Tag Archives: Cryptocurrency

What is 1AjZPMsnmpdK2Rv9KQNfMurTXinscVro9V ?

Some of you probably figured out that it is a cryptocurrency (AKA Bitcoin) wallet.  But there is something that makes this bitcoin wallet different from the tens of millions of Bitcoin wallets out there in the wild.

Making a payment to this Bitcoin wallet may classify you a terrorist and subject you to arrest and prosecution.

But, you say, you were hit by a ransomware attack and you need your data back.

Sorry, says the government, you are still a terrorist.

Enough, you say, with this riddle.  Explain what the **bleep** is going on.

OK, here is the story and most of it is not news to anyone who has worked in financial services.

The U.S. Treasury Department has an office (AKA Department) called OFAC or Office of Foreign Asset Control.  Predecessors to the current OFAC department have around at least since the 1940s.

The idea behind OFAC is to make sure that U.S. businesses and citizens do not send money to terrorists.  In fact, when I was in the title and escrow business, we checked each and every payment, both inbound and outbound to make sure that we were not accepting money from terrorists nor sending money to terrorists.  We had special software to do this since we made tens of thousands of payments a day.

OFAC manages a list of what they call Specially Designated Nationals (SDN) or, basically, terrorists or people that help them.  As of today, that list is contained in a PDF file that is 1254 pages long.

As a way to try to squeeze terrorists, the government has started adding cryptocurrency wallet addresses to the SDN list.  The government expects that every time you make a cryptocurrency transaction, you check to make sure that the recipient is not on the SDN list.  If you use a service like Coinbase or one of its competitors, they do that for you.  If you arrange for the Bitcoin transfer yourself, they expect you to do it.

Since the Bitcoin blockchain (unlike many other blockchains) is publicly visible, it is pretty easy for the government to look at transactions and see if anyone in the U.S. is sending money to that wallet.  Since transfers are relatively anonymous if done carefully (like you only use that wallet for one transaction and other restrictions), the government may or may not try and find you if you violate the OFAC rules, but if you are a money handler, they will definitely come after them.  If you put money into a Bitcoin wallet from a bank account to pay the hacker, anonymity is totally gone – FYI.

Penalties, recently, for violating OFAC rules varied from a low of $87,000 to a high of $53,966,000 .  Big range, although $87,000 is still a large number.

There is a mechanism for requesting a waiver to send money to a person on the SDN list (called a blocked person or blocked entity), but I doubt the process is simple or quick, two things that are probably important when you are trying to unlock your data.

The simple solution is don’t get attacked by ransomware (easier said than done) or only get hacked by friendly hackers or hope that your attacker is not on the SDN list.  Otherwise, check and see if the person you are paying is on the bad guy list. 

We live in interesting times.  Information for this post came from Bleeping Computer and information on OFAC and the SDN list can be found here.

Facebooktwitterredditlinkedinmailby feather

Cryptocurrencies Under Attack

A story that seems to be repeated with way too much frequency is cryptocurrency attacks.  This is because most users don’t understand how easy these attacks are.

I am aware of *NO* attacks that compromised the cryptography of cryptocurrencies.  Always it is the software.  Sometimes on the user’s side.  Other times on the exchange’s side.

The cryptocurrency exchange called Coinrail lost $40 million to an attack.  Coinrail has taken its service offline and has moved what is left of its currency into cold storage to make it harder for the hackers and to help investigators figure out how the attackers got in (source: Techcrunch).

The Japanese exchange Coincheck lost $400 million to hackers.  They say they do not know how the attackers stole the money. They are considering compensating users who lost money – whatever that means. (Source: Techcrunch)

Tether, a cryptocurrency startup lost $31 million to attackers.  (Source: Techcrunch)

Bitcoin lost $500 of value in an hour after the most recent attack.  The industry as a whole lost $42 billion in value. (Source: Bloomberg)

As a coin speculator, what should you be doing?

First, you need to understand that you are a speculator in a wildly volatile commodity and that commodity has zero inherent value, unlike hog bellies or gold.

Second, understand that there is no insurance, very limited government regulation and no government protection from losses suffered.  This is about as risky as loaning money to your cousin Vinny.

Third, like all investments, diversify.  Whether that means stocks, bonds and Crypto or just different crypto exchanges (and not different currencies at the same exchange), diversify.  I recommend the first;  you do the second at your own peril.

Keep your wallet offline.  Hackers stole $20 million in Ethereum because users had opened a port on their local machines which allowed hackers to empty their wallets.  Offline is not a silver bullet, but it will stop that particular attack as long as the wallet stays offline.

Only run cryptocurrency transactions on a machine that you know to be secure.  One recent attack used DNS compromises on user’s machines to make their software think they were connecting to their exchange when, in fact, they were connecting to their attacker’s computers.

Bottom line – it is your money.  Treat it like it is important.

 

 

Facebooktwitterredditlinkedinmailby feather

Yet Another Digital Currency Heist

There is a lot of attention focused on digital currency and the potential it represents – maybe too much attention.

In May I wrote about the Bitcoin exchange Gatecoin, that was hacked to the tune of $2 million.

This week hackers made off with with $50 million in another virtual currency, Ether, but this time it is a little different.

The victim this time is an organization called The DAO for Decentralized Autonomous Organization which spent $150 million building a bitcoin look alike called Ether.  But this is not a currency exchange like Gatecoin.  Instead, people invest money in The DAO and The DAO invests in companies.  The DAO investors get a vote, based on how much money they put in, regarding which projects to fund.  More money, more votes.  No fund manager to may messy investment decisions.

In theory, the distributed nature of it means that no one could run off with the money.  Except they did.  Sort of.

What they did is move $50 million in Ether into a clone of The DAO that MAY delay payouts for four weeks like The DAO does.  If so, then The DAO has a couple of weeks to figure out an answer.

Like Bitcoin, Ether is not anonymous, so it would be difficult for the attacker to actually spend the money.  Maybe.

Ether transfers are a form of “smart contract” where the “terms” of the contract are cryptographically encoded into the Ether.  That, supposedly, makes it impossible for any to modify the contract in a way that is not detectable.

While they have not figured out exactly how the hack worked, the assumption is that the hacker exploited a bug in the code.

In this case, IF they do not recover the money, it is the investors who lose.  Just like any investment, there is no guarantee of success.

Some people want The DAO to hack their own code and create a new version of the code that makes it look like that transaction never took place.  Talk about a kludge with a capital K.

In any case, they have a little time still, they think, to figure this out.

No matter what they do, it is a black eye for virtual currencies.

If they change the rules by releasing a new version of the code that destroys that hacker’s transactions, what does that say for the integrity of digital currency and any money that you store in digital currency.

If they don’t hack the software but instead let the investors lose $50 million, what does that do?

In the long term, digital currencies and smart contracts are not going away.  In the short term, one might be advised to treat this like gambling – don’t put  more money into digital currencies than you are OK with completely losing.  Not necessarily the message that the creators of digital currency want to deliver.

However, unlike your local bank, there is no government agency to bail you out.

And, likely, no cyber insurance either.  This may be too risky for the insurance companies to swallow.  They have not said whether they have insurance, but I assume that if they did have insurance, they would have said so.

Stay tuned as they decide what to do.

Information for this post came from Wired.

Facebooktwitterredditlinkedinmailby feather