Tokyo-based cryptocurrency exchange hacked, losing $530M: NHK

I think you definitively could make something like Keybase on Bitcoin, by using multiple third-party institutions (chosen by the user) as a fallback.

When sending coins to your storage address, you'd say "anyone can use this money if they have this private key OR if they get a digitally-signed certificate from 3 out of 4 of these keys (A, B, C, D)". Those keys could belong to different institutions (or persons) that would declare they vouch for your identity.

Then if you lost your key, you'd go to each of them to get your certificate signed and could then use the coins again.

--

Of course, this means that if those institutions colluded, or all got hacked, you could still lose your coins, but it'd be harder than just keeping them in an exchange.

Oh, they're certainly getting some.

The suspicion is they're siphoning it off to their personal accounts, and that they're claiming to have received way more USD than they actually have so they can issue USDT that aren't actually backed to manipulate the market.

So if they're tracking the coins to ensure they're not sold, and assuming it's never sold, wouldn't that mean the price of XEM should increase, as the supply has now decreased?

Perhaps I am misunderstanding how tracking coins typically happens, but if "tainting" the coins effectively prohibits the actors from withdrawing at their perceived value, how would this work if the actor decided to send the vast majority coins to many random, arbitrary accounts? (e.g. arbitrarily sending coins to everyone who has committed a trade on some exchange in the last X days.) Would enough information be known to allow an actor to enumerate arbitrary public addresses thus use this to attempt to hide in the crowd?

Do you have M friends, of which you're certain at most N-1 would collaborate to steal from you and/or get hacked? In that case, you can do secure password recovery.

Shamir's secret sharing algorithm can be applied over many groups other than GF(2^N). In particular, you can generate a polynomial of degree N where F(0) is your ECDSA private key, and for 1 You can even have N parties each generate their own secret random polynomial f of degree N, and publicly share f(0)*G and privately share f(x) with party x. You add up all of the publicly shared elliptic curve points to get a public key for which no one party knows the secret key. Each party remembers the sum of the f(x) secrets they've been told. For polynomials, f(x) + g(x) + h(x) = (g+g+h)(x), so any N of the participants can collaborate to calculate the previously unknown polynomial for which f(0) is the private key. You need to first share Pedersen commitments of the public f(0)G values, perform a sanity check on those, and then reveal the f(0)G values and perform some more sanity checks in order to rule out cheating. See https://duckduckgo.com/?q=gennaro+distributed+key+generation

Once you have your public key for which nobody knows the private key, you can perform the same procedure to generate the random R value of the (R,S) pair of a Schnorr signature. Each party can then perform a Schnorr signature on H using their secret share of R and their secret share of the public key. They each reveal their signatures, and any N of those signatures can be used to reconstruct a polynomial where F(0) is the S value in the (R,S) signature on H. At the end, all of the sub-signatures and the final signature can be made public without anyone learning anything about the secret values. This is called a threshold signature scheme. (There are other threshold signature schemes. I had to implement threshold RSA in Rivest's 6.857 class.)

Unfortunately, ECDSA isn't a Schnorr signature scheme, but Ed25519 is. Any coin built using Schnorr signatures for wallets would allow you to construct threshold wallets where any N of M parties can collaborate to spend from the wallet, but generating transactions doesn't leak information to anyone about how to generate transactions alone.