The digital currency markets repeatedly remind us of a tired but true maxim: your money is only as secure as the bank that guards it.
After a recent hack resulted in the theft of $70 million worth of bitcoin, Hong Kong-based Bitfinex caused a minor panic when it announced it would spread the losses equally among all its customers, even those whose holdings weren't touched. In doing so, the exchange called our attention — yet again — to how vulnerable virtual currencies are to criminals who hack through the Internet-connected systems that handle money transactions.
Proponents of the technology behind bitcoin say the problem isn’t with the blockchain technology that underpins the currency but rather with the way exchanges store the code that determines ownership. In other words, the banks' security is to blame.
Bitfinex, one of the world’s largest bitcoin exchanges, was hardly the first to suffer from a cyberheist. The most famous robbery came in 2014, when the Tokyo-based exchange Mt. Gox announced $480 million had been stolen by hackers and filed for bankruptcy. Its customers are still waiting to a claim a fraction of their deposits.
This latest theft is rattling the cryptocurrency community. “The failure of one company to secure the private keys of its users is casting a shadow, unfairly, over the bitcoin ecosystem,” Alex Tapscott, co-author of “Blockchain Revolution: How the Technology Behind Bitcoin is Changing Money, Business and the World,” told Salon. “This hack demonstrates the urgent need for stronger governance.”
Tapscott adds that Bitfinex’s decision to “socialize the loss” of nearly 120,000 bitcoins (each worth almost $600) is undermining consumer confidence in the exchanges, and with the digital currency itself. Instead, he says, Bitfinex should follow the usual procedures that companies take when there isn’t enough capital available to cover a loss: file for bankruptcy and renegotiate terms with creditors.
Instead, Bitfinex announced last week that all of its account holders would lose 36 percent of the value of their deposits, arguing that if it were forced into bankruptcy its clients would lose out anyway. In exchange, Bitfinex gave its customers debt tokens which it says could be redeemed in the future for shares in BitFinex's parent company, iFinex Inc. But the tokens quickly became the digital equivalent of junk-status corporate bonds, trading at 30 percent of their initial $70 million value Thursday when they debuted on Bitfinex, Bloomberg reported.
Meanwhile, Bitfinex customers are fuming. "The idea of dipping into USD, and digital asset wallets that were 100 percent unaffected, and without user approval selling 36 percent of those funds is likely criminal," Bitfinex customer Joseph Schweitzer told CNBC via email on Friday.
Hong Kong authorities are at a loss on how to respond. Like almost everywhere else, virtual currency exchanges operate outside of existing regulatory frameworks. An International Monetary Fund report earlier this year focused largely on the need to regulate these currencies to guard against terrorist-funding activities, money laundering by drug gangs, tax evasion and fraud. And so far, oversight of virtual currencies exchanges has been largely focused on rooting out criminal activity, not protecting the holdings of the average digital currency user.
As consumers become aware of the risks to virtual currency exchanges, the global financial system is rapidly embracing the exchanges' Achilles heel — highly vulnerable blockchain — as a means of recording and storing transactions. Essentially, banks want to introduce this decentralized blockchain technology to make transactions like stock trades and bank-to-bank payments faster and less costly.
“Rather than to stay at the margins of the finance industry blockchain will become the beating heart of it,” Giancarlo Bruno, the head of financial services industries at the World Economic Forum, said in a statement.
It's unclear whether this will embolden tech-savvy bank robbers to hack into traditional financial institutions. But until that is clear and until there is some security oversight of the virtual currency market: buyer — or depositor — beware.