In September, this decentralized exchange (DEX) overtook Coinbase in trading volume:
A) UniswapB) AaveC) CompoundD) Both A and B Scroll down for the answer.
Ranking and September Winners and Losers
2020 Top 10 Rank Lots of movement this month: six out of the Top Ten changed positions in September. BCH climbed one from #6 to #5 and BNB made a big move from #10 to #6. Going the opposite direction were BSV, EOS, and Tezos, dropping one, two, and four places respectively. The big story though, at least for anyone who’s been watching crypto for a while, was the ejection of Litecoin from the Top Ten. In just 30 days, LTC fell five places from #7 to #12. For some context, Litecoin’s absence from the Top Ten is a Top Ten Experiment first. It is also the first time since CoinMarketCap has tracked crypto rankings that Litecoin has not has not held a spot in the Top Ten. Drop outs: after nine months of the experiment, 30% of the cryptos that started 2020 in the Top Ten have dropped out. LTC, EOS, and Tezos have been replaced by ADA,LINK, and most recently, DOT. September Winners – Winner, singular: BNB was the only crypto to finish in the green, finished up +25% for the month, and gained four places in the rankings. A very good month for Binance Coin. September Losers – Tezos was the worst performing crypto of the 2020 Top Ten portfolio, losing nearly a third of its value, down -31% for the month. LTC also had a bad month, losing -24% and dropping out of the Top Ten. Since COVID-19 has hammered the sporting world, let’s be overly competitive and pit these cryptos against each other, shall we? Here’s a table showing which cryptos have the most monthly wins and losses nine months into the 2020 Top Ten Crypto Index Fund Experiment: Wins/Losses ETH is in the lead three monthly Ws, followed by Tether and Tezos with two wins each. Even though it is up +79% since January 1st, 2020, BSV has the most monthly losses: it has been the worst performing crypto of the group four out of the first nine months in 2020.
Overall update – ETH maintains strong lead, followed by BNB. 100% of Top Ten are in positive territory.
Ethereum remains firmly in the lead, up +187% on the year. Thanks to a strong month for BNB and a weak month for Tezos,Binance Coin has overtaken XTZ for second place, and is now up +109% in 2020. Discounting Tether (no offense Big-T), EOS (+4%) is the worst performing cryptocurrency of the 2020 Top Ten Portfolio. 100% of the cryptos in this group are in positive territory.
Total Market Cap for the cryptocurrency sector:
The overall crypto market lost about $35B in September, ending the month up +85% since the beginning of this year’s experiment in January 2020. Despite a rough month, this is the second highest month-end level since the 2020 Top Ten Experiment started nine months ago.
Monthly BitDom - 2020 BitDom ticked up slightly this month, but is still lower than it has been for most of the year. As always, a low BitDom reflects a greater appetite for altcoins. For context, the BitDom range since the beginning of the experiment in January 2020 has been roughly between 57% and 68%.
Overall return on investment since January 1st, 2020:
After an initial $1000 investment on January 1st, the 2020 Top Ten Portfolio is now worth $1,536, up +56%. This is the best performing of the three Top Ten Crypto Index Fund Portfolios, but not by much: the 2019 Top Ten came in at +54% in September. Here’s the month by month ROI of the 2020 Top Ten Experiment, hopefully helpful to maintain perspective and provide an overview as we go along: Monthly ROI - 2020 Top Ten Even during the zombie apocalypse blip in March, the 2020 Top Ten has managed to end every month so far in the green (for a mirror image, check out the all red table you’ll find in the 2018 experiment). The range of monthly ROI for the 2020 Top Ten has been between a low of +7% in March and high of +83% in August. So, how does the 2020 Top Ten Experiment compare to the parallel projects?
Taken together, here’s the bottom bottom bottom line for the three portfolios: After a $3000 investment in the 2018, 2019, and 2020 Top Ten Cryptocurrencies, the combined portfolios are worth $3,340 ($238+ $1,538 +$1,564). That’s up about +11% for the three combined portfolios, compared to +31% last month. Here’s a table to help visualize the progress of the combined portfolios: Combined ROI - UP +11% That’s a +11% gain by buying $1k of the cryptos that happened to be in the Top Ten on January 1st, 2018, 2019, and 2020. But what if I’d gone all in on only one Top Ten crypto for the past three years? While many have come and gone over the life of the experiment, five cryptos have started in Top Ten for all three years: BTC, ETH, XRP, BCH, and LTC (Big L, no pressure, but if you don’t claw yourself back in the Top Ten by January 2021, you’re out of the club). Let’s take a look: Three Year Club At this point in the Experiments, Ethereum (+104%) would have easily returned the most, followed by BTC (+77%). On the other hand, following this approach with XRP, I would have been down nearly a third at -31%. So that’s the Top Ten Crypto Index Fund Experiments snapshot. Let’s take a look at how traditional markets are doing.
Comparison to S&P 500
I’m also tracking the S&P 500 as part of my experiment to have a comparison point to traditional markets. The S&P slipped a bit from an all time high in August and is now up just +5% in 2020. Over the same time period, the 2020 Top Ten Crypto Portfolio is returning about +56%. The initial $1k investment in crypto is now worth about $1,563. That same $1k I put into crypto in January 2020 would be worth $1050 had it been redirected to the S&P 500 instead. That’s a $513 difference on a $1k investment, one of the largest gaps in favor of crypto all year. But that’s just 2020. What about in the longer term? What if I invested in the S&P 500 the same way I did during the first three years of the Top Ten Crypto Index Fund Experiments? What I like to call the world’s slowest dollar cost averaging method? Here are the figures:
$1000 investment in S&P 500 on January 1st, 2018 = $1260 today
$1000 investment in S&P 500 on January 1st, 2019 = $1350 today
$1000 investment in S&P 500 on January 1st, 2020 = $1050 today
So, taken together, here’s the bottom bottom bottom line for a similar approach with the S&P: After three $1,000 investments into an S&P 500 index fund in January 2018, 2019, and 2020, my portfolio would be worth $3,660. That $3,660 is up +22%since January 2018, compared to a +11% gain of the combined Top Ten Crypto Experiment Portfolios over the same period of time. That’s an 11% swing in favor of the S&P 500 and breaks a two month mini-streak of wins from the Top Ten crypto portfolios. For those keeping track or unable to see the table above: that’s seven monthly victories for the S&P vs. two monthly victories for crypto. The largest gap so far was a 22% difference in favor of the S&P back in June.
September saw losses for both traditional and crypto markets, but crypto got hit harder. What can we expect for the rest of 2020? The Neverending Year is entering the final quarter and is not finished with us yet: a lot can and will happen in the remaining months. More volatility is no doubt to come as we enter the final stretch of a truly unpredictable and exhausting year. Buckle up. Stay healthy and take care of yourselves out there. Thanks for reading and for supporting the experiment. I hope you’ve found it helpful. I continue to be committed to seeing this process through and reporting along the way. Feel free to reach out with any questions and stay tuned for progress reports. Keep an eye out for the original 2018 Top Ten Crypto Index Fund Experiment and the 2019 Top Ten Experiment follow up experiment.
First one to find the three hidden cultural references gets some moons.
What's this all about? I purchased $100 of each of Top Ten Cryptos in Jan. 2018, haven't sold or traded. Did the same in 2019 and 2020. Learn more about the history and rules of the Experimentshere.
September - BTC, although -8%, outperforms the field this month.
Overall since Jan. 2018 - Bitcoin miles ahead of the pack, and only one close-ish to break even point.
Combining all three three years, Top Ten cryptos underperforming S&P if I'd taken a similar approach.
Month Thirty Three – Down 76%
2018 Top Ten Summary for September After a rough start to September, crypto spent the month trying in vain to claw back ground. While a few coins rebounded quite a bit from the monthly lows, most ended up finishing the month significantly down. Out of the 2018 Top Ten group, Bitcoin lost the least, down -8% in September. NEM followed it’s winning August (yes, you read that right) with the poorest performance, down -26%.
Question of the month:
Which cryptocurrency exchange won approval to create America’s first crypto bank in September?
A) Binance B) Binance.us C) Kraken D) Coinbase Scroll down for the answer.
Ranking and September Winners and Losers
Rank of 2018 Portfolio - 50% no longer in Top Ten A lot of shuffling in September. On the upside, Bitcoin Cash and Cardano gained one place each landing at #5 and #10 respectively. Cardano gets special mention for re-entering the Top Ten. Heading the wrong direction were IOTA, NEM, Dash, and Stellar each falling two or three spots. The big story though, for long time crypto watchers, was the ejection of Litecoin from the Top Ten, down five places from #7 to #12 in just one month. For some context, Litecoin’s absence from the Top Ten is a Top Ten Experiment first. It is also the first time since CoinMarketCap has tracked crypto rankings that Litecoin has not been in the Top Ten. Drop outs: After thirty-three months of this experiment 50% of the cryptos that started 2018 in the Top Ten have dropped out. NEM, Litecoin, Dash, IOTA, and Stellar have been replaced by Binance Coin, Tether,BSV, LINK, and most recently, DOT. September Winners – Although it lost -8% of its value, this month’s W goes to Bitcoin. ADA gets second place, down -15% and climbing back into the Top Ten. September Losers – As most probably expected after an extremely out of character victory last month, NEM came back down to earth in September, bigly, down -26%. Litecoin finished right behind, down -24% and dropping out of the Top Ten. For the overly competitive, below is a tally of the winners of the first 33 months of the 2018 Top Ten Crypto Index Fund Experiment. Bitcoin still has the most monthly wins (8) and Cardano in second place with 6 monthly wins. With its poor September performance, NEM now has 7 monthly losses. Ws and Ls - One clear winner Every crypto has at least one monthly win and Bitcoin is unique as the only cryptocurrency that hasn’t lost a month yet since January 2018.
Overall update – BTC solidly in the lead, followed by ETH. Dash in the basement, LTC drops out of the Top Ten.
Even though BTC took a bit of a detour on its way back to break-even point, it is still far ahead of the field, down -17% since January 2018. The initial investment of $100 thirty-three months ago is now worth about $83. Second place Ethereum is down -49% over the same time period. At this point in the 2018 Top Ten Experiment, Dash is at the bottom. It is currently worth $70.49, down from a January 1st, 2018 starting price of over $1,000. That’s a loss of -93%. The initial $100 invested in Dash 33 months ago is now worth $6.77. The big story this month is LTC’s departure from the Top Ten, the first time since I started the experiment back in January 2018. Whether or not it will eventually fend off the new generation of coins remains to be seen, but it certainly is noteworthy to have one of the most well known and long standing cryptos drop out of the Top Ten. Consider pouring one out for Litecoin.
Total Market Cap for the entire cryptocurrency sector:
The crypto market lost over $35B in September and is down -39% since January 2018. The value of the overall crypto market is near where it was in August of this year, just a few months back. As painful as the beginning of the month was, looking at a table like this helps with perspective, especially if you’re panic prone.
After steadily dipping for months, BitDom increased a bit in September, up to 57.5%. For some context: since the beginning of the experiment, the range of Bitcoin dominance has been quite wide: we saw a high of 70% BitDom in September 2019 and a low of 33% BitDom in February 2018.
Overall return on $1,000 investment since January 1st, 2018:
The 2018 Top Ten Portfolio lost -$50 this month. If I cashed out today, the $1000 initial investment would return about $238, down -76% from January 2018. September broke an encouraging upward trend, but at least the portfolio is taking a break from the -80% range. Here’s a look at the ROI over the life of the experiment, month by month, for some context: 33 Monthly ROIs on Top Ten since Jan 2018 The absolute bottom was -88% back in January 2019. So the Top Ten Cryptos of 2018 are down -76%. What about the 2019 and 2020 Top Tens? Let’s take a look:
So overall? Taking the three portfolios together, here’s the bottom bottom bottom line: After a $3000 investment in the 2018, 2019, and 2020 Top Ten Cryptocurrencies, my combined portfolios are worth $3,340 ($238+ $1,538 +$1,564). That’s up about +11% for the three combined portfolios, compared to +31% last month. Here’s a table to help visualize: Combined ROI on $3k over 3 years - UP +11% That’s a +11% gain by investing $1k on whichever cryptos happened to be in the Top Ten on January 1st for three straight years. But surely you’d do better if you went all in on one crypto, right? Depends on your choice. Let’s take a look: ETH for the win Only five cryptos have started in the Top Ten for all three years: BTC, ETH, XRP, BCH, and LTC (unless Litecoin can make a comeback by the 1st of Jan. 2021, it’s not going to make the four year club!). Knowing what we know now, which one would have been best to go all in on? Ethereum, by a pretty good margin: the initial $3k would be up +104%, worth $6,118 today. The worst choice of a basket to put all your eggs in at this point in the experiment is XRP, down by almost one third.
Comparison to S&P 500:
I’m also tracking the S&P 500 as part of the experiment to have a comparison point with other popular investments options. The S&P 500 Index fell from an all time high in August, but is currently up +26% since January 2018. S&P since Jan. 2018 The initial $1k investment into crypto on January 1st, 2018 would have been worth about $1260 had it been redirected to the S&P. But what if I took the same invest-$1,000-on-January-1st-of-each-year approach with the S&P 500 that I’ve been documenting through the Top Ten Crypto Experiments? Here are the numbers:
$1000 investment in S&P 500 on January 1st, 2018 = $1260 today
$1000 investment in S&P 500 on January 1st, 2019 = $1350 today
$1000 investment in S&P 500 on January 1st, 2020 = $1050 today
Taken together, here’s the bottom bottom bottom line for a similar approach with the S&P: After three $1,000 investments into an S&P 500 index fund in January 2018, 2019, and 2020, my portfolio would be worth $3,660. That is up +22%since January 2018, compared to a +11% gain of the combined Top Ten Crypto Experiment Portfolios. That’s an 11% swing in favor of the S&P 500 and breaks a two month mini-streak of wins from the Top Ten crypto portfolios. S&P vs. Top Ten Crypto Experiments That’s seven monthly victories for the S&P vs. two monthly victories for crypto. The largest gap so far was a 22% difference in favor of the S&P in June.
September was a tough month for both traditional and crypto markets. What’s next for the rest of 2020? More volatility is no doubt to come as we enter the last quarter of a truly unpredictable and exhausting year. Buckle up. Thanks for reading and for supporting the experiment. I hope you’ve found it helpful. I continue to be committed to seeing this process through and reporting along the way. Feel free to reach out with any questions and stay tuned for progress reports. Keep an eye out for my parallel projects where I repeat the experiment twice, purchasing another $1000 ($100 each) of two new sets of Top Ten cryptos as of January 1st, 2019 then again on January 1st, 2020.
And the Answer is…
C) Kraken According to an official announcement in September, Kraken is “the first digital asset company in U.S. history to receive a bank charter recognized under federal and state law.”
Brief Comments on Goguen: Q4 2020, Q1 2021, utility, Marlowe, DSL, Glow, Plutus, IELE, smart contracts, thanksgiving to you, sidechains and Hydra, Goguen rollout and additions to product update
Summary: Everyone knows that when you give your assets to someone else, they always keep them safe. If this is true for individuals, it is certainly true for businesses. Custodians always tell the truth and manage funds properly. They won't have any interest in taking the assets as an exchange operator would. Auditors tell the truth and can't be misled. That's because organizations that are regulated are incapable of lying and don't make mistakes. First, some background. Here is a summary of how custodians make us more secure: Previously, we might give Alice our crypto assets to hold. There were risks:
Alice might take the assets and disappear.
Alice might spend the assets and pretend that she still has them (fractional model).
Alice might store the assets insecurely and they'll get stolen.
Alice might give the assets to someone else by mistake or by force.
Alice might lose access to the assets.
But "no worries", Alice has a custodian named Bob. Bob is dressed in a nice suit. He knows some politicians. And he drives a Porsche. "So you have nothing to worry about!". And look at all the benefits we get:
Alice can't take the assets and disappear (unless she asks Bob or never gives them to Bob).
Alice can't spend the assets and pretend that she still has them. (Unless she didn't give them to Bob or asks him for them.)
Alice can't store the assets insecurely so they get stolen. (After all - she doesn't have any control over the withdrawal process from any of Bob's systems, right?)
Alice can't give the assets to someone else by mistake or by force. (Bob will stop her, right Bob?)
Alice can't lose access to the funds. (She'll always be present, sane, and remember all secrets, right?)
See - all problems are solved! All we have to worry about now is:
Bob might take the assets and disappear.
Bob might spend the assets and pretend that he still has them (fractional model).
Bob might store the assets insecurely and they'll get stolen.
Bob might give the assets to someone else by mistake or by force.
Bob might lose access to the assets.
It's pretty simple. Before we had to trust Alice. Now we only have to trust Alice, Bob, and all the ways in which they communicate. Just think of how much more secure we are! "On top of that", Bob assures us, "we're using a special wallet structure". Bob shows Alice a diagram. "We've broken the balance up and store it in lots of smaller wallets. That way", he assures her, "a thief can't take it all at once". And he points to a historic case where a large sum was taken "because it was stored in a single wallet... how stupid". "Very early on, we used to have all the crypto in one wallet", he said, "and then one Christmas a hacker came and took it all. We call him the Grinch. Now we individually wrap each crypto and stick it under a binary search tree. The Grinch has never been back since." "As well", Bob continues, "even if someone were to get in, we've got insurance. It covers all thefts and even coercion, collusion, and misplaced keys - only subject to the policy terms and conditions." And with that, he pulls out a phone-book sized contract and slams it on the desk with a thud. "Yep", he continues, "we're paying top dollar for one of the best policies in the country!" "Can I read it?' Alice asks. "Sure," Bob says, "just as soon as our legal team is done with it. They're almost through the first chapter." He pauses, then continues. "And can you believe that sales guy Mike? He has the same year Porsche as me. I mean, what are the odds?" "Do you use multi-sig?", Alice asks. "Absolutely!" Bob replies. "All our engineers are fully trained in multi-sig. Whenever we want to set up a new wallet, we generate 2 separate keys in an air-gapped process and store them in this proprietary system here. Look, it even requires the biometric signature from one of our team members to initiate any withdrawal." He demonstrates by pressing his thumb into the display. "We use a third-party cloud validation API to match the thumbprint and authorize each withdrawal. The keys are also backed up daily to an off-site third-party." "Wow that's really impressive," Alice says, "but what if we need access for a withdrawal outside of office hours?" "Well that's no issue", Bob says, "just send us an email, call, or text message and we always have someone on staff to help out. Just another part of our strong commitment to all our customers!" "What about Proof of Reserve?", Alice asks. "Of course", Bob replies, "though rather than publish any blockchain addresses or signed transaction, for privacy we just do a SHA256 refactoring of the inverse hash modulus for each UTXO nonce and combine the smart contract coefficient consensus in our hyperledger lightning node. But it's really simple to use." He pushes a button and a large green checkmark appears on a screen. "See - the algorithm ran through and reserves are proven." "Wow", Alice says, "you really know your stuff! And that is easy to use! What about fiat balances?" "Yeah, we have an auditor too", Bob replies, "Been using him for a long time so we have quite a strong relationship going! We have special books we give him every year and he's very efficient! Checks the fiat, crypto, and everything all at once!" "We used to have a nice offline multi-sig setup we've been using without issue for the past 5 years, but I think we'll move all our funds over to your facility," Alice says. "Awesome", Bob replies, "Thanks so much! This is perfect timing too - my Porsche got a dent on it this morning. We have the paperwork right over here." "Great!", Alice replies. And with that, Alice gets out her pen and Bob gets the contract. "Don't worry", he says, "you can take your crypto-assets back anytime you like - just subject to our cancellation policy. Our annual management fees are also super low and we don't adjust them often". How many holes have to exist for your funds to get stolen? Just one. Why are we taking a powerful offline multi-sig setup, widely used globally in hundreds of different/lacking regulatory environments with 0 breaches to date, and circumventing it by a demonstrably weak third party layer? And paying a great expense to do so? If you go through the list of breaches in the past 2 years to highly credible organizations, you go through the list of major corporate frauds (only the ones we know about), you go through the list of all the times platforms have lost funds, you go through the list of times and ways that people have lost their crypto from identity theft, hot wallet exploits, extortion, etc... and then you go through this custodian with a fine-tooth comb and truly believe they have value to add far beyond what you could, sticking your funds in a wallet (or set of wallets) they control exclusively is the absolute worst possible way to take advantage of that security. The best way to add security for crypto-assets is to make a stronger multi-sig. With one custodian, what you are doing is giving them your cryptocurrency and hoping they're honest, competent, and flawlessly secure. It's no different than storing it on a really secure exchange. Maybe the insurance will cover you. Didn't work for Bitpay in 2015. Didn't work for Yapizon in 2017. Insurance has never paid a claim in the entire history of cryptocurrency. But maybe you'll get lucky. Maybe your exact scenario will buck the trend and be what they're willing to cover. After the large deductible and hopefully without a long and expensive court battle. And you want to advertise this increase in risk, the lapse of judgement, an accident waiting to happen, as though it's some kind of benefit to customers ("Free institutional-grade storage for your digital assets.")? And then some people are writing to the OSC that custodians should be mandatory for all funds on every exchange platform? That this somehow will make Canadians as a whole more secure or better protected compared with standard air-gapped multi-sig? On what planet? Most of the problems in Canada stemmed from one thing - a lack of transparency. If Canadians had known what a joke Quadriga was - it wouldn't have grown to lose $400m from hard-working Canadians from coast to coast to coast. And Gerald Cotten would be in jail, not wherever he is now (at best, rotting peacefully). EZ-BTC and mister Dave Smilie would have been a tiny little scam to his friends, not a multi-million dollar fraud. Einstein would have got their act together or been shut down BEFORE losing millions and millions more in people's funds generously donated to criminals. MapleChange wouldn't have even been a thing. And maybe we'd know a little more about CoinTradeNewNote - like how much was lost in there. Almost all of the major losses with cryptocurrency exchanges involve deception with unbacked funds. So it's great to see transparency reports from BitBuy and ShakePay where someone independently verified the backing. The only thing we don't have is:
ANY CERTAINTY BALANCES WEREN'T EXCLUDED. Quadriga's largest account was $70m. 80% of funds are in 20% of accounts (Pareto principle). All it takes is excluding a few really large accounts - and nobody's the wiser. A fractional platform can easily pass any audit this way.
ANY VISIBILITY WHATSOEVER INTO THE CUSTODIANS. BitBuy put out their report before moving all the funds to their custodian and ShakePay apparently can't even tell us who the custodian is. That's pretty important considering that basically all of the funds are now stored there.
