Hacker News Reader

Hacker News

Comment by panarky | Hacker News Reader

Parent Full thread

panarky

In 2011 a new Bitcoin exchange called Bitcoinica launched.

I deposited 100 BTC to test it out.

First thing I did was to try to withdraw negative 100 BTC.

It sent me 100 BTC, but instead of a zero balance in the exchange, it said I now had 200 BTC.

So then I withdrew a negative 200 BTC, and it sent me 200 BTC and increased my exchange balance to 400 BTC.

I contacted the owner and returned the funds and he sent me a 100 BTC bug bounty.

Was entering a negative number in a web form "hacking"? Should that be illegal?

View on HN

> Was entering a negative number in a web form "hacking"? Should that be illegal?

Many hacking laws were drafted in the 80s and are exceptionally broad. What you did was almost certainly illegal hacking, as the laws define it.

Of course, whether the victims would care to complain; and whether they could get the police to take them seriously; and whether they can find you; and whether you and they are in the same jurisdiction; are other matters. I certainly wouldn't recommend you rely on the CFAA to protect you from ransomware gangs.

$4 million bug bounty! Eclipses anything here... https://www.pcmag.com/news/7-huge-bug-bounty-payouts

In 2011, so the value of BTC at the time was between $1 and $32.

I dunno whether it would be considered hacking, fraud, or plain old theft, but if you hadn't returned the BTC, this would be a clear example of exploiting a bug for financial gain. if nothing else, the operator should have some legal recourse to get their money back. if it can be shown that you did it deliberately, I don't think it would be unreasonable to consider it a criminal offense.

of course, this is not quite the same as misunderstanding some subtleties in an explicit contract. for example, the mere fact that I did not understand an auto-renewal clause in a lease does not get me off the hook for payment. although I might have some recourse if the lease stipulates something absurd (eg, notice to vacate must be hand-delivered to office in antarctica).

crypto does not necessarily mean you get to do a complete end run around the laws of sovereign nations. what it might mean, if designed well, is that you don't have to depend on those nations enforcing things.

Yes, but the point of a digital contract is that everything doesn't hinge on proof of a meeting of the minds. If lawyers and the digital contract can now be so far apart that one says you get the money and the other says you get jail time that isn't an improvement over local law.

They need to go back and wrap all this stuff in actual legal boiler plate to have a meeting of the minds limiting what any individual digital contract can mean, if anything, rather than pretending this is orthogonal when it clearly is not.

You were exploiting a bug, an egregious one, and I don't think any reasonable person would think that behavior was the intent of the service provider. In other words, "the code let me do it" isn't going to fly in court.

To your original question, entering a negative amount in a web form should not be illegal. That's silly. But you're responsible for the effects and what you do after noticing the odd behavior. If an ATM machine vends me an extra $20 because the bills were stuck together, I should return the extra $20.

Reply on news.ycombinator.com