This is how banking regulations happened, once enough people lost their money, the law had to step in.
Technically crypto corporations are already regulated the same way banks and financial businesses are. It's just that most of these exchanges exist outside US jurisdiction, and will often not accept US customers.
Experts disagree on how to do security. For instance, there’s still some people who insist that complex password rules are a genius idea that makes the world far safer, yet they’re unambiguously bad for security because they knowingly decrease the number of possible password combinations.
Whose idea of best practices wins? I’d hate that the decision now becomes a dictate by some bureaucracy that likely barely knows what the hell is going on.
But my bank still does 2 Factor Authentication only through SMS and doesn’t even offer some kind of Authentication App as an option.
Additionally they have strict password rules in place, a basically broken password reset form, and a comically short maximum password limit.
Color me not impressed with whatever rules do exist.
You have regulations like CPI on how to store credit card credentials, transaction history, and audit logging.
You have regulations on physical access and who's allowes to touch production.
There's enormous amounts of regulation on auditing and software that's permitted to generate bank transactions.
Having worked in the space I am definitely impressed; it's taken very seriously, there are real, concrete consequences for not taking is seriously, and you generally don't see retail banks failing because someone messed around with ACH transactions, for example.
And we're not talking about outdated user-facing login authentication procedures, we're talking about securing the back-end.
When is the last time your bank had $150 million stolen?
A cyber-criminal organization who wants to rob some big player like Goldman Sachs, BlackRock, or Citibank of 9+ figures probably knows that they're going to have a devil of a time getting away with any big-time theft. The US government is actually going to go after anybody who tries to pull money out of big banks accounts to the point that they might even be willing to go to war in the right circumstance. If you're a cyber criminal, even if you could hack into some big bank systems and force a transfer, how would you get away with the cash in most cases? If they really target you with their full weight, you're probably completely screwed.
In comparison, random Crypto Financial Agents are on many power-players "Naughty List". Depending on the exact circumstances of some crypto-robbery, the full weight of the US Government probably isn't going to be deployed against some cyber criminal organization who manages to take out a crypto firm's assets in the same way that they would if you targeted the existing banks. So maybe relatively more cyber attacks happen against crypto than other types of assets because it's known as a safer target. (I have no clue, this is just a reasonable hypothesis to me)
That’s a good question. I don’t know how often banks get robbed of cash due to digital intrusions. I have gotten credit card info stolen before and that happens with many people, so maybe errors in the banking system more commonly take the form of lots of small fraud rather than a few big events.
Also, I haven't worked with my actual bank, but I've done multiple bits of consulting in the past on some other national bank's technology, and my time there was such a disorganized mess that I have to doubt the quality of all of their systems and practices.
So if a bank takes funds or won't release funds, there's a route you can use to get that back. One look at the sub-reddits for most crypto exchanges will show quite a few posts from people who can't get withdrawals and the exchanges are just stonewalling them.
Were customers even affected in this Bitcoin heist? Just because some crypto was stolen from the exchange, doesn't mean they won't pay their customers? 150M loss might not be that much in the greater scheme of things. A bank could also make losses of 150M by investing their customers money?
You can also lose your money on the stock exchange, with regular banks as brokers.
As to them having your money, that's what capital adequacy controls (another form of regulation) are for. banks are required to keep a percentage of their assets in low/no risk securities to mitigate the risk of insolvency due to bets going wrong.
Many many many customers have been affected by hacks on crypto coin exchanges. To take one recent example I think the customers of Cream finance basically lost it all after cream were hacked for the 3rd time in a year.
You can ofc lose money on the stock exchange, and in the UK there are regulations about what products can be offered to retail customers. things like leveraged investing are restricted.
None of this is to say that financial regulations are perfect, they're very much not, but that there are reasons why they have evolved in the way they have, generally in response to the kind of things happening to the crypto market right now.
“Maybe I’m out of touch with the rest of the developed world? Impossible, it’s everyone else demanding the enforcement of laws and regulations around value transfer, storage, and ownership who are the problem.” (Not you personally, crypto folks in general)
The prior owners were hodling it wrong.
Tangentially, I support my tax dollars being spent pursuing these threat actors for as long as it takes, with sentencing guidelines in line with the value stolen.
It's just that it doesn't trump contract law and it's not generally a barrier for implementing contracts digitally.
I’ll try again: I would like my taxpayer dollars going to smart contract development, auditing, and promulgating industry standards in a collaborate way. Just an additional signer for industry participants to consider or lean on the opinion of. Conditional execution on a distributed ledger with standardized conditions could easily get its own legal carveout to trump the analogous contract law, no different than someone someone agreeing to arbitration, but even as far as the local law invalidating private sector legalise when a parallel smart contracts is involved to limit possible behaviors already.
Governments can be a collaborative coding participant as we use this technology to re-evaluate the concept of governance and what redundancies the world actual needs to handle disputes or control behaviors with the pooled capital of taxpayers and the credit markets.
Right now this conversation has been limited to “adversary or not”, and that’s also shortsighted. Fortunately they’ve all moved too slow and there is enough capital within the crypto ecosystem to capture them. So I dont think it will be an organic growth from here to this reality, just consensus flippenings as wealthy backers direct public agencies and legislatures to “do the needful”.
As you might imagine, this was a much more extreme position to publicly have 6 years ago. But less absurd now, still not something to say on TV or in a web 2.0 office setting but at a bar or conference its understandable by people now, yay speculation driving innovation.
https://www.mercurynews.com/2021/11/30/houston-man-spent-ppp...
Decade old best practices for using crypto assets circumvents all of this. Ignoring the best practices leads to the assets being seized in the first place as well as persecution of the thief.
Using the best practices prevents seizure from an independent private thief or the state actor thief, so you see its not even about the government and its inflated sense of relevance.
Here is one comparable hack[0] I remember which followed another series of SWIFT hacks. Further, people lose money all the time to more minor exploits that target just specific accounts, credit cards are always sold (less of a fault of the banks directly but tied to how the system is set up), Robinhood had a data breach recently, etc.
>also I’m sure all the people with money in that exchange would be loving from FDIC insurance right now
Plenty of big exchanges like Binance and Coinbase do have similar insurance and have made users whole after a hack[1]..
0. https://en.m.wikipedia.org/wiki/Bangladesh_Bank_robbery
1. https://www.wired.com/story/hack-binance-cryptocurrency-exch...
Yeah, I wouldn't want to rely on the Federal Reserve Bank noticing a misspelled instruction before my billion dollars were released, but at least there's someone with a brain looking at the transfer before it happens!
>The RCBC bank branch in Manila to which the hackers tried to transfer $951m was in Jupiter Street. There are hundreds of banks in Manila that the hackers could have used, but they chose this one - and the decision cost them hundreds of millions of dollars.
>"The transactions… were held up at the Fed because the address used in one of the orders included the word 'Jupiter', which is also the name of a sanctioned Iranian shipping vessel," says Carolyn Maloney.
>Just the mention of the word "Jupiter" was enough to set alarm bells ringing in the Fed's automated computer systems. The payments were reviewed, and most were stopped. But not all. Five transactions, worth $101m, crossed this hurdle.
Not to mention the billions lost to BEC schemes.
https://www.reuters.com/article/us-cyber-heist-swift-special...
Yes, actually. If I had to trust one entity to safeguard something digital, I'd trust the security team at a major crypto exchange, than the police department at a major city. The problem isn't really that they're incompetent, it's that they're the juiciest targets.
Short story:
I had a job offer from one of these financial law enforcement agencies, specifically focused on preventing and tracking crypto hackers. It was rescinded by the new administration due to a mission change in the organization, refocusing on revenue through regulatory enforcement and surveillance rather than protecting Americans from theft and violence.
In reality, calling them incompetent may be charitable. The simplest explanation is that they are profit-driven, and frankly don’t care about any actual harm.
The money from these hacks often goes toward torturing the North Korean people, funding terror against American interests, or supporting violent drug cartels. One of the few things that angers me is that the only thing they are doing about it, is using it to further their surveillance agenda against Americans.
That’s the measure I use.