ANY IDEA ABOUT THE OTHER EXCHANGES. In order for this to be effective, it has to be the norm. It needs to be "unusual" not to know. If obscurity is the norm, then it's super easy for people like Gerald Cotten and Dave Smilie to blend right in.
It's not complicated to validate cryptocurrency assets. They need to exist, they need to be spendable, and they need to cover the total balances. There are plenty of credible people and firms across the country that have the capacity to reasonably perform this validation. Having more frequent checks by different, independent, parties who publish transparent reports is far more valuable than an annual check by a single "more credible/official" party who does the exact same basic checks and may or may not publish anything. Here's an example set of requirements that could be mandated:
First report within 1 month of launching, another within 3 months, and further reports at minimum every 6 months thereafter.
No auditor can be repeated within a 12 month period.
All reports must be public, identifying the auditor and the full methodology used.
All auditors must be independent of the firm being audited with no conflict of interest.
Reports must include the percentage of each asset backed, and how it's backed.
The auditor publishes a hash list, which lists a hash of each customer's information and balances that were included. Hash is one-way encryption so privacy is fully preserved. Every customer can use this to have 100% confidence they were included.
If we want more extensive requirements on audits, these should scale upward based on the total assets at risk on the platform, and whether the platform has loaned their assets out.
There are ways to structure audits such that neither crypto assets nor customer information are ever put at risk, and both can still be properly validated and publicly verifiable. There are also ways to structure audits such that they are completely reasonable for small platforms and don't inhibit innovation in any way. By making the process as reasonable as possible, we can completely eliminate any reason/excuse that an honest platform would have for not being audited. That is arguable far more important than any incremental improvement we might get from mandating "the best of the best" accountants. Right now we have nothing mandated and tons of Canadians using offshore exchanges with no oversight whatsoever. Transparency does not prove crypto assets are safe. CoinTradeNewNote, Flexcoin ($600k), and Canadian Bitcoins ($100k) are examples where crypto-assets were breached from platforms in Canada. All of them were online wallets and used no multi-sig as far as any records show. This is consistent with what we see globally - air-gapped multi-sig wallets have an impeccable record, while other schemes tend to suffer breach after breach. We don't actually know how much CoinTrader lost because there was no visibility. Rather than publishing details of what happened, the co-founder of CoinTrader silently moved on to found another platform - the "most trusted way to buy and sell crypto" - a site that has no information whatsoever (that I could find) on the storage practices and a FAQ advising that “[t]rading cryptocurrency is completely safe” and that having your own wallet is “entirely up to you! You can certainly keep cryptocurrency, or fiat, or both, on the app.” Doesn't sound like much was learned here, which is really sad to see. It's not that complicated or unreasonable to set up a proper hardware wallet. Multi-sig can be learned in a single course. Something the equivalent complexity of a driver's license test could prevent all the cold storage exploits we've seen to date - even globally. Platform operators have a key advantage in detecting and preventing fraud - they know their customers far better than any custodian ever would. The best job that custodians can do is to find high integrity individuals and train them to form even better wallet signatories. Rather than mandating that all platforms expose themselves to arbitrary third party risks, regulations should center around ensuring that all signatories are background-checked, properly trained, and using proper procedures. We also need to make sure that signatories are empowered with rights and responsibilities to reject and report fraud. They need to know that they can safely challenge and delay a transaction - even if it turns out they made a mistake. We need to have an environment where mistakes are brought to the surface and dealt with. Not one where firms and people feel the need to hide what happened. In addition to a knowledge-based test, an auditor can privately interview each signatory to make sure they're not in coercive situations, and we should make sure they can freely and anonymously report any issues without threat of retaliation. A proper multi-sig has each signature held by a separate person and is governed by policies and mutual decisions instead of a hierarchy. It includes at least one redundant signature. For best results, 3of4, 3of5, 3of6, 4of5, 4of6, 4of7, 5of6, or 5of7. History has demonstrated over and over again the risk of hot wallets even to highly credible organizations. Nonetheless, many platforms have hot wallets for convenience. While such losses are generally compensated by platforms without issue (for example Poloniex, Bitstamp, Bitfinex, Gatecoin, Coincheck, Bithumb, Zaif, CoinBene, Binance, Bitrue, Bitpoint, Upbit, VinDAX, and now KuCoin), the public tends to focus more on cases that didn't end well. Regardless of what systems are employed, there is always some level of risk. For that reason, most members of the public would prefer to see third party insurance. Rather than trying to convince third party profit-seekers to provide comprehensive insurance and then relying on an expensive and slow legal system to enforce against whatever legal loopholes they manage to find each and every time something goes wrong, insurance could be run through multiple exchange operators and regulators, with the shared interest of having a reputable industry, keeping costs down, and taking care of Canadians. For example, a 4 of 7 multi-sig insurance fund held between 5 independent exchange operators and 2 regulatory bodies. All Canadian exchanges could pay premiums at a set rate based on their needed coverage, with a higher price paid for hot wallet coverage (anything not an air-gapped multi-sig cold wallet). Such a model would be much cheaper to manage, offer better coverage, and be much more reliable to payout when needed. The kind of coverage you could have under this model is unheard of. You could even create something like the CDIC to protect Canadians who get their trading accounts hacked if they can sufficiently prove the loss is legitimate. In cases of fraud, gross negligence, or insolvency, the fund can be used to pay affected users directly (utilizing the last transparent balance report in the worst case), something which private insurance would never touch. While it's recommended to have official policies for coverage, a model where members vote would fully cover edge cases. (Could be similar to the Supreme Court where justices vote based on case law.) Such a model could fully protect all Canadians across all platforms. You can have a fiat coverage governed by legal agreements, and crypto-asset coverage governed by both multi-sig and legal agreements. It could be practical, affordable, and inclusive. Now, we are at a crossroads. We can happily give up our freedom, our innovation, and our money. We can pay hefty expenses to auditors, lawyers, and regulators year after year (and make no mistake - this cost will grow to many millions or even billions as the industry grows - and it will be borne by all Canadians on every platform because platforms are not going to eat up these costs at a loss). We can make it nearly impossible for any new platform to enter the marketplace, forcing Canadians to use the same stagnant platforms year after year. We can centralize and consolidate the entire industry into 2 or 3 big players and have everyone else fail (possibly to heavy losses of users of those platforms). And when a flawed security model doesn't work and gets breached, we can make it even more complicated with even more people in suits making big money doing the job that blockchain was supposed to do in the first place. We can build a system which is so intertwined and dependent on big government, traditional finance, and central bankers that it's future depends entirely on that of the fiat system, of fractional banking, and of government bail-outs. If we choose this path, as history has shown us over and over again, we can not go back, save for revolution. Our children and grandchildren will still be paying the consequences of what we decided today. Or, we can find solutions that work. We can maintain an open and innovative environment while making the adjustments we need to make to fully protect Canadian investors and cryptocurrency users, giving easy and affordable access to cryptocurrency for all Canadians on the platform of their choice, and creating an environment in which entrepreneurs and problem solvers can bring those solutions forward easily. None of the above precludes innovation in any way, or adds any unreasonable cost - and these three policies would demonstrably eliminate or resolve all 109 historic cases as studied here - that's every single case researched so far going back to 2011. It includes every loss that was studied so far not just in Canada but globally as well. Unfortunately, finding answers is the least challenging part. Far more challenging is to get platform operators and regulators to agree on anything. My last post got no response whatsoever, and while the OSC has told me they're happy for industry feedback, I believe my opinion alone is fairly meaningless. This takes the whole community working together to solve. So please let me know your thoughts. Please take the time to upvote and share this with people. Please - let's get this solved and not leave it up to other people to do. Facts/background/sources (skip if you like):
The inspiration for the paragraph about splitting wallets was an actual quote from a Canadian company providing custodial services in response to the OSC consultation paper: "We believe that it will be in the in best interests of investors to prohibit pooled crypto assets or ‘floats’. Most Platforms pool assets, citing reasons of practicality and expense. The recent hack of the world’s largest Platform – Binance – demonstrates the vulnerability of participants’ assets when such concessions are made. In this instance, the Platform’s entire hot wallet of Bitcoins, worth over $40 million, was stolen, facilitated in part by the pooling of client crypto assets." "the maintenance of participants (and Platform) crypto assets across multiple wallets distributes the related risk and responsibility of security - reducing the amount of insurance coverage required and making insurance coverage more readily obtainable". For the record, their reply also said nothing whatsoever about multi-sig or offline storage.
In addition to the fact that the $40m hack represented only one "hot wallet" of Binance, and they actually had the vast majority of assets in other wallets (including mostly cold wallets), multiple real cases have clearly demonstrated that risk is still present with multiple wallets. Bitfinex, VinDAX, Bithumb, Altsbit, BitPoint, Cryptopia, and just recently KuCoin all had multiple wallets breached all at the same time, and may represent a significantly larger impact on customers than the Binance breach which was fully covered by Binance. To represent that simply having multiple separate wallets under the same security scheme is a comprehensive way to reduce risk is just not true.
Private insurance has historically never covered a single loss in the cryptocurrency space (at least, not one that I was able to find), and there are notable cases where massive losses were not covered by insurance. Bitpay in 2015 and Yapizon in 2017 both had insurance policies that didn't pay out during the breach, even after a lengthly court process. The same insurance that ShakePay is presently using (and announced to much fanfare) was describe by their CEO himself as covering “physical theft of the media where the private keys are held,” which is something that has never historically happened. As was said with regard to the same policy in 2018 - “I don’t find it surprising that Lloyd’s is in this space,” said Johnson, adding that to his mind the challenge for everybody is figuring out how to structure these policies so that they are actually protective. “You can create an insurance policy that protects no one – you know there are so many caveats to the policy that it’s not super protective.”
The most profitable policy for a private insurance company is one with the most expensive premiums that they never have to pay a claim on. They have no inherent incentive to take care of people who lost funds. It's "cheaper" to take the reputational hit and fight the claim in court. The more money at stake, the more the insurance provider is incentivized to avoid payout. They're not going to insure the assets unless they have reasonable certainty to make a profit by doing so, and they're not going to pay out a massive sum unless it's legally forced. Private insurance is always structured to be maximally profitable to the insurance provider.
The circumvention of multi-sig was a key factor in the massive Bitfinex hack of over $60m of bitcoin, which today still sits being slowly used and is worth over $3b. While Bitfinex used a qualified custodian Bitgo, which was and still is active and one of the industry leaders of custodians, and they set up 2 of 3 multi-sig wallets, the entire system was routed through Bitfinex, such that Bitfinex customers could initiate the withdrawals in a "hot" fashion. This feature was also a hit with the hacker. The multi-sig was fully circumvented.
Bitpay in 2015 was another example of a breach that stole 5,000 bitcoins. This happened not through the exploit of any system in Bitpay, but because the CEO of a company they worked with got their computer hacked and the hackers were able to request multiple bitcoin purchases, which Bitpay honoured because they came from the customer's computer legitimately. Impersonation is a very common tactic used by fraudsters, and methods get more extreme all the time.
A notable case in Canada was the Canadian Bitcoins exploit. Funds were stored on a server in a Rogers Data Center, and the attendee was successfully convinced to reboot the server "in safe mode" with a simple phone call, thus bypassing the extensive security and enabling the theft.
