Hacker News Reader

Comment by nikanj | Hacker News Reader

So far, it seems like a decent enough business idea to start an exchange, wait for the wallets to warm up nicely, then get "hacked".

View on HN

In the crypto space this practice is so common it has earned it's own name, the "exit scam"

It’s kind of difficult to do something with the bitcoins because it’s immediately visible.

The perks of being an exchange is you get access to many streams. Things are already broken up on little pieces for you. You act as a Tumblr

You can mix the stolen coins. Change them to many different coins, shuffle them around in and out of different tokens. In the end, move everything back to BTC and sell on localbitcoins in some offshore country like Hong Kong or Macau (and spread this around too not to raise suspicion, so travel around different countries and sell couple BTC on every stop, open local bank account, deposit money, rinse and repeat).

it's not actually that easy to open a local bank account everywhere is it

Is anyone seriously tracking where these "stolen" coins from these past several hacks are going?

This is like saying that open source software is more secure than closed source software because the code is public and auditable.

Sure it is auditable, but nobody is doing it. And then shellshock happens.

>Is anyone seriously tracking where these "stolen" coins from these past several hacks are going?

Yeah

https://youtu.be/l70iRcSxqzo

Tracking won't accomplish much, they run transactions through mixers/tumblers, and you quickly lose track.

Here's the money from the NiceHash hack two weeks ago (or "hack") getting moved out, in plain sight:

https://bitinfocharts.com/bitcoin/address/1EnJHhq8Jq8vDuZA5a...

You can kinda see what's happening (how it's being laundered) but you can't pin it on a given entity or idividual, unless they make a mistake.

It's not visible at all, because you can sell coins which never existed because exchange transactions don't happen on the blockchain.

You start off selling maybe 100 bitcoins which you've 'created', so the value of bitcoins on your exchange is 100 higher than in your 'wallet'. No-one can audit that and no one will notice because it's a tiny amount compared to the total volume. The more you do this, the more popular your exchange looks and the more you can repeat it and get away with it.

Eventually you be holding only a tiny fraction of the exchange book in actual bitcoin having cashed out 90% of it generating large amounts of money for yourself in the process.

If it ever looks like there's a run and you can't provide people with their bitcoin you claim "hack".

By the time you exit scam and claim "hack" the missing coins are gone but really they didn't exist so there's nothing to trace.

If you’re willing to go this far then it is just a plain pyramid scheme, that doesn’t really have anything to do with cryptocurrency.

Yup. The past decade has been geeks who think they're smarter than everyone else slowly re-discovering the reason why financial regulations exist.

There's an xkcd for this, isn't there? https://xkcd.com/1831/

I'm not sure I understood correctly. Could you elaborate?

Wouldn't selling created bitcoin lower the price of bitcoin at your exchange? A lower price would attract USD and the exchange would leak BTC with people doing arbitrage.

Then if you claim a hack wouldn't you have to show that value moved to the hackers wallets and that value and the value you retain had to add up to the total value received in BTC? And if the "stolen" amount of BTC couldn't be shown to be in another wallet, wouldn't the fraud be discovered?

I think the parent comment was referencing "wash trades", where you trade between your own accounts to create an illusion of active trading (or movement up or down - whatever your objective may be).

Currently this is very easy to do. Such trades are local to the exchange, so they don't register on the blockchain. If you execute them as "maker" (limit) orders, there aren't any fees either. So you can fake significant market activity for free.

Re: "When you buying Bitcoins they go to your wallet and you can verify the transaction on blockchain.info."

Not necessarily. For example you can trade on GDAX (between ETH/BTC/LTC/USD) without hitting the blockchain. Once you "withdraw" your purchase and deposit it into "your" (because it's not really your wallet) wallet on Coinbase, then maybe.

Many of these "internal" exchange transactions are only reflected in their internal DB and not public blockchain.

This is a scam and a stupid one too. Each exchange creates a new wallet for you when you sign up. When you buying Bitcoins they go to your wallet and you can verify the transaction on blockchain.info. Remember that the blockchain is public!

An exchange who works like a normal eWallet, so your money are stored in their database only, is seriously suspicious. I understand there are people who will fall for these scams, but there are scammed people everywhere in the world.

Also, a serious bitcoin trader/buyer should always have the bulk of his Bitcoins on a personal wallet not on an exchange.

Transferring Bitcoin to an internal customer wallet on the public blockchain would be extremely expensive. Transaction fees are still north of $10 last I checked! So most every exchange combines wallets, and I don't think this will change anytime soon.

It's the most common form of scam. The owner of the exchange leaves with the money.

That's why exchanges are regulated. Step one of the regulation is getting the identity of all the owners. Step two is having servers and backups on regulated soils so you can seize everything at any time and reconstruct the ledgers.

> crypto space

Sorry, but this is so bloody annoying that I have to tell you:

"crypto" = cryptography (stuff like symmetric/asymmetric encryption, hashing, etc.)

"crypto currency" = useless shit like bitcoin

So I think you meant "exit scams" in the crypto currency space.

One of the most important features that still makes the human brain superior to a machine is its innate ability to use context to discern meaning.

In fact, one would need context to conclude that "crypto" refers to cryptography, and not something else like cryptozoology or cryptofascism. There's also probably at least one legitimate metal band with "crypto" in their name.

Reply on news.ycombinator.com