The History of the Mt Gox Hack: Bitcoin’s Biggest Heist ...

Technical: A Brief History of Payment Channels: from Satoshi to Lightning Network

Who cares about political tweets from some random country's president when payment channels are a much more interesting and are actually capable of carrying value?
So let's have a short history of various payment channel techs!

Generation 0: Satoshi's Broken nSequence Channels

Because Satoshi's Vision included payment channels, except his implementation sucked so hard we had to go fix it and added RBF as a by-product.
Originally, the plan for nSequence was that mempools would replace any transaction spending certain inputs with another transaction spending the same inputs, but only if the nSequence field of the replacement was larger.
Since 0xFFFFFFFF was the highest value that nSequence could get, this would mark a transaction as "final" and not replaceable on the mempool anymore.
In fact, this "nSequence channel" I will describe is the reason why we have this weird rule about nLockTime and nSequence. nLockTime actually only works if nSequence is not 0xFFFFFFFF i.e. final. If nSequence is 0xFFFFFFFF then nLockTime is ignored, because this if the "final" version of the transaction.
So what you'd do would be something like this:
  1. You go to a bar and promise the bartender to pay by the time the bar closes. Because this is the Bitcoin universe, time is measured in blockheight, so the closing time of the bar is indicated as some future blockheight.
  2. For your first drink, you'd make a transaction paying to the bartender for that drink, paying from some coins you have. The transaction has an nLockTime equal to the closing time of the bar, and a starting nSequence of 0. You hand over the transaction and the bartender hands you your drink.
  3. For your succeeding drink, you'd remake the same transaction, adding the payment for that drink to the transaction output that goes to the bartender (so that output keeps getting larger, by the amount of payment), and having an nSequence that is one higher than the previous one.
  4. Eventually you have to stop drinking. It comes down to one of two possibilities:
    • You drink until the bar closes. Since it is now the nLockTime indicated in the transaction, the bartender is able to broadcast the latest transaction and tells the bouncers to kick you out of the bar.
    • You wisely consider the state of your liver. So you re-sign the last transaction with a "final" nSequence of 0xFFFFFFFF i.e. the maximum possible value it can have. This allows the bartender to get his or her funds immediately (nLockTime is ignored if nSequence is 0xFFFFFFFF), so he or she tells the bouncers to let you out of the bar.
Now that of course is a payment channel. Individual payments (purchases of alcohol, so I guess buying coffee is not in scope for payment channels). Closing is done by creating a "final" transaction that is the sum of the individual payments. Sure there's no routing and channels are unidirectional and channels have a maximum lifetime but give Satoshi a break, he was also busy inventing Bitcoin at the time.
Now if you noticed I called this kind of payment channel "broken". This is because the mempool rules are not consensus rules, and cannot be validated (nothing about the mempool can be validated onchain: I sigh every time somebody proposes "let's make block size dependent on mempool size", mempool state cannot be validated by onchain data). Fullnodes can't see all of the transactions you signed, and then validate that the final one with the maximum nSequence is the one that actually is used onchain. So you can do the below:
  1. Become friends with Jihan Wu, because he owns >51% of the mining hashrate (he totally reorged Bitcoin to reverse the Binance hack right?).
  2. Slip Jihan Wu some of the more interesting drinks you're ordering as an incentive to cooperate with you. So say you end up ordering 100 drinks, you split it with Jihan Wu and give him 50 of the drinks.
  3. When the bar closes, Jihan Wu quickly calls his mining rig and tells them to mine the version of your transaction with nSequence 0. You know, that first one where you pay for only one drink.
  4. Because fullnodes cannot validate nSequence, they'll accept even the nSequence=0 version and confirm it, immutably adding you paying for a single alcoholic drink to the blockchain.
  5. The bartender, pissed at being cheated, takes out a shotgun from under the bar and shoots at you and Jihan Wu.
  6. Jihan Wu uses his mystical chi powers (actually the combined exhaust from all of his mining rigs) to slow down the shotgun pellets, making them hit you as softly as petals drifting in the wind.
  7. The bartender mutters some words, clothes ripping apart as he or she (hard to believe it could be a she but hey) turns into a bear, ready to maul you for cheating him or her of the payment for all the 100 drinks you ordered from him or her.
  8. Steely-eyed, you stand in front of the bartender-turned-bear, daring him to touch you. You've watched Revenant, you know Leonardo di Caprio could survive a bear mauling, and if some posh actor can survive that, you know you can too. You make a pose. "Drunken troll logic attack!"
  9. I think I got sidetracked here.
Lessons learned?

