Immutability FTW!

There's an apparently apocryphal story that when Willie Sutton, the notorious bank robber of the 1930s  to 1950s, was asked why he robbed banks, he answered:

Because that's where the money is!

Today's Willie Suttons don't need a disguise or an (unloaded) Thompson submachine gun, because they rob cryptocurrency exchanges. As David Gerard writes:

Crypto exchange hacks are incredibly rare, and only happen every month or so.

Yesterday Bloomberg reported:

Binance, one of the world’s largest cryptocurrency exchanges, said hackers withdrew 7,000 Bitcoins worth about $40 million via a single transaction in a “large scale security breach,” the latest in a long line of thefts in the digital currency space.

Below the fold, a few thoughts:

BTC-USD on Coinbase 5/8/19

First, "7,000 Bitcoins worth about $40 million" implies 1BTC ≅ $5,700. Just before the news 1BTC ≅ $5,900 on Coinbase, an exchange where it is possible to sell BTC for USD, On the news it dropped to $5,700 before recovering to around $5,800.

But in order to allow customers to withdraw USD, Coinbase conforms to the Know Your Customer/Anti-Money-Laundering laws. So it is unlikely that the perpetrators could use any of the BTC-USD exchanges to turn their ill-gotten BTC into USD. They would have to use a less scrupulous exchange, which means they'd end up with USDT (Tether) not USD.

Since the New York State Attorney General sued Bitfinex, the exchange that sponsors Tether, and revealed an $850M hole in Tether's reserve, Tether was forced to admit that it was not backed 100% by USD. They now claim only 74%, but there has never been an independent audit to confirm their USD holdings. Despite this, the USDT-USD rate has held up well although customers are fleeing Bitfinex. Because USDT is so central to cryptocurrency trading, it has become too big to fail. But the converse of this is that if it does fail, the whole house of cards collapses.

Even assuming the perpetrators could trade their BTC for USD, what effect would selling 7,000BTC have on the price? Cryptocurrency markets are heavily manipulated; around 95% of all cryptocurrency trades are fake. Apart from the fake trades, the markets are not very liquid, as the Mt. Gox bankruptcy trustee found out:

An upset Mt. Gox creditor analyses the data from the bankruptcy trustee’s sale of bitcoins. He thinks he’s demonstrated incompetent dumping by the trustee — but actually shows that a “market cap” made of 18 million BTC can be crashed by selling 60,000 BTC, over months, at market prices, which suggests there is no market.

So the stolen 7,000 BTC are in practice unlikely to end up worth anything close to $40M. Still good for the perpetrators, but not so good for the journalists reporting on the theft.

Second, the initial response from the CEO of Binance is revealing:

In the wake of a multimillion-dollar hack Tuesday, Changpeng Zhao, the CEO of cryptocurrency exchange startup Binance publicly discussed whether the company might seek to encourage bitcoin miners and node operators to “rollback” the bitcoin blockchain, reversing transactions confirmed by the network to return the funds. ... Zhao said:

“To be honest, we can actually do this probably within the next few days. But there are concerns that if we do a rollback on the bitcoin network at that scale, it may have some negative consequences, in terms of destroying the credibility for bitcoin.”

Mining Pools 05/08/19

Zhao is right that Binance could have paid for a rollback. They would only have to have persuaded 4 mining pools to do it. 7,000 BTC is the reward for nearly 4 days of mining, so they would have had a lot of BTC to do the persuasion with.

The whole point of the blockchain technology underlying cryptocurrencies is to implement an "immutable public ledger", and thus make transactions irreversible. But, as we saw with the great DAO heist, the first reaction to a major theft is to consider a "hard fork" to reverse the transaction. Because immutability is for the little guys, not for us:

• Immutability of blockchain ledgers is sold as being enforced by the technology, but as we see it is really enforced socially.
• Ifa ledger is really immutable it is a "be careful what you wish for" thing, because in the real world it works well until it doesn't.

Binance have suspended withdrawals, but have promised to make good customer losses. However, as David Gerard reports, there is much less to this promise than meets the eye:

Binance has reassured customers that their SAFU insurance fund fully covers the loss, and customers will not be out anything.

The SAFU fund was created after July 2018 irregularities on the exchange involving Syscoin, a minor altcoin. SAFU contains only Binance’s own BNB on-exchange token — and the July 2018 compensation to affected traders was paid out in BNB.
...
That’s at least 188,000 bitcoins that can’t be sold on real markets for a week. The Bitcoin price on Binance is likely to diverge wildly from the prices on exchanges still open to withdrawals.

Binance itself — and insiders — would be able to move their coins off just fine. The price differences would create remarkable arbitrage opportunities, and ability to capture what liquidity exists in the markets — for those privileged few who can still deposit and withdraw.

The transaction that removed the 7,000 BTC was confirmed with 7.5 BTC, or about 0.1% of its value. Recent game-theoretic analysis suggests that there are strong economic limits to the security of cryptocurrency-based blockchains. For safety, the total value of transactions in a block needs to be less than the value of the block reward. Which kind of spoils the whole idea, doesn't it?