Hacker News new | past | comments | ask | show | jobs | submit login
The Missing Mt. Gox Bitcoins (blog.wizsec.jp)
168 points by dwwoelfel on April 19, 2015 | hide | past | favorite | 89 comments



The author says "MtGox operated at fractional reserve for years". A better and more conventional way to put it: it was insolvent for years.


aren't they essentially the same thing?


When you operate a fractional reserve, other people/businesses owe you at least as much money as you owe to your deposit accountholders.

When you're insolvent, you can't cover your obligations. Even if you called in every loan you'd made, it still wouldn't give you enough cash that all your deposit account customers could withdraw all their money.

Calling Mt. Gox a "fractional reserve" is giving them way too much credit.


That was mostly meant to be a bit snarky, however your explanation is fair enough for the pedantic in me.


Being insolvent means that they can't cover your obligations right now. If you deposit 100BTC in my wallet, I invest it for a year and you want it back right now I'm insolvent because I can't pay you right now; despite my books being perfectly balanced.

In the event of everyone wanting to withdraw their money at once, operating a fractional reserve and being insolvent are basically the same (unless you can instantly get the money out of your investments). That's a major reason why fractional reserve banking is frowned upon in the bitcoin ecosystem.


Fractional reserve banking can be done with bitcoin just as with any underlying "base asset" such as gold or Federal Reserve Banknotes. It just means that the banks can lend most of the asset, and must keep back a fraction for liquidity purposes (in case a depositor wants some of their asset back).

In many ways Fractional Reserve Banking would be much more risky with bitcoin than with banknotes; with banknotes at least there is a lender-of-last-resort central bank. The central bank can create additional money at will to lend to a bank that is in a liquidity crisis, to see it through the crisis. With bitcoin, there is no such operator.

Now if nobody ever lends or borrows bitcoin, then there will be no issue - but lending and borrowing has been quite central to commerce over the last couple of centuries, with mostly decent effects. Personally I'm not sure bitcoin economics are that well thought out!


Sure fractional reserve banking can be done with bitcoin. It's not a problem of the currency but of the environment and ecosystem.

A regular bank is well-trusted and insured. A bank run is unlikely because of the trust and even in that case the insurance or a lender can keep the bank solvent. A bitcoin bank is at best moderately trusted and is almost always uninsured. Minor events can lead to panic which leads to a bank run, which leads to insolvency because there is neither insurance nor a good lending infrastructure available to most bitcoin banks.

Concerning lending: there is a small but growing bitcoin lending community, but it's closer to Kickstarter or the VC model. Credits are not given out by banks but by a number of small investors. It's not very efficient yet, but it kind of works.


Yes I agree, and personally I would trust a bitcoin bank even less given the repeated security problems that bitcoin businesses to date.


You are conflating lending and fractional reserve.

It's possible to have lenders and borrowers without operating a fractional reserve.


Well as I see it there are only really two possibilities: full reserve or fractional reserve, and I've never really seen full reserve banking (i.e. demand deposits cannot be lent).

But please explain if you mean something else.


I don't.

With a full reserve, demand deposits shouldn't be lent, but term deposits can be.

With this, you maintain a full reserve and continue to have lenders/borrowers.


Lending term deposits cannot provide a guarantee of full reserve, because term deposits mature and you cannot absolutely guarantee that you will have reserves on hand to meet them when they mature.

You can have "full reserve" of demand (including matured term) deposits as a goal and lend out term deposits, but you get at best a statistical probability approaching -- but never equaling -- unity of maintaining full reserve based on past repayment and new deposit patterns.


And? Demand deposits are still 100% whole.


To be honest, I don't see how you could possibly do fractional reserve with Bitcoin. By definition fractional reserve is lending more currency than you have. Banks can do this because they are allowed to create the money that they lend. So if I am allowed a 10:1 ratio of lending and reserve, as long as I maintain $1 in my reserve, I'm allowed to lend $10. Those $10 are poofed into existence when the loan is created, though.

As another person mentioned, I think you are confusing lending with reserve banking. A bank (or any entity) is allowed to lend as much money as they want to someone if they are actually lending money that they have. That's not fractional reserve. Fractional reserve creates money. The fraction limits how much money you are allowed to create.

You can't do that with Bitcoin by design. Of course, you can lend money (that you have) with Bitcoin. There is currently no automated way to record that the transaction was a loan as opposed to a payment, but that's true of all currencies. In fact Bitcoin had some plans to implement contracts in the protocol, but I don't think anyone has done it yet.

If I am to opine slightly, I think that Bitcoin's lack of ability to do fractional reserve is probably a mistake. I think it relegates it to a payment method as opposed to a viable currency. The problem with Bitcoin as a currency is the lack of availability. Although it often doesn't look like it, I think the purpose of a currency is to get resources into the hands of people who need resources, but don't have it. With Bitcoin, the currency is a limited resource and those that have it have no particular reason to spread it around. With a more traditional currency, the money supply can grow to match demand. The banks which create the currency have an incentive to loan money because the money that they are loaning is springing into existence at that time -- they aren't loaning their own money. The only thing the banks need to worry about is that on average, the growth produced by the loan is greater than the interest charged. Having a fluid money supply like this allows people who do not have money to get it and reduces inefficiencies (i.e. people being idle because they don't have the resources to produce something).

Having said all that, I have no idea how you could implement fractional reserve in a distributed system and have any protection for horrible abuses. Until that problem is solved, I can't really see a way for this kind of currency to act as a true currency (as opposed to a payment method). If I remember correctly, there was a review of Bitcoin by a prominent economist a few years ago that pointed out this problem.


Sorry but I do disagree with few things you say.

> A bank (or any entity) is allowed to lend as much money as they want to someone if they are actually lending money that they have.

No they are not. There are supervisory limits on what a bank can lend (leverage ratios, capital adequacy rations etc.).

> By definition fractional reserve is lending more currency than you have.

No it is not, it is lending a fraction (less than 100%) of the money that has been deposited with you.

I think the confusion comes from that in todays banking system there are two sorts of money that seem very similar - the base money (federal bank notes) and the bank money (loans/deposits of federal bank notes). The loans/deposits can also be used as money but crucially they are NOT the underlying money even if it is very easy to convert one to the other (depositing or withdrawing the base money). Example: I can buy something with the fact that Chase bank owes me bank notes (with the loan I made to it), by changing the ownership of that loan to the shop I want to buy something from. I have a bank card that makes that transfer very simple.

The 10:1 ratio is a limit on bank money (loans / deposits) to base money (federal bank notes). Both sorts of money are denominated in dollars, but they are different and have different supply and demand.

To recap, by keeping careful records of the loans / deposits, and making systems to easily transfer ownership of the loans and deposits, these loans end up also having characteristics of money - they can be used for transactions, for accounting etc.

> You can't do that with Bitcoin by design

You absolutely can. The loans/deposits form of bank money could work with bitcoin as the base money, and you could have the same rules around fractional reserve, capital adequacy rules, liquidity ratio rules etc. that the normal banking system has.


Here's how to create a fractional reserve with bitcoin.

1) create a service that offers to store people's bitcoins safely.

2) give depositors an option to receive interest in their bitcoins if they'll allow you to loan them other people.

3) loan some (but not all) of those bitcoins to other people, and charge interest.

4) collect the interest, (optionally pay part of it to the depositors), and use it to fund your operation.

That's it.

I get that you don't think that's fractional reserve banking, but you're wrong. I have just accurately described how the money 'poofs' into existence. I get that you don't understand this truth, but it is indeed a truth.


The main difference between a fractional-reserve BitCoin bank and a conventional bank would be that there would be no lender of last resort to use in case of a bank run.

Other than that, you'd still fulfill the basic function of creating liquidity -- any individual depositor has full access to their money, and your creditors also make use of it, so the money supply increases.

Just because there's no BitCoin-denominated lender of last resort also doesn't necessarily screw you in case of a bank run. If your loans are sound, any individual bank could probably find lenders in case of a run: if all of a banks depositors want their BitCoin back at once, the bank would go to other banks or lenders and borrow BitCoin against the value of their loans. As long as there is sufficient liquidity in the entire banking system, the individual banks could survive a run.

You could also get around the lack of a BitCoin-denominated lender of last resort by using a non-BitCoin-denominated lender of last resort: while the accounts may be BitCoin-denominated, you could (in the ToS) give the depositors an equivalent amount of USD if you "run out" of BitCoin and you are unable to borrow BitCoin from other lenders. It'd be more complex because you'd need to borrow USD against the value of the BTC-denominated loans you yourself have, and then insure against the risk of a BTC crash, but that's the sort of think that financial and insurance people do all the time.


> Being insolvent means that they can't cover your obligations right now

No, it doesn't. If it did it would mean that everyone with a mortgage is insolvent, as would most businesses (what sort of business keeps a 1:1 debt/cash ratio?). What insolvent means is that you don't have enough cash, and/or assets with enough liquidity to be able to pay your debts.

Banks are fine, because for the most part they can sell debtors for cents on the dollar when they really need the cash.


Insolvent: Liabilities exceed assets.

Illiquid: Immediate demands for cash exceed liquid assets.

Fractional reserve banking: Short term deposits are lent out as long term loans.

Under normal conditions, a bank has capital (ie, its assets exceed its liabilities). The capital acts as a cushion, which means it is not insolvent, and not likely to become insolvent.

On the other hand, fractional reserve banks are prone to liquidity crises (aka, a bank run), because while the bank will pretty much always have enough assets to give all depositors their money back, it will pretty much never have enough to do so immediately. Which is why real banks have depositor insurance (and also why depositor insurance is affordable to provide).

The article is describing MtGox as being insolvent; and despite incorrectly using the term, it's not describing fractional reserve banking, and the two are not the same thing. MtGox didn't make long term loans (or any loans), and it did not suffer a liquidity crisis. It was insolvent because the money was stolen. It's a vastly different thing.


No.

If I accept $10 in deposits, make $8 in loans, and have $3 of cash on hand, I'm operating a fractional reserve.

I have $11 in assets ($3 cash, and $8 of loans receivable), and $10 in liabilities (cash owed to depositors). There's some risk if my loans go bad, but it's fundamentally sane.

Insolvency, on the other hand would be if I accept $10 in deposits, make $8 in loans, and have $0 cash on hand.

At this point, I'm insolvent. There's no reason to believe I can pay back my depositors because my liabilities are greater than my assets. Even if all the loans are repaid, I simply don't have the money.


No. Fractional reserve assumes people owe you and your books balance perfectly fine.

Insolvency means you fucked up.


The author states that the bitcoins were stolen over time, however, the graph shows that between June and November 2011 there is a gap due to missing data. It then opens in November 2011 with a huge gap between actual btc and expected btc of some 500k bitcoins. Practically almost all the "missing" bitcoins. Suggesting therefore that either they were "lost" sometime between June-November 2011 or they were hidden at the time somewhere on blockchain or that the authors have made some sort of mistake.

I am not sure how such a huge amount of bitcoins can be "lost" within such a short period of 4 months. Leaving open the option that there may be some mix up with the internal data or that the analysis is incomplete.


Doesn't this cover it quite well?

> The "gap" in the left-most part of the graph is caused by MtGox bitcoins that we temporarily lose track of (likely as they pass through old cold storage that we have not yet mapped out). They later reappear in known addresses, which marks the "end" of the gap.


> Doesn't this cover it quite well?

No it doesn't. What Andrew_Quentin meant is that even ignoring the gap (grey line) or taking it into account (red line), both show that 500k BTC are missing by Nov 2011, and this all happened in a mere 5 months, between Jun and Nov: http://4.bp.blogspot.com/-Np_kU7aOZOY/VS_HpjyMq2I/AAAAAAAAC3...

I find it surprising that WizSec doesn't advance the following theory, but it is likely that the same hacker from the disastrous June 2011 hacking incident (which I blogged about; http://blog.zorinaq.com/?e=55) is responsible for stealing the MtGox bitcoins which started disappearing right around this time.


And the third graph (the difference between observed and expected BTC holdings) nicely supports that. Almost all of the BTC from that gap reappear.


He's talking about right after that gap. At the start of the gap the disparity between real and expected holdings is small, but right after the gap, the disparity is huge, implying a lot of btc were lost during the gap, or a mistake has been made in the analysis.


Yes, almost all of the ~600BTC from that huge increase in expected BTC holdings during Jul-Oct 2011 are unaccounted for. But this seems completely orthogonal to the fact that they loose track of ~450BTC during that timeframe, which this "gap" is about.

Those are two seperate events in the same timeframe: The ~450BTC which cause the gap all reappear in November 2011, while the disparity is growing at a rate that perfectly matches the disparity growth after the gap (see third graph).

Also these ~500BTC aren't "almost all" "missing" bitcoins, but only half of the bitcoins they can't account for.


The problem is that they have no way of knowing how many BTC they actually lost track of during that period or whether all of it did reappear. For those 5 months they have no idea which addresses Mt Gox was keeping the vast majority of their BTC in or how much they had, and if any funds remained in those addresses after November 2011 the whole argument breaks down. They're assuming that none did because the amount of funds in addresses they know about after the gap is roughly the same as before the gap - but the amount of BTC that Mt Gox's accounts claimed they have doubled during that time period, and there's no way to tell whether Mt Gox actually had a shortfall or there was more BTC but only a portion of it got moved to known addresses.


It's embarrassing for the Tokyo Metropolitan Police that they haven't cracked this case yet. They're one of the biggest police departments in the world and have extensive resources. Yes, their in-house computer crime department is new, but they could draw on expertise at the national level or from outside Japan.


I read a book recently that went into some detail about tokyo police's methods regarding a series of murders in the 1990s/2000s. In that account at least they didn't seem very compentent in their investigative skills - they were largely focused on getting confessions from people. Probably not relevant to the MtGox case.

http://www.goodreads.com/book/show/7555367-tokyo-hostess


How do you convert big amounts of bitcoins into cash, even over time, without leaving a trace? Isn't there bank account information involved leading to individuals, which a criminal investigation could request?


The only "trace" that you could find would be a wire transfer from an exchange to a bank account, and even that isn't too suspicious, because I would imagine that large exchanges do that regularly.

You could also sell the bitcoins for cash in person over time, and avoid any traces.


Not necessarily. You could easily funnel the coins through multiple addresses, and then use them to pay for illicit goods, which would then be sold on the black market. Or you could use them at a gambling site which returns real money. Techniques like these are often used by organized crime to launder money, I imagine with btc it is even easier.


Not much different from other stolen goods like jewellery. It has value, people want to pay for it ignorant or disregarding of its (stolen) origins. You do it in person. The buyer has limited culpability. In addition, after some time (I don't know the English legal term for this), ownership transfers from the victim to whoever possesses it for long enough. (i.e. if B steals a bike from A, and sells it to C, then C possesses the bike but doesn't legally own it, ownership is still with A. But after a while, ownership transfers to C. At least in many legal systems). The sale occurs in cash and identities are generally not registered.

In other words, the banking system is circumvented and everything is done with cash. The other option is to employ the banking system in a way that is also used for business fraud in general: use throw away accounts from socioeconomically fragile and 'disposable' people. Criminals will approach someone who is (semi) homeless, or a minor in high school. They probably have a bank account with $50 on it. You pay them $100 for their ATM card & bank account and promise more with some story, e.g. employment as 'jr. financial controller' in the criminals' non-existent company. The victims (who fall for it) argue to themselves "I have $50, I get $100, and have been promised $500 more, what do I have to lose?"

Will there be people who deny this opportunity? Yes, probably most. Will there be people who won't? Yes. And you only need a single card and you can run 3-5 days of scams on it before the account gets reported, flagged and blocked. And you can run thousands of dollars of money through in that period.

The criminal now has a regulated bank account on which he can receive payments without it leading back to his identity. At this point you can scam people on Craigslist (send me $200 for the Playstation and I'll send it to you asap, do it at 3AM and it won't get deleted manually by an admin, and you'll find 3-4 people who'll fall for a too good to be true price because they're desperate), or indeed actually sell stolen bitcoins at 95% of market value (inviting arbitrage who will buy up everything you have).

You then go to the bank, use your card to withdraw everything, and disappear. The guy who gave you his card gets a call from the police and tells his story. Sometimes he gets a minor fine, but generally he is a victim, too and has no means of covering any damage.

Will there be people who deny stolen bitcoins? Yes. Will there be people who either have no clue at all which bitcoins were recently stolen or not, or if they do, not care? Yes.

It's really messed up and pretty fool-proof. The big criminals get caught eventually. (they leak information to friends who report them. They run $500k of scams through Craigslist and get priority and get traced via their ISP, usually they barely know what an IP is). Or they do this + a bunch of other stuff like break ins and get caught when the police finds $100k in cash at their home. Or they get reported trying to recruit lots of kids for their debit cards etc. But I'd bet if you did it small-time/smartly you could easily get away with it.


Selling publicly known stolen bitcoins seems to me as a rather difficult task. Exchanges could refuse dealing with those addresses, and researchers would surely jump if they noticed a set of dormant addresses suddenly starting to see usage. It seems as the same problem as art thieves have, as even if their identity can be hidden, the goods they try to sell are inherently identifiable.


Exchanges could but they definitely don't have a black list of dormant/fraudulent addresses somewhere.

These people could also tumble the bitcoins, where they convert it to an alt coin or other currency before converting back to a different address. That's how money launderers currently use bitcoin now and bypass the whole "public record" thing.


I wouldn't say 'definitely'. I think it's actually quite likely. Some reports have already surfaced of this. Some reports have surfaced about their reporting obligations. Both because they're controversial. i.e. the fungibility of bitcoins is very important for many reasons. The moment we have 'tarred' bitcoins, we get different bitcoins with different histories, and with different values. So a stolen $1 is suddenly worth $0.50, forever, because it's got a blockchain history associated with theft. That is not a workable long-term system, so it has received a lot of backlash from the community, which is why these stories usually get out.

And it's known that many companies do a lot of analysis and tracking and have lists, so the biggest bitcoin company in the world for example (close to half a billion valuation), Coinbase, is known to close down and flag accounts who's bitcoins have been traced to e.g. relatively innocuous sports gambling websites, because of its compliance obligations.

So the notion of black lists is not unlikely. What is unlikely is that (without gov. pressure), they will be eager to employ them. Again, fungibility gets destroyed and bitcoin takes a big hit, might not be workable that way. And two, they cut into their own business to block customers. And three, institutions blocking blacklisted coins goes against the privacy spirit and non-reliance on 3rd party permission of bitcoin, which is something that makes you popular.

It also appears government hasn't asked for this yet and that they prioritise innovation and rapid growth over implementing crushing regulations in a tiny ecosystem. But that might change. Although if this happens (government requiring black lists etc) I think it's more likely that exchanges will get extra reporting duties, allow the sale of bitcoins, and that banks will be the ones freezing the fiat accounts. That'll give the government easily seizable assets, and proof of laundering, yet allows the bitcoin ecosystem to continue on as usual.


I've seen some rumors about blacklists, but I didn't think anyone took it seriously. All it would take is one exchange to allow the bitcoins to change addresses to defeat the purpose.

The international scope of the exchanges and their competitive nature makes it seem unlikely that blacklists will be successful. Addresses are pretty ubiquitous by design, so short of blacklisting entire exchanges I don't see it working. (Even then tumbling would get around it)


There have been some efforts out there to provide completely anonymous bitcoin transactions, namely ZeroCoin and bitcoin mixers like Silk Road used. After these services are used, t becomes impossible to track the coins origins.

http://isi.jhu.edu/~mgreen/ZerocoinOakland.pdf


Fundamentally, Bitcoin is about not having any of that info. If it were a responsible financial institution, then there would have been federal regulations regarding reporting, reserves etc. But the miracle of bitcoins is, somehow it isn't subject to any reasonable oversight.


Bitcoin is pretty much digital cash. There is no institution that governs the transfer of cash, as in if you pay at a store with cash, or pay a friend cash, or pay a criminal cash, or buy some drugs with cash, there's no 3rd party involved here like say a Paypal or bank transfer.

Bitcoin is like that.

But like bitcoin and cash, institutions are part of the ecosystem. You likely get paid by regulated organisations such as an employer or company, you may store your cash with a third party like Paypal, a bank or a bitcoin wallet service like Coinbase. You may exchange your cash into a different currency, or have a company send your cash somewhere, and institutions are involved just like with bitcoin.

And all these organisations are generally subject to the same, or stricter regulatory oversight. In most states for example, bitcoin companies are considered money transmitters and subject to your regular money transmitter laws. And in some states like New York, actual bitlicenses are being designed to specifically provide bitcoin/cryptocurrency regulations in addition to these laws, not replacing them.

The fact that not everyone uses institutions, or that some illegal institutions exist (just like how some use cash without using banks see [0], or use illegal organisations for their financial services (e.g. Hawala remittance services instead of Western Union, illegal in many countries), is no different from people using bitcoin without involving an institution, or using bitcoin services that don't follow their regulatory obligations. (the minority of popular wallet companies, exchanges etc, btw).

So... no miracle here. It's extremely similar to cash as we know it. Not exactly similar of course.


Yes, almost all of the advantages of Bitcoin are because it currently has practically no regulatory oversight. If it was to get mainstream usage, regulation would also grow, and at least if you want to play in licit channels, it would be almost exactly the same as what already exists. Being your own bank is much too hard and risky for the average consumer, and payment systems that provide useful consumer protections like chargebacks would be formed, so in the end, most people would be doing their banking at BitChase and using a BitVisa credit card.


Bitcoin companies in e.g. the US have quite a lot of regulatory oversight. Not sure where you're coming from.

Chargebacks are a different topic, I know it's a cop out but I can't be bothered right now. I'll just say they're not as nice as people make them out to be, they're a big cost factor, they invite quite a bit of fraud, carry an awkward burden of proof, and socialise the costs (which I normally don't mind, but in this particular case it makes little sense).

I agree it's not unlikely that we'll still use institutions with bitcoin. The difference is that unlike something silly like Swift, we can have an open money protocol that is global, works with currency-agnostic tokens (bitcoins) that can present any value given the right derivatives market. It's more global, cheaper, faster, but perhaps most importantly more open and democratic, even with regulations in play. It's a bit like the Internet, even if companies individually are regulated, an open network is massively important. Anyway I won't stretch that comparison too far, most people dislike comparisons of something that's still very small to something grand. In addition to that, an open money protocol that is not proprietary or regional is a lot easier to disintermediate with software solutions. Even if institutions will still play a role, they'll be more software companies than brick & mortar administrative financial companies.


There are plenty of people who recommend against using those US companies like Coinbase because of they follow the regulations. This is on the front page of /r/Bitcoin at the moment: https://www.reddit.com/r/Bitcoin/comments/335lqi/coinbase_fl...


So, did you change your point and agree with me, or does this somehow refute what I said? I don't follow.


I like how the reason for "chargebacks" is often touted as "consumer protection" when the real reason it to line the pockets of the credit card duopoly and ensure the merchant always gets screwed.

In many developed countries there are consumer protection laws which entitle the buyer to Replacement, Repair, Refund (in that order usually), so a merchant not adhering to these laws could endup in serious legal trouble as is.

Bitcoin at least gives a choice to both buyers and sellers just like plain old cash does

Bitcoin, Cash and Traditional Banking (SEPA etc) provide an alternative for commerce where one is free from Visa/Mastecard stupidities and ensure that the Visa/Mastercard duopoly is actually forced to compete and not grow into a more dominant and more abusive entities than they already are. They provide an alternative to being tracked and data-mined and having personal information sold to god knows who :( People do not value their privacy until they lose it, and by then its too late.

* Cash allows me to pay (quite anonymously and without fear of being an entry in some datamine) for things locally

* SEPA bank transfer allows me to pay EUwide for goods and services reasonably quickly and for no fees (thank you EU! credit card duopoly must hate SEPA)

* Bitcoin allows me to instantly pay world wide with ultralow fees, its basically electronic Cash (credit card duopoly do hate bitcoin with a passion, just yesterday they prevented neteller from bridging bitcoin and credit card worlds which IMHO is anticompetitive! http://blog.neteller.com/2015/04/new-deposit-option-bitcoin/)

I forgot the last time I had to use a credit card (or paypal and their "consumer protection") in the last year, and my life both personal and business is easier and better for it.


Insurance (and chargebacks) is one of those things you don't care about until you need it.

When someone stole my debit card number (probably through a compromised reader) and began using it fraudulently, my bank contact me, shut down the card, and eventually gave me my money back. How many people at Mt. Gox were insured?

You can make contrived hypotheticals about the "benefits" of not having these services, but they get harder to explain away when you do need them.


Bitcoin != Mt Gox

The people using Mt Gox knew it was not an insured service and for most part ignored all warning signs for a long time that it was basically a scam.

They CHOSE to trust a shady service with a ridiculous name for the storage of their bitcoins when they could have stored them locally in a quite a secure manner. They CHOSE to send bitcoins and fiat to service that had warning lights flashing above it for months and months on end. The people who lost money in Mt Gox knew exactly what they were getting into and got burned for it.

Their stupidity is not the fault of bitcoin protocol/platform yet you and many others equate bitcoin to MtGox unfortunately.

BTW > http://blog.ycombinator.com/coinbase-yc-s12-is-becoming-the-... There are services being build around bitcoin including Ycombinator funded ones that build on bitcoin and start to offer things such as insurance and good professional trading tools and api's etc etc on top.

