A 96 Bitcoin ransom payment ends up on Bitfinex • Hacker News Board

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#91

Post by Canada » Wed, Jan 29, 2020, 11:27 PM UTC

GBiT wrote: post #70

I think this year we will see the first international orders to miners do not process some addresses and freeze that coins. I know a lot of here thinks, that it's not possible, but bitcoin has only a few big miners. And if they will get orders they will have to comply or fight it in courts. It's not possible to mine anonymously, because you need hundreds of millions to invest into miners and a lot of power.

Unidentified parties mine blocks all the time, so it's doubtful that blacklists sent to the well known pools would be effective. Are they just supposed to orphan mined blocks that contain blacklisted inputs or outputs? How can anyone reasonably be expected to comply with a demand to fork Bitcoin?

Surely any pool that adopted such a policy would lose most of their members pretty quick. Same for any pool that leaves money on the table by deliberately excluding valid, profitable transactions.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#92

Post by lolc » Thu, Jan 30, 2020, 12:06 AM UTC

nybble41 wrote: post #80

nradov wrote: post #69

Earlier quoted context omitted.

Yes wrecking trust in cryptocurrencies would be an excellent outcome for everyone. And there is no true anonymity (never has been).

"Forcing an innocent to hand over bitcoins they had no clue they were tainted" shouldn't wreck trust in cryptocurrencies, but rather in the organization unjustly harming those innocents—i.e. the government. If anything the fact that they had to track down each individual recipient and force them to transfer the funds, rather than simply pressuring some bank or other intermediary, ought to increase trust in cryptocurr…

The "but I didn't know" excuse of innocence is not universal. In some cases one is required to do due diligence or risk catching some of the guilt in one's trades. Whether Bitcoin traders should be held responsible for the provenance of their coins is an interesting question. It really comes down to whether we want to protect Bitcoin as a payment system. And few people even care so it's not looking good.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#93

Post by Canada » Thu, Jan 30, 2020, 12:17 AM UTC

zelon88 wrote: post #78

Canada wrote: post #45

There already is such tracking going on, exchanges do freeze balances sometimes. The problem is that if the stolen coin gets traded before exchanges can freeze them you wind up with a lot of innocent people holding those coins and it's not practical to freeze those later. Consider these two scenarios: A stolen bike vs a stolen sack of coffee. In the case of the bike, if you can find it you can take it back from someo…

Your coffee bean analogy isn't sound. If someone steals a 50lb bag of beans and sells them to me, I am now in possession of 50lbs of stolen property. If I sell 25lbs of the beans before the police catch me, they will confiscate the remaining 25lbs of beans and those beans become evidence. Then I will go to jail for receiving stolen property. Then the victim will sue me in civil court for reimbursement of 50lbs of bea…

Let me put this another way.

Please remember that for the purpose of this discussion the receiver of the stolen goods and the person they are sold onward to are 100% innocent and nobody suspects them of being dishonest. If the receiver was in on it then this does not apply.

If someone stole 2 iPhones from you and sells them to a used phone dealer, who then sells those very 2 iPhones - your iPhones - to someone else, does the law require the used phone dealer to give you 2 other iPhones of the same model that he happens to have?

I believe, and perhaps I am wrong here, that it does not. As the victim you may well be happy to made whole with 2 other identical iPhones but that is not what will happen. Furthermore, the used phone dealer will not be required to pay you any of the money he received from the buyer of your phones or reimburse you for the cost of your phones.

If the dealer had sold only 1 of the phones then you would get that back and not have to compensate the dealer for his loss resulting in paying the thief.

If the items were such that you cannot prove you own it, such as with coffee beans, then you get absolutely nothing. You do not get some fair volume of them to compensate you.

That is how I understand the way stolen property is handled in general currently. I am not attempting to pass a moral judgement about it, merely describe how it is. (may not be so in all jurisdictions, but in CA/US/UK/AU/at least some parts of SE Asia)

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#94

Post by nybble41 » Thu, Jan 30, 2020, 12:23 AM UTC

lolc wrote: post #92

nybble41 wrote: post #80

Earlier quoted context omitted.

"Forcing an innocent to hand over bitcoins they had no clue they were tainted" shouldn't wreck trust in cryptocurrencies, but rather in the organization unjustly harming those innocents—i.e. the government. If anything the fact that they had to track down each individual recipient and force them to transfer the funds, rather than simply pressuring some bank or other intermediary, ought to increase trust in cryptocurr…

The "but I didn't know" excuse of innocence is not universal. In some cases one is required to do due diligence or risk catching some of the guilt in one's trades. Whether Bitcoin traders should be held responsible for the provenance of their coins is an interesting question. It really comes down to whether we want to protect Bitcoin as a payment system. And few people even care so it's not looking good.