Spilman Channels

Incentive-compatible time-limited unidirectional channel; or, Satoshi's Vision, Fixed (if transaction malleability hadn't been a problem, that is).
Now, we know the bartender will turn into a bear and maul you if you try to cheat the payment channel, and now that we've revealed you're good friends with Jihan Wu, the bartender will no longer accept a payment channel scheme that lets one you cooperate with a miner to cheat the bartender.
Fortunately, Jeremy Spilman proposed a better way that would not let you cheat the bartender.
First, you and the bartender perform this ritual:
  1. You get some funds and create a transaction that pays to a 2-of-2 multisig between you and the bartender. You don't broadcast this yet: you just sign it and get its txid.
  2. You create another transaction that spends the above transaction. This transaction (the "backoff") has an nLockTime equal to the closing time of the bar, plus one block. You sign it and give this backoff transaction (but not the above transaction) to the bartender.
  3. The bartender signs the backoff and gives it back to you. It is now valid since it's spending a 2-of-2 of you and the bartender, and both of you have signed the backoff transaction.
  4. Now you broadcast the first transaction onchain. You and the bartender wait for it to be deeply confirmed, then you can start ordering.
The above is probably vaguely familiar to LN users. It's the funding process of payment channels! The first transaction, the one that pays to a 2-of-2 multisig, is the funding transaction that backs the payment channel funds.
So now you start ordering in this way:
  1. For your first drink, you create a transaction spending the funding transaction output and sending the price of the drink to the bartender, with the rest returning to you.
  2. You sign the transaction and pass it to the bartender, who serves your first drink.
  3. For your succeeding drinks, you recreate the same transaction, adding the price of the new drink to the sum that goes to the bartender and reducing the money returned to you. You sign the transaction and give it to the bartender, who serves you your next drink.
  4. At the end:
    • If the bar closing time is reached, the bartender signs the latest transaction, completing the needed 2-of-2 signatures and broadcasting this to the Bitcoin network. Since the backoff transaction is the closing time + 1, it can't get used at closing time.
    • If you decide you want to leave early because your liver is crying, you just tell the bartender to go ahead and close the channel (which the bartender can do at any time by just signing and broadcasting the latest transaction: the bartender won't do that because he or she is hoping you'll stay and drink more).
    • If you ended up just hanging around the bar and never ordering, then at closing time + 1 you broadcast the backoff transaction and get your funds back in full.
Now, even if you pass 50 drinks to Jihan Wu, you can't give him the first transaction (the one which pays for only one drink) and ask him to mine it: it's spending a 2-of-2 and the copy you have only contains your own signature. You need the bartender's signature to make it valid, but he or she sure as hell isn't going to cooperate in something that would lose him or her money, so a signature from the bartender validating old state where he or she gets paid less isn't going to happen.
So, problem solved, right? Right? Okay, let's try it. So you get your funds, put them in a funding tx, get the backoff tx, confirm the funding tx...
Once the funding transaction confirms deeply, the bartender laughs uproariously. He or she summons the bouncers, who surround you menacingly.
"I'm refusing service to you," the bartender says.
"Fine," you say. "I was leaving anyway;" You smirk. "I'll get back my money with the backoff transaction, and posting about your poor service on reddit so you get negative karma, so there!"
"Not so fast," the bartender says. His or her voice chills your bones. It looks like your exploitation of the Satoshi nSequence payment channel is still fresh in his or her mind. "Look at the txid of the funding transaction that got confirmed."
"What about it?" you ask nonchalantly, as you flip open your desktop computer and open a reputable blockchain explorer.
What you see shocks you.
"What the --- the txid is different! You--- you changed my signature?? But how? I put the only copy of my private key in a sealed envelope in a cast-iron box inside a safe buried in the Gobi desert protected by a clan of nomads who have dedicated their lives and their childrens' lives to keeping my private key safe in perpetuity!"
"Didn't you know?" the bartender asks. "The components of the signature are just very large numbers. The sign of one of the signature components can be changed, from positive to negative, or negative to positive, and the signature will remain valid. Anyone can do that, even if they don't know the private key. But because Bitcoin includes the signatures in the transaction when it's generating the txid, this little change also changes the txid." He or she chuckles. "They say they'll fix it by separating the signatures from the transaction body. They're saying that these kinds of signature malleability won't affect transaction ids anymore after they do this, but I bet I can get my good friend Jihan Wu to delay this 'SepSig' plan for a good while yet. Friendly guy, this Jihan Wu, it turns out all I had to do was slip him 51 drinks and he was willing to mine a tx with the signature signs flipped." His or her grin widens. "I'm afraid your backoff transaction won't work anymore, since it spends a txid that is not existent and will never be confirmed. So here's the deal. You pay me 99% of the funds in the funding transaction, in exchange for me signing the transaction that spends with the txid that you see onchain. Refuse, and you lose 100% of the funds and every other HODLer, including me, benefits from the reduction in coin supply. Accept, and you get to keep 1%. I lose nothing if you refuse, so I won't care if you do, but consider the difference of getting zilch vs. getting 1% of your funds." His or her eyes glow. "GENUFLECT RIGHT NOW."
Lesson learned?

