In 2009, Satoshi Nakamoto had an idea: a digital currency that could be used without bank or central entities, based on the trust the users had for each other. With the help of public-key cryptography and the Internet, members of this peer-to-peer network could tell if a user was legitimate and allow transactions from and to him or her, without revealing personal details that were separate from the public identity. So BitCoin was born.
It took a couple of years for this system to be known, used mostly by people who wanted to develop and experiment with something new. Little by little, as more people became members of the network, small business and professionals started to accept it as payment, and a currency exchange was started. Sites like Mt.Gox or TradeHill could let you buy and sell BitCoins for U.S. dollars or Euros, among others. Thus BitCoins became not only an electronic currency, but also a physical one that you could use in the “real world.” BitCoin prices started to grow at an awesome rate, from less than a cent to almost US$20. It was an excellent investment tool and its uses started to become more and more interesting and varied.
But as with all foundations based on trust, the slightest mishap can make the system crumble, and that is what happened here. BitCoins were used as currency for illegal digital drug markets. When those were taken down, the wrath of certain organizations was directed at BitCoin. They wanted to ban it for being supposedly untraceable and a great tool for criminals.
We must point out that BitCoin transactions are traceable, as every transaction is broadcast to the network with a public log. What is difficult is to learn who is the actual person behind any BitCoin user, because the transaction logs only the public key of the user.
With the system already under scrutiny, the second strike came. A user reported the theft of almost U$500,000 in BitCoins and the first weakness of the system appeared: Because this is peer-to-peer networking has no centralized database, it was impossible to confirm or refute the claim, even by the architects. A lot of doubt was cast over the report, because some people say that the system can’t handle such a big transaction, but that is not important. The key is that if a PC is compromised, the system is not secure and it can’t be trusted implicitly because you never know if the user is who he or she claims to be. You trust a user because he or she has the correct credentials, but you can’t really know there is impersonation going on.
That happened in early June. A couple of days later some malware was found. Designed just for infiltrating BitCoin computers, detecting the digital wallets and uploading them to an FTP server, it allowed whoever was behind it to do legal transactions with the wallets of other users because it had the correct credentials. Clever.
For the coup de grâce, the hacking of BitCoin’s biggest exchange site was reported. The media says that almost 60,000 accounts and passwords were stolen in the hack. The price of BitCoins has plummeted and site’s order to roll back has not been well received.
If you look at the big picture, is a logical chain of events. With the credentials that the malware stole, an attacker could access the currency exchange site of those particular users. Even when the trades were stopped until the situation was normalized, the implicit trust of the system was completely broken because of the new and unknown player. It is fair to ask if the same group that wrote the malware is the same group that compromised the exchange site. Coincidence? It’s difficult to say.
It is certainly hard to say whether this system could survive another “Black Thursday.” Trust from the users and from the environment, maybe, but can you trust something that is so distributed with no central verification?
Sources:
http://www.wired.com/threatlevel/2011/06/silkroad/
http://www.theregister.co.uk/2011/06/16/bitcoin_theft_claims/
http://forum.bitcoin.org/index.php?topic=16457.0
http://forum.bitcoin.org/index.php?topic=1958.0
http://www.zdnet.com/blog/btl/bitcoin-a-guide-to-the-future-of-currency/50601