Bitcoin - Reward Comes With Risk - Part Four

by Dorsey & Whitney LLP
Contact

The nature and prospects of “virtual currencies”, and bitcoin in particular, have been keenly debated. Virtual currency systems arguably have positive aspects if they contribute to financial innovation and provide payment alternatives to consumers. However, they also pose risks for users, especially due to the lack of regulation aimed at consumer protection. These risks were underlined in the recent warning on virtual currencies issued by the European Banking Authority (EBA). This eUpdate is the fourth part in a series of eUpdates on bitcoin-related topics and issues. The first part of the series described what bitcoin is. The second part explained the legal status of bitcoin and how it is approached in different countries. The third part analyzed the effects of the Chinese demand on bitcoin, as well as how bitcoin is defined in China.

Controversies over virtual currencies

Virtual currencies are embroiled in controversies. They are often associated with being a monetary alternative for illegal activities, as well as with users claiming loss through cyberattacks or fraud.

Recent cases include the following:

  • In October 2013, Silk Road, an online marketplace, ceased to operate due to allegations that it allowed more than a billion U.S. dollars of illegal drugs and illicit services to be bought using bitcoin.
  • Another website, Sheep Marketplace, used bitcoin and the browser Tor1 to enable online sales of illicit goods, similar to Silk Road.2 It was launched in March 2013 and ceased to operate in early December 2013, after approximately US$5 million worth of bitcoins were stolen from the website.3 It was later reported that another US$44 million worth of bitcoins may also have been stolen from the users of Sheep Marketplace. A tech reporter for Forbes said that the closure of Sheep Marketplace was only the latest event in a “widening crisis” that was hitting drug sellers operating via the “dark net”. He cited the examples of two other sites, Atlantis and Project Black Flag, which shut down following the FBI seizure of Silk Road.4
  • Bitcoin was featured in the news on a cyberattack of the database belonging to the Japan-based bitcoin exchange Mt. Gox in June 2011. This news managed to knock the value of the currency down from US$17.50 to US$0.01 within minutes. Around 400,000 bitcoins (worth almost US$9 million) were affected.5 In addition, the perpetrator hacked into the Mt. Gox database, gaining access to usernames, e-mail addresses and passwords of thousands of users. Mt. Gox responded by closing down the system for a few days, promising that the transactions carried out by the hacker would be reversed. Bitcoin defenders claim that the bitcoin system did not fail, and that the problem was related to a particular bitcoin trading platform – Mt. Gox – which did not have sufficient security measures in place.
  • Another similar case occurred in May 2012, when Bitcoinica, a bitcoin exchange platform, lost 18,547 bitcoins from its deposits following a cyberattack, in which sensitive customer data might also have been misappropriated.6
  • In early November 2013, Inputs.io, a website owned by bitcoin payment processor TradeFortress, was attacked. Hackers allegedly stole more than US$1 million worth of bitcoins belonging to TradeFortress users, fuelling concerns about the security of the bitcoin system.7
  • In late October 2013, the Hong Kong-registered Global Bond Limited, a bitcoin trading platform, simply disappeared overnight, allegedly taking around US$4.1 million of investor money along with it.

These are but a handful of many other recently reported cases involving virtual currencies.8

Bitcoin-specific characteristics make it particularly attractive for illegal activities:

  • Bitcoin is a virtual currency that is not regulated, backed, guaranteed or protected by any central bank or government.
  • Bitcoin is based on a decentralized, peer-to-peer network, which means that there is no central authority in charge of it.
  • Bitcoin transactions are virtually anonymous as parties’ identities are not disclosed.
  • Bitcoin has no intrinsic value; its value depends largely on people’s confidence in the virtual currency.

The bitcoin system demonstrates a clear case of information asymmetry. On the one hand, it is complex and therefore not easily understood by users. On the other hand, the bitcoin software application is easily downloadable and used by users as such, even if they do not fully understand how the system works or appreciate the risks.

These features, in the context of legal uncertainty and the lack of close oversight, lead to a high-risk situation. Bitcoin is a high-risk system for its users from a financial perspective, as it could collapse if people attempt to exit the system en masse but are unable to do so due to its illiquidity.9 The fact that the founder of bitcoin uses a pseudonym – Satoshi Nakamoto – and is surrounded by mystery does not help promote transparency and credibility in the system.

Risks for virtual currency users

Virtual currencies, including bitcoin, raised untested legal concerns, in particular related to consumer protection. There is no specific regulatory protection to cover users’ losses if, for example, a virtual currency trading platform fails or goes out of business, or if its users’ digital wallets get hacked and virtual currency gets stolen. Therefore, buying, spending, holding or trading virtual currencies such as bitcoin involves a number of risks for their users.