CLTV-protected Spilman Channels

Using CLTV for the backoff branch.
This variation is simply Spilman channels, but with the backoff transaction replaced with a backoff branch in the SCRIPT you pay to. It only became possible after OP_CHECKLOCKTIMEVERIFY (CLTV) was enabled in 2015.
Now as we saw in the Spilman Channels discussion, transaction malleability means that any pre-signed offchain transaction can easily be invalidated by flipping the sign of the signature of the funding transaction while the funding transaction is not yet confirmed.
This can be avoided by simply putting any special requirements into an explicit branch of the Bitcoin SCRIPT. Now, the backoff branch is supposed to create a maximum lifetime for the payment channel, and prior to the introduction of OP_CHECKLOCKTIMEVERIFY this could only be done by having a pre-signed nLockTime transaction.
With CLTV, however, we can now make the branches explicit in the SCRIPT that the funding transaction pays to.
Instead of paying to a 2-of-2 in order to set up the funding transaction, you pay to a SCRIPT which is basically "2-of-2, OR this singlesig after a specified lock time".
With this, there is no backoff transaction that is pre-signed and which refers to a specific txid. Instead, you can create the backoff transaction later, using whatever txid the funding transaction ends up being confirmed under. Since the funding transaction is immutable once confirmed, it is no longer possible to change the txid afterwards.

Todd Micropayment Networks

The old hub-spoke model (that isn't how LN today actually works).
One of the more direct predecessors of the Lightning Network was the hub-spoke model discussed by Peter Todd. In this model, instead of payers directly having channels to payees, payers and payees connect to a central hub server. This allows any payer to pay any payee, using the same channel for every payee on the hub. Similarly, this allows any payee to receive from any payer, using the same channel.
Remember from the above Spilman example? When you open a channel to the bartender, you have to wait around for the funding tx to confirm. This will take an hour at best. Now consider that you have to make channels for everyone you want to pay to. That's not very scalable.
So the Todd hub-spoke model has a central "clearing house" that transport money from payers to payees. The "Moonbeam" project takes this model. Of course, this reveals to the hub who the payer and payee are, and thus the hub can potentially censor transactions. Generally, though, it was considered that a hub would more efficiently censor by just not maintaining a channel with the payer or payee that it wants to censor (since the money it owned in the channel would just be locked uselessly if the hub won't process payments to/from the censored user).
In any case, the ability of the central hub to monitor payments means that it can surveill the payer and payee, and then sell this private transactional data to third parties. This loss of privacy would be intolerable today.
Peter Todd also proposed that there might be multiple hubs that could transport funds to each other on behalf of their users, providing somewhat better privacy.
Another point of note is that at the time such networks were proposed, only unidirectional (Spilman) channels were available. Thus, while one could be a payer, or payee, you would have to use separate channels for your income versus for your spending. Worse, if you wanted to transfer money from your income channel to your spending channel, you had to close both and reshuffle the money between them, both onchain activities.