The very nature of custodians circumvents multi-sig. This is because custodians are not just having to secure the assets against some sort of physical breach but against any form of social engineering, modification of orders, fraudulent withdrawal attempts, etc... If the security practices of signatories in a multi-sig arrangement are such that the breach risk of one signatory is 1 in 100, the requirement of 3 independent signatures makes the risk of theft 1 in 1,000,000. Since hackers tend to exploit the weakest link, a comparable custodian has to make the entry and exit points of their platform 10,000 times more secure than one of those signatories to provide equivalent protection. And if the signatories beef up their security by only 10x, the risk is now 1 in 1,000,000,000. The custodian has to be 1,000,000 times more secure. The larger and more complex a system is, the more potential vulnerabilities exist in it, and the fewer people can understand how the system works when performing upgrades. Even if a system is completely secure today, one has to also consider how that system might evolve over time or work with different members.
By contrast, offline multi-signature solutions have an extremely solid record, and in the entire history of cryptocurrency exchange incidents which I've studied (listed here), there has only been one incident (796 exchange in 2015) involving an offline multi-signature wallet. It happened because the customer's bitcoin address was modified by hackers, and the amount that was stolen ($230k) was immediately covered by the exchange operators. Basically, the platform operators were tricked into sending a legitimate withdrawal request to the wrong address because hackers exploited their platform to change that address. Such an issue would not be prevented in any way by the use of a custodian, as that custodian has no oversight whatsoever to the exchange platform. It's practical for all exchange operators to test large withdrawal transactions as a general policy, regardless of what model is used, and general best practice is to diagnose and fix such an exploit as soon as it occurs.
False promises on the backing of funds played a huge role in the downfall of Quadriga, and it's been exposed over and over again (MyCoin, PlusToken, Bitsane, Bitmarket, EZBTC, IDAX). Even today, customers have extremely limited certainty on whether their funds in exchanges are actually being backed or how they're being backed. While this issue is not unique to cryptocurrency exchanges, the complexity of the technology and the lack of any regulation or standards makes problems more widespread, and there is no "central bank" to come to the rescue as in the 2008 financial crisis or during the great depression when "9,000 banks failed".
In addition to fraudulent operations, the industry is full of cases where operators have suffered breaches and not reported them. Most recently, Einstein was the largest case in Canada, where ongoing breaches and fraud were perpetrated against the platform for multiple years and nobody found out until the platform collapsed completely. While fraud and breaches suck to deal with, they suck even more when not dealt with. Lack of visibility played a role in the largest downfalls of Mt. Gox, Cryptsy, and Bitgrail. In some cases, platforms are alleged to have suffered a hack and keep operating without admitting it at all, such as CoinBene.
It surprises some to learn that a cryptographic solution has already existed since 2013, and gained widespread support in 2014 after Mt. Gox. Proof of Reserves is a full cryptographic proof that allows any customer using an exchange to have complete certainty that their crypto-assets are fully backed by the platform in real-time. This is accomplished by proving that assets exist on the blockchain, are spendable, and fully cover customer deposits. It does not prove safety of assets or backing of fiat assets.
If we didn't care about privacy at all, a platform could publish their wallet addresses, sign a partial transaction, and put the full list of customer information and balances out publicly. Customers can each check that they are on the list, that the balances are accurate, that the total adds up, and that it's backed and spendable on the blockchain. Platforms who exclude any customer take a risk because that customer can easily check and see they were excluded. So together with all customers checking, this forms a full proof of backing of all crypto assets.
However, obviously customers care about their private information being published. Therefore, a hash of the information can be provided instead. Hash is one-way encryption. The hash allows the customer to validate inclusion (by hashing their own known information), while anyone looking at the list of hashes cannot determine the private information of any other user. All other parts of the scheme remain fully intact. A model like this is in use on the exchange CoinFloor in the UK.
A Merkle tree can provide even greater privacy. Instead of a list of balances, the balances are arranged into a binary tree. A customer starts from their node, and works their way to the top of the tree. For example, they know they have 5 BTC, they plus 1 other customer hold 7 BTC, they plus 2-3 other customers hold 17 BTC, etc... until they reach the root where all the BTC are represented. Thus, there is no way to find the balances of other individual customers aside from one unidentified customer in this case.
Proposals such as this had the backing of leaders in the community including Nic Carter, Greg Maxwell, and Zak Wilcox. Substantial and significant effort started back in 2013, with massive popularity in 2014. But what became of that effort? Very little. Exchange operators continue to refuse to give visibility. Despite the fact this information can often be obtained through trivial blockchain analysis, no Canadian platform has ever provided any wallet addresses publicly. As described by the CEO of Newton "For us to implement some kind of realtime Proof of Reserves solution, which I'm not opposed to, it would have to ... Preserve our users' privacy, as well as our own. Some kind of zero-knowledge proof". Kraken describes here in more detail why they haven't implemented such a scheme. According to professor Eli Ben-Sasson, when he spoke with exchanges, none were interested in implementing Proof of Reserves.
And yet, Kraken's places their reasoning on a page called "Proof of Reserves". More recently, both BitBuy and ShakePay have released reports titled "Proof of Reserves and Security Audit". Both reports contain disclaimers against being audits. Both reports trust the customer list provided by the platform, leaving the open possibility that multiple large accounts could have been excluded from the process. Proof of Reserves is a blockchain validation where customers see the wallets on the blockchain. The report from Kraken is 5 years old, but they leave it described as though it was just done a few weeks ago. And look at what they expect customers to do for validation. When firms represent something being "Proof of Reserve" when it's not, this is like a farmer growing fruit with pesticides and selling it in a farmers market as organic produce - except that these are people's hard-earned life savings at risk here. Platforms are misrepresenting the level of visibility in place and deceiving the public by their misuse of this term. They haven't proven anything.
Fraud isn't a problem that is unique to cryptocurrency. Fraud happens all the time. Enron, WorldCom, Nortel, Bear Stearns, Wells Fargo, Moser Baer, Wirecard, Bre-X, and Nicola are just some of the cases where frauds became large enough to become a big deal (and there are so many countless others). These all happened on 100% reversible assets despite regulations being in place. In many of these cases, the problems happened due to the over-complexity of the financial instruments. For example, Enron had "complex financial statements [which] were confusing to shareholders and analysts", creating "off-balance-sheet vehicles, complex financing structures, and deals so bewildering that few people could understand them". In cryptocurrency, we are often combining complex financial products with complex technologies and verification processes. We are naïve if we think problems like this won't happen. It is awkward and uncomfortable for many people to admit that they don't know how something works. If we want "money of the people" to work, the solutions have to be simple enough that "the people" can understand them, not so confusing that financial professionals and technology experts struggle to use or understand them.
For those who question the extent to which an organization can fool their way into a security consultancy role, HB Gary should be a great example to look at. Prior to trying to out anonymous, HB Gary was being actively hired by multiple US government agencies and others in the private sector (with glowing testimonials). The published articles and hosted professional security conferences. One should also look at this list of data breaches from the past 2 years. Many of them are large corporations, government entities, and technology companies. These are the ones we know about. Undoubtedly, there are many more that we do not know about. If HB Gary hadn't been "outted" by anonymous, would we have known they were insecure? If the same breach had happened outside of the public spotlight, would it even have been reported? Or would HB Gary have just deleted the Twitter posts, brought their site back up, done a couple patches, and kept on operating as though nothing had happened?
In the case of Quadriga, the facts are clear. Despite past experience with platforms such as MapleChange in Canada and others around the world, no guidance or even the most basic of a framework was put in place by regulators. By not clarifying any sort of legal framework, regulators enabled a situation where a platform could be run by former criminal Mike Dhanini/Omar Patryn, and where funds could be held fully unchecked by one person. At the same time, the lack of regulation deterred legitimate entities from running competing platforms and Quadriga was granted a money services business license for multiple years of operation, which gave the firm the appearance of legitimacy. Regulators did little to protect Canadians despite Quadriga failing to file taxes from 2016 onward. The entire administrative team had resigned and this was public knowledge. Many people had suspicions of what was going on, including Ryan Mueller, who forwarded complaints to the authorities. These were ignored, giving Gerald Cotten the opportunity to escape without justice.
There are multiple issues with the SOC II model including the prohibitive cost (you have to find a third party accounting firm and the prices are not even listed publicly on any sites), the requirement of operating for a year (impossible for new platforms), and lack of any public visibility (SOC II are private reports that aren't shared outside the people in suits).
Securities frameworks are expensive. Sarbanes-Oxley is estimated to cost $5.1 million USD/yr for the average Fortune 500 company in the United States. Since "Fortune 500" represents the top 500 companies, that means well over $2.55 billion USD (~$3.4 billion CAD) is going to people in suits. Isn't the problem of trust and verification the exact problem that the blockchain is supposed to solve?
To use Quadriga as justification for why custodians or SOC II or other advanced schemes are needed for platforms is rather silly, when any framework or visibility at all, or even the most basic of storage policies, would have prevented the whole thing. It's just an embarrassment.
We are now seeing regulators take strong action. CoinSquare in Canada with multi-million dollar fines. BitMex from the US, criminal charges and arrests. OkEx, with full disregard of withdrawals and no communication. Who's next?
We have a unique window today where we can solve these problems, and not permanently destroy innovation with unreasonable expectations, but we need to act quickly. This is a unique historic time that will never come again.
Everyone and his grandma know what cryptocurrency mining is. Well, they may not indeed know what it actually is, in technical terms, but they have definitely heard the phrase as it is hard to miss the news about mining sucking in energy like a black hole gobbles up matter. On the other hand, staking, its little bro, has mostly been hiding in the shadows until recently. by StealthEX Today, with DeFi making breaking news across the cryptoverse, staking has become a new buzzword in the blockchain space and beyond, along with the fresh entries to the crypto asset investor’s vocabulary such as “yield farming”, “rug pull”, “total value locked”, and similar arcane stuff. If you are not scared off yet, then read on. Though we can’t promise you won’t be.
Cryptocurrency staking, little brother of crypto mining
There are two conceptually different approaches to achieving consensus in a distributed network, which comes down to transaction validation in the case of a cryptocurrency blockchain. You are most certainly aware of cryptocurrency mining, which is used with cryptocurrencies based on the Proof-of-Work (PoW) consensus algorithm such as Bitcoin and Ether (so far). Here miners compete against each other with their computational resources for finding the next block on the blockchain and getting a reward. Another approach, known as the Proof-of-Stake (PoS) consensus mechanism, is based not on the race among computational resources as is the case with PoW, but on the competition of balances, or stakes. In simple words, every holder of at least one stake, a minimally sufficient amount of crypto, can actively participate in creating blocks and thus also earn rewards under such network consensus model. This process came to be known as staking, and it can be loosely thought of as mining in the PoS environment. With that established, let’s now see why, after so many years of what comes pretty close to oblivion, it has turned into such a big thing.
Why has staking become so popular, all of a sudden?
The renewed popularity of staking came with the explosive expansion of decentralized finance, or DeFi for short. Essentially, staking is one of the ways to tap into the booming DeFi market, allowing users to earn staking rewards on a class of digital assets that DeFi provides easy access to. Technically, it is more correct to speak of DeFi staking as a new development of an old concept that enjoys its second coming today, or new birth if you please. So what’s the point? With old-school cryptocurrency staking, you would have to manually set up and run a validating node on a cryptocurrency network that uses a PoS consensus algo, having to keep in mind all the gory details of a specific protocol so as not to shoot yourself in the foot. This is where you should have already started to enjoy jitters if you were to take this avenu entirely on your own. Just think of it as having to run a Bitcoin mining rig for some pocket money. Put simply, DeFi staking frees you from all that hassle. At this point, let’s recall what decentralized finance is and what it strives to achieve. In broad terms, DeFi aims at offering the same products and services available today in the traditional financial world, but in a trutless and decentralized way. From this perspective, DeFi staking reseblems conventional banking where people put their money in savings accounts to earn interest. Indeed, you could try to lend out your shekels all by yourself, with varying degrees of success, but banks make it far more convenient and secure. The maturation of the DeFi space advanced the emergence of staking pools and Staking-as-a-Service (SaaS) providers that run nodes for PoS cryptocurrencies on your behalf, allowing you to stake your coins and receive staking rewards. In today’s world, interest rates on traditional savings accounts are ridiculous, while government spending, a handy euphemism for relentless money printing aka fiscal stimulus, is already translating into runaway inflation. Against this backdrop, it is easy to see why staking has been on the rise.
Okay, what are my investment options?
Now that we have gone through the basics of the state-of-the-art cryptocurrency staking, you may ask what are the options actually available for a common crypto enthusiast to earn from it? Many high-caliber exchanges like Binance or Bitfinex as well as online wallets such as Coinbase offer staking of PoS coins. In most cases, you don’t even need to do anything aside from simply holding your coins there to start receiving rewards as long as you are eligible and meet the requirements. This is called exchange staking. Further, there are platforms that specialize in staking digital assets. These are known as Staking-as-a-Service providers, while this form of staking is often referred to as soft staking. They enable even non-tech savvy customers to stake their PoS assets through a third party service, with all the technical stuff handled by the service provider. Most of these services are custodial, with the implication being that you no longer control your coins after you stake them. Figment Networks, MyContainer, Stake Capital are easily the most recognized among SaaS providers. However, while exchange staking and soft staking have everything to do with finance, they have little to nothing to do with the decentralized part of it, which is, for the record, the primary value proposition of the entire DeFi ecosystem. The point is, you have to deposit the stakable coins into your wallet with these services. And how can it then be considered decentralized? Nah, because DeFi is all about going trustless, no third parties, and, in a narrow sense, no staking that entails the transfer of private keys. This form of staking is called non-custodial, and it is of particular interest from the DeFi point of view. If you read our article about DeFi, you already know how it is possible, so we won’t dwell on this (if, on the off chance, you didn’t, it’s time to catch up). As DeFi continues to evolve, platforms that allow trustless staking with which you maintain full custody of your coins are set to emerge as well. The space is relatively new, with Staked being probably the first in the field. This type of staking allows you to remain in complete control of your funds, and it perfectly matches DeFi’s ethos, goals and ideals. Still, our story wouldn’t be complete if we didn’t mention utility tokens where staking may serve a whole range of purposes other than supporting the token network or obtaining passive income. For example, with platforms that deploy blockchain oracles such as Nexus Mutual, a decentralized insurance platform, staking tokens is necessary for encouraging correct reporting on certain events or reaching a consensus on a specific claim. In the case of Nexus Mutual, its membership token NXM is used by the token holders, the so-called assessors, for validating insurance claims. If they fail to assess claims correctly, their stakes are burned. Another example is Particl Marketplace, a decentralized eCommerce platform, which designed a standalone cryptocurrency dubbed PART. It can be used both as a cryptocurrency in its own right outside the marketplace and as a stakable utility token giving stakers voting rights facilitating the decentralized governance of the entire platform. Yet another example is the instant non-custodial cryptocurrency exchange service, ChangeNOW, that also recently came up with its stakable token, NOW Token, to be used as an internal currency and a means of earning passive income.
Nowadays, with most economies on pause or going downhill, staking has become a new avenue for generating passive income outside the traditional financial system. As DeFi continues to eat away at services previously being exclusively provided by conventional financial and banking sectors, we should expect more people to get involved in this activity along with more businesses dipping their toes into these uncharted waters. Achieving network consensus, establishing decentralized governance, and earning passive income are only three use cases for cryptocurrency staking. No matter how important they are, and they certainly are, there are many other uses along different dimensions that staking can be quite helpful and instrumental for. Again, we are mostly in uncharted waters here, and we can’t reliably say what the future holds for us. On the other hand, we can go and invent it. This should count as next. And remember if you need to exchange your coins StealthEX is here for you. We provide a selection of more than 250 coins and constantly updating the list so that our customers will find a suitable option. Our service does not require registration and allows you to remain anonymous. Why don’t you check it out? Just go to StealthEX and follow these easy steps: ✔ Choose the pair and the amount for your exchange. For example ETH to BTC. ✔ Press the “Start exchange” button. ✔ Provide the recipient address to which the coins will be transferred. ✔ Move your cryptocurrency for the exchange. ✔ Receive your coins! The views and opinions expressed here are solely those of the author. Every investment and trading move involves risk. You should conduct your own research when making a decision. Original article was posted onhttps://stealthex.io/blog/2020/09/08/cryptocurrency-staking-as-it-stands-today/
The events of a SIM swap attack (and defense tips)
Posted this on Coinbase and someone recommend it also be posted here. The information below on an attempted SIM swap attack was pieced together through a combination of login and security logs, recovering emails initiated by the attacker that were deleted and then deleted again from the trash folder, and learning from AT&T’s fraud representatives. The majority if this is factual, and we do our best to note where we are speculating or providing a circumstantial suspicion. TLDRs at the bottom. The full story: We were going about our business and received a text from AT&T that says “…Calls & texts will go to your new phone/SIM card. Call 866-563-4705 if you did not request.” We did not request this, and were suspicious that the text itself could be a phishing scam since we searched the phone number and it wasn’t overtly associated with AT&T. Thus, we tried calling AT&T’s main line at 611 but all we hear is beep beep beep. The phone number is already gone. We use another phone to call AT&T and at the same time start working on our already compromised email. While we didn’t see everything real time, this is what the recovered emails show. In less than 2 minutes after receiving the text from AT&T, there is already an email indicating that the stolen phone number was used to sign into our email account associated with Coinbase. 2 minutes after that, there is an email from Coinbase saying: "We have received your request for password reset from an unverified device. As a security precaution, an e-mail with a reset link will be sent to you in 24 hours. Alternatively, if you would like your password reset to be processed immediately, please submit a request using a verified device. This 24 hour review period is designed to protect your Coinbase account." This is where Coinbase got it right to have a 24 hour review period (actually a recovery period) before allowing the password to be reset. However, the attackers knew this and planned to steal the second email from Coinbase by setting email rules to forward all emails to a burner address and also have any emails containing “coinbase” re-routed so they don’t appear in the Inbox. 5 minutes later, they request a password reset from Gemini and the password was reset to the attacker’s password within a minute after that. The next minute they target and reset DropBox’s password followed immediately with Binance. Less than 2 minutes later, an email from Binance indicates that the password has been reset and another email arrives a minute later indicating a new device has been authorized. It’s at this point that we begin locking the attacker out by (1) removing the phone number as 2FA (2) changing the email password, (3) and three forcing a logout of all sessions from the email. There was a bit of back and forth where they still had an active login and re-added the stolen phone number as 2FA. They added only one more password reset to a gaming account that was not deleted. I can only suspect that was a decoy to make it look like the attack was directed at gaming rather than finances. The Gemini and Binance accounts were empty and effectively abandoned, with no balances and inactive bank accounts (if any), and no transactions in 1-3 years. DropBox had no meaningful files (they probably look for private keys and authenticator backups) and the phone number they stole from us was suspended, so as far as the attacker is concerned, there is no meat on this bone to attack again… unless they had inside information. This is where I suspect someone internal at Coinbase receiving wire deposits has been compromised in tipping off ripe accounts – accounts with new and somewhat large balances. We had completed a full withdrawal of funds from Coinbase earlier in the year, and had a balance of less than $20 heading into May. Deposits to Coinbase staggered in to get above six figures through mid-May then stopped. The attack occurred 7 days after the last large wire deposit was made to Coinbase. From the perspective of an attacker that had no inside information, we were a dead end with abandoned Gemini and Binance accounts with zero balances and stale transactions, no DropBox information, and the suspended phone number access. Our Coinbase deposits were known to no one except us, Coinbase, and our bank. We were also able to stop the hacker’s email forwarding before Coinbase’s 24 hour period to send the password reset, so this one didn’t work out for the attackers and it would make sense for them to move on to the next rather than put efforts into a second attack only for Coinbase - for what would appear to be a zero-balance Coinbase account based on the other stale accounts. Then…23 hours and 42 minutes after the first attack, another message from AT&T “…Calls & texts will go to your new phone/SIM card. Call 866-563-4705 if you did not request.” Here we go again. We had been confident in AT&T’s assurances that our account had been locked and would not be SIM swapped again, so we unwisely added the phone number back to our email account as a backup (it’s now removed permanently and we use burner emails for account recovery like we should have all along). Upon seeing that our phone number had been stolen again I knew they were after the Coinbase reset email that was delayed by 24 hours from Coinbase as part of their security. We did 4 things within 2 minutes of that text: (1) removed the phone number again from the email account – this time for good, (2) market sell all Bitcoin on Coinbase, (3) withdraw from Coinbase, (4) have AT&T suspend service on the phone line. In speaking with AT&T, they were floored that our SIM would be transferred again in light of all the notes about fraud on the account and the PIN being changed to random digits that had never been used by us before. Based on the response of disbelief from AT&T on the second port, I suspect that this attack also involved a compromised AT&T employee that worked with the attacker to provide timely access to the Coinbase password reset email. Apparently, this has been going on for years: https://www.flashpoint-intel.com/blog/sim-swap-fraud-account-takeove with phone carrier employees swapping SIMs for $80s a swap. Remember that most of this was hidden in real time, and was only known because we were able to recover emails deleted from Trash by the attacker. Since we require any withdrawals to use Google Authenticator on Coinbase, our funds may have been secure nonetheless. However, under the circumstances with attackers that were apparently working with insiders to take our phone number twice in attempts to steal Bitcoin, and it being unknown if they had additional tools related to our Google Authenticator, we decided it was safer on the sidelines. The coins were held on the exchange for a quick exit depending on whether Bitcoin was going to break up or down from $10,000. A hardware wallet is always safest, but we were looking to time the market and not have transaction delays. For some some security recommendations: AT&T: If you are going to send a text saying that calls and texts are moving to a new number, provide a 10 minute window for the phone number to reply with a “NO” or “STOP” to prevent the move. This can escalate the SIM dispute to more trusted employees to determine who actually owns the line. Don’t let entry level employees swap SIMs. Coinbase: Do not default to phone numbers as 2FA. Also, if someone logs in successfully with the password before the 24 hours are up, the password is known and there is no need to send the password reset email again for attacker to have forwarded to them. At least have an option to stop the password reset email from being sent. We did not tag our account at Coinbase with fraud because of the stories of frozen funds once an account is tagged. I’m not sure what the solution is there, but that is another problem. Being a trader, it would be nice to think of Coinbase as any other type of security brokerage where your assets are yours (someone can’t steal your phone number and transfer your stocks to their account). We fell into that mindset of security, yet this experience has reminded us of the uniqueness of cryptocurrency and the lack of custodial assurance and insurance from exchanges because of the possession-is-everything properties of cryptocurrency. As many have said before, 2FA with a phone number quickly becomes 1-factor authentication as soon as that phone number is associated with password recovery on your email or other accounts. Our overall recommendation is to avoid having a phone number associated with any recovery options across all your accounts. TLDR on the process: Scammers will steal your phone number (in our case twice in 24 hours) and use your phone number to access your email and accounts. They will use your email to reset passwords at financial accounts and file hosting such as DropBox. They will then use that combination to transfer any assets they can access from your accounts to theirs. They will do their best to hide this from you by (1) not resetting your email password so as to raise suspicion, (2) immediately delete any password reset emails you may receive from financial accounts to hide them from you, (3) attempt to forward all emails sent to your address to a burner email, and (4) set email rules to forward emails containing “coinbase” to an email folder other than your Inbox so that you don’t see the transactions and password reset emails that arrive to your inbox. TLDR on defense tips: If your phone stops working or you receive a text of your number being ported do the following as soon as possible: (1) log into your email account(s) associated with your financial accounts and remove your phone number as 2FA immediately (2) change your email password, (3) force a logout of all sessions from your email (at this point you have locked them out), then (4) check your mail forwarding settings for forwards to burner addresses, (5) check your mail rules for rerouting of emails from accounts such as Coinbase, and (6) call your carrier to have them suspend service on your lost phone number and ask them to reinstate your SIM or get a new SIM. This will require a second phone because your personal phone number has been stolen. We hope this helps some others be safe out there in protecting their coins. The more we know, the more we can protect ourselves. Wishing you all the best!
The events of a SIM swap attack directed at Coinbase (and defense tips)
The information below on an attempted SIM swap attack was pieced together through a combination of login and security logs, recovering emails initiated by the attacker that were deleted and then deleted again from the trash folder, and learning from AT&T’s fraud representatives. The majority if this is factual, and we do our best to note where we are speculating or providing a circumstantial suspicion. TLDRs at the bottom. The full story: We were going about our business and received a text from AT&T that says “…Calls & texts will go to your new phone/SIM card. Call 866-563-4705 if you did not request.” We did not request this, and were suspicious that the text itself could be a phishing scam since we searched the phone number and it wasn’t overtly associated with AT&T. Thus, we tried calling AT&T’s main line at 611 but all we hear is beep beep beep. The phone number is already gone. We use another phone to call AT&T and at the same time start working on our already compromised email. While we didn’t see everything real time, this is what the recovered emails show. In less than 2 minutes after receiving the text from AT&T, there is already an email indicating that the stolen phone number was used to sign into our email account associated with Coinbase. 2 minutes after that, there is an email from Coinbase saying: "We have received your request for password reset from an unverified device. As a security precaution, an e-mail with a reset link will be sent to you in 24 hours. Alternatively, if you would like your password reset to be processed immediately, please submit a request using a verified device. This 24 hour review period is designed to protect your Coinbase account." This is where Coinbase got it right to have a 24 hour review period (actually a recovery period) before allowing the password to be reset. However, the attackers knew this and planned to steal the second email from Coinbase by setting email rules to forward all emails to a burner address and also have any emails containing “coinbase” re-routed so they don’t appear in the Inbox. 5 minutes later, they request a password reset from Gemini and the password was reset to the attacker’s password within a minute after that. The next minute they target and reset DropBox’s password followed immediately with Binance. Less than 2 minutes later, an email from Binance indicates that the password has been reset and another email arrives a minute later indicating a new device has been authorized. It’s at this point that we begin locking the attacker out by (1) removing the phone number as 2FA (2) changing the email password, (3) and three forcing a logout of all sessions from the email. There was a bit of back and forth where they still had an active login and re-added the stolen phone number as 2FA. They added only one more password reset to a gaming account that was not deleted. I can only suspect that was a decoy to make it look like the attack was directed at gaming rather than finances. The Gemini and Binance accounts were empty and effectively abandoned, with no balances and inactive bank accounts (if any), and no transactions in 1-3 years. DropBox had no meaningful files (they probably look for private keys and authenticator backups) and the phone number they stole from us was suspended, so as far as the attacker is concerned, there is no meat on this bone to attack again… unless they had inside information. This is where I suspect someone internal at Coinbase receiving wire deposits has been compromised in tipping off ripe accounts – accounts with new and somewhat large balances. We had completed a full withdrawal of funds from Coinbase earlier in the year, and had a balance of less than $20 heading into May. Deposits to Coinbase staggered in to get above six figures through mid-May then stopped. The attack occurred 7 days after the last large wire deposit was made to Coinbase. From the perspective of an attacker that had no inside information, we were a dead end with abandoned Gemini and Binance accounts with zero balances and stale transactions, no DropBox information, and the suspended phone number access. Our Coinbase deposits were known to no one except us, Coinbase, and our bank. We were also able to stop the hacker’s email forwarding before Coinbase’s 24 hour period to send the password reset, so this one didn’t work out for the attackers and it would make sense for them to move on to the next rather than put efforts into a second attack only for Coinbase - for what would appear to be a zero-balance Coinbase account based on the other stale accounts. Then…23 hours and 42 minutes after the first attack, another message from AT&T “…Calls & texts will go to your new phone/SIM card. Call 866-563-4705 if you did not request.” Here we go again. We had been confident in AT&T’s assurances that our account had been locked and would not be SIM swapped again, so we unwisely added the phone number back to our email account as a backup (it’s now removed permanently and we use burner emails for account recovery like we should have all along). Upon seeing that our phone number had been stolen again I knew they were after the Coinbase reset email that was delayed by 24 hours from Coinbase as part of their security. We did 4 things within 2 minutes of that text: (1) removed the phone number again from the email account – this time for good, (2) market sell all Bitcoin on Coinbase, (3) withdraw from Coinbase, (4) have AT&T suspend service on the phone line. In speaking with AT&T, they were floored that our SIM would be transferred again in light of all the notes about fraud on the account and the PIN being changed to random digits that had never been used by us before. Based on the response of disbelief from AT&T on the second port, I suspect that this attack also involved a compromised AT&T employee that worked with the attacker to provide timely access to the Coinbase password reset email. Apparently, this has been going on for years: https://www.flashpoint-intel.com/blog/sim-swap-fraud-account-takeove with phone carrier employees swapping SIMs for $80s a swap. Remember that most of this was hidden in real time, and was only known because we were able to recover emails deleted from Trash by the attacker. Since we require any withdrawals to use Google Authenticator on Coinbase, our funds may have been secure nonetheless. However, under the circumstances with attackers that were apparently working with insiders to take our phone number twice in attempts to steal Bitcoin, and it being unknown if they had additional tools related to our Google Authenticator, we decided it was safer on the sidelines. The coins were held on the exchange for a quick exit depending on whether Bitcoin was going to break up or down from $10,000. A hardware wallet is always safest, but we were looking to time the market and not have transaction delays. For some some security recommendations: AT&T: If you are going to send a text saying that calls and texts are moving to a new number, provide a 10 minute window for the phone number to reply with a “NO” or “STOP” to prevent the move. This can escalate the SIM dispute to more trusted employees to determine who actually owns the line. Don’t let entry level employees swap SIMs. Coinbase: Do not default to phone numbers as 2FA. Also, if someone logs in successfully with the password before the 24 hours are up, the password is known and there is no need to send the password reset email again for attacker to have forwarded to them. At least have an option to stop the password reset email from being sent. We did not tag our account at Coinbase with fraud because of the stories of frozen funds once an account is tagged. I’m not sure what the solution is there, but that is another problem. Being a trader, it would be nice to think of Coinbase as any other type of security brokerage where your assets are yours (someone can’t steal your phone number and transfer your stocks to their account). We fell into that mindset of security, yet this experience has reminded us of the uniqueness of cryptocurrency and the lack of custodial assurance and insurance from exchanges because of the possession-is-everything properties of cryptocurrency. As many have said before, 2FA with a phone number quickly becomes 1-factor authentication as soon as that phone number is associated with password recovery on your email or other accounts. Our overall recommendation is to avoid having a phone number associated with any recovery options across all your accounts. TLDR on the process: Scammers will steal your phone number (in our case twice in 24 hours) and use your phone number to access your email and accounts. They will use your email to reset passwords at financial accounts and file hosting such as DropBox. They will then use that combination to transfer any assets they can access from your accounts to theirs. They will do their best to hide this from you by (1) not resetting your email password so as to raise suspicion, (2) immediately delete any password reset emails you may receive from financial accounts to hide them from you, (3) attempt to forward all emails sent to your address to a burner email, and (4) set email rules to forward emails containing “coinbase” to an email folder other than your Inbox so that you don’t see the transactions and password reset emails that arrive to your inbox. TLDR on defense tips: If your phone stops working or you receive a text of your number being ported do the following as soon as possible: (1) log into your email account(s) associated with your financial accounts and remove your phone number as 2FA immediately (2) change your email password, (3) force a logout of all sessions from your email (at this point you have locked them out), then (4) check your mail forwarding settings for forwards to burner addresses, (5) check your mail rules for rerouting of emails from accounts such as Coinbase, and (6) call your carrier to have them suspend service on your lost phone number and ask them to reinstate your SIM or get a new SIM. This will require a second phone because your personal phone number has been stolen. We hope this helps some others be safe out there in protecting their coins. The more we know, the more we can protect ourselves. Wishing you all the best!
The power players of consumer finance in the 21st century will be crypto-native companies who build with blockchain technology at their core.
The crypto landscape is still nascent. We’re still very much in the fragmented, unbundled phase of the industry lifecycle. Beyond what Genesis Block is doing, there are signs of other companies slowly starting to bundle financial services into what could be an all-in-one bank replacement. So the key question that this series hopes to answer:
Which crypto-native company will successfully become the bank of the future?
We obviously think Genesis Block is well-positioned to win. But we certainly aren’t the only game in town. In this series, we’ll be doing an analysis of who is most capable of thwarting our efforts. We’ll look at categories like crypto exchanges, crypto wallets, centralized lending & borrowing services, and crypto debit card companies. Each category will have its own dedicated post. Today we’re analyzing big crypto exchanges. The two companies we’ll focus on today are Coinbase (biggest American exchange) and Binance (biggest global exchange). They are the top two exchanges in terms of Bitcoin trading volume. They are in pole position to winning this market — they have a huge existing userbase and strong financial resources. Will Coinbase or Binance become the bank of the future? Can their early success propel them to winning the broader consumer finance market? Is their growth too far ahead for anyone else to catch up? Let’s dive in. https://preview.redd.it/lau4hevpm7f51.png?width=800&format=png&auto=webp&s=2c5de1ba497199f36aa194e5809bd86e5ab533d8
The most formidable exchange on the global stage is Binance (Crunchbase). All signs suggest they have significantly more users and a stronger balance sheet than Coinbase. No other exchange is executing as aggressively and relentlessly as Binance is. The cadence at which they are shipping and launching new products is nothing short of impressive. As Tushar Jain from Multicoin argues, Binance is Blitzscaling. Here are some of the products that they’ve launched in the last 18 months. Only a few are announced but still pre-launch.
Binance is well-positioned to become the crypto-powered, all-in-one, bundled solution for financial services. They already have so many of the pieces. But the key question is:
Can they create a cohesive & united product experience?
Binance is strong, but they do have a few major weaknesses that could slow them down.
