Indeed, perhaps it is a case of mismanagement or embezzlement (coins transferred out of the company address by someone who had legitimate acces to the keys) rather than theft proper (by someone who was not supposed to have them).   MtGOX would not be the largest example of embezzlement, of course.

However, since in this case it may be impossible to know whether it was embezzlement or theft, perhaps it sould be counted as the latter.  The boundary is somewhat blurry anyway; simulated or arranged theft seems to be common also for cash and other valuables.

As for knowing more, I just saw an MIT study showing that the malleability bug exploit cannot have stolen more than 386 coins.  Therefore it is much more likely that it was either embezzlement or external hacking.  In the latter case, it seems a bit unlikely that the hacker managed to repeat the attack several times, stealing part of the coins at each time.  But with sufficiently messy administration, that cannot be ruled out.
[/quote]


Good point.  But shall we evaluate them at the time of the theft, or at the time when the thief sold (or will sell) them?  


Well, there is a long list of bitcoin heists (that has not been udated since November).  And that shows only major heists, generally from companies, that have made the news.  I wonder how many cases there have been of bitcoins stolen from individuals.  

Let's see when they come out.  I will be very surprised if they can be totally secure even when attached to a compromised computer.   


Could it be that they were hacked, and all their bitcoin capital was stolen? 

Like most risks, they presumably will never be totally resolved; they will only be made less likely and/or their consequencs will be mitigated. 

The irrevocability of transactions is considered a design feature of bitcoin.  Therefore, once the thief has transferred the victim's bitcoins to an address of his own, they cannot be taken from him nor returned to the victim, unless the thief is caught and somehow convinced to undo the transfer.

The anonimity of bitcoin accounts and operations  makes it very difficult to catch the thief.  The theft can be done by malicious software in the victim's computer, without communication with the thief, in which case he cannot be tracked down at that time.  Once the theft is detected, he may not be able to spend those coins openly in some countries, but may still spend them in the "criminal" segment of the bitcoin economy.  And he may be able to "wash" themin a tumbler, or in some other way.

I know that some people are trying to track the coins stolen in MtGOX and some other cases.  Have any of those attempts succeeded?

I have yet to see how those two problems could be fixed without a fundamental change of design. 

There are many other ways to steal through credit cards and from bank accounts (which is the "competition" being considered).  Whether they are more or less than the ways of stealing bitcoins, in any sense, it is not clear.


Item (3) is concrete evidence that item (2) is not bullshit.  AFAIK, for (digital) bitcoin theft, the ROGTJ (Risk of Going To Jail) is basically 0%, and the average HMYKFWYS (How Much You Keep from What You Steal) rate is close to 100%.  And the ratio of bitcoins stolen to bitcoins used in commerce is much larger than the similar ratio for credit cards (0.3%) , even if we leave out MtGOX and a few other cases that may be actually embezzlement rather than hacking.

Yes, I am aware that the private keys are supposed to be confidential.  But in practice they can be stolen, or used to sign transfers to the thief's wallet.  These risks must be included when comparing the safety of bitcoin vs. competition.

OK, so can we agree that bitcoins may be one day safer than credit cards and bank deposits -- but are not quite there yet?


OK. 

However, I don't think that bitcoins will be much protection against seizure by government, either.   For that purpose, storing your money in bitcoin is like burying cash in some desert location.  If the government knows that you have the money hidden somewhere, and wants to get it, it will order you to turn it in or suffer the consequences.   If you refuse, and are lucky to have a government that mostly respect human rights, they may just send you to jail for some years.   Even in that case, most people would rather lose a few million dollars than some years of their life.  Then they might as well leave their money in the bank, and let the government help itself to it.

In some aspects, hiding money as bitcoin is worse than burying cash in the desert for this purpose, because the blockchain is public and can be used as proof in court that you have that money, and that so-and-so gave it to you.  All they need is to connect the bitcoin addresses to the people in question -- which we khew that they are quite capable of, even before Snowden.

Even without NSA-level hackery, they can just wait for you to spend some of those coins.  Indeed, it is much easier for the police to monitor thousands of blockchain addresses and TCP/IP connections 24/7 for years, than to physically stalk one guy whom they suspect of having a cash hoard hidden somewhere.


Considering that card transactions can be cancelled and bank accounts are insured, these risks are so small for credit card payments and bank deposits that people usually do not worry much about them.  For long-term storage, in fact, people generally put their money in some fund or savings account that pays small but guaranteed interest above inflation.  That still seems to me a lot safer and more attractive than bitcoin.

And, needless to say, one cannot consider bitcoin a safe long-term wealth storage medium until its price stabilizes and its long-term survival is reasonably assured.


Well, even the smartest computer genius has his moments of academic professorship. 

Credit cards are rather "stupidity tolerant" because their transactions can be cancelled.  Bitcoins seem to be much more "stupidity- sensitive".

Chinese Slumber Method prediction for Monday April 21

Prediction valid for: Monday 2014-04-20, 19:00--19:59 UTC (not before, not after)
Huobi's predicted price: 3097 CNY
Bitstamp's predicted price: 496 USD





Plot legend

Today's data point was fair, (S = 0.0 035 W = 0.782) and, like the previous one, totally off the trend of Apr/16--18.  Whatever external causes sustained that trend must have ceased, so it is appropriate to start a new trend, the straight line defined by the last two points.  Namely, A + B*(d-d0), where d-d0 is the number of days since Apr/19, A = 3153 and B = -28.

The Bitstamp prediction, as usual, is the Huobi prediction divided by the currency conversion factor R, which was assumed to be 6.24 CNY/USD. It was 6.25, 6.26, 6.18, 6.21, 6.23 at the last five Slumber Times.
 
Checking the previous prediction

Prediction was posted on: Saturday 2014-04-19, 23:37 UTC
Prediction was valid for: Sunday 2014-04-20, 19:00--19:59 UTC (~19 hours later)

Punished for my stubborness:

Huobi's predicted price: 2788 CNY
Huobi's actual price (L+H)/2: 3125 CNY
Error: 337 CNY (~54 USD)

Bitstamp's predicted price: 450 USD
Bitstamp's actual price (L+H)/2: 500 USD
Error: 50 USD
 
NOTE:
  "On two occasions I have been asked, 'Pray, Mr. Babbage, if you
  put into the machine wrong figures, will the right answers come out?'"

Bah. It is the Age of the Internet.  Who cares where China is anyway? 

I believe it is 00:57 now.  They are usually still trading at this hour, and stay up even later when price is changing fast.

Someone typed "sell 5000 at 2090" instead of "sell 5.000 at 3090"? 

Huobi on BW showed a little progress then froze again.  Bid side, log, current price still at ~3101.  Ask side down to 2090 (yes, 2090, not 2900).

EDIT may be a bug on their chart API.  

EDIT2 Back to working it seems, ~3067

I was looking at bitcoinwisdom.  They show it on their site too but it is being DDOSed apparently, 404 for me.  Meanwhile OKCoin is falling.

Huobi frozen for 8 minutes already.
EDIT: only the current price and the bid half of the book is frozen.  The ask part is plummeting.

EDIT2: May be coincidence, but now in China it is just past 00:00 of the first business day after the Apr/18 deadline.

EDIT3: Huobi's main page is unavailable for me (nginx 404).

A "phony imposter prof" is an "imposter prof" that is not actually an imposter? 

That was not "theft", but fraud (he did not take money from people without their knowledge or consent; people gave money to him, consciously), and the fraud was spread over many years.  Like Enron, Worldcom, OGX, ...

I understand that the thief may have been Mark himself, stealing from his clients.  Either way at least 600'000 bitcoins were stolen by digital transfer, the thief cannot be identified, he is still in control of the coins (unless he lost the keys), and the coins cannot be seized and returned.

The largest cash robbery in that list seems to be "only" 1 billion dollars.  Surely the MtGOX heist would have been bigger if MtGOX had more coins in their possession.

Anyway my question was about digital theft.  I know some cases (e.g. Barings Bank, Banco Noroeste, massive botnet/virus thefts) where larger sums were stolen or lost by means of digital transfers, but they were spread out over many separate operations.

The discussion started because someone (@aminorex?) claimed flatly that bitcoins are much safer than traditiional payment methods.   That statement is at least unwarranted, because (1) there are many ways to steal bitcoins, (2) stealing bitcoins is easier, "safer", and more effective in many ways than stealing credit cards or bank keys, and (3) bitcoin theft is still a common occurrence in bitcoin businesses, which are supposedly run by computer-savy people.

AFAIK, each year about 7 trillion dollars are paid with credit cards worldwide, of which 20 billion dollars (~0.3%) are fraudulent. 

What about bitcoins? I have no idea how much is the total use of bitcoin in commerce (excluding speculation, internal shuffling, and large finance), but last year Bitpay said they paid 100 million dollars, so let's say 300 million total.  The MtGOX heist alone was at least 300 million dollars.  Even spread over 2 years, it alone would be 30% of all commercial use.  So, I think it is pretty fair to say that bitcoin theft is a much bigger problem than credit card theft, relative to total commerce.

Yes, many of those problems could be fixed in theory; but in practice many still haven''t been fixed, and others (like the irrevocability of thefts and the near impossibility of identifying the thief) do not seem to have a solution even in theory.  Others, like address phishing (tricking people to send bitcoins to the wrong address) may be done in so many ways that it seems unlikely they will have a single, simple solution.  The problem is made worse by exaggerated claims of security, since they may induce users to lower their guard. (E.g., see that site that generated vanity addresses.)

And anyway, why should I find the solutions? I am the skeptic here...

By the way, the MtGOX heist must have been the largest single digital theft of all time, not just of bitcoin. Is that true? I cannot even imagine how a hacker could steal 300 million old-fashioned dollars from a company, and walk away with it.

Well, BTC-China just installed a bitcoin ATM in Shangai and unveiled a phone app, both independent of banks:
http://shanghaiist.com/2014/04/18/chinas-first-bitcoin-atm-installed-in-shanghai-mall.php
I saw an article about it in Chinese posted to a Chinese government website, "submitted by the Shangai city municipality".  I can't find it now, but I have the vague recollection that the date&time coincided with the jump from ˜2900 to ~3100 on Huobi at 05:55 UTC (13:55 local time).

I haven't seen any new notices on the Huobi and OKCoin sites about the bank (non)closures. 

Yeah, I am not insider (or even a US citizen) but that agrees with my understanding of how civil servants think and work (being one myself).  I would also guess that, probably

* The people in charge of the sale are not particularly motivated to obtain the maximum possible price for those coins,  since their pay does not depend on that; but

* Their first concern is not doing anything that they could be reprimanded for, such as failing to follow the laws and regulations, or making clearly stupid decisions -- such as choosing lot sizes and dates that result in  too few bids.

* As long as they get enough bids, they will not care for the effect of the sale on the BTC price.

* They will not care if someone buys the coins for X at the auction and immediately sells them for 2*X.  That sort of thing happens all the time at government auctions.

* In their view, all the coins and other assets seized from SilkRoad belong to DPR (& associates?).   If the court confirms the seizure and authorizes the auction, all the money goes to the US Govt.  Otherwise, all the assets will be returned to DPR.  The concept of "client of SilkRoad" must be meaningless before US law, except for its bad implicatons.

Makes sense?

Chinese Slumber Method prediction for Sunday April 20

Prediction valid for: Sunday 2014-04-20, 19:00--19:59 UTC (not before, not after)
Huobi's predicted price: 2788 CNY
Bitstamp's predicted price: 450 USD





Plot legend

Today's data point was very weak, (S = 0.0114, W = 0.075) and totally off the current trendline.  External reasons would indicate a break and another trendline, but the Method would rather ignore today's point as a freak and persist in the previous straight line trend, fitted by weighted least squares to the points of Apr/16--18; namely, A + B*(d-d0), where d-d0 is the number of days since Apr/16, A = 3187.6 and B = -100.0.

The Bitstamp prediction, as usual, is the Huobi prediction divided by the currency conversion factor R, which was assumed to be 6.19 CNY/USD. It was 6.26 at today's Slumber Point, but 6.18, 6.21, 6.23 at the last three Slumber Times with decent weights.
 
Checking the previous prediction

Prediction was posted on: Saturday 2014-04-19, 02:10 UTC
Prediction was valid for: Saturday 2014-04-19, 19:00--19:59 UTC (~17 hours later)

Foiled again by the devious Chinese:

Huobi's predicted price: 2888 CNY
Huobi's actual price (L+H)/2: 3153 CNY
Error: 265 CNY (~43 USD)

Bitstamp's predicted price: 467 USD
Bitstamp's actual price (L+H)/2: 506 USD
Error: 39 USD
 
NOTE: "Two wrongs don't make a right, but three lefts do." (unknown)

Dear @AnonyMint, we could hardly be further apart in our political views, especially the value and role of government.  Therefore I would rather not discuss that topic, but would like to comment on a few peripheral points:

* It is debatable whether Europe went into 600 years of darkness after the fall of Rome.  Our view of History is biased towards recorded History, and the end of the Empire meant the end of the largest and most punctillious record keeping organization of that Millenium.  The centralized administration collapsed, and with it the supply network that sustained the large population in Rome; but it seems hard to evaluate whether the life of the Europeans as a whole regressed in the following centuries, or continued to improve.  Many cities throughout Europe surely kept growing and became more "civilized".   Perhaps the "total degree of civilization" kept increasing, but in a quantitative rather than qualitative sense --- that is, a lot of people improved, while a few regressed.   To tell whether this happened or not, one would need statistics that seem largely unavailable.

Moreover, if one looks a bit beyond Europe, one can say that the center of civilization simply moved elsewhere, to the Caliphate -- that built an Empire about as large as the Roman one, and was just as civilized and progressive as the Romans had been. 

* You are right that knowledge may be 1000x more valuable than matter, in terms of the results it may produce; but value does not equate to price (that is, how much one can obtain in exchange for it).  Just consider that air is infinitely more valuable than caviar, for example.

In a free market, the price of a product eventually settles to the cost of production plus a few percent.  But the cost of duplicating knowledge is almost nil now.  Threfore, if/when knowledge will be traded in a few market, it will cost almost nil.  We are seeing it happen now: newspaper paywalls, copyright, and DRM are only a nuisance, since people can get most of the news and entertainment they want from free sources.   

Copyright and patent royalties can be collected only when and where the government is corrupted by the "intellectual property owners" to forcefully prevent the development of a free market of information.   If that free market existed, "knowledge makers" would be paid only for producing new knowledge, and only while they are producing it; not for selling or renting knowledge that they "own" -- just as a mason only gets paid while he works, not for rent in perpetuity of the houses that he built.

* I am very skeptical of anonimity as a "weapon of freedom".  On one hand, one cannot build a functional society only with anonymous interactions.  What makes society work it is the network of person-to-person interactions, where the parties know and trust each other.  In anonymous interactions, outside the reach of government, there is no incentive to honor deals or build a reputation.

Bitcoiners claim that their contraption removes the need for mutual trust or a trusted intermediary in commercial transactions, but that is not true.  A commercial transaction involves two transfers, money in one direction and goods or services in the other direction.  Bitcoin only handles the former; but one still needs trust (or a trusted intermediary with teeth), in order to ensure that the customer will pay for the goods that have been sent, or that the merchan will ship the goods that have been paid.  I don't see how to get that with anonymous transactions and without a government to enforce honest dealing.

Anonimity would be important in times when democracy has failed and citizens need to conspire underground in order to remove an illegitimate, undemocratic  government.  Unfortunately, such governments can and will easily prevent anonimity.  Even technically sophisticated citizens will have little chance against a determined ditactorial government. 

I found this mildly interesting, an inside glimpse of MtGOX in 2012:

  March 29, 2014 - Reuters
  Exclusive: Mt. Gox faced questions on handling client cash long before crisis
  http://www.reuters.com/article/2014/03/30/us-bitcoin-mtgox-idUSBREA2T01T20140330

Sounds very similar to the Neo & Bee story (but of course the amounts involved were 50-100 times bigger, and the drama lasted years instead of months).