Poon-Dryja Lightning Network

Bidirectional two-participant channels.
The Poon-Dryja channel mechanism has two important properties:
Both the original Satoshi and the two Spilman variants are unidirectional: there is a payer and a payee, and if the payee wants to do a refund, or wants to pay for a different service or product the payer is providing, then they can't use the same unidirectional channel.
The Poon-Dryjam mechanism allows channels, however, to be bidirectional instead: you are not a payer or a payee on the channel, you can receive or send at any time as long as both you and the channel counterparty are online.
Further, unlike either of the Spilman variants, there is no time limit for the lifetime of a channel. Instead, you can keep the channel open for as long as you want.
Both properties, together, form a very powerful scaling property that I believe most people have not appreciated. With unidirectional channels, as mentioned before, if you both earn and spend over the same network of payment channels, you would have separate channels for earning and spending. You would then need to perform onchain operations to "reverse" the directions of your channels periodically. Secondly, since Spilman channels have a fixed lifetime, even if you never used either channel, you would have to periodically "refresh" it by closing it and reopening.
With bidirectional, indefinite-lifetime channels, you may instead open some channels when you first begin managing your own money, then close them only after your lawyers have executed your last will and testament on how the money in your channels get divided up to your heirs: that's just two onchain transactions in your entire lifetime. That is the potentially very powerful scaling property that bidirectional, indefinite-lifetime channels allow.
I won't discuss the transaction structure needed for Poon-Dryja bidirectional channels --- it's complicated and you can easily get explanations with cute graphics elsewhere.
There is a weakness of Poon-Dryja that people tend to gloss over (because it was fixed very well by RustyReddit):
Another thing I want to emphasize is that while the Lightning Network paper and many of the earlier presentations developed from the old Peter Todd hub-and-spoke model, the modern Lightning Network takes the logical conclusion of removing a strict separation between "hubs" and "spokes". Any node on the Lightning Network can very well work as a hub for any other node. Thus, while you might operate as "mostly a payer", "mostly a forwarding node", "mostly a payee", you still end up being at least partially a forwarding node ("hub") on the network, at least part of the time. This greatly reduces the problems of privacy inherent in having only a few hub nodes: forwarding nodes cannot get significantly useful data from the payments passing through them, because the distance between the payer and the payee can be so large that it would be likely that the ultimate payer and the ultimate payee could be anyone on the Lightning Network.
Lessons learned?

Future

After LN, there's also the Decker-Wattenhofer Duplex Micropayment Channels (DMC). This post is long enough as-is, LOL. But for now, it uses a novel "decrementing nSequence channel", using the new relative-timelock semantics of nSequence (not the broken one originally by Satoshi). It actually uses multiple such "decrementing nSequence" constructs, terminating in a pair of Spilman channels, one in both directions (thus "duplex"). Maybe I'll discuss it some other time.
The realization that channel constructions could actually hold more channel constructions inside them (the way the Decker-Wattenhofer puts a pair of Spilman channels inside a series of "decrementing nSequence channels") lead to the further thought behind Burchert-Decker-Wattenhofer channel factories. Basically, you could host multiple two-participant channel constructs inside a larger multiparticipant "channel" construct (i.e. host multiple channels inside a factory).
Further, we have the Decker-Russell-Osuntokun or "eltoo" construction. I'd argue that this is "nSequence done right". I'll write more about this later, because this post is long enough.
Lessons learned?
submitted by almkglor to Bitcoin [link] [comments]

Cross chain transactions. Problems and solutions

As cryptocurrency is becoming more popular as it replaces conventional banks, we are beginning to notice some of its problems. A fundamental flaw of some of the most dominant coins on the cryptocurrency (i.e. Bitcoin, Ethereum, and Litecoin) is their inability to be transacted for other currencies without a centralized entity arbitrating the trade. This decreases the scalability of crypto and makes peer to peer transactions very difficult.
Exchanges are not solution
Currently, most digital assets and currencies rely upon third-party exchange software such as Binance, Coindesk, and Coinbase as a way of arbitrating peer to peer trade. This way of transacting is more susceptible to being exploited by hackers or failing from human corruption or manipulation. Even worse, the funds that are illegally acquired are unable to be recovered and refunded to users resulting in cataclysmic losses. Such losses have occurred in instances like the attack on the MtGox exchange which resulted in the loss of $700,000,000 worth of BTC, the Cryptsy hack which resulted in the loss of $9,500,000 worth of Bitcoin and Litecoin, and the Bitstamp attack which resulted in the loss of $5,100,000 worth of bitcoin.
We need smarter peer to peer transactions
Not only do thousands of people lose the money that they worked hard for, but these attacks ruin bitcoins public perception and cause people to have bad connotations about the new technology. Moreover, the more secure ways to transfer funds to different coins requires that coins be converted into different currency twice which depletes the amount of money your new coins are worth because of the exchange fees, making coin exchanging not only inefficient, but also a waste of money. Although the current way of trading coins has shown to be inefficient and dangerous, many professionals speculate that atomic cross chain trading won’t become a viable solution to this problem until 2019, but some coins are already paving the way to smarter peer to peer transactions. These blockchain technologies are using something similar to a lightning network, an instantaneous and anonymous system in which peers can exchange currencies with a virtual contract that is verified when the ledgers of two peers are fairly transferred to the wallets of the two peers.
Atomic cross chain technology. What’s advantage?
The beauty of this system is that it is programmed so that if a peer doesn’t complete their demand, all currency is refunded making the system much safer and less prone to fraud. In addition, all decisions regarding the trade are made by the computer eliminating the risks of human corruption. This system is another layer of code that can be applied on top of the blockchain to increase its interoperability which means that none of the traditional blockchain technologies security features are lost. A coin that enables users to exchange distinct coins without a third party with atomic cross chain technology will be able to optimize the way in which funds of different currencies are transferred.
One promising coin in this sector of technology is Quark.Market.
The initial coin offering has implemented an additional layer to their blockchain that makes cross chain exchanging super easy. Users can do fast and simple exchanges of their coins without liquidity fragmentation, a problem with most other coins that aren’t compatible with each other which results in users losing money on their trade while the exchanges rack up money. Quark will allow users to trade their coins without losing substantial amounts of money or risking their accounts being expropriated all while keeping their transactions secret so as not to impact the market. The new ICO’s promising features may revolutionize the simplicity and security of peer to peer cross chain transactions.
submitted by quarkmarket to BlockchainStartups [link] [comments]

Mt Gox Bitcoin Fork Dilemma, Stellar + Western Union, XRP Base Pair & Binance Coin Price Jump Why Cryptocurrency Will EXPLODE Soon, Mt. Gox Bitcoin DUMPING POSTPONED, Elon Musk Crypto (03/12/18) Bitcoin FUD - Mt Gox, Binance Hack, SEC Regulations! Crypto Market Crash - Bad NEWS! - Binance Hack Rumor/MT Gox Sell OFF/SEC-Reg/Bittrex Country Ban #314 Bitcoin Flash Crash, Binance Hack & Mt Gox News, Coinbase Indexfonds & TrueUSD BINANCE-HACK  Mt.Gox Abverkauf  40 % Kurssturz  Ryan Gosling ICO  KW 10 Mt. Gox Bitcoin Delay, Ripple + Justin Bieber, Monero Futures & Bitcoin Price Bounce