Due diligence is not sufficient in the interesting cases. If exchanges instituted a blacklist of known ransom payments, for example, ransomware authors would just wait until the coins have been changed into some other untraceable form before releasing their hostages. Blacklisting the transaction in time to do any good would be the same as not paying the ransom. Reporting the address after the fact can only harm innocents several stages removed from the ransomers who could not possibly have known that the transaction was tainted.

The only reasonable solution is to track down the actual ransomers and make them pay for the damage they caused. Dragging other parties into this can only make things worse.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#95

Post by derefr » Thu, Jan 30, 2020, 12:37 AM UTC

wmf wrote: post #68

derefr wrote: post #36

Earlier quoted context omitted.

Many upstanding people—and even large companies like payment processors!—process their received funds through a mixer “just to be safe”, i.e. to escape any coincidental untoward paper-trail that attaches to their funds two or three steps back. You know how they say that every US dollar bill has a little cocaine on it? Using your suggestion, every dollar bill would be marked tainted as drug proceeds.

That's as dumb as laundering clean money “just to be safe” or covering up a crime you didn't commit “just to be safe” (hey Reiser). If your coins are clean, mixers make them dirtier and this has been known all along.

If you're e.g. a retailer, you can maybe know your coins are clean one step out, but you can't know if they're clean for their whole traceable history without standing up a fancy Network Analysis OLAP cluster and hitting it with some really high-cost queries.

Let me put it this way: what would you do with your float if you run a convenience store in a bad part of town, and know that there are marked bills floating around in the local economy, and that the police might pop in at random one day and take them out of your till? Well, you'd probably deposit your float in your local bank at the end of each day, and then get new, guaranteed-unmarked bills from the bank. That's mixing! It's not money laundering, just mixing. You're removing the potential liability of being blamed for what your customers' employers' customers' employers did.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#96

Post by lolc » Thu, Jan 30, 2020, 12:45 AM UTC

nybble41 wrote: post #94

lolc wrote: post #92

Earlier quoted context omitted.

The "but I didn't know" excuse of innocence is not universal. In some cases one is required to do due diligence or risk catching some of the guilt in one's trades. Whether Bitcoin traders should be held responsible for the provenance of their coins is an interesting question. It really comes down to whether we want to protect Bitcoin as a payment system. And few people even care so it's not looking good.

Due diligence is not sufficient in the interesting cases. If exchanges instituted a blacklist of known ransom payments, for example, ransomware authors would just wait until the coins have been changed into some other untraceable form before releasing their hostages. Blacklisting the transaction in time to do any good would be the same as not paying the ransom. Reporting the address after the fact can only harm innoc…

Making the receiving parties intent in covering losses can help a lot during discovery. Dragging "innocents" into it might just get us to a system that makes it hard for extortionists. And that system might not look like the Bitcoin we know.

You can argue that we should suffer the extortionists for other benefits we get out of Bitcoin. I'm not convinced at this point.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#97

Post by Waterluvian » Thu, Jan 30, 2020, 12:46 AM UTC

Canada wrote: post #45

There already is such tracking going on, exchanges do freeze balances sometimes. The problem is that if the stolen coin gets traded before exchanges can freeze them you wind up with a lot of innocent people holding those coins and it's not practical to freeze those later. Consider these two scenarios: A stolen bike vs a stolen sack of coffee. In the case of the bike, if you can find it you can take it back from someo…

> The problem is that if the stolen coin gets traded before exchanges can freeze them you wind up with a lot of innocent people holding those coins and it's not practical to freeze those later.

Isn't this fundamentally _not_ how it works in the traditional financial world? If you are paid in ill-gotten money it can certainly be clawed back no matter how innocent you are.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#98

Post by Canada » Thu, Jan 30, 2020, 1:24 AM UTC

rahimnathwani wrote: post #79

Canada wrote: post #45

There already is such tracking going on, exchanges do freeze balances sometimes. The problem is that if the stolen coin gets traded before exchanges can freeze them you wind up with a lot of innocent people holding those coins and it's not practical to freeze those later. Consider these two scenarios: A stolen bike vs a stolen sack of coffee. In the case of the bike, if you can find it you can take it back from someo…

You said "Bitcoin works like the coffee example not the bike." after "Now you can't identify your distinct stolen coffee anymore." But you can identify distinct stolen/tainted Bitcoin. Just like you can identify distinct stolen banknotes. The difference (according to the article) is that banknotes have special legal status meaning that they're effectively fungible after being spent.

