The Missing Mt. Gox Bitcoins
blog.wizsec.jp
blog.wizsec.jp
When you're insolvent, you can't cover your obligations. Even if you called in every loan you'd made, it still wouldn't give you enough cash that all your deposit account customers could withdraw all their money.
Calling Mt. Gox a "fractional reserve" is giving them way too much credit.
In the event of everyone wanting to withdraw their money at once, operating a fractional reserve and being insolvent are basically the same (unless you can instantly get the money out of your investments). That's a major reason why fractional reserve banking is frowned upon in the bitcoin ecosystem.
In many ways Fractional Reserve Banking would be much more risky with bitcoin than with banknotes; with banknotes at least there is a lender-of-last-resort central bank. The central bank can create additional money at will to lend to a bank that is in a liquidity crisis, to see it through the crisis. With bitcoin, there is no such operator.
Now if nobody ever lends or borrows bitcoin, then there will be no issue - but lending and borrowing has been quite central to commerce over the last couple of centuries, with mostly decent effects. Personally I'm not sure bitcoin economics are that well thought out!
It's possible to have lenders and borrowers without operating a fractional reserve.
But please explain if you mean something else.
With a full reserve, demand deposits shouldn't be lent, but term deposits can be.
With this, you maintain a full reserve and continue to have lenders/borrowers.
You can have "full reserve" of demand (including matured term) deposits as a goal and lend out term deposits, but you get at best a statistical probability approaching -- but never equaling -- unity of maintaining full reserve based on past repayment and new deposit patterns.
A regular bank is well-trusted and insured. A bank run is unlikely because of the trust and even in that case the insurance or a lender can keep the bank solvent. A bitcoin bank is at best moderately trusted and is almost always uninsured. Minor events can lead to panic which leads to a bank run, which leads to insolvency because there is neither insurance nor a good lending infrastructure available to most bitcoin banks.
Concerning lending: there is a small but growing bitcoin lending community, but it's closer to Kickstarter or the VC model. Credits are not given out by banks but by a number of small investors. It's not very efficient yet, but it kind of works.
As another person mentioned, I think you are confusing lending with reserve banking. A bank (or any entity) is allowed to lend as much money as they want to someone if they are actually lending money that they have. That's not fractional reserve. Fractional reserve creates money. The fraction limits how much money you are allowed to create.
You can't do that with Bitcoin by design. Of course, you can lend money (that you have) with Bitcoin. There is currently no automated way to record that the transaction was a loan as opposed to a payment, but that's true of all currencies. In fact Bitcoin had some plans to implement contracts in the protocol, but I don't think anyone has done it yet.
If I am to opine slightly, I think that Bitcoin's lack of ability to do fractional reserve is probably a mistake. I think it relegates it to a payment method as opposed to a viable currency. The problem with Bitcoin as a currency is the lack of availability. Although it often doesn't look like it, I think the purpose of a currency is to get resources into the hands of people who need resources, but don't have it. With Bitcoin, the currency is a limited resource and those that have it have no particular reason to spread it around. With a more traditional currency, the money supply can grow to match demand. The banks which create the currency have an incentive to loan money because the money that they are loaning is springing into existence at that time -- they aren't loaning their own money. The only thing the banks need to worry about is that on average, the growth produced by the loan is greater than the interest charged. Having a fluid money supply like this allows people who do not have money to get it and reduces inefficiencies (i.e. people being idle because they don't have the resources to produce something).
Having said all that, I have no idea how you could implement fractional reserve in a distributed system and have any protection for horrible abuses. Until that problem is solved, I can't really see a way for this kind of currency to act as a true currency (as opposed to a payment method). If I remember correctly, there was a review of Bitcoin by a prominent economist a few years ago that pointed out this problem.
Other than that, you'd still fulfill the basic function of creating liquidity -- any individual depositor has full access to their money, and your creditors also make use of it, so the money supply increases.