As regulatory attention to bitcoin increased globally and its exchange rates became extremely volatile, a number of government authorities around the world began to take measures to address the user-related risks involved. On December 12, 2013, the EBA issued a warning to consumers on virtual currencies.10 The EBA’s warning followed similar announcements from the central banks of China, France and New Zealand. India was also reported to soon issue a public advisory to warn against potential risks associated with “this new digital currency concept”.11

The EBA identified several characteristics and risks that users should be aware of when dealing with bitcoin or similar virtual currency12. Such risks include the following:

  • Money can be stolen from digital wallets: Virtual currencies are stored in users’ “digital wallets”, on computers, laptops or smart phones. Digital wallets are not impervious to hackers; therefore, virtual currencies can be stolen from such wallets. In addition, if a user loses the key or password to the digital wallet, the virtual currency belonging to such user could be lost forever. There are no central agencies that record passwords or issue replacement ones.
  • There is no protection in using virtual currencies as a means of payment: When using virtual currencies as a means to pay for goods and services, users are not protected by any refund rights under any law. Unauthorized or incorrect debits from digital wallets are therefore not usually reversed. Acceptance of virtual currencies by retailers is not permanently guaranteed and is based on their discretion or contractual agreements, which may cease at any point without notice.
  • Money can be lost on exchange platforms: Virtual currency exchange platforms tend to be unregulated. They may go out of business or fail, for instance, due to hacking by third parties. Such exchange platforms are not banks that hold their virtual currency as a deposit. If an exchange platform loses any money or fails, there is no specific legal protection (such as, e.g., through a deposit guarantee scheme), which covers a user for losses arising from any funds held on the exchange platform, even if the exchange is registered with a national authority.
  • Value of virtual currencies can change quickly, or even evaporate completely: The value of virtual currencies has been extremely volatile and can easily go down as well as up. There is no assurance that the value of virtual currencies will remain largely stable.
  • Transactions in virtual currencies may be misused for criminal activities, including money laundering: Transactions in virtual currencies are public, but the parties of the transactions are not. Transactions are largely untraceable and provide virtual currency users with a high degree of anonymity. It is therefore possible that the virtual currency network will be used for transactions associated with criminal activities, including money laundering. This misuse could affect virtual currency users, as law enforcement agencies may decide to close exchange platforms and prevent users from accessing or using any funds that the platforms may be holding for them. 
  • Virtual currency users may be subject to tax liabilities: Holding virtual currencies may have tax implications, such as value added tax or capital gains tax. Their users should consider whether tax liabilities apply.

The EBA warned that virtual currency users should be fully aware of and understand specific characteristics of such currencies. Users should not spend “real” money to buy virtual currencies that they cannot afford to lose. They should exercise the same caution with digital wallets as they would do with their physical wallets, e.g., they should not keep large amounts of money in digital wallets for an extended period of time, and should ensure that virtual currencies are kept safe and secure. They should also familiarize themselves with the ownership, business model, transparency, and public perception of the virtual currency exchange platforms that they are considering using. The EBA has not suggested any other measures for protection of virtual currency users or their virtual property or any further steps in this direction. While bitcoin and similar virtual currency prices slightly dropped after the EBA’s warning, they quickly bounced back.

Issues associated with virtual currencies also apply to cash or other forms of “real” money. Nevertheless, virtual currencies have unique characteristics which may attract further regulatory attention.

1    Tor is a system that hides the identity of people visiting sites and it has also given rise to a “dark net” of sites accessible via an associated Tor browsing program; see http://en.wikipedia.org/wiki/Tor_(anonymity_network)
2    http://www.theverge.com/2013/4/29/4281656/silk-road-black-market-reloaded-tor-marketplaces
3    http://www.bbc.co.uk/news/technology-25185225
4    http://www.forbes.com/sites/andygreenberg/2013/12/01/silk-road-competitor-shuts-down-and-another-plans-to-go-offline-after-6-million-theft/
5    https://mtgox.com/press_release_20110630.html
6    http://www.finextra.com/News/Fullstory.aspx?newsitemid=23713
7    http://www.sci-tech-today.com/story.xhtml?story_id=022002OTBA7I
8    https://bitcointalk.org/index.php?topic=83794.0#post_toc_22
9    http://www.ecb.europa.eu/pub/pdf/other/virtualcurrencyschemes201210en.pdf 
10  http://www.eba.europa.eu/documents/10180/16136/EBA+Warning+on+Virtual+Currencies.pdf  
11  http://articles.timesofindia.indiatimes.com/2013-12-10/internet/45033531_1_bitcoin-digital-currency-currency-concept
12  Similar risks related to bitcoin were earlier identified by Bitcoin.org and mentioned on its website; see http://bitcoin.org/en/you-need-to-know

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Dorsey & Whitney LLP | Attorney Advertising

Written by:

Dorsey & Whitney LLP
Contact
more
less

Dorsey & Whitney LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Privacy Policy (Updated: October 8, 2015):
hide

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.

Security

JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.