Bitcoin Thieves Yet to Spend Stolen Hoard
bbc.com
bbc.com
In China, Korea, Singapore, and Japan, virtual goods are considered property to varying degrees.
EDIT: reply to discountgenius since there was no reply link. One of the functions of government is to create laws protecting property. There aren't any laws in the U.S. that treat virtual goods such as bitcoin as property. In the U.S., at least, courts have proven extremely reluctant to extend property protections to virtual goods, i.e., MMO items, because the state of the law and underlying technology is still too much in flux. At best, virtual goods are treated as licenses. However, licenses are not property that can be stolen (and this has been litigated in non-virtual contexts).
In Japan and Korea a few years ago, some courts ruled that in-game purchases were considered property for specific purposes. I do not know if their respective courts followed those cases.
It's a relatively new protocol. There may be laundering methods that nobody's thought of yet.
For example, if the thieves just did something naive, like transfer all those 'coins' to an address in a wallet they had previous used, or that was previously connected to an identity, it could reveal who they are.
In that scenario, the person receiving the coins could be faced with the questions 'Why did you just receive all those stolen coins? If you arent the thief, then who gave them to you? Did you sell them something?' etc.
I did some work on this before, showing it was possible to follow flows of stolen bitcoins at least some distance through the blockchain. The visualisation lower down this page is of a previous alleged theft, and is extracted from the blockchain: http://anonymity-in-bitcoin.blogspot.ie/2011/07/bitcoin-is-n...
I'm surprised someone hasn't started a hot-sheet for stolen coins, so that exchanges and individuals can check before accepting them.
There are some issues with the idea. Some of them are subtle:
The first thing to realize is that bitcoins do not exist as independent trackable entities, in the system. So there are no individually identifiable bitcoins that you can 'mark'.
Instead, address balances exist. So, you might say, lets just mark the address balance as 'hot'.
This has some merit. It violates what appears to be a design assumption of Bitcoin, which is that bitcoins are meant to be fungible; but it has some merit.
If someone tries to pay you with a transfer from that address full of stolen coins, you can just say "Im not accepting that as valid payment. Take your business elsewhere."
But, what happens when somebody - lets say an anonymous mixer - accepts, say, 100 stolen bitcoins, into an address that has 900 bitcoins already in it.
Now, you have an address with 1000 bitcoins. 10% of these bitcoins are dirty - but which 10%? How do you deal with this scenario? What if someone tries pay you 100 coins from that address? Do you say that transfers from that address are only worth 90% of the value they had before? What if that address goes through a mixer again? You can keep track of percentage 'contamination' but its going to start making things complicated.
If you accept dirty bitcoins, that weren't dirty when you got them (lets say you are a mixer and get a transfer before people realise there has been a theft), what happens? Also, who gets to say which bitcoins are dirty? A centralised authority? That sort of breaks the design goal of fungibility - if you have to ask a central authority whether this is a real bitcoin or not, why not also just have the centralised authority issue them in the first place, and dispense with all the complexity?
I'm not sure whether a marking system would work; there certainly seem to be some reasons its tricky. I've seen discussions about this on the bitcoin forum; plenty of people there who have thought about this a lot.
It seems that the problem now becomes one of reputation management. The diamond markets in New York work entirely by trust (a handshake can seal a $10 million deal), but that's not possible when the community is the world.
A pretty challenge. :)
In real-world cases like this, you generally launder the money through untraceable sources, where they can re-enter the system from anywhere and be 'clean'. You can do something similar in bitcoin, where I think they're called "mixers". I don't know if any automated ones exist, but basically: mix (i.e., melt) a bunch of people's money from addresses A-M in one account, and send the same amount out to (brand-new, anonymous) addresses N-Z.
N-Z are owned by unknown entities, so as long as e.g. X doesn't receive exactly as much money as only D put in, you can't infer ownership. All coins are 'tainted' because the sources can be tracked perfectly (i.e., a marker chemical in gold), but who owns what coin is now lost. Obviously there's more to it, and distributing without losing perfect anonymity is difficult, but it shows the basic problem. Again similar to melting, you can even send # coins to addresses 1-9 over a large period of time, while melting more and more coins into the shared pool, so there's less of a chance of guessing who owns what based on timing.
For example, after the Linode hack the stolen coins were moving around and there were reports, from people who had bought coins from cryptoXchange or had paid with paxum, that mtgox was freezing those deposits because they were connected to the stolen funds.
To simplify a bit, your money isn't stored on any device you own -- it's stored on the network, in the cloud. Everyone can see what's going on, although they don't know who has the key who can authorization transfers from cffc7f08c81b63b3fb6b56d3eae8f984.
An individual that accepts them?
So, how can they ever be truly laundered? Because eventually someone is going to want to convert them to cash, and at that point, they're traceable right?
Bitcoin is done with computers. It's no more "annoying" to trace one hundred transactions than it is to trace one.
Lets say you have an address with 1000 bitcoins in it.
A thief steals a lot of bitcoins, and maliciously, unknown to you, sends you 10 stolen bitcoins.
You now have an account/address with 1010 bitcoins in it. The system you have just proposed tags your address as hot.
What happens next?
[This is not a hypothetical scenario: in the 'allinvain' alleged theft, we saw several organisations and individuals receive stolen bitcoins from quite soon after the theft; probably as unsolicited donations.]
Then, as with every criminal investigation, you follow up that lead. Not all Bitcoin addresses will be resolveable to a person in an area where you have LEO authority, but I'm fairly confident that eventually it'll happen and you start tracking back up the chain.
I didn't say the solution was entirely technical--I've said more than once that nerds who default to "computers can solve every problem" are wrong. It does still involve old-fashioned detective work. And you're not going to solve every case. But Bitcoin gives you a lot of clues.
So you can't spend them from a different address, without first transferring them to that different address; and that transfer must be publicly announced to the network. It is the public announcement which gives the other address the ability to spend the 'coins'.
If were the criminal behind this heist and I wanted to whitewash these bit coins, I would first establish several new wallets, would divide the coins between them, then would programmatically transfer the coins back and forth between the accounts in random amounts at short but random intervals over the course of several months to increase the noise level. I would then (again programmatically) buy a different electronic currency (namecoins, etc.) with them to obscure the trail even more. Finally I could transfer them back into bitcoins, using several new wallets.
At that point they could be cashed out or spent more or less freely.
Again, I'm new to bit coins so I may not know all the dynamics involved, but what I have outlined seems logical based on what I know at this point.
A few other comments mention that Mt. Gox is treating certain coins within some distance of certain accounts as tainted and freezing those transactions.