Just because there's no BitCoin-denominated lender of last resort also doesn't necessarily screw you in case of a bank run. If your loans are sound, any individual bank could probably find lenders in case of a run: if all of a banks depositors want their BitCoin back at once, the bank would go to other banks or lenders and borrow BitCoin against the value of their loans. As long as there is sufficient liquidity in the entire banking system, the individual banks could survive a run.
You could also get around the lack of a BitCoin-denominated lender of last resort by using a non-BitCoin-denominated lender of last resort: while the accounts may be BitCoin-denominated, you could (in the ToS) give the depositors an equivalent amount of USD if you "run out" of BitCoin and you are unable to borrow BitCoin from other lenders. It'd be more complex because you'd need to borrow USD against the value of the BTC-denominated loans you yourself have, and then insure against the risk of a BTC crash, but that's the sort of think that financial and insurance people do all the time.
1) create a service that offers to store people's bitcoins safely.
2) give depositors an option to receive interest in their bitcoins if they'll allow you to loan them other people.
3) loan some (but not all) of those bitcoins to other people, and charge interest.
4) collect the interest, (optionally pay part of it to the depositors), and use it to fund your operation.
That's it.
I get that you don't think that's fractional reserve banking, but you're wrong. I have just accurately described how the money 'poofs' into existence. I get that you don't understand this truth, but it is indeed a truth.
> A bank (or any entity) is allowed to lend as much money as they want to someone if they are actually lending money that they have.
No they are not. There are supervisory limits on what a bank can lend (leverage ratios, capital adequacy rations etc.).
> By definition fractional reserve is lending more currency than you have.
No it is not, it is lending a fraction (less than 100%) of the money that has been deposited with you.
I think the confusion comes from that in todays banking system there are two sorts of money that seem very similar - the base money (federal bank notes) and the bank money (loans/deposits of federal bank notes). The loans/deposits can also be used as money but crucially they are NOT the underlying money even if it is very easy to convert one to the other (depositing or withdrawing the base money). Example: I can buy something with the fact that Chase bank owes me bank notes (with the loan I made to it), by changing the ownership of that loan to the shop I want to buy something from. I have a bank card that makes that transfer very simple.
The 10:1 ratio is a limit on bank money (loans / deposits) to base money (federal bank notes). Both sorts of money are denominated in dollars, but they are different and have different supply and demand.
To recap, by keeping careful records of the loans / deposits, and making systems to easily transfer ownership of the loans and deposits, these loans end up also having characteristics of money - they can be used for transactions, for accounting etc.
> You can't do that with Bitcoin by design
You absolutely can. The loans/deposits form of bank money could work with bitcoin as the base money, and you could have the same rules around fractional reserve, capital adequacy rules, liquidity ratio rules etc. that the normal banking system has.
No, it doesn't. If it did it would mean that everyone with a mortgage is insolvent, as would most businesses (what sort of business keeps a 1:1 debt/cash ratio?). What insolvent means is that you don't have enough cash, and/or assets with enough liquidity to be able to pay your debts.
Banks are fine, because for the most part they can sell debtors for cents on the dollar when they really need the cash.
Insolvency means you fucked up.
Illiquid: Immediate demands for cash exceed liquid assets.
Fractional reserve banking: Short term deposits are lent out as long term loans.
Under normal conditions, a bank has capital (ie, its assets exceed its liabilities). The capital acts as a cushion, which means it is not insolvent, and not likely to become insolvent.
On the other hand, fractional reserve banks are prone to liquidity crises (aka, a bank run), because while the bank will pretty much always have enough assets to give all depositors their money back, it will pretty much never have enough to do so immediately. Which is why real banks have depositor insurance (and also why depositor insurance is affordable to provide).
The article is describing MtGox as being insolvent; and despite incorrectly using the term, it's not describing fractional reserve banking, and the two are not the same thing. MtGox didn't make long term loans (or any loans), and it did not suffer a liquidity crisis. It was insolvent because the money was stolen. It's a vastly different thing.