Bitcoin is a technology which gives users more options and choice (including choice to spend their money on scams such as MtGox if they so wish)


Mt. Gox used bitcoin, just as my bank uses USD and has FDIC insurance. Stop splitting hairs.

Any number of the fraudulant/hacked bitcoin exchanges or marketplaces could be used in place of Mt. Gox as an example of when you need insurance: https://bitcointalk.org/index.php?topic=83794.0

You can't claim that no insurance/chargebacks is a competitive benefit and then say the ensuing consequences aren't a problem because of "expectations". People on a daily basis do not expect accidents or fraud, but when it does happen it is needed.


You got it backwards it is the person I replied to earlier who claims that credit cards are superior because they have the "chargeback" feature.

Most of the worlds commerce is done in cash, Bitcoin is very much like electronic cash and it does this very very well. Like any other well designed protocol it does not attempt to do more than it was designed to do.

Things like insurance and chargebacks etc etc will be provided (already are!) by startups in the bitcoin space, and thats great.

In my opinion the credit card "chargeback" process is not a feature it gives too much control to the consumer while shafting them merchant (which in turns leads to higher prices for the consumer) all while making money for the credit card duopoly. If anything it makes fraud (against the merchant) more possible and likely this once again results in the consumers being indirectly harmed when merchants have to price in credit card fraud and chargebacks into their prices.


The spotted insurance being provided for bitcoin is through private for-profit organizations, which unlike FDIC, has margins that come at a cost to the consumer.

There are "chargeback" solutions, which involve multi-sig escrow, but are not unique to bitcoin and thus not competitive.

This is why bitcoin can't be competitive - because consumers make the decision on what type of payment method to use and opt for the method that empowers them in case of fraud and accidents. Bitcoin isn't competitive by design, and no amount of proselytizing will change that.


You see a problem I see opportunities for banks to have regular (insured) current account linked to bitcoin payment system giving the consumer the option to pay using bitcoin direct from their current account if they so wish.

Imagine a consumer instead of withdrawing €50 at an ATM with their debit card and then going for a drink in the pub. Instead settling their tab at the pub (or paying by waving their phone) using their phone with a bitcoin app


And they couldn't do this with a credit card and Google Wallet/Apple Pay/Softcard, because?


>. I like how the reason for "chargebacks" is often touted as "consumer protection" when the real reason it to line the pockets of the credit card duopoly and ensure the merchant always gets screwed.

No, it's consumer protection.

Without chargeback being available many people wouldn't shop online, ever. I might not go that far but I would certainly only ever shop at stores whose names I already know. There's no way in hell I'd send money to some unknown vendor that may never fulfil my order without the ability to get the money back.


I have different observations. In Germany most people don't own a credit card, yet online shopping is alive and well. From my observation, when people don't fully trust a store they even prefer wire transfers (which are common, easy, and free, but offer no way to get your money back).

People simply trust the law to protect them. Doing a chargeback already implies that one of both sides is committing fraud. If an online shop is committing fraud we trust the police to get our money back.


Chargebacks are quicker and easier than trying to drag a vendor through the courts, especially when your only relationship to the vendor is online, the vendor may be in another country and they may have just packed up and disappeared, or for whatever reason it is they just don't have the money.

Further, under UK law, the credit card issuer is a party to the debt and acts as a guarantor - they're on the hook if the merchant does somehow manage to get away with the cash.

>> Doing a chargeback already implies that one of both sides is committing fraud.

Yes, and we have thousands of years of 'Caveat Emptor' shenanigans to point out just how necessary consumer protections are in this space.

>> If an online shop is committing fraud we trust the police to get our money back.

Then you must be prepared to wait a long time and frequently be disappointed.


> to line the pockets of the credit card duopoly and ensure the merchant always gets screwed.

First, in the US there are four companies, not two (or three, if you don't want to count Discover). And chargebacks aren't the reason that there are so few players - they're far from the biggest barrier to entry for an upstart, aspiring credit card provider.

> In many developed countries there are consumer protection laws which entitle the buyer to Replacement, Repair, Refund (in that order usually), so a merchant not adhering to these laws could endup in serious legal trouble as is.

That's not what chargebacks are generally for, and in fact using a chargeback for any of those three things is oftentimes considered misuse of the chargeback system. Chargebacks are for handling disputes regarding the actual goods or services promised or rendered.

Furthermore, having laws in place means nothing if it's prohibitively expensive for consumers to actually get them to be enforced in all but the largest disputes. Chargebacks are a tool that consumers can (and do) use to ensure that merchants adhere to these agreements. No individual is going to go to court with a merchant over a few hundred dollars on a disputed credit card charge. The consumer delegates this authority to the credit card company, who is more than happy to aggregate this risk across multiple customers, in exchange for a cut[0]. This is not a problem; it is the system working as intended!

I'm saying this both as a consumer and as a merchant who has gotten screwed over by one of the four (not two) major credit card companies[1] - chargebacks suck, but they provide an essential protection for consumers that the judicial system cannot.

(All of this is separate from fraud, which is a different matter entirely.)

> I forgot the last time I had to use a credit card (or paypal and their "consumer protection") in the last year, and my life both personal and business is easier and better for it.

I've had to make a few chargebacks in my life. The largest was for almost $2000. Even though the vendor was clearly in the wrong (and I had the written contract to prove it), it would have been way too expensive to actually try and get our money back through the judicial system. Fortunately, my credit card company was more than happy to settle the matter for us.