Only after the coffee goes in the big container full of lots of other coffee is it rendered unidentifiable. If the coffee vendor didn't pour the stolen bag of beans into the rest of it then it's still clearly identifiable.

Bitcoins are not quite like the a banknote. If I have a $1 and $20 bill that's 2 things each with a serial number. I can give them to you, and you can give them back to me. Bitcoins on the other hand don't work that way. The movement of them changes them, even though you can trace the flow of the value represented.

Let's say someone steals your 1 bitcoins, sending 0.999998 bitcoins to himself, leaving 0.000002 bitcoins for the miner who confirms the transaction. Then the thief sends 0.999996 bitcoins to someone totally innocent in exchange for a car, leaving another 200 satoshi for that miner.

You find the person who sold that car for those bitcoins and he still controls that balance. Are you entitled to get those bitcoins back?

Well, say the car seller had no other bitcoin. One argument would be that he still has 0.999996 of your bitcoins, so he's obligated to give your property back and he needs to figure out how to collect for the car, tough luck for him. The fact that he doesn't have it all is no different than if his car was stolen and he found just missing a couple of hubcaps.

Another argument could be that no, your bitcoins were the UTXO that you could solve the unlock script for, which you still can, so it's like the car seller had received an item that your bitcoins were exchanged for (new script). I don't think most people would have much sympathy for this argument.

But what if your coins were only 1 input into the transaction sent to the car seller, and then the car seller spent half of on his rent, receiving back the balance to his change address?

Now we've arrived at coffee beans. Even though you can know the balances, you cannot say whether your bitcoins are in the possession of the car seller or his landlord. It makes no sense to say that each of them has half, nor does it make any sense to claim that one or the other has your stolen property.

So assuming bitcoins do not have the special money status and stolen bitcoins are going to be treated like other stolen property is then they are like the coffee beans in that they become unidentifiable without anyone trying to be dishonest.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#99

Post by wolco » Thu, Jan 30, 2020, 1:40 AM UTC

Canada wrote: post #93

zelon88 wrote: post #78

Earlier quoted context omitted.

Your coffee bean analogy isn't sound. If someone steals a 50lb bag of beans and sells them to me, I am now in possession of 50lbs of stolen property. If I sell 25lbs of the beans before the police catch me, they will confiscate the remaining 25lbs of beans and those beans become evidence. Then I will go to jail for receiving stolen property. Then the victim will sue me in civil court for reimbursement of 50lbs of bea…

Let me put this another way. Please remember that for the purpose of this discussion the receiver of the stolen goods and the person they are sold onward to are 100% innocent and nobody suspects them of being dishonest. If the receiver was in on it then this does not apply. If someone stole 2 iPhones from you and sells them to a used phone dealer, who then sells those very 2 iPhones - your iPhones - to someone else,…

Someone steals your phone. You can sue that someone for the value of lost property if caught or if the police recover money.

If he sells down the line. Police will follow the chain and if the property is found it will be taken and it will be used in trial and recovered back to you.

The people who bought the used phones may lose them. If they do they can sue the store. If the store hasn't sold them they will lose them and can sue the orginal thief.

Re: A 96 Bitcoin ransom payment ends up on Bitfinex

#100

Post by Blake_Emigro » Thu, Jan 30, 2020, 3:42 AM UTC

wolco wrote: post #99

Canada wrote: post #93

Earlier quoted context omitted.

Let me put this another way. Please remember that for the purpose of this discussion the receiver of the stolen goods and the person they are sold onward to are 100% innocent and nobody suspects them of being dishonest. If the receiver was in on it then this does not apply. If someone stole 2 iPhones from you and sells them to a used phone dealer, who then sells those very 2 iPhones - your iPhones - to someone else,…

Someone steals your phone. You can sue that someone for the value of lost property if caught or if the police recover money. If he sells down the line. Police will follow the chain and if the property is found it will be taken and it will be used in trial and recovered back to you. The people who bought the used phones may lose them. If they do they can sue the store. If the store hasn't sold them they will lose them…

Pawn shops hold the goods they purchased for 30 days to give time for someone to make a claim against them as property that was stolen from them. (This is my experience in Canada anyway.) In theory, exchanges could do the same thing for deposits above a certain amount, but this would presumably hurt their business the way things work right now.