Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bad code may be to blame for $500M of cryptocurrency losses in seven months

topbitcoin.lv

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#31

Post by zzbzq »

zaroth wrote: post #23

Consider this: Every single Bitcoin mined has either been lost/stolen, or will be lost/stolen, with probability approaching 1 over increasing timespans. I’d argue that since January 2009 about 50% of the ~17M coins minted to-date are lost. But the realization that this number will asymptotically approach 100% of all coins is a bit striking. The reasoning is simple - maintaining control of your coins is surprisingly d…

Seems like sort of a theoretical argument, so I have to point out that I believe it's theoretically wrong. Caveat that I'm not a blockchain programmer so somebody may be able to correct me here, but I believe it's true. Bitcoin aren't individually identifiable, the "state" of ownership in the chain is stored as "unspent transactions." Meaning, once stolen are mixed with un-stolen, you can't differentiate them.

Obviously, the next step is we can reformulate your statement to say that the total number of Bitcoin lost or stolen will eclipse the total supply, given enough time. However, since the total supply is fixed, and time is not, that's not a very profound revelation.

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#32

Post by ifdefdebug »

SamPatt wrote: post #26
zaroth wrote: post #23

Consider this: Every single Bitcoin mined has either been lost/stolen, or will be lost/stolen, with probability approaching 1 over increasing timespans. I’d argue that since January 2009 about 50% of the ~17M coins minted to-date are lost. But the realization that this number will asymptotically approach 100% of all coins is a bit striking. The reasoning is simple - maintaining control of your coins is surprisingly d…

I've been using cryptocurrency for over five years and haven't lost as much as a satoshi. It's no more difficult than keeping other sensitive data secure.

The argument still holds. As long as there is a tiny probability for you or someone else to lose their private keys, and I don't see how that probability can be reduced to zero, bitcoin supply will approach zero over time.

And I don't think we are talking about some theoretical astronomical time span here - after a few hundred years (assuming in a few hundred years someone still cares about the bitcoin ledger), the proportion of lost coins must be huge - just think about people passing away without providing a way for their heirs to find the keys, maybe because they die young or because they have no heirs etc.

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#34

Post by boobsbr »

nobrains wrote: post #33

If a coin is stolen, it is still in circulation. No affect on the holders of that cryptocurrency. If a coin is lost, it is out of circulation, and the net effect is that it is distributed to all the remaining holders of that cryptocurrency.

> If a coin is lost, it is out of circulation, and the net effect is that it is distributed to all the remaining holders of that cryptocurrency.

Meaning the value of the remaining coins increases a tiny bit because supply was reduced?

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#35

Post by jerf »

s_dev wrote: post #28

I've lost .38 Eth because of the Mist wallet on macOS. Seems they've a password issue where the password is always wrong even if you wrote it down at the time of setup. The suggested solution on the GitHub issues is to use a brute force attack using a python script. Such an issue just screams poor testing.

Is it this script? https://github.com/burjorjee/pyethrecover

That is atrociously bad. It appears to use a pure-python implemention of AES (!!!) [1]. Holy cow. This is going to be miserably slow. Using all the CPUs isn't going to help when it's going to be literally tens of thousands of times slower than better techniques.

You will literally have time to learn hashcat [2] from scratch, learn how to implement the plugin, test the plugin with some sample passwords, and run it yourself, and still save time over running the Python script, because even if you leave the Python script running during the entire, say, week you spend learning all this, the hashcat script will still outrun Python in the first minute or so, by my somewhat conservative estimate that it will run 10,000x faster. (I wouldn't consider 100,000x out of reach. Depends on your GPU. But hashcat will still be faster even just on the CPU alone.)

(Also hashcat shows some ethereum support, but neither of the two things it says say "aes". I don't know whether hashcat would support this out of the box, I'm just saying that you literally have time to implement this from scratch and still be faster than running that Python script.)

(I also want to be clear that this isn't GPU fanboying. It can't be, because I'm not one. GPU computing is very often oversold. But this is legitimately one of those cases where GPUs can smoke CPUs by multiple factors of magnitude.)

[1] https://github.com/burjorjee/pyethrecover/blob/master/aes.py

[2] https://hashcat.net/hashcat/

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#36

Post by notahacker »

nobrains wrote: post #33

If a coin is stolen, it is still in circulation. No affect on the holders of that cryptocurrency. If a coin is lost, it is out of circulation, and the net effect is that it is distributed to all the remaining holders of that cryptocurrency.

Both of those assume that desire to acquire a cryptocurrency is unaffected by trust in its exchange infrastructure and the integrity of others parties offering to make payments in that cryptocurrency. That doesn't seem like a reasonable assumption to make.

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#37

Post by wereHamster »

zaroth wrote: post #23

Consider this: Every single Bitcoin mined has either been lost/stolen, or will be lost/stolen, with probability approaching 1 over increasing timespans. I’d argue that since January 2009 about 50% of the ~17M coins minted to-date are lost. But the realization that this number will asymptotically approach 100% of all coins is a bit striking. The reasoning is simple - maintaining control of your coins is surprisingly d…

Backing your coins up is very easy, most wallets support BIP32/39/44. Just write the mnemonic down and put it under your mattress. Or a safe if you have one. But seriously, for most people under the mattress is equally safe. I don't understand why anyone would keep a non-trivial amount of coins in a wallet and not have a backup. That's irresponsible.

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#38

Post by Retric »

wereHamster wrote: post #37
zaroth wrote: post #23

Consider this: Every single Bitcoin mined has either been lost/stolen, or will be lost/stolen, with probability approaching 1 over increasing timespans. I’d argue that since January 2009 about 50% of the ~17M coins minted to-date are lost. But the realization that this number will asymptotically approach 100% of all coins is a bit striking. The reasoning is simple - maintaining control of your coins is surprisingly d…

Backing your coins up is very easy, most wallets support BIP32/39/44. Just write the mnemonic down and put it under your mattress. Or a safe if you have one. But seriously, for most people under the mattress is equally safe. I don't understand why anyone would keep a non-trivial amount of coins in a wallet and not have a backup. That's irresponsible.

As the parent pointed out, that increases the risk of theft.

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#39

Post by dawhizkid »

zaroth wrote: post #23

Consider this: Every single Bitcoin mined has either been lost/stolen, or will be lost/stolen, with probability approaching 1 over increasing timespans. I’d argue that since January 2009 about 50% of the ~17M coins minted to-date are lost. But the realization that this number will asymptotically approach 100% of all coins is a bit striking. The reasoning is simple - maintaining control of your coins is surprisingly d…

Curious how that factor into the price of BTC?

Re: Bad code may be to blame for $500M of cryptocurrency losses in seven months

#40

Post by Retric »

tlrobinson wrote: post #15

On the flip side, the combined market cap* of all cryptocurrencies has increase approximately $400B in the last year. * Yes, I know market cap is a poor metric, but it’s equivalently bad to the $500M “lost” metric used here.

That's assuming the total number of coins still exists. I would not be surprised if 20% of all bitcoins have already been lost.

EX: Satoshi's coins could all have been lost at this point.

Post reply on HN