If I accept $10 in deposits, make $8 in loans, and have $3 of cash on hand, I'm operating a fractional reserve.
I have $11 in assets ($3 cash, and $8 of loans receivable), and $10 in liabilities (cash owed to depositors). There's some risk if my loans go bad, but it's fundamentally sane.
Insolvency, on the other hand would be if I accept $10 in deposits, make $8 in loans, and have $0 cash on hand.
At this point, I'm insolvent. There's no reason to believe I can pay back my depositors because my liabilities are greater than my assets. Even if all the loans are repaid, I simply don't have the money.
I am not sure how such a huge amount of bitcoins can be "lost" within such a short period of 4 months. Leaving open the option that there may be some mix up with the internal data or that the analysis is incomplete.
> The "gap" in the left-most part of the graph is caused by MtGox bitcoins that we temporarily lose track of (likely as they pass through old cold storage that we have not yet mapped out). They later reappear in known addresses, which marks the "end" of the gap.
Those are two seperate events in the same timeframe: The ~450BTC which cause the gap all reappear in November 2011, while the disparity is growing at a rate that perfectly matches the disparity growth after the gap (see third graph).
Also these ~500BTC aren't "almost all" "missing" bitcoins, but only half of the bitcoins they can't account for.
No it doesn't. What Andrew_Quentin meant is that even ignoring the gap (grey line) or taking it into account (red line), both show that 500k BTC are missing by Nov 2011, and this all happened in a mere 5 months, between Jun and Nov: http://4.bp.blogspot.com/-Np_kU7aOZOY/VS_HpjyMq2I/AAAAAAAAC3...
I find it surprising that WizSec doesn't advance the following theory, but it is likely that the same hacker from the disastrous June 2011 hacking incident (which I blogged about; http://blog.zorinaq.com/?e=55) is responsible for stealing the MtGox bitcoins which started disappearing right around this time.
In many developed countries there are consumer protection laws which entitle the buyer to Replacement, Repair, Refund (in that order usually), so a merchant not adhering to these laws could endup in serious legal trouble as is.
Bitcoin at least gives a choice to both buyers and sellers just like plain old cash does
Bitcoin, Cash and Traditional Banking (SEPA etc) provide an alternative for commerce where one is free from Visa/Mastecard stupidities and ensure that the Visa/Mastercard duopoly is actually forced to compete and not grow into a more dominant and more abusive entities than they already are. They provide an alternative to being tracked and data-mined and having personal information sold to god knows who :( People do not value their privacy until they lose it, and by then its too late.
* Cash allows me to pay (quite anonymously and without fear of being an entry in some datamine) for things locally
* SEPA bank transfer allows me to pay EUwide for goods and services reasonably quickly and for no fees (thank you EU! credit card duopoly must hate SEPA)
* Bitcoin allows me to instantly pay world wide with ultralow fees, its basically electronic Cash (credit card duopoly do hate bitcoin with a passion, just yesterday they prevented neteller from bridging bitcoin and credit card worlds which IMHO is anticompetitive! http://blog.neteller.com/2015/04/new-deposit-option-bitcoin/)
I forgot the last time I had to use a credit card (or paypal and their "consumer protection") in the last year, and my life both personal and business is easier and better for it.
First, in the US there are four companies, not two (or three, if you don't want to count Discover). And chargebacks aren't the reason that there are so few players - they're far from the biggest barrier to entry for an upstart, aspiring credit card provider.
> In many developed countries there are consumer protection laws which entitle the buyer to Replacement, Repair, Refund (in that order usually), so a merchant not adhering to these laws could endup in serious legal trouble as is.
That's not what chargebacks are generally for, and in fact using a chargeback for any of those three things is oftentimes considered misuse of the chargeback system. Chargebacks are for handling disputes regarding the actual goods or services promised or rendered.
