1. Open an exchange. 2. Collect real money in exchange for fake money. 3. "Get hacked" losing all the fake money and keeping all the real money.
sounds extremely suspicious.
In retrospect, it was a horrible decision not to research these transactions in depth as they happened, but the Excoin team was fighting a "bigger" fire at the time with the DDoS.
If the answer is no (and I suspect it is), then incentives are aligned so that putting extra effort into security is something an exchange operator should definitely not do.
All of this is also assuming (on faith) that the business model is actually running an exchange, as opposed to a hack-blaming racket.
It's not just about losing the bitcoin, people running these exchanges may be personally liable.
That's true, but who's going to make that happen?
In traditional society, there are laws about who can be a bank and how carefully you need to treat people's money (and often government programs to reimburse customers when good-faith banking efforts fail). Quite a fraction of Bitcoin users are in Bitcoin because, to first order, they want to move away from that model.
So the free market needs to not let their money be handled by people who believe that, and it's not yet clear they care. Probably they will, in a few years.
The law is still very murky here, and there are plenty of ways to deflect responsibility.
I'm not saying any of this is right, I'm suggesting that the way our culture and infrastructure is laid out, running a shoddy (perhaps conspiratorial) business might actually be the optimal path -- and that's where we need a solution.
When you're transacting in something of value (whether that be money, digital currency, or pokemon cards) for your users, you better be sure to take it seriously.
I lost money to Mt. Gox, but filing a lawsuit won't get anyone anywhere. Want to see a sad pdf? https://www.mtgox.com/img/pdf/20150202_tibanne.pdf
Sad for the customers. Not for Karpeles, the owner of Mt. Gox. He's still a millionaire and still free, and might even have the customers' bitcoins. No one will probably find out.
I know you're talking about Bitcoin startups founded in the US or EU, but the same applies: If the startup goes bankrupt, the customers won't get anything back. There's nothing to get back except empty coffers.
We have courts and bankruptcy laws for a reason.
You're now a millionaire, and no one can ever take that way from you. No court matters. As long as the price of bitcoin doesn't go down by more than 10x, you'll still be very wealthy. And no one can prove a thing.
This is business as usual in the bitcoin world. Bitcoin has made it very easy to separate people from their money, and courts have no power to do anything about it.
Would you go to prison for a few years to be a millionaire? There is no shortage of people willing to risk this.
As you can see from the rest of the thread, people are willing to believe almost any cover story, no matter how implausible. Even that an exchange could be DDoSed by search engines.
This will undoubtedly have the effect that some number of them will stop using services like this until their confidence is restored -- this has undoubtedly been the case with previous attacks as well. And it will prevent future customers who have heard about these types of attacks, or who hear less hype about bitcoin as a result of these types of attacks, from choosing to participate in exchanges until confidence is restored.
Unfortunately it takes time and it takes people getting hurt. And people do get fooled multiple times when there is "get rich quick" hype. But eventually they stop getting fooled or run out of money.
These adversaries will have more skill, more time, and more tenacity than you do.
Knowing this threat environment, what will you do differently from the dozens exchanges that have come before you and failed?
I have a friend who ported then maintained critical software at NASA about almost decade ago. He said that introducing source control was viewed as "a radical idea" at the time. Also, management seemed to go with superstition and "truthiness" as far as making decisions. "If it ain't broke, don't fix it" was the management mantra.
(I would reveal the piece of software he was working on, but that would easily reveal his identity.)
Now hardware: The NASA hardware guys who showed up to the Houston hackerspace always really impressed me. (But what do I know? I'm a software guy.)
I was thinking more along the lines of "I don't like this code, let's refactor". That can be dangerous.