Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you have bitcoins in 'cold storage' (Gox supposedly had 99+% their BTC that way) - i.e., the keys are physically offline and not accessible remotely in any way - then I don't see any easy ways of checking if all those coins are still valid.


then I don't see any easy ways of checking if all those coins are still valid.

Every client holds a copy of the blockchain, that is the full transaction history of the bitcoin network.

Consequently it's not just easy to check the balance of a cold wallet, it is trivial.

Here's the balance and history for a SatoshiDice address:

https://blockchain.info/de/address/1dice8EMZmqKvrGE4Qc9bUFf9...


Couldn't they keep the addresses online for private keys which are offline, and look up the balance for each address on the blockchain?


"the keys" are the private component of a private key/public key pair. the public key can be shared with anyone / stored anywhere, and gives you the address which makes checking ones balance trivial.


Okay, you can detect open thefts that way and Gox should've implemented that. But you still can't detect if you've lost control of the private keys - if you've split all your cold balance into many addresses of X BTC each, then you can remotely check if the addresses are still filled, however, if an [inside] attacker takes those keys and replaces them with garbage, then no auditor is going to know that the addresses aren't in your control anymore; the solution would probably be periodic (automatic?) proof-of-ownership tests on those balances.

In any case, securing BTC is hard and requires stricter controls and more discipline than securing general banking systems, as the nature of BTC makes it easier to get away with large amounts of funds. For example, you need a solid solution for multiple "write-only" offsite backups of 'cold keys' because otherwise you simply risk your assets being permanently destroyed due to a simple hardware failure, but if anyone in your company is able to singlehandedly recover&decrypt a single such backup then he can immediately abscond with all money.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: