Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen
coindesk.com
coindesk.com
The US government seemed surprisingly warm to bitcoin in the senate hearing. I suspect that if governments end up getting involved in bitcoin, each merchant will require some form of ID for each wallet that they interact with. This will mean that tracking down crimes like this will be fairly easy, since there's a record of each transaction. Trace down the chain, find the people involved, and if an anonymous wallet shows up, you investigate the people that it transferred to or from.
Sure, it erodes privacy, but bitcoin has the potential to make things much easier for law enforcement (and anyone else interested in money transfers) by causing registration of endpoints, giving very strong leads to investigators.
There is also factoring in the complexity added to associating any form of ID to a particular coin, if CoinJoin or similar trustless anonymizing mixing services reach widespread adoption.
This is all assuming Bitcoin continues it's mainstream course.
Any automated website or tool will require a "hot wallet" of some kind. The more funds in the hot wallet, the longer the website / BTC Bank can go automatically.
Customers like having funds available to them immediately... among other things.
That's why I said that it would be manual. Actually, it could be semi-automatic - a script could generate all relevant transactions, and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key.
> Customers like having funds available to them immediately... among other things.
Either security or convenience. This service was aimed for merchants, which are used to get their funds from payment processors much slower than in a matter of hours.
Also, that's only one of the solutions that I mentioned. Second one, which is convenient and more secure at the same time, is using multisignature wallets.
It's a payment system. This would be unacceptable.
Yes, you can. You can have the hot wallet only deal with multi-signature outputs, and have these approved by separately locked down servers running behind TOR, for example, using out-of-band mechanisms for approving transactions.
This isn't handwavery. It's basic security engineering.
Then you don't have a cold-wallet scheme. You have a hot wallet scheme.
I've seen fast food joints and parking lots with 24/7 attendants, it can't possibly cost more than $100,000 a year.
The future of modern banking is to return to physical transfer of funds. Instead of relying on modern networking, technology, automation, or websites... we will manually move money over a physical medium.
</sarcasm>
Without automation, how the hell is BTC supposed to be any better than cash?
$10,000,000 spent to secure a bitcoin exchange to within 99.999% secure via "automation"
$100,000 spent to secure a bitcoin exchange to within 99.999% secure via physical air gap...
which makes more sense
And merchants who don't make enough profit to pay $20-$30 an hour to put a human in the loop can have a payment processing company do it.
Don't get me wrong, if you think bitcoin websites have done a superb job at securing their hot wallets [1,2], you're welcome to keep all your money in a hot wallet where it can be 100% cleaned out without a human lifting a finger. Good luck with that.
[1] https://bitcointalk.org/index.php?topic=83794.0 [2] http://fc13.ifca.ai/proc/1-2.pdf
But then again, the headline made it to the front page and got me to comment...
2) The article title becomes immediately obsolete due to exchange rate fluctuations. On the day of the theft for instance, the BTC/USD rate was hugely volatile, fluctuating between $522 and $788.
We could go dig up the old Bitcoin Forum posts about people losing 25k coins and mark-to-market those losses for more sensational headlines. Or we could simply post the BTC amount in the headline along with present fiat value.
https://news.ycombinator.com/item?id=6783710
granted, i don't present these things very tactfully
The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact.
I enjoyed the bit at the end about a potential lawsuit to get the BTC back. Sounds awfully familiar to the legal posturing after some other BTC heists--none of which got anywhere AFAIK.
Do people still think the irrevocability of BTC transactions is a good thing?
Events like this encourage better thieves.
They took a risk, and one don't always win when taking a risk. (You startup folks should know.)
Yes. Third parties will provide escrow/insurance services if there is demand for them. Transactions been irreversible "by default" is a core benefit of bitcoin and merchants may preffer that over chargebacks at 18€.
I'm paranoid of investment banks but I think plain old banks are benign. You put a certain amount of money in your account and they handle all this for you. There is usually no charge for checking. Credit cards don't charge interest unless you go into debt, etc.
I don't think lack of competition is so much an issue, it seems that the Bitcoin movement just has a fundamental distrust of govt/corporations. I think if Bitcoin money didn't magically appreciate in value so much it wouldn't be much cheaper than banking except for big international money transfers.
What insurance might solve regarding bitcoin irreversible transactions and thieves is that customers of bitcoin services could have their funds reimbursed after a heist.
While Bitcoin is stolen from some exchanges from time to time, it's much more diffused and it's enormously harder to take bitcoins massively from population than gold.
See also: http://en.wikipedia.org/wiki/Executive_Order_6102
By the way, these "insured" USDs that you have in your account are not owned by you. Try to cash out everything in paper. Or move anywhere at once without asking for permission. Or what would you do when they impose capital controls like in Cyprus or Argentina? Or when your % of total USDs in the economy is going down while Fed is printing more dollars? Or when some new taxation is applied retroactively? Or when some bureaucrat didn't see your tax return papers in time and your entire account is frozen during investigation?
Bitcoin reduces systemic risk like the one present in banking system and shifts the burden on individual users. You can still create a bank if you want, but that's totally optional and you have many other options as well. In the future people will develop hundreds really different devices, services and tricks to store your coins securely. Compare that with monopolised non-innovative heavily regulated banking.
As bitcoins are so cheap to store, security is asymmetrical: it's much harder to take, than to hide. Gold, or any physical commodity, are as hard to protect as to take from you. Hence, most brutal guys end up owning precious metals over the course of the history. Average Joe can only have as much gold as he can hide in his pants.
Putting aside the increasingly clear fact that network-attached computers won't be secure from state-actors for the foreseeable future --- and bitcoin transactions always have to hit the network --- states can effectively control bitcoin being spent or bitcoin cash-outs being transferred in country as well as any currency.
Presently the risk of losing or having stolen your bitcoin is far higher than the same for gold or conventional stores of value.
So you're saying the transaction costs of converting from bitcoin to any useful currency is really high and that we should see the unattractiveness of money-servicing costs as a security-assurance since script-kiddie criminals don't like seeing any portion of their free "money" siphoned away by the money-changers in the temple.
my point was simpler tho which is just that the real numbers being applied to these amounts rely on ecosystem stability and the market cap (a term a trader helpfully pointed me to in order to understand their favorite stat, which these "multiply by exchange rate" figures are an extension of) really doesn't represent the real world value of assets in Bitcoin since the value declines as money is pulled out of the system.
It seems to be anyone's guess as to whether or not it has real value or is a pyramid scheme. There's no way to tell without a mass cashout. Then we'd see how many BTC can get sold off before one starts to incur heavy losses. I think if some of the big players cashed out (early adopters with an inordinate amount of essentially self-printed wealth) the system would destabilize and finally flop. It's why they instead drive the price up & try to trickle units out one by one.
I would think the thieves are smart enough to make multiple transactions to move this money, in which case they won't get caught at all.
How many BTC can you convert in dollars before you crash the market?
You can see the cumulative bids for the price as it moves down so you can pretty easily see what kind of loss you would take if you needed to sell a few thousand coins and it's not currently that bad.
For example, you could unload 1295 BTC without pushing the price below 760, and that's if you just dumped it all at once. http://bitcoinity.org/markets
Just ignore or downvote next time.
Bitcoin is a hot topic these days, tons of people are interested in what's going on.