News for hackers. Stuff that matters.
Re:WannaCry ransomware bitcoins move from online wallets by feral on Thursday August 03, 2017 @10:14AM (#14919744)
I was an author of one of the first papers examining bitcoin's lack of anonymity.

People understand things a lot more now, but from this thread, in my opinion people still don't 'get it'.

The traceability issue is not magically removed by mixing - at least not in steady state, once the system matures.

To see this, consider a future where a single large exchange, lets call it Xchange, has substantial market share - (maybe like Coinbase). Let's assume they are a respectable company regulated by the laws of the USA, and that law enforcement tells them they have to comply with existing laws on stolen property.

Some company Bobcorp has $10M of bitcoins stolen, and pays someone to follow the coins. If those coins ever show up in the Xchange's addresses, Bobcorp is going to call the police and file suit to recover them.

Obviously there aren't literal coins in bitcoin, but Bobcorp is going to go to court and explain their block chain analysis to the judge, and the judge is maybe going to ask Xchange where the coins come from. And that'll be an interesting court case. But it seems unlikely the judge will be persuaded by ideological arguments about how this not-really-fungible currency should be treated as if we all pretend its fungible, and will instead be asking Xchange for its KYC records about the customer that lodged the coins.

Now, here's the important bit: the above doesn't have to actually play out. All that has to happen is that Xchange starts worrying about the above playing out, and starts getting a tiny bit wary about accepting funds that come from reported thefts - starts seeing them as a tiny bit riskier, a tiny bit more likely to end up in court, than other bitcoin.

Once any non-trivial amount of entities start thinking like this, (and it seems obvious they will - I would if I was running any business; but imagine the most conservative bank who eventually reluctantly participates in the maturing ecosystem) then the 'stolen' coins instantly become worth less than obviously clean ones.

And as soon as you live in that world, what happens mixers?

Suddenly you run the risk of putting in your good clean coins, into the mixer, because you care about privacy, and getting back tainted coins, implicitly worth less.

Suddenly mixers become a lot less useful.

It seems inevitable to me that if bitcoin continues to grow that this is how things will play out. It's still a super interesting system but, like I've been saying for years, it's got a ton of downsides around anonymity and privacy, and in steady state may be the perfect Orwellian currency rather than the perfect cypherpunk one, and I don't think mixers make this go away.

Re:WannaCry ransomware bitcoins move from online wallets by adriancooney on Thursday August 03, 2017 @07:22PM (#14924927)
That is an extremely interesting point of view, thank you for sharing. Another thought: say some criminals pass their money through a mixer and like in the scenario you described, it's deemed worthless to any exchanges/payment processors because it's "dirty". Does this mean that, say they were feeling sour they couldn't book a hotel on Booking.com, could they potentially taint any public wallet address by sending tiny amounts of bitcoin from their tainted wallet to them? Can a user prevent/block coins being transferred to their account in the blockchain? If your prediction comes through, this could spell a disaster for Bitcoin because potentially every wallet could be tainted and thus all coins traced back to criminal activity.

As a side note, it's interesting to think that those "dirty" coins/wallets will be destined to circle around the black markets forever.

Re:WannaCry ransomware bitcoins move from online wallets by feral on Thursday August 03, 2017 @08:00PM (#14925202)
You've got to imagine that in a future world this priced proportionally to the level of taint; addresses are devalued proportional to the degree of taint, maybe with some premium for completely clean addresses.

I'm not saying a centralized system will enforce this, just it seems like a natural consequence that will emerge.

Re:WannaCry ransomware bitcoins move from online wallets by MichaelGG on Thursday August 03, 2017 @03:49PM (#14923128)
So it's in everyone's interest to fight this every way possible. Coinjoin or better on the tech side, lobbying on the legal side. Otherwise you end up with a traceable currency that can retroactively be stolen.

What if someone cashes out before Bobcorp notices? At which point does Bobcorp get to file a theft notice? It can't just be an open registry since then anyone can temporarily block anyone's coins. After a court order? That could take forever. What about when they wanna seize money from Silk Road 5 or MegaUpload3? Plus you'll end up with coins dirty in one country but not another. China and Venezuela probably want to claim any coins that went through their country in some way - they're violating currency export controls no?

At least Monero provides far more fungibility.

Re:WannaCry ransomware bitcoins move from online wallets by feral on Thursday August 03, 2017 @08:03PM (#14925222)
>What if someone cashes out before Bobcorp notices?

People (exchanges etc) will be wary of accepting large transactions which have moved a lot recently from untrusted sources, whereas coins that have sat in the same wallet for a few weeks won't be discounted against as much etc.

To give some intuition advice here, think of it like how a risk management department of a financial institution would, trying to price grey risks; not like a distributed systems engineer does, trying to reason about edge cases as either Boolean correct/incorrect. ("Hmm, guess we'll have to discount fast moving coins from people we don't know" vs "If the hacker sells it fast enough the whole taint thing is unworkable and everything will be fungible again") Analogous to https://xkcd.com/538/ - regulators and financial institutions will take the $5 wrench approach!

Re:WannaCry ransomware bitcoins move from online wallets by skycaptain1 on Thursday August 03, 2017 @11:00AM (#14920145)
Can you post a link to the paper? If not, just the title would be helpful. Thanks!
Re:WannaCry ransomware bitcoins move from online wallets by feral on Thursday August 03, 2017 @01:56PM (#14921982)
http://arxiv.org/abs/1107.4524

(This is also in my profile.)

Re:WannaCry ransomware bitcoins move from online wallets by lawn on Thursday August 03, 2017 @05:27PM (#14924049)
Good comment. This is why the approach Monero uses is the way forward, you cannot tell one coin from another as the blockchain is opaque.