Traders & Speculators Binance is currently very geared for speculators, traders, and financial professionals. Their bread-and-butter is trading (spot, margin, options, futures). Their UI is littered with depth charts, order books, candlesticks, and other financial concepts that are beyond the reach of most normal consumers. Their product today is not at all tailored for the broader consumer market. Given Binance’s popularity and strength among the pro audience, it’s unlikely that they will dumb down or simplify their product any time soon. That would jeopardize their core business. Binance will likely need an entirely new product/brand to go beyond the pro user crowd. That will take time (or an acquisition). So the question remains, is Binance even interested in the broader consumer market? Or will they continue to focus on their core product, the one-stop-shop for pro crypto traders?
Controversies & Hot Water Binance has had a number of controversies. No one seems to know where they are based — so what regulatory agencies can hold them accountable? Last year, some sensitive, private user data got leaked. When they announced their debit card program, they had to remove mentions of Visa quickly after. And though the “police raid” story proved to be untrue, there are still a lot of questions about what happened with their Shanghai office shut down (where there is smoke, there is fire). If any company has had a “move fast and break things” attitude, it is Binance. That attitude has served them well so far but as they try to do business in more regulated countries like America, this will make their road much more difficult — especially in the consumer market where trust takes a long time to earn, but can be destroyed in an instant. This is perhaps why the Binance US product is an empty shell when compared to their main global product.
Disjointed Product Experience Because Binance has so many different teams launching so many different services, their core product is increasingly feeling disjointed and disconnected. Many of the new features are sloppily integrated with each other. There’s no cohesive product experience. This is one of the downsides of executing and shipping at their relentless pace. For example, users don’t have a single wallet that shows their balances. Depending on if the user wants to do spot trading, margin, futures, or savings… the user needs to constantly be transferring their assets from one wallet to another. It’s not a unified, frictionless, simple user experience. This is one major downside of the “move fast and break things” approach.
BNB token Binance raised $15M in a 2017 ICO by selling their $BNB token. The current market cap of $BNB is worth more than $2.6B. Financially this token has served them well. However, given how BNB works (for example, their token burn), there are a lot of open questions as to how BNB will be treated with US security laws. Their Binance US product so far is treading very lightly with its use of BNB. Their token could become a liability for Binance as it enters more regulated markets. Whether the crypto community likes it or not, until regulators get caught up and understand the power of decentralized technology, tokens will still be a regulatory burden — especially for anything that touches consumers.
Binance Chain & Smart Contract Platform Binance is launching its own smart contract platform soon. Based on compatibility choices, they have their sights aimed at the Ethereum developer community. It’s unclear how easy it’ll be to convince developers to move to Binance chain. Most of the current developer energy and momentum around smart contracts is with Ethereum. Because Binance now has their own horse in the race, it’s unlikely they will ever decide to leverage Ethereum’s DeFi protocols. This could likely be a major strategic mistake — and hubris that goes a step too far. Binance will be pushing and promoting protocols on their own platform. The major risk of being all-in on their own platform is that they miss having a seat on the Ethereum rocket ship — specifically the growth of DeFi use-cases and the enormous value that can be unlocked. Integrating with Ethereum’s protocols would be either admitting defeat of their own platform or competing directly against themselves.
The crypto-native company that I believe is more likely to become the bank of the future is Coinbase (crunchbase). Their dominance in America could serve as a springboard to winning the West (Binance has a stronger foothold in Asia). Coinbase has more than 30M users. Their exchange business is a money-printing machine. They have a solid reputation as it relates to compliance and working with regulators. Their CEO is a longtime member of the crypto community. They are rumored to be going public soon.
Let’s look at what makes them strong and a likely contender for winning the broader consumer finance market.
Different Audience, Different Experience Coinbase has been smart to create a unique product experience for each audience — the pro speculator crowd and the common retail user. Their simple consumer version is at Coinbase.com. That’s the default. Their product for the more sophisticated traders and speculators is at Coinbase Pro (formerly GDAX). Unlike Binance, Coinbase can slowly build out the bank of the future for the broad consumer market while still having a home for their hardcore crypto traders. They aren’t afraid to have different experiences for different audiences.
Brand & Design Coinbase has a strong product design team. Their brand is capable of going beyond the male-dominated crypto audience. Their product is clean and simple — much more consumer-friendly than Binance. It’s clear they spend a lot of time thinking about their user experience. Interacting directly with crypto can sometimes be rough and raw (especially for n00bs). When I was at Mainframe we hosted a panel about Crypto UX challenges at the DevCon4 Dapp Awards. Connie Yang (Head of Design at Coinbase) was on the panel. She was impressive. Some of their design philosophies will bode well as they push to reach the broader consumer finance market.
Early Signs of Bundling Though Coinbase has nowhere near as many products & services as Binance, they are slowly starting to add more financial services that may appeal to the broader market. They are now letting depositors earn interest on USDC (also DAI & Tezos). In the UK they are piloting a debit card. Users can now invest in crypto with dollar-cost-averaging. It’s not much, but it’s a start. You can start to see hints of a more bundled solution around financial services.
Let’s now look at some things that could hold them back.
Slow Cadence In the fast-paced world of crypto, and especially when compared to Binance, Coinbase does not ship very many new products very often. This is perhaps their greatest weakness. Smaller, more nimble startups may run circles around them. They were smart to launch Coinbase Ventures where tey invest in early-stage startups. They can now keep an ear to the ground on innovation. Perhaps their cadence is normal for a company of their size — but the Binance pace creates quite the contrast.
Institutional Focus As a company, we are a Coinbase client. We love their institutional offering. It’s clear they’ve been investing a lot in this area. A recent Coinbase blog post made it clear that this has been a focus: “Over the past 12 months, Coinbase has been laser-focused on building out the types of features and services that our institutional customers need.” Their Tagomi acquisition only re-enforced this focus. Perhaps this is why their consumer product has felt so neglected. They’ve been heavily investing in their institutional services since May 2018. For a company that’s getting very close to an IPO, it makes sense that they’d focus on areas that present strong revenue opportunities — as they do with institutional clients. Even for big companies like Coinbase, it’s hard to have a split focus. If they are “laser-focused” on the institutional audience, it’s unlikely they’ll be launching any major consumer products anytime soon.
Coinbase Wrap Up
At Genesis Block, we‘re proud to be working with Coinbase. They are a fantastic company. However, I don’t believe that they’ll succeed in building their own product for the broader consumer finance market. While they have incredible design, there are no signs that they are focused on or capable of internally building this type of product. Similar to Binance, I think it’s far more likely that Coinbase acquires a promising young startup with strong growth.
Other US-based exchanges worth mentioning are Kraken, Gemini, and Bittrex. So far we’ve seen very few signs that any of them will aggressively attack broader consumer finance. Most are going in the way of Binance — listing more assets and adding more pro tools like margin and futures trading. And many, like Coinbase, are trying to attract more institutional customers. For example, Gemini with their custody product.
Coinbase and Binance have huge war chests and massive reach. For that alone, they should always be considered threats to Genesis Block. However, their products are very, very different than the product we’re building. And their approach is very different as well. They are trying to educate and onboard people into crypto. At Genesis Block, we believe the masses shouldn’t need to know or care about it. We did an entire series about this, Spreading Crypto. Most everyone needs banking — whether it be to borrow, spend, invest, earn interest, etc. Not everyone needs a crypto exchange. For non-crypto consumers (the mass market), the differences between a bank and a crypto exchange are immense. Companies like Binance and Coinbase make a lot of money on their crypto exchange business. It would be really difficult, gutsy, and risky for any of them to completely change their narrative, messaging, and product to focus on the broader consumer market. I don’t believe they would ever risk biting the hand that feeds them. In summary, as it relates to a digital bank aimed at the mass market, I believe both Coinbase and Binance are much more likely to acquire a startup in this space than they are to build it themselves. And I think they would want to keep the brand/product distinct and separate from their core crypto exchange business. So back to the original question, is Coinbase and Binance a threat to Genesis Block? Not really. Not today. But they could be, and for that, we want to stay close to them. ------ Other Ways to Consume Today's Episode:
I want to thank everyone who replied to our survey! Your feedback is extremely valuable! Here are the results and how they're helping shape our direction.
What goals would you like to see us accomplish? What's most important to you in how this Quadriga situation ends?
This was an open-ended question and the answers varied widely (and there was definitely a lot of responses which mentioned multiple goals). Here's a summary:
65% mentioned recovering losses for affected users.
45% described a desire to get better standards on Canadian exchanges.
30% included justice for victims.
25% desired education on crypto-asset protection.
20% had the creation of the new exchange.
The justice theme has been entirely overlooked by what we're doing. Discussing the idea on the Quadriga Uncovered Telegram group, it was determined that there was definite interest in a potential letter-writing initiative. One possibility would be sending letters to the RCMP to request the exhumation.
Is there any part of our initiative which confuses you?
Almost universally, there was no mention of any confusion. The feedback we did receive:
"The website landing page could provide an executive summary of the key aspects of the initiative".
The front page was last updated March 30th. We are constantly experimenting and improving the front of the website and our presentation of ideas and welcome any insight.
"I was worried with the proposal to have a token for affected users. The intention may be ok, but tokens and ICOs have a bad reputation for being scams. I confess that I didn't read the website of the Initiative, but from communications, I didn't see the association between the Initiative and the official committee."
We should make clear we are fully separate from the bankruptcy process. There is no tie to the official committee, although we have gotten their feedback throughout. This is an opportunity for the business community to provide additional help for victims.
We are contemplating the need for having blockchain-backing, however it does provide the ability to have greater transparency in the distribution/supply, more control in the form of a multi-sig smart contract, and easier liquidity options.
What we are doing is fundamentally different from any ICO. Tokens are distributed 100% free against verified losses. Redemption happens over time for utility (products/services) or goodwill (best-effort redemption) and it's always a fixed value of $1.
"Generally i understand. Confused about progress and value offer to crypto enthusiasts."
The initial (very first) value proposition for the tokens will be the ability to offset trading fees on the partner exchange, where we expect that traders may adopt having a small stash to cover their trading expenses as they trade. From there, we have other businesses interested in accepting partial payment in tokens. Basically, tokens are spent in place of dollars to get a discount at participating businesses which wish to support affected users.
In terms of progress, we are still waiting for three things:
Partner exchange full launch.
First bankruptcy payout to complete.
Reaching 1,000 signups (as necessary for our deal).
Please feel free to reach out on Telegram and Reddit if there are any further questions!
Is it more important to you that we focus on (a) helping victims of Quadriga recover, (b) educating more people about Quadriga and other exchange fraud, or (c) preventing future exchange fraud events like Quadriga?
Of the first or only choice picked, 70% chose (a) helping victims of Quadriga recover, while 30% chose (c) preventing future exchange fraud events like Quadriga. (a) was mentioned in 80% of cases, and top choice in 70%. (b) was a second choice in 30% of cases and mentioned in 35%. (c) was mentioned in 65% of responses and top choice in 30%. The educational portion of our initiative was seen as the lowest value. We are floating the idea of replacing the Education goal with a separate Justice goal, which is composed of letter-writing and other advocacy to help speed up any potential criminal investigations.
What bothers you most about Canadian cryptocurrency exchanges?
The responses varied widely. Here's a selection:
"The lack of unbiased information on how trustworthy exchanges are."
"The lack of transparency."
"that they are unregulated"
"I only use a non-custodial exchange now (Bull Bitcoin). The inertia and apathy of the government bothers me a lot. After Quadriga there should have been an inquiry. Even my emails to MPs Marie-France Lalonde and Bill Blair got no response. It's not realistic to wait for exchanges to 'self-regulate'."