[0] The consumer doesn't pay for this service directly, but they do indirectly (which isn't fundamentally different from many other products and services, in which the actual cashflow is invisible to the end consumer - this can be problematic in its own right, but that's a separate matter of discussion).

[1] I have plenty of chargeback horror stories as a merchant, but that's the topic of another post. And that doesn't mean I don't see the value in chargebacks in general.


> First, in the US there are four companies, not two (or three, if you don't want to count Discover). And chargebacks aren't the reason that there are so few players - they're far from the biggest barrier to entry for an upstart, aspiring credit card provider.

Regardless of how many players there are, it's hard to deny that they behave like a cartel, which I think was the point of GP's use of duopoly.

I don't really see chargebacks as an anti-competitive practice, but I do see them as shifting the burden for their shockingly-bad security practices to merchants and consumers and focusing on ease of use (even for criminals) to increase the amount of credit card spending and profits for the payment networks. Europe has had chip and pin for decades now (it was already well established on my first trip there in 1998) and we're just getting it now after a ton of major breaches that should have been easily prevented. But merchants are forced to take credit cards because consumers love the convenience of paying that way and they're prevented from knowing the added cost that it imposes. That's where the cartel behavior comes into play...the policies that prevent merchants from advertising different prices for credit card transactions to reflect that added cost of accepting credit cards adds a silent ~5% tax onto everything we buy. Even for informed consumers, it creates tragedy of the commons situation because you'd be foolish to buy with cash when you can pay the same price and get 1% cash back.

All of this follows from the chargeback system that places all the burden for fraud on merchants. If the payment networks bore the burden for fraud out of their cut, we would have seen credible security features long ago. And somehow, when breaches like Target and Home Depot come to light, we blame those companies rather than the payment networks who should have been responsible for solving these issues many years ago.


> Europe has had chip and pin for decades now (it was already well established on my first trip there in 1998) and we're just getting it now after a ton of major breaches that should have been easily prevented.

There's a lot of misinformation about chip-and-pin (which is not surprising, because a lot of well-funded companies currently have a financial interest not to clarify the misinformation). This has been explained in more detail on the threads about the breaches by others who work on payment systems, but chip-and-pin would not actually have prevented several of the breaches that have happened recently in the US.

Furthermore, the main benefit to chip-and-pin has to do with the liability, not actual security. I'm not talking about the liability shift onto merchants who don't accept chip-and-pin; I'm talking about the situation in which fraud or suspected fraud occurs using a chip-and-pin system. In this case, though, the benefit is entirely for Mastercard/Visa/etc., and not for the consumer.


Mass use of credit cards must be an American thing, here in Europe we actually do have descent consumer friendly payment methods (beside cash) in most countries and also fairly efficient Small Claims Courts.

Visa/Mastercard must absolute hate the EU and its consumer friendly policies that actually focus on making lives easier and cheaper for people here.


Even going to a "fairly efficient" small claims court is infinitely less convenient than not going at all.

I think the consumer wins on this one.


The consumer doesn't win, the consumer pays 1-3% more for everything than they should for good/services and the merchants ALWAYS endsup being shafted which leads them to raise prices more to account for fraud and chargebacks.

The only who actually wins is the credit card cartel.


You've already decided that the increased costs associated with credit/debit cards aren't worth the increased protections and convenience you get as a consumer.

Personally, I find it much easier to be able to carry a credit or debit card rather than having to worry about carrying cash for everything. And knowing that I can get my money back pretty quickly if there's a breach or if a merchant doesn't provide the services they were supposed to is worth paying a bit more.


You know whats even better than having a wallet full of cash and credit cards (which can be stolen, cloned etc and having to spend hours on the phone trying to convince your bank that no you really didnt go on a trip to eastern europe paying for hookers with your card)

Having a phone with a Bitcoin app where I tap on the payment terminal and pay by confirming the amount and entering my pin.

Or scanning a Bitcoin QR code and paying online instead of typing long string of numbers, expiry codes, cvv etc etc and then going thru the anal probing that Verified by Visa or mastercard secure code is.


I kind of like the aspect of cash that it doesn't run out of battery life.


Because your wallet can be stolen, but not your phone?


Chargebacks remove all responsibility from the buyer. Perhaps we'd be better off if the consumer did have to put some thought into the quality of the goods and services they're purchasing and the vendor they're purchasing from? In particular I don't think chargebacks should be allowed for sales under (at least) $50. In many cases where the sum is below that amount, the chargeback fee and man-time cost asssociated with filing a dispute makes it an automatic loss of money for the vendor, even if he/she wins the dispute.


It's not like merchants are required to accept credit cards, or customers are required to use them. If you don't like using credit cards, don't. If you don't like merchants who accept them, patronize those who don't.

Of course, that last bit is pretty hard, but only because merchants have mostly decided that the cost and hassle of accepting credit cards is well worth it.


If you want to sell anything over the internet your choice is either credit cards (and wallets such as paypal build on credit cards) or bank transfer or bitcoin

Once the again the keyword here is "choice" Bitcoin gives yet another option for eCommerce at ultralow fees. and thats great.