In spite of the June 2011 hack, by 2013 Mt. Gox had established itself as the largest bitcoin exchange in the world, in part as a result of increased interest in bitcoin as the price of the coins increased rapidly (jumping from $13 dollars in January 2013 to a peak of more than $1,200).. However, behind the scenes all was not well. Binance, which is based in Taiwan, announced on Tuesday that hackers were able to withdraw about 7,000 bitcoin through a single transaction, amounting to $40 million. Hackers employed various methods, including phishing and viruses, in what the company described as a “large scale security breach.” Withdrawals and deposits on the platform have since been suspended. Fortunately for Binance ... Buy Bitcoin Binance Bitcoin Shares Found Bitcoin Futures Chart Bitcoin Capitalization Vs Dollar Circulating Bitcoin Memepool Bitcoin Ira A Scam What To I Use To Buy Bitcoin Buy Bitcoin Binance Bitcoin Investment Trust Ticker Symbol Buy Bitcoin Binance Bitcoin Advertising Reviews The Future Of Bitcoin 2017 Best Bitcoin Faucet Bot Fast Free Bitcoin. Moreover, given the Binance “SAFU” fund, all of those users who were impacted by the hack had their accounts reimbursed. Binance covered the entire cost of the hack and no users were affected. Conclusion. While these Bitcoin hacks may be painful to read about, it is incredibly helpful to study them and learn about the causes behind the ... TwitterFacebookWhatsAppGoogle+BufferLinkedIn At the beginning of 2014, Mt Gox, a bitcoin exchange based in Japan, was the largest bitcoin exchange in the world, handling over 70% of all bitcoin transactions worldwide. By the end of February of that year, it was bankrupt. Anyone who was using Mt. Gox lost access to their assets, and it has … Hack Date: 4th March 2014 Amount Hacked: 12.3% of all BTCs Poloniex, which is one of the busiest exchanges of Bitcoin and altcoins, was hacked in the summer of 2014. The exact number of Bitcoin lost was not shared by the company, but a detailed explanation of the hack was given on the Bitcointalk forum.. Basically, the hackers were able to exploit a faulty withdrawal code of Poloniex. Binance, which is based in Taiwan, announced on Tuesday that hackers were able to withdraw about 7,000 bitcoin through a single transaction, amounting to $40 million. Hackers employed various ... And how much did Satoshi Nakamoto contribute to the 'Zombie' fund? Blockchain Center has compiled data for some of the biggest Bitcoin hodlers — from the Winklevoss twins to various scammers and hackers, and even “zombie coins”.. Allegedly, the twins own 150,000 BTC, which places them between the Bitfinex hackers, who own 120,000 BTC, and the Mt. Gox trustees who lay claim to 166,000 BTC. Binance first announced the hack at around 03:00 UTC on May 8 via an official blog post. As we detailed in an earlier report on the hack, the 7,000 BTC were transferred out of Binance’s Bitcoin hot wallet in a single transaction timed at 17:15 UTC on May 7. Binance’s announcement of the hack included several steps that the exchange will be ... At the beginning of 2014, Mt Gox, a bitcoin exchange based in Japan, was the largest bitcoin exchange in the world, handling over 70% of all bitcoin transactions worldwide. By the end of February of that year, it was bankrupt. Anyone who was using Mt. Gox lost access to their assets, and it has been a cautionary tale for crypto investors. While the assets weren’t all lost, anything that was ...

[index] [7130] [13610] [20868] [10776] [19388] [16049] [10045] [12359] [6332] [14101]

Mt Gox Bitcoin Fork Dilemma, Stellar + Western Union, XRP Base Pair & Binance Coin Price Jump

Binance ging es (fast) an den Kragen - Hacks, Verbot von Krypto für Beamte, gestohlenes Mining-Equipment und noch mehr im Wochenrückblick! Unterstütze unsere Aufklärungsmission mit einem Like ... Index Funds And Bitcoin Dumps! Binance FUD, Tokyo Whale, SEC and CFTC Press Releases - Ep159 - Duration: 20:02. Coin Mastery 35,316 views. 20:02. How to build your swimming pool - Step by step ... Links to sources featured in the video below: State crypto laws: https://bitcoincenternyc.com/bitcoin-news/bitcoin-blockchain-cryptocurrency-laws-50-states/ ... Index Funds And Bitcoin Dumps! Binance FUD, Tokyo Whale, SEC and CFTC Press Releases - Ep159 - Duration: 20:02. Coin Mastery 35,315 views. 20:02. Trevon James Loses His Mind - Crypto Nick On The ... My Second Channel: https://www.youtube.com/channel/UCvXjP6h0_4CSBPVgHqfO-UA ----- Supp... coinbase to binance coinbase ripple coinbase review coinbase wallet coinbase fees coinbase to gdax coinbase ripple coinbase review xrp ripple xrp cryptoe xrp coinbase xrp cryptoocurrency xrp coin ... Support Me On Patreon! https://www.patreon.com/TheModernInvestor ----- Protect And Sto...

#