"Terrible for trading and unreliable"
"Where is the regulation and oversight?"
"It's difficult to know which one is safe and w[h]ich one is not. It's easier to go to a bigger exchange (eg. Binance, Kraken, ... ) who has a solid reputation than Canadian one (at least for now)"
"Slow volume, difficulty to access for some, security"
"Security, trust, support, education"
There is clearly a lack of satisfaction.
Should preventing events like Quadriga focus more on regulatory reform (working with regulators) or trying to create change through setting the example on one exchange and go from there (similar to how "Tesla" has electrified vehicles)?
40% of respondents desired an approach which included both aspects.
40% of respondents desired an approach of setting an example in one exchange.
20% preferred a regulatory approach.
"(c), creating an independent classification/review system that would allow users to know which exchanges are most trustworthy, and to force less trustworthy ones to shape up."
There are a few such services out there. Key issues are that these opinions can be influenced by referral bonuses, the exchange reputations change over time (as was the case in Quadriga), and there is limited information on which to base the evaluation. Many reputable third parties have recommended shady services that subsequently failed.
Pressing forward on both fronts appears to make the most sense.
Would you rather have the recovery run inside of a for-profit exchange (sort of a marketing/promotion idea to push people onto a safer exchange) or as an independent group of affected users pushing for our own interests (working with the safer exchange and other businesses potentially similar to a labour union or political advocacy)?
The end result:
The majority (55%) prefer to have the independent group advocating for affected users.
A minority (35%) prefer to have it run in a for-profit/promotional way inside the exchange.
There were 10% of responses indicating both would be acceptable, or no clear preference.
We will be working to run this independently, however working closely with our partner exchange as a joint project (and it is definitely a promotional tool for them).
If given the choice, would you prefer (a) $20 cash each year for 10 years (slower recovery with full choice), or (b) your choice of $200 worth of discounts on products/services that are donated by small businesses which you could use this year (faster recovery with less choices)?
60% indicated a preference for (b), and 40% had the preference for (a). There is clear interest in focusing on both, which will push the fastest and most flexible recovery.
Affected users have a liquidation option which allows non-victims to purchase their tokens on the exchange. How do you feel about charging non-victims a small fee (5 cents per token) that is split between funding the project and a pool for affected user payout?
50% expressed outright support for the idea. Below are more detailed responses and comments:
"indifferent, although I think any fee will end up factoring in to the exchange rate on the value of the token. If people are willing to pay $10 for a $15 coupon, then a 5% fee might mean they'll only pay $9.50"
This is undoubtedly true. In your example, 25 cents would go to the project, 25 cents to affected users, and $9.50 to the seller. As opposed to $10 going to the seller.
"I am not yet clear on the cost structure of the proposed solution. Has the cost of managing the recovery effort been accounted for?"
It hasn't been properly accounted for, and this is one possible solution.
"I think that it is more important to have broad communication, reaching out to public at large and crypto communities in other countries. Then there should be multiple ways for different communities to contribute financially to affected users. I don't like the idea of fees and tokens because it seems to distract from the larger tasks of communication, rallying, documenting and advocating."
You bring up great points. Outreach is important, as is flexibility in approach. If you have more concrete ideas we would love to consider them!
"Good idea, but it restricts the on boarding of new users"
This is a fair point. The hope is that those participating want to help.
"I would prefer to avoid this option, Unless we can show that there are many added benefits from using this platform over others, thus justifying the fees and making it more acceptable to users."
Absolutely. Hopefully there will be many added benefits.
"I think it a good idea, fees will go anyway to affected users, I totally agree"
Awesome. That's definitely the intent.
"better not tax when tokens are transferred to the blockchain - tax the transaction (something small, in order not to affect the volume/liquidity too much) like what they are doing with the flight tickets in Quebec"
Absolutely! This would be a transaction cost only.
At the moment this has not yet been agreed upon by the partner exchange.
Have you discussed the project with anyone else who lost funds in Quadriga? What kind of feedback are you hearing?
40% said they've discussed it. 40% have not. 20% didn't answer (or it was hard to understand). Some of the responses:
"only online, and there there seems to be some confusion about the projects goals, some concerns about the connection to a for-profit exchange, and a general 'one bitten twice shy' mentality."
"Yes, Matt and my spouse. The problem was foreseeable. We just all ignored the risk because we were sold on the simplicity. The first red flag I saw was that accounts could be reloaded through an entity in China, which did not make sense, but I ignored it because of my perceived impression of protection given that the operator was in Canada."
"Yes - most have given up hope of recovering funds"
" I can't follow the chats on Telegram. I gained no knowledge the times I tried to read the discussions there. In fact the discussions there seemed to be not very polite. I wasn't able to connect with any other affected user. I wish there were some more structured gathering. Maybe a webinar would be nice."
Note: This sounds like it may be talking about the separate and more popular Quadriga Uncovered Telegram group. We would be very interested for any examples of impolite discussions on our Telegram group.
"This recovery process started out fine, but has turned into a circus show as is usual with lawyers who naturally want to stretch cases out to steal more money from victims."
"Not for now, I don't know any other victim (except members of Quadriga initiative)"
"Its your fault for keeping it on an exchange, what did you think was going to happen. There will be no money left after the 'bankruptcy'.. Lightning will solve all these problems other than recovery of funds."
Many affected users have strong privacy concerns and shame regarding what happened to them, such that they are even hesitant to share basic details. What do you feel is the best way to build trust and openness among the affected user community?
Here are some of the replies:
"I really don't know. Keeping things as anonymous as possible might help, but then the project would also need accountability to show that most of the tokens weren't sent to your own account. It's a tricky problem."
Absolutely. We also need to consider the various ways the project could be defrauded.
"What you are doing now. I am just not clear on the sustainab[i]lility of this effort without appropriate financial support."
"We all lost. We got burned. No shame in getting burned. It happens."
"There must be a way for affected users to connect to each other. Communication is the foundation, and it can be done preserving privacy. Some ideas include a webinar, chat tools that preserve privacy, etc. I heard of the documentary but I don't know what will be there. I think it is important also for the public at large to know how Quadriga affected users. That is, it's important for some personal stories to be published, ideally in the mainstream press."
We have Telegram, Reddit, and Twitter. A webinar would be great! There have been a number of mainstream news articles on Quadriga, although it's not well known outside of the crypto community. We welcome any further ideas for platforms.
"I would use the angle that crypto will continue to gain traction as time goes on, and that although the affected users were victims of a terrible fraud, we have an opportunity to prevent this from happening to others. I would also use the fact that this initiative has gained a considerable following and that affected users are all in this together, whether we want it or not."
"Maybe a guarantee that nobody will be further persecuted would help."
Hopefully no affected users are persecuted. Who's being persecuted?
"I don't know what else could be done for now."
"Just let us go forward."
"Once you demonstrate positive effects (and communicating about them), and set up ways to contact you securely, the users who have privacy concerns will contact you. You should have anonymous way to communicate with you (maybe using memo.cash?)"
Feel free to use an anonymous handle for any communication with us via Reddit, Twitter, Telegram, or email.
"Simple questions, good job :). Wonder about the stages of loss/gr[ie]f. Maybe the stinging pain needs to subside before people will trust."
Notes: Percentages rounded to the nearest 5%. Thank you very much for everyone who took the time to respond! We will continue to study your answers as we move forward!
A new report suggests that Binance is failing to prevent ransomware hackers from converting their stolen bitcoin into cash. According to an exclusive report published by Forbes, cybercriminals leveraging crypto-ransomware, including the popular Ryuk variant, have been using Binance to exchange their stolen funds.. A group researchers, who asked to remain anonymous, told Forbes that over $1 ... The inside story of Binance’s explosive rise to power How Binance escaped China, rode the Bitcoin bull, made half a billion dollars in one year and plans to revolutionize money. By Tim Copeland. 20 min read. Nov 16, 2019 Nov 28, 2019. Binance Coin. NEW YORK—Not too long ago, I was shacked up in a cheap hostel, in Manhattan. The window was open to counteract the heat of the stiff radiator ... The Binance exchange, which stores Bitcoin and other crypto-currencies for members, said hackers took 7,000 bitcoins in one go. Withdrawals have now been suspended on the platform. Binance was founded in China in the summer of 2017 by Changpeng Zhao, 44, a cryptocurrency veteran with prior experience at bitcoin wallet provider Blockchain LLC and cryptocurrency exchange, OKCoin. It was a good week for crypto and the exchange businesses. Bitcoin price was up, so were trading volumes. But for a number of our users and for our engineers, it was a tough week. We had a number of performance issues, which negatively impacted the accessibility of our platform. As always, we feel it is important to maintain transparency during tough times, and we will openly disclose some of ... Hackers stole 7,000 bitcoin from major cryptocurrency exchange Binance, the platform said. They used a variety of methods to carry out the “large scale security breach," according to the exchange. Binance Holdings Ltd., one of the world’s most innovative and largest Bitcoin trading venues, has announced the launch of its business-to-business-to-consumer (B2B2C) cloud infrastructure aimed at making it possible for interested businesses to launch their digital assets exchanges.The team says crypto exchanges built upon Binance cloud will enjoy the same liquidity, security and other ... Researchers have compiled information that could be damaging to Binance, one of the largest bitcoin exchanges in the world—suggesting the exchange is failing to prevent Ryuk hackers from turning ... story from Markets. Hackers Steal $40.7 Million in Bitcoin From Crypto Exchange Binance. May 7, 2019 at 23:57 UTC Updated May 8, 2019 at 07:04 UTC. Binance CEO Changpeng Zhao (Binance) Nikhilesh ...
BREAKING! JAPAN & USA COLLABORATION to BEAT China's E-Yuan! Ethereum to 10k minimum + SEC Securities - Duration: 29:09. Digital Asset News 31,107 views BINANCE XRP TRADING TAGALOG TUTORIAL and Reviews 2019 MOBILE APP VERSION, coins.ph - Duration: 21:23. Bitcoin atbp Pinas Tube 19,817 views Since Binance is not going to be available in the US anymore after September 12th, here are some alternative exchanges to use.-----Get Brave ad-free browser: Binance is considered the top cryptocurrency exchange in the world, having added an astronomical 240,000 users in a matter of 1 HOUR. If you want to learn how to set it up, this is the video for ... “About Bitcoin: The Story of Genesis” covers the whole financial history, from the start of exchange relations between people, through supremacy of banking and governmental systems, up to the ... Bitcoin future ट्रेडिंग कैसे करेBinance exchange Full Tutorial for Beginners Dear frnds, #binancefuturemargintrading kaise kare, #bitcoinfuturetradingbinance per ... How to get started on Binance, tutorial and review by OJ Jordan First steps, placing a buy order, trading Bitcoin and hundreds of Alt coins. 📍 BINANCE LINK: ... buy BITCOIN WITH Paypal Payment from CashQ Exchanger Money Exchange Paypal Payeer Skrill Bitcoin Litecoin WebMoney Perfect Money Neteller link website: https:/cashq.net. CZ, founder and CEO of Binance, is LIVE with us to answer ALL your questions regarding bitcoin, binance, and cryptocurrency in 2020! [This is NOT sponsored!]... The US Department of Homeland Security seized a payment processing account belonging to Mt. Gox, the largest international Bitcoin trader, claiming the monetary exchange service falsified ...