Recent Updates (highlights, details below)
- Bitfinex will ‘socialize’ losses: everyone loses 36% of Bitfinex holdings.
- Bitfinex will issue its own currency (BFX) as an independent, tradeable token. BFX will be redeemable at a future date, with the goal of fully reimbursing losses.
- The site relaunched on August 7th.
- The exact cause of the hack is still unknown
On Tuesday, August 2, at approximately 6pm UTC, Hong Kong-based cryptocurrency exchange Bitfinex announced they had been hacked and would suspend trading. The hack involved 120,000 BTC, worth over $60 million and representing .75% of the entire Bitcoin supply.
“We are investigating the breach to determine what happened, but we know that some of our users have had their Bitcoins stolen. We are undertaking a review to determine which users have been affected by the breach. While we conduct this initial investigation and secure our environment, bitfinex.com will be taken down and the maintenance page will be left up,” – Bitfinex status page (August 3, 2016)
The attack is one of the largest in Bitcoin’s history, though still an order of magnitude less than the Mt. Gox losses. In early 2014, Mt. Gox filed for bankruptcy claiming $480 million worth of Bitcoin had been stolen. This represented almost 7% of the Bitcoin supply at the time.
Bitfinex is a major Bitcoin trading exchange and led trading activity among exchanges outside of China.
Cause still unknown
At time of writing, the exploited vulnerability was unknown. Bitfinex assured press it wasn’t an issue with the underlying cryptographically-secured blockchain. Zane Tackett, Bitfinex’s director of community and product development, also claimed that the attack wasn’t internal. He will be posting updates on Reddit.
Initial reports suggest that the stolen funds were in a multi-signature segregated wallet, and that the hacker had private keys from both Bitgo and Bitfinex. The new architecture moves away from the hot/cold wallet system employed by many exchanges in which customer trades occur off-chain and are periodically settled up on chain. The new system secures each account in a wallet and requires 2/3 signatures for trades and withdrawals – Bitgo has one, Bitfinex has two. There were also limits on how much could be automatically authorized in transfers; the attack circumvented such measures.
Bitgo, which partnered with Bitfinex this year to secure customer funds in segregated multi-signature wallets claimed they found no evidence they were hacked.
Bitgo quickly tweeted that their servers weren’t breached
It has emerged that Bitgo used its key to sign transactions authorized by Bitfinex and it would not use it to sign transactions authorized by users.
Unless compelled by an arbitrator or otherwise required by applicable law, BitGo will only use a private key to sign a Multi-Signature Wallet transaction that is first signed by Bitfinex. – Terms of Service 5.4
Emin Gur Sirer of Hacking Distributed speculated that someone simply acquired Bitfinex’s key, issued instructions to Bitgo to authorized the transactions signed with Bitfinex’s key, and found a way around the limits.
Implications for the Blockchain Community
Whether the job was an unforeseen external security breach or an inside job, the hack will have major implications for the blockchain community. Izabella Kaminska of Financial Times writes that if Bitgo’s system was fundamentally insecure, it will cast doubt on the entire ecosystem of companies touting blockchain security. If it was an inside job, it will invite further regulation and oversight, eventually adding costs to exchanges and fees to traders.
The Aftermath: Generalize Losses and Debt-Equity Token
Bitfinex has opted to generalize losses across its user base: everyone takes a 36% haircut.
The move is both unprecedented among cryptocurrency hacks and likely controversial.
“I would be surprised if there are not lawsuits that emerge from this incident, especially by customers who may want to contest the socialized loss scheme.” – Jerry Brito, Coin Center
Still, it’s not clear how such lawsuits would be implemented. Bitfinex’s terms of service (cached version) reveal it was incorporated in British Isles, so any lawsuits would take place there, and the terms include mandatory arbitration.
Many users were not just trading on the platform but also storing tokens as part of a margin-trading service: users could lend out tokens for others to speculate with and be compensated interest payments in return.
When financial institutions offer such a service, they are required to have insurance. Bitfinex did not. The Commodity Futures Trading Commission (CFTC) had previously fined Bitfinex for offering services while not complying as a futures-trading entity. The hot/cold wallet system in particular drew criticism, and presumably the CFTC’s action was part of why Bitfinex engaged Bitgo to offer separate customer wallets.
“Anyone who holds any asset at any exchange realises they’re part of the insurance plan for others,” – Emin Gun Sirer at Cornell University
Debt-equity Tokens as Compensation
To compensate users, Bitfinex will issue a digital token called BFX to all users. BFX will be redeemable in the future for fiat (presumably as Bitfinex has available resources) or could be converted to shares in iFinex, the exchange’s Hong Kong-based parent company. They will be priced initially at $1, tradeable and transferable, and users will receive BFX equal to the value of their losses (with BTC at 604.06 USD)
“In place of the loss in each wallet, we are crediting a token labeled BFX to record each customer’s discrete losses. Tokens will be distributed without release or waiver. The BFX tokens will remain outstanding until redeemed in full by Bitfinex or possibly exchanged—upon the creditor’s request and Bitfinex’s acceptance—for shares of iFinex Inc.” – Bitfinex Interim Update (August 6, 2016)
Forbes Writer Francis Coppola writes that such issuance seems legally dubious and not destined to end well. She compared these to Peruvian Land Bonds, which Peru offered to land owners as compensation after it seized their land to redistribute it to small farmers. The comparison is not flattering: the land bonds collapsed and became worthless.
Coindesk spoke with a number of lawyers who the move to issue a debt-equity token fits within existing legal frameworks in the financial world, though it’s unclear how it will impact legal proceedings. They thought regulators will start paying attention to the hack.
Bitcoin price fell (but hack not fully to blame)
The attack came amidst a decline in Bitcoin’s price and markets reacted quickly, pushing the price down as low as $530. The hack itself should not explain the decline experienced over the past couple days. Coindesk attributes the previous slide to the recent halving in miner rewards. Cryptocurrencies broadly have had a rocky summer. Ethereum, hailed as Bitcoin’s rival and potential successor, underwent a controversial hard fork to return funds stolen from The DAO, but the old blockchain persisted and is gradually gaining market and mining momentum. People are still trying to make sense of both the DAO hack and now Ethereum v. Ethereum Classic.