Furthermore, having laws in place means nothing if it's prohibitively expensive for consumers to actually get them to be enforced in all but the largest disputes. Chargebacks are a tool that consumers can (and do) use to ensure that merchants adhere to these agreements. No individual is going to go to court with a merchant over a few hundred dollars on a disputed credit card charge. The consumer delegates this authority to the credit card company, who is more than happy to aggregate this risk across multiple customers, in exchange for a cut[0]. This is not a problem; it is the system working as intended!
I'm saying this both as a consumer and as a merchant who has gotten screwed over by one of the four (not two) major credit card companies[1] - chargebacks suck, but they provide an essential protection for consumers that the judicial system cannot.
(All of this is separate from fraud, which is a different matter entirely.)
> I forgot the last time I had to use a credit card (or paypal and their "consumer protection") in the last year, and my life both personal and business is easier and better for it.
I've had to make a few chargebacks in my life. The largest was for almost $2000. Even though the vendor was clearly in the wrong (and I had the written contract to prove it), it would have been way too expensive to actually try and get our money back through the judicial system. Fortunately, my credit card company was more than happy to settle the matter for us.
[0] The consumer doesn't pay for this service directly, but they do indirectly (which isn't fundamentally different from many other products and services, in which the actual cashflow is invisible to the end consumer - this can be problematic in its own right, but that's a separate matter of discussion).
[1] I have plenty of chargeback horror stories as a merchant, but that's the topic of another post. And that doesn't mean I don't see the value in chargebacks in general.
Visa/Mastercard must absolute hate the EU and its consumer friendly policies that actually focus on making lives easier and cheaper for people here.
I think the consumer wins on this one.
The only who actually wins is the credit card cartel.
Personally, I find it much easier to be able to carry a credit or debit card rather than having to worry about carrying cash for everything. And knowing that I can get my money back pretty quickly if there's a breach or if a merchant doesn't provide the services they were supposed to is worth paying a bit more.
Having a phone with a Bitcoin app where I tap on the payment terminal and pay by confirming the amount and entering my pin.
Or scanning a Bitcoin QR code and paying online instead of typing long string of numbers, expiry codes, cvv etc etc and then going thru the anal probing that Verified by Visa or mastercard secure code is.
Of course, that last bit is pretty hard, but only because merchants have mostly decided that the cost and hassle of accepting credit cards is well worth it.
Once the again the keyword here is "choice" Bitcoin gives yet another option for eCommerce at ultralow fees. and thats great.
My point is, you have a choice, so if you don't like how credit cards do things, don't use them.
This whole line of argument is kind of a red herring anyway. It's OK to discuss things we do or don't like about something without it becoming a "take it or leave it" situation. "Take it or leave it" is meant to shut down an discussion that the party pushing that line doesn't want to happen. I never asserted that the force of law compelled anyone to accept credit cards, so it should be obvious that it's "optional", right? Why can't we talk about the problems, real or perceived, with chargeoffs, mikeash?
Back off from trying to stop people from using something a lot of them clearly like, and I'm happy to talk about the problems.
In any case, "take it or leave it" is a perfectly valid argument for things that aren't collective action problems. "Cars are destroying society" "so don't drive one" is a bad argument, because your individual choice doesn't make a noticeable difference. "Excessive parking hurts businesses" "so don't install excessive parking at your business" is a perfectly good argument, because you have the power to change your own circumstances there. (Ignoring, for a moment, the fact that it's common to have parking lot size dictated by local laws.) Using and accepting credit cards falls into the latter category: if credit cards hurt your business, don't accept them. That this will probably result in a failure of your business merely indicates that the benefits outweigh the costs. If you think the benefits could be preserved while reducing the costs, that would be interesting, but I don't think such a scheme would actually succeed, and not simply because the existing infrastructure is entrenched.
Regardless of how many players there are, it's hard to deny that they behave like a cartel, which I think was the point of GP's use of duopoly.
