I Just Lost 1,400 BTC (2020)

https://github.com/spesmilo/electrum/issues/5072

by optimalsolver • 5 years ago

42 75 5 years ago

github.com

fspacef• 5 years ago

That’s a bummer

exdsq4• 5 years ago

Or $68,387,200 USD as of today

lucb1e• 5 years ago

So how do we prevent this? Not everyone can cryptographically verify software updates, like I can't expect my mom to do that, and that is assuming you can reliably determine which key to use for verification in the first place, and that you trust whoever owns that key, and that this signer properly checked all commits or trusts the people that did.

Perhaps a start would be not to keep more than, say, a fifth of your cryptocurrency in a single place if you have many millions' worth?

morpheos1372• 5 years ago

I good start would be to write security critical software right the first time and not require frequent updates if at all. Every time an update happens it imposes a time cost and security risk on users. No other engineering discipline has the concept of updates to an in use product. When Toyota sells you a car if it has a "bug" in a control arm that results in it breaking and you losing control on the highway there is no software update. There is an NHTSA investigation and a recall.

yashap• 5 years ago

I’m far, far from an expert, but it seems to me that the unforgiving “software is the law, nothing can be reversed” nature of crypto means that all sorts of vulnerabilities and/or mistakes can instantly lead to you losing all your money. It feels inherent to the system - the core reasons behind these weaknesses are also the core strengths of crypto. You can patch individual vulnerabilities, and try not to make mistakes, but it seems it’ll always be the case that if all your money gets stolen, nothing can really be done.

lumost• 5 years ago

Custodial services is one area where the BTC community is sorely lacking.

Typically you can safely work with an independent financial advisor as your money is stored with a custodian like fidelity. Fidelity is on the hook to make basic tax reports, account statements, and provide security for your funds. Obviously a part of that security is controlling transfers and not dealing with dubious business partners.

I can’t point to any vault where my money is stored, but I can reasonably bet that fidelity has enough safeguards that it won’t vanish. I wish there were more such custodians for btc assets providing “cold wallets”. BTC makes audits and other activities to verify nothings gone odd with the custodian for your and everyone else’s accounts without requiring privileged access to the ledger.

Paying .05% for the price large of not having your btc vanish is a bargain.

SquishyPanda23• 5 years ago

Unless you want everyone to understand PKI, the solution is to use a payment system where transactions are reversible in cases of fraud.

Nextgrid2• 5 years ago

Not everyone can cryptographically verify software updates

In this case don't use cryptocurrencies, or at least don't hold your own coins and delegate that to a third-party (keep them in an exchange, etc).

Keeping your coins in a self-hosted wallet is like handling millions in physical cash or precious metals. You can do it, but it requires responsibility and precautions, which is why in the real world it's typically delegated to financial institutions (as in you keep that cash in the bank) and they themselves use precautions such as moving physical cash in armored trucks.

With this kind of amount, you need to take the appropriate precautions and have (or build) a digital "armored truck" and definitely not keep them on an online machine. Use a hardware wallet at the very least, or "build your own" hardware wallet by using an air-gapped machine with no direct access to the internet.

exdsq4• 5 years ago

I think the UX of crypto is its biggest failing. People don't need to know how SWIFT works to send a transaction and they shouldn't need to understand cryptography to use cryptocurrencies. Hopefully companies focus on solving these issues so anyone can open an account and use crypto just like cash but with a few of the extra advantages you get from crypto.

x86_64Ubuntu• 5 years ago

You don't. People want full control, with 0 oversight. Such incidents are going to be not uncommon. In all the solutions you've provided, they all require the user to do something other than click a random popup on outdated software. The issue is a people problem, not a tech problem.

nyolfen3• 5 years ago

if i had a huge fucking pot of crypto i would probably also announce to the world that i had lost it

Nextgrid2• 5 years ago

I don't understand the point - are you suggesting that he earlier on leaked the fact that he had lots of crypto and faked losing it to no longer be a target? If so he seems to be posting from a throwaway account which defeats the purpose.

nyolfen3• 5 years ago

perhaps he can provably point to it in the future if the government comes knocking. mainly i am remembering the guy in the uk that made a big show of looking for his old hard drive in a landfill, my immediate suspicion was that it was a ruse.

pinkybanana11• 5 years ago

It would be good way to avoid taxes, as you can write it as a loss and then go enjoy your BTC stash to some other country tax-free.

The problem is though that the BTC will still be traced to you...

nyolfen3• 5 years ago

chaumian coinjoin, atomic swap for monero or zcash, or even just cashing out off the books

tomxor• 5 years ago

Or £49,673,410 GBP as of today

morpheos1372• 5 years ago

If I recall correctly the issue was something like electrum permitted any full bitcoin node to broadcast any message and a nefarious node (since anybody can run a node anonymously) broadcast a message to users to update their electrum client to a trojan client. Just goes to show that "security" is amatuerish in much of the bitcoin community. Bitcoin may be cryptographically secure but how people use it often is not.

On top of all this around the same time I was trying to access some small amount of bitcoin in an older electrum wallet. It was no longer supported so I would have been forced to upgrade while there was this trojan variant going around.

Any way what the lesson should be is when writing security critical software do it right the first time, don't force users to upgrade frequently, don't allow messages from anybody to be broadcast to users, don't break existing secure installations forcing users to upgrade unnecessarily. Keep it simple and secure. KISS.

crtasm2• 5 years ago

It was no longer supported so I would have been forced to upgrade while there was this trojan variant going around.

Safely done by downloading a new version from the official website (which wasn't compromised) + verifying its signature.

I agree that allowing nodes to pop up messages was a huge error.

nonameiguess• 5 years ago

It seems like crypto has created a whole lot of people who are now rich but don't know how to be rich. People with normal assets can't transfer ownership of those assets by clicking on a popup link downloaded from the Internet. They have teams of accountants, bankers, brokers, lawyers, who sure, slow things down, take a cut, require that they know who you are and what you're buying, but they also keep you from accidentally giving $68 million to criminals.

birdyrooster2• 5 years ago

And those same financial services companies will end up managing these in the end game for crypto. This is just early adopter syndrome. Risk and reward, freedom and responsibility.

pinkybanana11• 5 years ago

There are already Bitcoin ETFs and other stock-market tradable products in many jurisdictions (not US though). These are very straightforward for casual user, I don't see how it would be any more insecure than buying for example Gold ETF.

pinkybanana11• 5 years ago

The people have been always there, it is just that now they have the tools. I personally have no problem, bitcoin should be for adults who can manage their own risks. You can always opt out and not use it. This whole thing has been repeated since the early Bitcoin times ad infinitum and shouldn't be a surprise.

This issue has been fixed in Electrum a long time ago already. However the problem is that no one can prevent people from running older versions.

This kind of problems are to be expected in crypto in the future as well, so always stay cautious.

TekMol3• 5 years ago

In times of banking apps, why does this not happen to old fashioned bank accounts?

What keeps hackers from taking over someones phone and sending their dollar/euro holdings somewhere?

relax884• 5 years ago

A vast system of fraud detection and limits on what can be done to accounts, especially on a mobile app.

If you try and move large amounts of money via your mobile banking app you won’t get very far before you have to show up in person at a branch.

TekMol3• 5 years ago

Is that true? What would be maximum amount someone can transfer from their bank account in a given day via the banking app / website?

renegadus• 5 years ago

Because banking transactions are far more traceable and can often be reversed if found to be fraudulent.

TekMol3• 5 years ago

"Often" indicates that there are ways to send funds in a way that is not reversible. Wouldn't a thief make use of such a way?

eh9• 5 years ago

I guess this is my disconnect or naïveté, but I thought the whole point of crypto is that it’s fairly traceable - obviously, there’s no decentralized way to address fraud, but couldn’t we have a decentralized report system that can warn people before sending tokens to known malicious actors?

pjc502• 5 years ago

This does happen. Then they're tracked down and prosecuted and the money returned - sometimes. But the regular banks also put a bit more effort into authentication. And amounts over certain figures attract more scrutiny.

Two specific design decisions of crypto - irreversibility and pseudonymity - make this much harder for crypto.

ronsor• 5 years ago

Banks usually have transfer limits to prevent you from losing 10 million dollars at once.

dustinmoris• 5 years ago

Just a few from the top if my head:

- Banks limit the amount per single transaction

- Limit on total daily amount one can transfer

- If a limit has to be exceeded for a large purchase they have a 24/7 hotline to authenticate and authorise such a one off transaction

- Additional checks on source of funds when someone pays in a lot of money

- Need for multiple extra factors of authentication when making a transfer to a new payee

- Extra checks including money laundering checks when making transfers abroad

- … and much more

diegocg• 5 years ago

Bank transactions are reversible.

exporectomy2• 5 years ago

I don't know why people keep saying this. They're often not. There was a case in my country of someone receiving a pile of money by mistake and he withdrew or transferred it quickly and fled the country. I also know someone overseas whose dad lost his life savings through a phishing scam that asked for his password and 2FA token via text message. The bank could only tell them where the money went (multiple accounts in other banks) but not get it back. Elder abuse often happens by the abuser using the victim's bank card and PIN to buy groceries/etc. then also taking money for themselves. The banks blame the victim who broke the rules by giving away their PIN and the abuser says it was a genuine payment for services or rent or whatever.

If your bank's app has a vulnerability that you lose money through, they bank will probably compensate you out of their own pocket even if they can't reverse the transaction.

Igelau• 5 years ago

Or 574,718,687 Turkish Lira today

Meekro• 5 years ago

Here's the discussion of this Electrum vulnerability from back when it happened: https://news.ycombinator.com/item?id=18770577

Looks like this guy installed an old and vulnerable version.

Electrum has a history of severe security bugs. If you want to store crypto safely, I recommend a Trezor hardware wallet. If you want crypto exposure in your portfolio without the technical/security headaches, I recommend Grayscale's investment products. GBTC, for example, is backed by Bitcoin and you can buy it through any investment account.

Pxtl• 5 years ago

Once again: Crypto currency is about tearing down the old rules and institutions of banking and finding out one failure at a time why each rule and institution exists.

Comevius• 5 years ago

The hippie problem. South Park described it accurately.

Man 2: Right now we're proving we don't need corporations. We don't need money. This can become a commune where everyone just helps each other.

Man 1: Yeah, we'll have one guy who like, who like, makes bread. A-and one guy who like, l-looks out for other people's safety.

Stan: You mean like a baker and a cop?

Man 2: No no, can't you imagine a place where people live together and like, provide services for each other in exchange for their services?

Kyle: Yeah, it's called a town.

pinkybanana11• 5 years ago

However crypto has made lots of people millionaires and that kind of hippie stuff doesn't. It is not like reinventing old institutions, Bitcoin has features that central banking based systems are fundamentally unable to offer (such as limited supply).

Gadiguibou• 5 years ago

I understand that often, we think something new will solve all our problems, but it only changes how they look and the old solution ends up being good enough already.

However, isn't it kind of pessimistic to think that there's nothing new to learn from rebuilding existing institutions from the ground up based on new knowledge?

I'm by no mean a crypto apologist. I think it's important to discuss why those new ideas fail and what we can learn from them in the future rather than mock them for trying to reinvent the wheel.

jefftk• 5 years ago

On the other hand, there are likely some old rules / institutions that it turns out we don't need anymore. If we're lucky, crypto will end up being garbage collection for financial regulation.

(We're probably not lucky)

KingMachiavelli2• 5 years ago

Wow. The desktop application allowed random nodes to trigger popup alerts that could just say anything they wanted. It sounds like that was a super old version? It's a bit unclear which version of Electrum was the last to have that issue.

It's pretty crazy the number of people who bought Bitcoin/crypto at such an early stage (e.g spending >$1000 on something nearly worthless and very obscure) yet are very bad at the security of this. You would think the first step to recovering >$10M plus would involve a Google search or two.

DSMan1952762• 5 years ago

Yeah I'm glad I'm not the only one who finds this a bit shocking, and their initial response doesn't really impress me that much. I don't expect a desktop app to be displaying random unverified messages to me in the same way my email or phone might, and especially so if it's not made that clear where the message is from. It's certainly true that this guy shouldn't have made this mistake anyway, but there are plenty of steps Electrum could do to make it clear whether a message should be trusted or not, and to their credit it does at least sound like they did make changes in this area in later versions. Of course, to clarify I have not actually tried this thing, I'm just basing that on their description of changes they made such as no longer displaying RTF and/or arbitrary messages.

zarzavat• 5 years ago

What can they do about old versions? Yes clearly it is an exploit but patching only fixes it in new versions. If someone insists on using an old version with that bug, they are on their own.

swiley• 5 years ago

You can overdo the security too though. I'd have a house right now if I had kept my wallet passphrase on a computer instead of in a notebook that I lost.

istingray2• 5 years ago

It would be interesting to interview people like this and publish their stories. What happens to someone in between spending $1000 USD on something nearly worthless and very obscure and having a wallet worth $10M USD?

i.e. perhaps a trend is people are so terrified of anyone finding out about it that they avoid Google etc and do everything in secret.

pinkybanana11• 5 years ago

There have been plenty of news articles about these people. For example in Scandinavia top tax payers are published yearly, there have been some crypto investors who have made it to the top of the list, and have given out interviews.

Reading some of these it is not that much different to someone winning in the lottery or getting some making million-level exit from IT business.

pinkybanana11• 5 years ago

It's pretty crazy the number of people who bought Bitcoin/crypto at such an early stage (e.g spending >$1000 on something nearly worthless and very obscure) yet are very bad at the security of this. You would think the first step to recovering >$10M plus would involve a Google search or two.

Though $1000 is a money typical let's say IT employee can easily spend and lose without having major issues. The issue with some early BTC adopters is that it was like buying a lottery ticket, most probably assumed that they would be likely losing the money, therefore they didn't invest in security and careful planning. Many people working for FAANG for example don't have to work that long to make $1000, so it is quite natural not to spend several hours of r&d on $1000 investment.

KingMachiavelli2• 5 years ago

The lack of security at the time of purchase isn't really the issue... it's the lack of security & best practices at the time of recovery that is the issue. Anyone getting >=10,000x returns on crypto basically had to have either forgotten or temporarily lost their crypto because 99.99% of people would sell after getting 1000x gains.

I think the main issue in this vulnerability was only fixed in early 2019 so it is super recent compared to the value & state of cryptocurrenty. Even I would expect any crypt wallet software from 2018 to be secure because crypto was no longer a niche interest at that point. Sure regular security & bug fixes are a norm for modern software but having such an egregious issue as recent as late 2018 is unacceptable.

crtasm2• 5 years ago

https://electrum.org/ says:

Warning: Electrum versions older than 3.3.4 are susceptible to phishing (links to [0])

3.3.4 was released 2019-02-13 [1]

[0] https://github.com/spesmilo/electrum/issues/4968

[1] https://github.com/spesmilo/electrum/releases?after=3.3.6

floatingatoll• 5 years ago

What is interesting or unusual about this GitHub issues link? Someone had coin stolen and they’re complaining about it. What makes this worth being on the front page?

rvz• 5 years ago

If you have this amount of BTC, why put it in a software wallet? Does this wallet even have a single security audit?

simonblack• 5 years ago

Bitcoin and others are just numbers. As such they are not backed by anything material. They have no intrinsic worth. You can't touch them or hold them. When the electricity stops they don't exist.

Your choice as to whether you entrust your assets to a scheme like that. I prefer something solid like real physical assets that I can hold or touch and that doesn't rely on a source of energy for its existence.

ryandvm• 5 years ago

Like paper.

xiphias2• 5 years ago

I wish it would be easier to use Bitcoin Core with multisig hardware wallets, as it's much more thorowly reviewed as other wallets. Partially signed transactions were a huge step forward, but there's still a lot to go to get rid of other software for managing large amounts of Bitcoins.

Koiwai• 5 years ago

Why the f*ck would I care? how is this news?

I Just Lost 1,400 BTC (2020)

Related Stories