connection, etc). If your bank account is hacked, and you report it, it's not your problem anymore.

How is this a property of "non-traceable"/anonymity?

If someone physically robs the bank and gets away with a large amount of cash that is arguably even more anonymous and non-traceable than bitcoins.

The only problem ought to be that bitcoin exchanges are not being insured, by who or that the currency happened to be bitcoin doesn't matter (as long as the insurance covers it).

Don't banks track the new money they receive by serial number range?

What stops you from doing that at a bitcoin exchange as well?

Read the thread referenced in the article: https://bitcointalk.org/index.php?topic=105818.0e

Bitfloor admits to earning about $2100 a month. So it's a totally unregulated market, and it'd be easy to increase your earnings by 100x this month. During the time the wallet was left in an unencrypted location, just happened to get hacked.

I can't call the Bitfloor owner a thief, but reading his posts about looking to the future, and not to the past, no claim of a police report being filed, and the generic term "We got hacked!" make for some obvious conclusions.

I seriously doubt they stole the money, because they've exhibited an extremely high level of professionalism in the past.

(Even when not comparing them to other bitcoin ventures, which tend to set a very low bar.)

Another reason I doubt they would steal it is because "cashing out" now would be like Zuckerburg cashing out a year after starting Facebook. At least, from the perspective of someone who believes in bitcoin.

"the attacker gained accesses to an unencrypted backup of the wallet keys"

What is with these bitcoin exchanges and their pathetic records on security? How is the currency ever supposed to go mainstream with these continual security lapses?

Hey man, they're just doing lean MVPs.

I guess they just tend to use a somewhat different value for viable than I might.

Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure and STILL have the occasional lapse in security; how do you think a couple of guys in their spare time will fare?

> Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure

Those banks are often guarding a considerably larger amount of money, which is something to take into consideration. I think your point still stands though.

A bank's software infrastructure and "attack surface" dwarfs these tiny bit coin exchanges. Banks also have byzantine processes and guidelines that encumber their technical teams so building their software is inherently costly regardless of security.

Meanwhile unregulated, nimble BitCoin exchanges struggle with the OWASP top 10.

I'm not quite sure I buy that. Obviously banks are more complicated. But because of the regulatory environment what they are not is "just servers on the internet". You can break into a bitcoin exchange and steal BTC by copying data. You can't do that with a bank -- banks can only transfer electronically to other banks, and "being a bank" is a tightly regulated state.

So while the complexity is there, it's not clear to me that it correlates to an "attack surface" in the sense network security people use the term.

The quote makes sense if you want some plausible deniability for an inside job.

I work for a finance related technology provider and as a consequence get to see the technology practices of many brokers and other market makers. Often times their security is just as bad. The key difference is that trade settlement (a.k.a clearing) is a separate process (usually also separate company from exchange). This adds a layer of security because compromising the exchange doesn't always get you access to the clearing details. Clearing details are usually things like "Depoist X million dollars in bank account A, I will deposit x million euros in your bank account B." With Bitcoin quoting, trading, and clearing are all rolled into one.

Moreover, how is it going to go mainstream without mainstream exchanges? If these bitcoin thefts continue putting exchanges out of business, the thieves will wind up with a big pile of currency nobody is willing to convert back into dollars.

It's hacker attitude. Build what seems like it will work, and launch.

The true flaw of hacker attitude is underestimation of the job by focusing on the part that looks straightforward, namely the part in code.

A bitcoin bank is the application. The bit that's written in code is just a part of it. The actual spec is: under all circumstances, this will either work as a bitcoin bank, or fail safe, or in the worst possible case fail with data loss. That spec requires you to examine the behaviors of the system as a system - you may be sure your opponents see it as such.

A problem with an untraceable currency is that it's also very easy for an exchange to collaborate with a hacker and vanish (or declare banckrupcy). Not saying that is what happened here, but that would be my fear.

Yep. Exploring that risk, they might say something like "the attacker gained accesses to an unencrypted backup of the wallet keys", then say they'll consider making everyone whole, then go bankrupt.

Those kinds of trust issues are present in some form in many kinds of commercial transactions, and there are many ways of dealing with them (insurance, lawsuits, interact with companies you can trust and avoid ones you can't, etc.).

Bitcoin provides plausible deniability, which makes lawsuits difficult. In contrast to centralized banking systems which leave a paper trail.

And insuring bitcoins has its own logistical challenges that will probably scare an actuary.