I don't really see chargebacks as an anti-competitive practice, but I do see them as shifting the burden for their shockingly-bad security practices to merchants and consumers and focusing on ease of use (even for criminals) to increase the amount of credit card spending and profits for the payment networks. Europe has had chip and pin for decades now (it was already well established on my first trip there in 1998) and we're just getting it now after a ton of major breaches that should have been easily prevented. But merchants are forced to take credit cards because consumers love the convenience of paying that way and they're prevented from knowing the added cost that it imposes. That's where the cartel behavior comes into play...the policies that prevent merchants from advertising different prices for credit card transactions to reflect that added cost of accepting credit cards adds a silent ~5% tax onto everything we buy. Even for informed consumers, it creates tragedy of the commons situation because you'd be foolish to buy with cash when you can pay the same price and get 1% cash back.
All of this follows from the chargeback system that places all the burden for fraud on merchants. If the payment networks bore the burden for fraud out of their cut, we would have seen credible security features long ago. And somehow, when breaches like Target and Home Depot come to light, we blame those companies rather than the payment networks who should have been responsible for solving these issues many years ago.
There's a lot of misinformation about chip-and-pin (which is not surprising, because a lot of well-funded companies currently have a financial interest not to clarify the misinformation). This has been explained in more detail on the threads about the breaches by others who work on payment systems, but chip-and-pin would not actually have prevented several of the breaches that have happened recently in the US.
Furthermore, the main benefit to chip-and-pin has to do with the liability, not actual security. I'm not talking about the liability shift onto merchants who don't accept chip-and-pin; I'm talking about the situation in which fraud or suspected fraud occurs using a chip-and-pin system. In this case, though, the benefit is entirely for Mastercard/Visa/etc., and not for the consumer.
When someone stole my debit card number (probably through a compromised reader) and began using it fraudulently, my bank contact me, shut down the card, and eventually gave me my money back. How many people at Mt. Gox were insured?
You can make contrived hypotheticals about the "benefits" of not having these services, but they get harder to explain away when you do need them.
The people using Mt Gox knew it was not an insured service and for most part ignored all warning signs for a long time that it was basically a scam.
They CHOSE to trust a shady service with a ridiculous name for the storage of their bitcoins when they could have stored them locally in a quite a secure manner. They CHOSE to send bitcoins and fiat to service that had warning lights flashing above it for months and months on end. The people who lost money in Mt Gox knew exactly what they were getting into and got burned for it.
Their stupidity is not the fault of bitcoin protocol/platform yet you and many others equate bitcoin to MtGox unfortunately.
BTW > http://blog.ycombinator.com/coinbase-yc-s12-is-becoming-the-... There are services being build around bitcoin including Ycombinator funded ones that build on bitcoin and start to offer things such as insurance and good professional trading tools and api's etc etc on top.
Bitcoin is a technology which gives users more options and choice (including choice to spend their money on scams such as MtGox if they so wish)
Any number of the fraudulant/hacked bitcoin exchanges or marketplaces could be used in place of Mt. Gox as an example of when you need insurance: https://bitcointalk.org/index.php?topic=83794.0
You can't claim that no insurance/chargebacks is a competitive benefit and then say the ensuing consequences aren't a problem because of "expectations". People on a daily basis do not expect accidents or fraud, but when it does happen it is needed.
Most of the worlds commerce is done in cash, Bitcoin is very much like electronic cash and it does this very very well. Like any other well designed protocol it does not attempt to do more than it was designed to do.
Things like insurance and chargebacks etc etc will be provided (already are!) by startups in the bitcoin space, and thats great.
In my opinion the credit card "chargeback" process is not a feature it gives too much control to the consumer while shafting them merchant (which in turns leads to higher prices for the consumer) all while making money for the credit card duopoly. If anything it makes fraud (against the merchant) more possible and likely this once again results in the consumers being indirectly harmed when merchants have to price in credit card fraud and chargebacks into their prices.
There are "chargeback" solutions, which involve multi-sig escrow, but are not unique to bitcoin and thus not competitive.
This is why bitcoin can't be competitive - because consumers make the decision on what type of payment method to use and opt for the method that empowers them in case of fraud and accidents. Bitcoin isn't competitive by design, and no amount of proselytizing will change that.
Imagine a consumer instead of withdrawing €50 at an ATM with their debit card and then going for a drink in the pub. Instead settling their tab at the pub (or paying by waving their phone) using their phone with a bitcoin app
No, it's consumer protection.
Without chargeback being available many people wouldn't shop online, ever. I might not go that far but I would certainly only ever shop at stores whose names I already know. There's no way in hell I'd send money to some unknown vendor that may never fulfil my order without the ability to get the money back.
People simply trust the law to protect them. Doing a chargeback already implies that one of both sides is committing fraud. If an online shop is committing fraud we trust the police to get our money back.
Further, under UK law, the credit card issuer is a party to the debt and acts as a guarantor - they're on the hook if the merchant does somehow manage to get away with the cash.
>> Doing a chargeback already implies that one of both sides is committing fraud.
Yes, and we have thousands of years of 'Caveat Emptor' shenanigans to point out just how necessary consumer protections are in this space.
>> If an online shop is committing fraud we trust the police to get our money back.
Then you must be prepared to wait a long time and frequently be disappointed.
Chargebacks are a different topic, I know it's a cop out but I can't be bothered right now. I'll just say they're not as nice as people make them out to be, they're a big cost factor, they invite quite a bit of fraud, carry an awkward burden of proof, and socialise the costs (which I normally don't mind, but in this particular case it makes little sense).
I agree it's not unlikely that we'll still use institutions with bitcoin. The difference is that unlike something silly like Swift, we can have an open money protocol that is global, works with currency-agnostic tokens (bitcoins) that can present any value given the right derivatives market. It's more global, cheaper, faster, but perhaps most importantly more open and democratic, even with regulations in play. It's a bit like the Internet, even if companies individually are regulated, an open network is massively important. Anyway I won't stretch that comparison too far, most people dislike comparisons of something that's still very small to something grand. In addition to that, an open money protocol that is not proprietary or regional is a lot easier to disintermediate with software solutions. Even if institutions will still play a role, they'll be more software companies than brick & mortar administrative financial companies.
Are you under the impression that it's an institution at all?
The whole reason Bitcoin is interesting is that it's not under the control of a company, group, or government.
Somewhat how traditional car companies were schizophrenic when it came to electric cars and have done everything to kill them despite posing little threat being such a small market until Tesla came along at shown that electric cars are 1) better in many ways and 2) actually profitable
In reality it's under the control of the lead developers and the people that run the very few large mining pools. As shown by their collusion to fix blockchain forks etc etc.
Only because they've done nothing wrong (thus far). If there was any hint of foul play, they would be out.
The people that run the mining pools don't "control" bitcoin to any substantial degree. And, again, if they seriously abused their power, a trivial software fix would be to change the proof-of-work algorithm, instantly obsoleting the miners' equipment.
I'm not trying to say that these actors have done anything bad, just the idea that it's not under control of a few central authorities isn't really grounded in observable fact...
Bitcoin is like that.
But like bitcoin and cash, institutions are part of the ecosystem. You likely get paid by regulated organisations such as an employer or company, you may store your cash with a third party like Paypal, a bank or a bitcoin wallet service like Coinbase. You may exchange your cash into a different currency, or have a company send your cash somewhere, and institutions are involved just like with bitcoin.
And all these organisations are generally subject to the same, or stricter regulatory oversight. In most states for example, bitcoin companies are considered money transmitters and subject to your regular money transmitter laws. And in some states like New York, actual bitlicenses are being designed to specifically provide bitcoin/cryptocurrency regulations in addition to these laws, not replacing them.
The fact that not everyone uses institutions, or that some illegal institutions exist (just like how some use cash without using banks see [0], or use illegal organisations for their financial services (e.g. Hawala remittance services instead of Western Union, illegal in many countries), is no different from people using bitcoin without involving an institution, or using bitcoin services that don't follow their regulatory obligations. (the minority of popular wallet companies, exchanges etc, btw).
So... no miracle here. It's extremely similar to cash as we know it. Not exactly similar of course.
You could also sell the bitcoins for cash in person over time, and avoid any traces.
These people could also tumble the bitcoins, where they convert it to an alt coin or other currency before converting back to a different address. That's how money launderers currently use bitcoin now and bypass the whole "public record" thing.
And it's known that many companies do a lot of analysis and tracking and have lists, so the biggest bitcoin company in the world for example (close to half a billion valuation), Coinbase, is known to close down and flag accounts who's bitcoins have been traced to e.g. relatively innocuous sports gambling websites, because of its compliance obligations.
So the notion of black lists is not unlikely. What is unlikely is that (without gov. pressure), they will be eager to employ them. Again, fungibility gets destroyed and bitcoin takes a big hit, might not be workable that way. And two, they cut into their own business to block customers. And three, institutions blocking blacklisted coins goes against the privacy spirit and non-reliance on 3rd party permission of bitcoin, which is something that makes you popular.
It also appears government hasn't asked for this yet and that they prioritise innovation and rapid growth over implementing crushing regulations in a tiny ecosystem. But that might change. Although if this happens (government requiring black lists etc) I think it's more likely that exchanges will get extra reporting duties, allow the sale of bitcoins, and that banks will be the ones freezing the fiat accounts. That'll give the government easily seizable assets, and proof of laundering, yet allows the bitcoin ecosystem to continue on as usual.
The international scope of the exchanges and their competitive nature makes it seem unlikely that blacklists will be successful. Addresses are pretty ubiquitous by design, so short of blacklisting entire exchanges I don't see it working. (Even then tumbling would get around it)
In other words, the banking system is circumvented and everything is done with cash. The other option is to employ the banking system in a way that is also used for business fraud in general: use throw away accounts from socioeconomically fragile and 'disposable' people. Criminals will approach someone who is (semi) homeless, or a minor in high school. They probably have a bank account with $50 on it. You pay them $100 for their ATM card & bank account and promise more with some story, e.g. employment as 'jr. financial controller' in the criminals' non-existent company. The victims (who fall for it) argue to themselves "I have $50, I get $100, and have been promised $500 more, what do I have to lose?"
Will there be people who deny this opportunity? Yes, probably most. Will there be people who won't? Yes. And you only need a single card and you can run 3-5 days of scams on it before the account gets reported, flagged and blocked. And you can run thousands of dollars of money through in that period.
The criminal now has a regulated bank account on which he can receive payments without it leading back to his identity. At this point you can scam people on Craigslist (send me $200 for the Playstation and I'll send it to you asap, do it at 3AM and it won't get deleted manually by an admin, and you'll find 3-4 people who'll fall for a too good to be true price because they're desperate), or indeed actually sell stolen bitcoins at 95% of market value (inviting arbitrage who will buy up everything you have).
You then go to the bank, use your card to withdraw everything, and disappear. The guy who gave you his card gets a call from the police and tells his story. Sometimes he gets a minor fine, but generally he is a victim, too and has no means of covering any damage.
Will there be people who deny stolen bitcoins? Yes. Will there be people who either have no clue at all which bitcoins were recently stolen or not, or if they do, not care? Yes.
It's really messed up and pretty fool-proof. The big criminals get caught eventually. (they leak information to friends who report them. They run $500k of scams through Craigslist and get priority and get traced via their ISP, usually they barely know what an IP is). Or they do this + a bunch of other stuff like break ins and get caught when the police finds $100k in cash at their home. Or they get reported trying to recruit lots of kids for their debit cards etc. But I'd bet if you did it small-time/smartly you could easily get away with it.
I assume the investigators would see a pattern of many small deposits being moved directly from those deposit addresses into the exchange's hot and cold wallets, which contained large amounts of money. That pattern could be recognized and the exchange's main wallets identified beyond reasonable doubt. Withdrawals from the exchange could also be tracked, I assume. Probably there is more sophisticated analysis of addresses clusters involved too.