It’s a heist movie cliché. “Don’t worry,” says our hero, apologetically brandishing a gun at the terrified bank teller: “Your money is insured by the federal government.” A particular problem arises when the money in question is specially designed to operate beyond the control of all governments, federal or otherwise. Such is the founding principle of Bitcoin—the most widely traded of the so-called “cryptocurrencies”—which suffered a sharp fall in value last week following a cyber-attack on Coinrail, a Bitcoin exchange in South Korea.
The news that hackers had compromised Coinrail triggered a massive sell-off in the market, wiping out over US$42 billion from Bitcoin’s market value in one hour. Because Bitcoin and other cryptocurrencies are underpinned by advanced encryption techniques, there is a misguided perception that they are immune from theft. In reality, they are only as secure as the digital “bank” or “exchange” in which they are stored.
While large traditional banks have the resources (and legal obligation) to invest heavily in security and fraud prevention, most cryptocurrency exchanges are startups with no regulatory oversight and razor-thin profit margins. Their circumstances provide little incentive to devote resources into effective risk-based fraud detection and user authentication solutions. This problem is compounded by the legal barriers faced by victims of cryptocurrency theft when they try to recover their losses.
The last Bitcoin theft to make international headlines occurred in 2014. Mt. Gox was a Japanese exchange which processed an estimated 70% of all Bitcoin transactions before it was targeted by a sophisticated cyber-attack and filed for bankruptcy. Without insurance or government guarantees, depositors were left to recover what they could from the insolvent company. Four years later, a number of class action lawsuits launched by creditors are slowly making their way through the Japanese courts. (Surprisingly, despite the sheer number of claimants—24,750, with approved claims in excess of US$432 million—creditors are likely to recoup their losses in full due to the fact that Mt. Gox’s few remaining Bitcoins are now worth far more than the 2014 value of its entire pre-theft inventory.)
Although Bitcoin has gained a measure of respectability over the past several years, it remains an immature financial asset. Exchanges are under no regulatory obligation to carry adequate insurance or refund depositors whose money is stolen, and the extent of their legal liability in major jurisdictions is unclear. While it is technically possible for individual users to keep Bitcoin and other cryptocurrencies secure by storing them on an offline hard drive, in practice this makes the currency unwieldy and difficult to use.
Realistically, cryptocurrencies will continue to be stored in online exchanges. As such, the industry will need to make major strides in terms of security and legal protections if it ever hopes to gain mainstream acceptance. In the short term, it will be interesting to see whether the arrival of traditional banks (several of which have recently established cryptocurrency trading operations) will succeed in turning security and legal certainty into key differentiators for cryptocurrency exchanges.