Trust is a hard one as I'm sure the people who used bitfloor had trusted it until today.

Insuring bitcoins is actually pretty easy. As a sidenote, there are already people doing it. The ideal way to do it would be to audit the exchange, and possibly also use an escrow, populated with money from the exchange, that pays you (the insurer) if the exchange loses money. It would be in the interest of the exchange to cooperate in these areas, in order to promote the availability of cheaper insurance, and therefore more customers.

A digression: Bitcoin would be the government regulator's wet dream if you could assign people addresses (and they could only use the assigned address), because you can trivially track all transactions. Actually, I have in mind a way to implement such a system in a (likely) cryptographically sound and enforceable way. But in theory, the government could outlaw cash and track all transactions anyway.

'hacked' ... Anyways, here's my question - why aren't private keys for these centralized wallets encrypted with a password the user has to put in when they do a transaction. That way private keys aren't stored on disk, but only temporarily in memory. Also if the encrypted keys get stolen, there's time for people to move their money to new wallets before the encryption is broken.

Transactions are often automatic and unattended. For instance, you put in a buy or sell order that may or may not be automatically fulfilled sometime in the next day.

Answered my own question - https://blockchain.info has an online wallet that works just like this.

The best thing about this is that the conversion rate of Bitcoins is relatively unaffected. And that's good, because this is not a failure of Bitcoin, but of a single service provider.

Since all bitcoin transactions are traceable, it will be interesting to see how this money gets laundered.

"Follow the money" has turned into "follow the chain".

1) Setup free Bitcoin mixer service where people can "launder" their own Bitcoins for improved anonymity (Hint: those services already exist)

2) Feed your stolen coins into the service and make sure that the rate of this isn't too high

3) Profit (if someone asks you have the perfect excuse)

And in case you argue "using money from such a mixer service is suspicious": It doesn't have to be a mixer service. Use one of the numerous Bitcoin casinos. With the right games you can expect to win around 90% or more of the money that you've invested. And if you're lucky the coins that you get from the casino are different than the ones you paid them.

1. Start a Bitcoin exchange

2. Announce you were "hacked"

3. Profit!

Are there tools/databases out that keep track of stolen Bitcoins and where they end up? It seems like it would be in the interest of the exchanges to share this information and blacklist coins originating from a theft.

They should also allow users to check incoming transactions against this blacklist and reject them if they choose. I suppose you'd end up with a black market of tainted Bitcoin, but that's better than just allowing thieves to immediately exchange stolen coins for another currency or legitimate services/products.

To answer your first question: It's pretty easy to track where bitcoins go. People have tools that visualize this (I've seen them). I don't know of one off the top of my head I can point you to, though.

To answer your second question: This idea has been discussed at length on bitcointalk.org by a lot of people. The idea is known as "tainting." There are a lot of problems with making it work in practice, so the concensus seems to be "don't go there."

To give you a sample of the (IMHO valid) objections: For one thing, it's difficult to verify which coins really should be tainted. (How do you know someone claiming certain coins should be tainted is trustworthy?) For another thing, tainting creates two "competing" bitcoin currencies, black coins and white coins. Finally, there is no central authority, so it would be challenging (though perhaps not impossible) to come to a "general concensus" on who should be in charge of declaring coins tainted.

I lost a lot back when they were ~$20 a pop and you could still crunch them. I lost enough to put me off completely. Nice to know my caution isn't entirely paranoia induced.

When you day lost, how exctly? Hacked trading? other?

I had some in an exchange which was hacked.

Yet another Bitcoin exchange on Linode being hacked through the service console (I can't find the post where he mentioned it, but I remember reading it yesterday. He mentioned that the machine wasn't reachable on an external IP.).

I'm currently not sure about weather this is partially to blame or not. Would a dedicated server have made it harder to access the machine?

Sorry to hear that a lot of people's bitcoin deposits were lost in the BitFloor hack.

CampBX has been in operation for over a year, is based in Atlanta, and has successfully cleared multiple independent Pen-tests and security audits.

Give us a try! www.CampBX.com

Why do people leave any amount of money in the wallets at these places?

Do you mean the exchange or the customers? The customers have to deposit BTC before they can place any sell order, and the BTC has to be held in escrow by the exchange as long as that order stays on the books. As others have said though, the exchange shouldn't be keeping much money in a hot wallet; that's probably just lazy programming.

Reply on news.ycombinator.com