Your Bitcoins Are Not Safe At All


SUBMITTED BY: Guest

DATE: July 3, 2013, 2:09 p.m.

FORMAT: Text only

SIZE: 5.2 kB

HITS: 1364

  1. While Bitcoin itself has no risk due to a catastrophic failure of an alternate crypto currency (alt-coin), those storing their bitcoins at an exchange where those alt-coins are traded are exposed to significiant risk.
  2. Consider this scenario:
  3. Attacker sends large amounts of feathercoins to a digital currency exchange.
  4. At the same time the attacker (with more than 51% mining capacity for that alt-coin) begins mining but does not release the solved blocks. The rest of the network doesn’t know a 51% attack is underway. Included in the attacker’s first block is a double spend of the attacker’s feathercoins sent to the exchange.
  5. Attacker waits for confirmation of those feathercoin deposits and then exchanges those feathercoins to bitcoins as well as litecoins, and whatever else is traded on the exchange — and then the attacker withdraws those funds.
  6. Once those withdrawals have been processed (confirmed and possibly already mixed) the attacker releases the mined blocks. This results in a blockchain fork and the attacker’s side is now the longest chain. All transactions in the attacker’s side of the fork become valid with the rest of the network, and any transactions from the losing (orphaned) side of the fork that conflict (i.e., the ones sent to the exchange) are ignored as invalid.
  7. The exchange did what it was asked. It allowed the trade of confirmed feathercoins for bitcoins and other alt-coins. But the exchange is now in trouble. The bitcoins and litecoins have already been withdrawn, but the exchange is now in debt a certain number of feathercoins to its customers. Their exchange E-Wallet accounts will show N feathercoins but the exchange no longer holds them in their physical wallet.
  8. This would likely cause the exchange to become technically bankrupt (defined as having a sum total of liabilities greater than the sum total of assets).
  9. In the wild, wild west of the unregulated digital currency realm there’s no knowing how an exchange operator will respond to the exchange becoming technically bankrupt (whether due to a hack, a 51% attack, fiduciary mismanagement, etc.). Some exchanges keep operating (on a fractional reserve) without ever notifying their customers (creditors) that they are bankrupt. Others shut down and pay out “pennies on the dollar". Others will give preferential treatment to some creditors at the expense to others.
  10. In nearly all instances, the exchange’s customer with funds in an E-Wallet is simply a creditor to the exchange. An E-Wallet account is considered a current account with the exchange/financial company. If the organization goes bankrupt, those with any funds at the exchange simply have a claim against the assets of the exchange which include other customer’s funds. The operator might try to “be fair" and return bitcoins from the E-Wallet to those having a bitcoin balance in their E-Wallet, or the operator might think fair is spreading the loss evenly to all, so losses from the feathercoin debt is shared by all customers. If bankruptcy law were to be applied, there is no preferential treatment for creditors, thus those with bitcoins would have no more of a claim against the exchange than would the feathercoin customer.
  11. This means even if you never touched a feathercoin but had bitcoins at an exchange that trades them then in the event of the exchange suffering a loss to an alt-coin 51% attack your balance of bitcoins at the exchange is at risk. Your bitcoins at such an exchange have the same standing as every alt-coin, and even are no different from the company’s other debts such as server hosting bills that are due, for instance.
  12. The exchanges don’t have their own money on the line, so if they are careless with their customer’s money it doesn’t hurt them (aside from business continuity and reputation should losses from an incident actually have a large impact on the organization). Exchanges make their money from trading activity and thus have more of an interest in gaining market share in the near term than protecting their customer’s assets from an event that may not ever actually occur.
  13. When Mt. Gox announced their intention to support trading of litecoins, a question about the risks due to a LItecoin 51% attack was asked. The response was that the concern would be considered and the support ticket status was changed to “closed".
  14. Mt. Gox has delayed its introduction of a litecoin trading market but other exchanges such as VirCurEx and others do support trading of alt-coins today.
  15. An exchange could implement and maintain contracts that would isolate funds (such as having a legal entity for trading the alt-coin be a different entity than the the trading of bitcoins) but at this time no alt-coin exchanges address the issue as far as how they would protect customer’s funds in a bankruptcy or as the result of an attack.
  16. The risk of losing bitcoins at these exchanges due to an alt-coin 51% attack are real. Please be aware of this risk when storing your bitcoins anywhere other than in a wallet that you control.

comments powered by Disqus