Or money orders or mailing cash or checks or barter or....

My point is, you have a choice, so if you don't like how credit cards do things, don't use them.


The "choice" to accept credit cards is kind of like the "choice" to have adequate parking -- if you don't do it, no matter how good you are, you're not going to be able to compete (in most parts of the country). Consumers expect to be able to use cards these days, many people don't carry any cash anymore. Every typical storefront is expected to accept cards and your shop won't get traffic if you don't, just like it won't get traffic (again, in most parts of the country) if you expect your customers to park a mile away and walk.

This whole line of argument is kind of a red herring anyway. It's OK to discuss things we do or don't like about something without it becoming a "take it or leave it" situation. "Take it or leave it" is meant to shut down an discussion that the party pushing that line doesn't want to happen. I never asserted that the force of law compelled anyone to accept credit cards, so it should be obvious that it's "optional", right? Why can't we talk about the problems, real or perceived, with chargeoffs, mikeash?


I'm fine with discussing costs and benefits, but I draw the line when people start talking about limiting what other people are allowed to do. The moment you say "I don't think chargebacks should be allowed for" then my response is going to move to the "then don't use it" approach.

Back off from trying to stop people from using something a lot of them clearly like, and I'm happy to talk about the problems.

In any case, "take it or leave it" is a perfectly valid argument for things that aren't collective action problems. "Cars are destroying society" "so don't drive one" is a bad argument, because your individual choice doesn't make a noticeable difference. "Excessive parking hurts businesses" "so don't install excessive parking at your business" is a perfectly good argument, because you have the power to change your own circumstances there. (Ignoring, for a moment, the fact that it's common to have parking lot size dictated by local laws.) Using and accepting credit cards falls into the latter category: if credit cards hurt your business, don't accept them. That this will probably result in a failure of your business merely indicates that the benefits outweigh the costs. If you think the benefits could be preserved while reducing the costs, that would be interesting, but I don't think such a scheme would actually succeed, and not simply because the existing infrastructure is entrenched.


If the vendor has screwed me, why should it only count if it's above a certain amount?


Bitcoin exchanges are requiring more and more information to conform to money laundering regulations. In most countries Bitcoins are regulated either as currency, foreign currency or investment similar to stock. Some countries haven't quite made up their mind yet, but the real reason for the lack of comprehensive oversight is that it's so easy to operate a bitcoin business anonymously, escaping all regulation.


>If it were a responsible financial institution

Are you under the impression that it's an institution at all?

The whole reason Bitcoin is interesting is that it's not under the control of a company, group, or government.


>> The whole reason Bitcoin is interesting is that it's not under the control of a company, group, or government.

In reality it's under the control of the lead developers and the people that run the very few large mining pools. As shown by their collusion to fix blockchain forks etc etc.


>In reality it's under the control of the lead developers

Only because they've done nothing wrong (thus far). If there was any hint of foul play, they would be out.

The people that run the mining pools don't "control" bitcoin to any substantial degree. And, again, if they seriously abused their power, a trivial software fix would be to change the proof-of-work algorithm, instantly obsoleting the miners' equipment.


At the very least any action like that would create a huge schism and split the community and the currency.

I'm not trying to say that these actors have done anything bad, just the idea that it's not under control of a few central authorities isn't really grounded in observable fact...


While Bitcoin use is currently small the actual concept of a working "electronic cash" that negates the need for the credit card network with the use of cryptography and maths must be a serious threat to Visa/Mastercard since it provides yet another alternative to their duopoly when it comes to commerce. No wonder they do everything in their power to spread fud about bitcoin, seed doubt and make life difficult for cryptotechnology related startups. Some banks (especially in UK) are in a similar boat.

Somewhat how traditional car companies were schizophrenic when it came to electric cars and have done everything to kill them despite posing little threat being such a small market until Tesla came along at shown that electric cars are 1) better in many ways and 2) actually profitable


And yet, Mt. Gox.


What about Mt. Gox?


Thank you for these posts. We need to keep awareness of the issue as high as possible as it will become easier and easier for both the forces and liquidators to dilute the funds left for payout down to nothing over time.


What I take away from this is that despite a totally open and visible accounting system (the blockchain) it is still possible to hide transactions - no wonder we have been stuffed preventing tax evasion.


How do they know that those BTC went to exchanges? The probably can check which BTC went back to Mt Gox, but how do they know that a particular receiving address belonged to e.g. Bitcoinica?


One probable method would be to look at the addresses that other people used to deposit to an exchange. Many people make this public, for various reasons.

I assume the investigators would see a pattern of many small deposits being moved directly from those deposit addresses into the exchange's hot and cold wallets, which contained large amounts of money. That pattern could be recognized and the exchange's main wallets identified beyond reasonable doubt. Withdrawals from the exchange could also be tracked, I assume. Probably there is more sophisticated analysis of addresses clusters involved too.



Why hasn't Mt. Gox disclosed what they know about the attack?


Reportedly because the police is still investigating the case and publicizing everything could harm the (slim) chances of finding the criminals.


Something I find eye-catching is that from Jul-Oct 2011, just shortly after the proof of solvency, the expected BTC holdings double while the observed BTC holdings don't seem to move very much. If that was a random hacker attack it would be exceptionally good timing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: