Bitcoin withdrawal processing suspended

https://www.bitstamp.net/article/bitcoin-withdraws-suspended/

by julespitt • 12 years ago

182 251 12 years ago

Scorpion• 12 years ago

So, did bitstamp also implement incorrectly despite warnings?

patio114• 12 years ago

It appears that Bitstamp did indeed use the creation transaction API in bitcoind which returns a transaction ID and they made the incorrect decision that the transaction ID returned had properties many programmers associate with IDs, like "meaning anything at all."

What they should have done was waited an hour then done an O(n) scan of all transactions globally in history to find the transaction by inspecting for parameters which exactly matched the ones they provided. That is, the Bitcoin developers now say, the correct use of the create transaction API.

Let me use an example programmers may be familiar with. Twilio lets you do SMS messages with three parameters: from_number, to_number, message. You are given back an SMS ID, which you can query to see the results of the SMS message (like, say, was it delivered successfully or did it fail with an error like "that telephone number did not exist").

Here's a discussion with Twilio in the bizarro world where it's like Bitcoin.

Me: "Hey Twilio I created an SMS message but when I try to query it for the results it 404s."

Them: "Are you sure you created the message?"

Me: "Yep pretty sure."

Them: "Are you sure you are looking for the right message ID in /messages/:id?"

Me: "Yep, I'm using the one that I got back when I created it."

Them: "Maybe it changed."

Me: "... What?"

Them: "Message IDs can change."

Me: "They don't usually change."

Them: "Of course, they don't usually change. Why have an ID if they usually changed? They only change some of the time."

Me: "What determines if a message ID changes?"

Them: "Oh, anyone globally can change your message IDs."

Me: "That sounds a bit insecure for a system which is, by its nature, deployed in a hostile environment."

Them: "Don't worry, they can't change after about an hour. Well, probably. It would be pretty expensive for an attacker to change them after an hour. Don't worry though, you'll never need an ID."

Me: "I find IDs useful for querying things. Like, say, messages. Which I have to do. To see whether the message was successful or not."

Them: "Well you're already downloading every message ever. Just scan through for one which matches the same from number, to number, and message contents."

Me: "... You're serious."

Them: "Don't worry though: they can't touch the from number, to number, or the message contents."

Me: "... Does this sound a little problematic to anyone else?"

Them: "It's on our wiki, noob!"

[Edit: Maybe somebody thinks I'm joking. Let me point you to one of the dangerous functions.

https://en.bitcoin.it/wiki/Original_Bitcoin_client/API_calls...

Name: sendtoaddress

Parameters: <bitcoinaddress> <amount> [comment] [comment-to]

Comments: <amount> is a real and is rounded to 8 decimal places. Returns the transaction ID <txid> if successful.

You should naturally, upon reading this documentation, figure "I should immediately discard that transaction ID, because it could be changed instantaneously after this message call. If I instead rely on that transaction ID, I will allow malicious users to break the software I am building."]

latchkey• 12 years ago

Comment of the year award. Seriously.

eterm2• 12 years ago

Funnily enough, I've had a similar situation to that in my line of work.

It wasn't twilio, but it turned out that when we submitted a SMS message of over 160 characters, the provider split it into 160 chunks and sent out as multiple SMS.

So far, so normal. But what happened when the first chunk sent successfully and the second chunk failed?

We got back a notification to say "MessageID: 4ACB-etc Result: OK" but the customer never got the message, and scanning the report on the provider's site showed the customer number, time and message as having failed.

But then the representative agreed it was a problem and set out to fix it rather than blaming our dependence on the ID!

carlio2• 12 years ago

I normally enjoy reading your posts here but this one I have to say I find a bit gleefully FUD-tastic. Given that you describe BitCoin as "magic Internet money" [0] I can't help but feel you simply rejoice in BitCoin failures as vindication of your belief that crytocurrency will never work.

There seem to be two prevailing extremes of opinion which appear a lot on Hacker News and many other places, as extremes are wont to do while those in the middle don't feel strongly enough to contribute. Those are 1) BitCoin will replace government control of money and fix freedom, dude! and 2) What fucking morons, can't wait until you crash and burn.

I love this whole thing. It's fascinating, it's an interesting solution to a problem, and watching DogeCoin take off is fun to watch. In my opinion, BitCoin is kind of like when a naïve programmer decides to rewrite an existing library themselves, and comes up against the brutal reality that led the original developers to the compromises and apparently necessary hacks to get the thing working. The analogy here being regulation, insurance, all that jazz. It's educational, and I haven't been this interested in a technology for a while.

I'm picking on your reply here because it is one of many that exemplifies a "haha told you so" rather than really digging into the interesting technical and sociological aspects.

* Message IDs from one API do not equate to IDs from the other, so your example is a bit flawed; there's no way to check with Twilio except the ID.

* Is "ID" even the term used? I don't know for sure, but "Tx Hash" seems to be more widely spread. [Edit: patio11 edited his comment while I was typing mine; I withdraw this point!]

* "It's on our wiki noob" - someone running the 3rd largest exchange should hardly be a "noob"

* "O(n) scan of all transactions globally" - that's not particularly hard, nor is it necessary (why scan all transactions from all time?), nor is it unexpected (the entire thing requires everyone to have the complete ledger, so you have the data anyway)

There are valid points to be made that the BitCoin protocol needs improvements, and these are even acknowledged by the core devs. This whole situation is a bit ludicrous. But I wish we were talking about "what have we learned", not "told you so".

When it comes to BitCoin, the conversation seems to be full of radicals and optimists when success happens, and gloaters when it doesn't. I don't feel either add to the conversation, we could be talking about how to improve this as a currency or (as I believe the long term actual application to be) how this can influence distributed trust, especially important in the current climate.

[0] https://twitter.com/patio11/status/431347845031940096

lucb1e4• 12 years ago

Now THAT is the ELI5 explanation I was looking for. This analogy is so much clearer than all the articles!

ufo• 12 years ago

btw, why is the transaction ammount a real number in there? Wouldn't it be clearer to use an integer multiple of whatever the lowest denomination of bitcoins would be?

codexon3• 12 years ago

This sums up my view on these recent turn of events.

I find it quite ridiculous that people are trying to lay the blame on not reading an obscure wiki page. I remember reading much of the bitcoin wiki myself and never seeing ANYTHING about not relying on transaction IDs. The API list doesn't even warn you about it.

Why bother returning a transaction ID if it is spoofable? That is simply misleading.

I guess it shows you how how biased all the bitcoin backers are.

laichzeit0• 12 years ago

I keep asking this over and either I'm missing something or no one knows the answer: The bitcoin devs keep saying that the malleability is a known "feature" since 2011 and that it's MtGox/Bitstamp's problem for searching for transactions based on tx ids. But what the fuck is the point of a tx id, practically speaking, how is it useful at all given that it's malleable?

weavejester6• 12 years ago

I feel I need to clarify some of your points, as they're a little misleading.

Don't worry, they can't change after about an hour. Well, probably. It would be pretty expensive for an attacker to change them after an hour.

You use the term "pretty expensive" here without qualifying it. Changing a transaction encoded in the blockchain would require outpacing the current hashrate of the bitcoin network. That would require a significant hardware investment, on the order of tens of millions of dollars.

Well you're already downloading every message ever. Just scan through for one which matches the same from number, to number, and message contents.

You make it sound as if you wouldn't have to do this if you had the transaction hash. You still need to iterate through the transactions regardless. It's just a question of whether you use the transaction hash, or derive your own from the parts of the transaction that are immutable.

Let's make your example a touch more realistic:

Me: "Hey Twilio I created an SMS message but when I try to query it for the results it 404s."

Them: "Has the message been delivered?"

Me: "I don't think so. I'm querying it shortly after I create it."

Them: "How are you querying it?"

Me: "With the message hash."

Them: "Ah, that explains it, then. A pending message may be changed before its delivered, altering the hash. This makes the hash unsuitable for identifying pending messages."

Me: "So how do I identify messages?"

Them: "Ideally you wait until they're delivered, but if you really need to check for pending messages, you can search through them looking for a message that matches on to, from and content."

Me: "That kinda sucks."

Them: "We know, but it's a difficult issue to fix. It's documented in our wiki."

Me: "What if I don't read your wiki, or follow your mailing list?"

Them: "Then should you really be running an exchange handling millions of dollars of transactions?"

Me: "... Good point."

gojomo2• 12 years ago

For those who seek to understand, rather than just mock with exaggerations:

You don't have to scan all transactions: only those from a firm reference-point of available-funds state, essentially the same point that was used to compose the outbound transaction.

Robust software already has to examine all incoming confirmed-in-block transactions for whether those transactions have consumed prior funds. If they have, even if the local software had as its design goal exclusive control of those funds, the local software must adapt to the new information. (Given the possibility of backups/virtualization-clones/private-key-exports, software must always be open to the possibility another node elsewhere has spent pending funds first.)

So safety against this particular mischief is possible with the same practice that's necessary for other reasons: it's not involved extra work.

Also, it's not "an hour" that lets a node know when it can rely on transaction-state, but block-confirmations, a precise and observable transition. One block is almost always enough, but each additional block adds more certainty. Still, all Bitcoin software already needs to handle occasional orphaned blocks and short forks, so being sensitive to periods of uncertainty is a essential part of all implementations, not extra work because of this one gotcha.

A better analogy than Twilio would be commercial payment systems: there you need to systems that are checking for weeks or months for chargebacks or reversals.

But an even better analogy than proprietary pay-per-use payment systems is SMTP or BitTorrent. The system is an emergent mess anyone can plug into. There are a lot of sharp edges, and even with great care, you're going to hit some painful and costly bugs. Those building billion-dollar businesses on such systems need to be experts, and will still take some arrows, but each incident that doesn't kill the software/business stacks only leaves them stronger.

scintill76• 12 years ago

What they should have done was waited an hour then done an O(n) scan of all transactions globally in history to find the transaction by inspecting for parameters which exactly matched the ones they provided.

Oh, you mean the scanning they have to do already, to verify "all transactions globally in history"? Inspecting all parameters on all transactions since the genesis, like you'd already have to do to verify they are not stealing or creating money from nothing? The inspection you have to do just to locate even the same transaction you submitted to the network yourself, to verify it was accepted? And you have to spend like 10 whole seconds of CPU time doing this, per ~10 minutes that a new block comes out, verifying the transactions from the last 10 minutes? Golly, that is sooooo much more onerous than just running the blockchain securely! /sarcasm

I'll agree that it's embarrassing, misleading, not documented well, and not gracefully handled by the community now that everyone points their fingers at each other. But you are deliberately making it sound worse by re-describing standard parts of the bitcoin protocol, as if they are new requirements in order to get a sane ID. Anyone writing financial software should be more than capable of quickly adding a few function hooks into the existing process to get a deterministic normalized ID, and the amount of extra computing resources is negligible compared to what you already have to do, just to use bitcoin safely.

yetfeo2• 12 years ago

It depends. There's a small issue with the reference client that is also causing chains of double spent transactions in merchant wallets: http://www.reddit.com/r/Bitcoin/comments/1xm49o/due_to_activ...

I would be more inclined to believe that the majority of sites use the reference client and this is why issues are appearing.

dublinben• 12 years ago

This is terrible news for Bitcoin. The currency will die without the exchanges.

weavejester6• 12 years ago

Because of an easily fixed bug in the software of some exchanges?

watty• 12 years ago

Yes, confidence in a currency is very important to its survival. The crazy volatility, the inability to withdraw sometimes, the competitors, the uncertainty everywhere. Bitcoin is not helping itself.

Phlarp2• 12 years ago

Because of the massive (and justified) collapse of confidence in everyone building web servies for this space.

It shouldn't surprise anyone that after months (years!) of BTC services absconding with millions of dollars worth of users money and now the exchanges starting to collapse in a similar fashion (users can't get money out) that the wider user base of bitcoin would begin to default toward not trusting services that purport to store coins 'securely'.

This is bad in the short term as the remaining exchanges prices show, but likely a positive progression in the safe use of crypto currencies going forward--

NotOscarWilde• 12 years ago

Being a Mt. Gox client which had some money on their server as they paused BTC withdrawals, this gives me hope that the flaw on their side was indeed purely technical and that they're not nearing bankrupcy just yet.

matkam• 12 years ago

Not too bad. It will encourage people to maintain control of their bitcoin

eterm2• 12 years ago

If you maintain control of both bitcoin and dollar, how could the exchange function? It requires storage of both.

Gambling exchanges have worked well for years, I wonder if the first serious competitor in the btc exchange space will be from one of those exchanges. (Unlike established financial exchanges they might be willing to risk a reputation hit for getting established in the space.)

aw3c23• 12 years ago

Heh, you summed up the stupidity of the current cryptocurrency rush in one sentence. Shouldn't they be self-contained and their success not be affected by exchanges?

rtpg4• 12 years ago

I wouldn't call it stupidity. It's like saying that the internet wouldn't last very long without ISPs.

Without many real places to deal with USD <-> BTC, then of course it will be hard to deal with the cryptocurrency (the passage is needed to allow for a transition period in currencies).

natrius• 12 years ago

That doesn't make any sense. How do you obtain a new currency without an exchange?

celticninja12• 12 years ago

How do you self-contain anythng in this world of interconnectivity?

If you understood cryptocurrency you would understamd that their success is not measured in the price point. That is the most marketable aspect so that is what you know, the utility and use of the protocol is as good if not a better measure of their success. the relative speed with which issues are identified and resolved speaks to the success of the protocol not the daily/weekly highs and lows.

baddox14• 12 years ago

Why should they be self-contained and not affected by exchanges? An exchange is just a market where you trade one good for another, where both the goods happen to be currencies (fiat or crypto). It's like saying that a market where you trade Bitcoins for domain names or Bitcoins for food is stupid.

higherpurpose• 12 years ago

I think this will be fixed in next-gen protocols like Ethereum:

http://www.ethereum.org/

We need exchanges that are also P2P like Bitcoin.

celticninja12• 12 years ago

oh god you have no idea other than reading headlines and extrapolating nonsense.

This is not going to kill any exchange (except perhaps mtgox, but that is due to an accumulation of poor performance rather than this minor issue).

dpanah• 12 years ago

This has to stop!

mbreese• 12 years ago

This is a denial-of-service attack made possible by some misunderstandings in Bitcoin wallet implementations

So... they didn't handle transaction processing correctly either. Are there any exchanges that are handling this properly?

psykovsky• 12 years ago

Are there any exchanges that are handling this properly?

I very much doubt it ;)

waterlesscloud4• 12 years ago

Probably due to the code they reused from back when they were a site to trade Magic cards.

mcantelon• 12 years ago

Wrong exchange.

waterlesscloud4• 12 years ago

I know. I'm mocking the ridiculous thread yesterday that was so insistent that was a factor in the Gox problems.

650REDHAIR• 12 years ago

Can someone give me a ELI5 breakdown of what's happening in the bitcoin world right now? First MtGox and now Bitstamp.

Any reading material on the subject (for a newbie) would be greatly appreciated.

smacktoward• 12 years ago

It looks a lot like a bank run to me:

http://en.wikipedia.org/wiki/Bank_run

EDIT: See this for a more thorough description of what I mean: http://www.dailytech.com/Mt+Gox+Bitcoin+Bank+Run+Intensifies...

celticninja12• 12 years ago

it is nothing like a bank run.

A bank run is where the bank does not hold enough money to cover everyones deposits. Bitstamp have enough BTC to cover everyones deposits they just are delaying withdrawals for 72 hours. Think of it like you rbank telling you you need to wait 3 days for a transaction to go through, not that unlikely and in fact quite common in traditional banking. It seems longer in bitcoin though because of the usually quick transactions.

dangrossman• 12 years ago

Both of these exchanges apparently implemented the Bitcoin protocol incorrectly. Their code that verifies a transaction has completed is incorrect, so they can be tricked into thinking a withdrawal did not happen when it actually did (or that a lesser amount was withdrawn). They need to fix their code, as there is a proper way to verify a transaction occurred or not.

Some reading:

http://qz.com/175565/why-nobody-can-withdraw-bitcoins-from-o...

mason555• 12 years ago

FWIW it's an error in the BTC reference implementation so it's an easy error to make

wcummings3• 12 years ago

(or that a lesser amount was withdrawn)

As I understand it, this is not correct, the new tx must be functionally identical to the old one (same inputs and outputs), just with a different txid.

Someone correct me if I'm wrong

patio114• 12 years ago

The Bitcoin protocol is the Satoshi client; the Satoshi client is the Bitcoin protocol. No Bitcoin protocol exists outside of the single source of truth, which is "how does the Satoshi client actually operate?"

Both exchanges use the JSON/RPC interface to the Satoshi bitcoin client. That is the One True Way to use Bitcoin to develop Bitcoin-consuming applications. To do otherwise is madness. (I've seen explanations that Mt. Gox was using a custom client, but I believe they mean "Mt. Gox was using a custom system which took care of bookkeeping for itself, because the Satoshi client cannot operate thousand of wallets in any sane fashion, but used the Satoshi client for interacting with the Bitcoin network.")

The Bitcoin RPC interface exposes many methods. I don't have intimate knowledge of which one these exchanges were using, but since they all have similar issues, let's assume they used sendtoaddress.

The message signature of sendtoaddress is (pseudo-code):

   #returns transaction_id
   sendtoaddress(from_account, to_bitcoin_address, amount, optional_message)

The mistake which both exchanges made is they assumed transaction_id is the same transaction_id used for gettransaction(transaction_id). It is. If you send a transaction, wait an hour, and then get it by ID, that will work.

But it isn't. Transaction ID means absolutely nothing. It can be changed by any party, worldwide, for up to one hour after the invocation of sendtoaddress. If you use gettransaction(transaction_id) and it returns nil, that does not prove that the transaction you previously created did not succeed correctly. You should not attempt to retry the transaction until first verifying that you have all the coins you started with and that the recipient does not have some of your coins. You can conveniently do this with an O(n) scan over all Bitcoin transactions ever. (Someone pointed out to me on twitter that it isn't O(n) if you have your database indices set properly. Well, yeah, true.)

You'll need to know what addresses you actually sent from, which is obscured by the sentoaddress API described above, for that scan to succeed, so essentially you're going to reimpliment much of the Satoshi Bitcoin client, particularly around the area of wallet management. Don't reimpliment everything, though -- down that path lies madness. Also, try not to make any bugs anywhere, particularly not the kind which only show up when someone tries to steal from you.

Good luck!

tghw• 12 years ago

There's a large attack being directed at Bitcoin exchanges that is trying to exploit what seems to be a common misunderstanding about the Bitcoin protocol. It's the same misunderstanding that forced Mt. Gox to go down.

http://www.coindesk.com/massive-concerted-attack-launched-bi...

malka• 12 years ago

Well, 2 identical transaction not resulting in the same hash is more a bug in the bitcoin implementation, than a misunderstanding in the protocol, imo

chrisBob• 12 years ago

If only there was some regulation. Then maybe I would consider trusting these exchanges.

snitko9• 12 years ago

Ahh, yes, regulation. Like when big exchanges lobby the government, then monopolize the market and do whatever the hell they want while charging high fees? Great idea.

What you want is an independent audit, not regulation.

api2• 12 years ago

Politics is often about finding bad solutions to worse problems.

ceejayoz2• 12 years ago

What you want is an independent audit, not regulation.

Maybe even some regulation requiring such a thing?

rtpg4• 12 years ago

Hey, at least when there's a bank run I (well not me, since I have no money in US banks) will see my federally insured $20k or whatever, even in the case of collapse.

btgeekboy• 12 years ago

Regulation gets me neat little things like, say, the FDIC.

michaelt2• 12 years ago

If you have much trust in independent audits, I guess you've never taken part in one!

Auditors generally have no incentive to rock the boat, and might have a disincentive in the form of losing future business. And even if they're really thorough, most auditors are only in for a few days or weeks and don't have time to go through things anything like as thoroughly as people who work on them full time. And even if they're really thorough and have the time to go through everything with a fine-toothed comb, insider threats can be undetectable, like if the guy preparing the cold storage wallet to put in the safety deposit box makes himself a copy.

The only audit of an exchange worth a damn is the audit undertaken by reputable insurers who will guarantee my entire deposit.

baddox14• 12 years ago

What mechanism would cause the regulatory agencies to be any more competent than the people running the exchanges?

erva• 12 years ago

Think about what you just said there. Imagine you are talking about governmental regulatory agencies and banks and re-read the same sentence.

celticninja12• 12 years ago

yeah like those people in Cyprus trusted their regulated banks, didnt save their depsoits did it, or in Argentina where capital controls exist and the inflation rate means your money is worht less every day, they are all regulated.

IgorPartola3• 12 years ago

I am lucky that about two months ago I moved over to Coinbase from both Mt Gox and BitStamp. I wonder now if Coinbase is going to start having issues.

mason555• 12 years ago

Coinbase has stated they're not affected by this issue

sillysaurus2• 12 years ago

You should consider moving your coins out right now, since there's no benefit to keeping them in Coinbase unless you're trading. (This is always true regardless of the current problems.)

wcummings3• 12 years ago

unless you're trading

Not even, since Coinbase is a webwallet not an exchange... People generally keep them there because its an easy way to manage/spend them (esp on a phone)

wfn• 12 years ago

    > I am lucky that about two months ago I moved over to Coinbase from both Mt Gox and BitStamp. I wonder now if Coinbase is going to start having issues.

You mean something like this? http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_...

'Someone' didn't ensure their trading engine did atomic writes to a database (by the way, that database doesn't do write isolation on multiple documents by default.. guess which database is that? Hint: it starts with the letter 'M'), which resulted in a potential race condition that could be exploited.

Coinbase uses that database, and apparently did not know that you need to ensure atomic write operations.

edit nwh links to Coinbase CEO's comment that it was not them. Ok, good to know. However, I still can't see how anyone would use said database in critical/production infrastructure, sorry. Maybe in a few+ years time it will be mature enough.

nwh• 12 years ago

The Coinbase CEO mentioned that this wasn't them being discussed there, which begs the question who else it could have been.

https://news.ycombinator.com/item?id=7214973

lucb1e4• 12 years ago

Meanwhile I still wonder why people bother with online wallets at all. They are less secure than traditional banks and centralised. I only hold very small amounts of coins in online wallets for trading and use bitcoin-qt for the rest. Can't say I ever noticed any downtime.

slg2• 12 years ago

I have a feeling that people in the Bitcoin community are going to start learning the results of a truly free market, lack of regulations, and the dangers of dealing with a bank that you can't trust.

celticninja12• 12 years ago

I thunk that is scaremongering nonsense. This is nothing to do with a free market, this is a software bug that has been well known but until yesterday it didnt affect many people. Someone is now trying to use it to obtain some sort of advantage but it doesnt actually allow them to steal any bitcoins.

Quite how you manage to link it to be a result of a "truly free market" is beyond me.

schrodinger• 12 years ago

When it's a bank, the bug and liability is on them

ok_craig• 12 years ago

Everyone involved already knows things like this can happen.

BlackDeath3• 12 years ago

I think a lot of it has to do with the mentality of considering exchanges to be banks.

snitko9• 12 years ago

No. People in the Bitcoin community would not in a million years want governments be involved in Bitcoin, regulating things. Exchanges need independent audit and insurance, but not greedy government bureaucrats waiting to be bribed. We want information and independent audit, not regulation.

pessimizer• 12 years ago

Does using Bitcoin require one to join the libertarian hivemind?

d23• 12 years ago

not greedy government bureaucrats waiting to be bribed

Instead of greedy speculators who are willing to pump and dump or crash the economy to make money off of the ignorant?

jdreaver• 12 years ago

Can you give me an example of a truly free market from history? By that, I mean absolutely no government involvement and regulation? I want to know what you mean by free market.

joelhaus• 12 years ago

A "truly free market" is like a unicorn, it only exists in fairy tales. In reality, Somalia is probably the closest you'll come.

baddox14• 12 years ago

Government regulated banks are no more trustworthy. This appears to be a software bug revealed by an organized attack. Government software, and software regulated by governments, is also vulnerable to software bugs and organized attacks.

dragontamer22• 12 years ago

You are guaranteed $100,000 in free insurance when you deposit your money at an FDIC-insured bank.

No matter what bugs, attacks, malware or whatever happens, the US Government will pay you back your deposited money, to the fullest extent that it can.

If you don't see why this is useful, maybe you need a sanity check.

walden42• 12 years ago

I agree. People will soon start seeing more and more responsibility over time as more bugs and bad practices get exposed, and more competitors start getting involved to solve existing issues. You can be sure this problem won't happen anymore, and we certainly won't need any regulations and other regulatory obstacles to overcome.

VMG3• 12 years ago

They already are, and it works tremendously.

There are multiple exchanges all around the world that compete for the business of customers and innovating in a break-neck speed, none of which would even exist if there was government regulation. Bugs are fixed and problems are addressed faster than the average legislator can spell "malleability".

It would work even better if there was less regulation and investors could fund exchanges in the US without having to buy a bank, so that development could actually happen everywhere and not only in Japan and Slovenia.

gamblor956• 12 years ago

Regulation would have provided that they would have gotten their funds back/in a timely manner.

Lack of regulation means that others learn from their misfortune.

drcross• 12 years ago

Bitcoin "Banks" (read exchanges) exist only through their reputation. They can die within a few days as shown from MtGox. This is the way traditional banks should operate instead of being propped by tax payers so that they are allowed privatize gains and socialize losses.

logicallee• 12 years ago

I have a feeling they won't, and will just solve the problem technically. It's how security is done.

rajacombinator• 12 years ago

Yes. In a regulated, unfree market, the banks you can't trust can send armed government stormtroopers to your home.

nmeofthestate• 12 years ago

I may be misremembering, but when MtGox was getting it in the neck for having this bug in their ridiculous terrible custom wallet implementation, someone asked "are there any reliable exchanges" and someone else answered "bitstamp".

Just goes to show, there's no use looking at a website (when that site is effectively a black-box) and judging its competency from a general vibe.

smackfu• 12 years ago

Probably thinking of this comment: https://news.ycombinator.com/item?id=7212862

jnbiche• 12 years ago

I stand by that comment. I'm disappointed that Bitstamp didn't take this issue into account when designing their exchange, but unlike Gox, their communication about the issue has been very good, and my confidence in Bitstamp remains unshaken.

Also, it appears that the Bitcoin network is under global attack by some large entity, so blame for the current exchange issues lie ultimately at the hands of some attacker who doesn't like Bitcoin, or wishes to plunge the price.

pmorici• 12 years ago

The difference between Gox and BitStamp is pretty easy to see take Gox they have had constant problems the most recent of which has been this which has been going on for multiple weeks now and their reaction was we are just going to suspend all withdrawals indefinitely.

On the other hand Bitstamp identified a problem within 24 hours of it starting to happen says they know how to fix it and will have everything back to normal shortly.

Personally I'd rather have my money with the latter.

dscrd• 12 years ago

So it wasn't just mtgox being incompetent, then?

aestra• 12 years ago

Does this relate to why coinedup suspended bitcoin withdraws and deposits for around 14 hours yesterday?

http://www.reddit.com/r/CoinedUp/comments/1xkft8/why_are_bit...

gtirloni2• 12 years ago

Starting a new financial system is proving to be very difficult. Who would have thought.

baddox14• 12 years ago

Is there another currency or financial system, virtual or crypto or fiat or otherwise, that has started from scratch and been more successful 5 years after it was created?

Fizzadar• 12 years ago

So another exchange which ignored the known 'bug' in bitcoin and which as a result made them open to exploitation. Why can't bitstamp just admit they have a software issue and are fixing it?

Bitcoin withdrawal processing suspended

Related Stories