zlacker

[parent] [thread] 19 comments
1. kisamo+(OP)[view] [source] 2022-02-08 17:16:32
In a hypothetical, if the two did not breach Bitfinex servers (unauthorized access to others systems) but instead managed to "guess" the private key to the Bitfinex wallet and transfer the funds, would this also be a crime?

Would this be treated the same way?

replies(9): >>realce+W >>seibel+h1 >>knorke+i1 >>shemno+p1 >>ngokev+Y1 >>runeks+F2 >>pc86+A3 >>oh_sig+6i >>manque+wc1
2. realce+W[view] [source] 2022-02-08 17:19:46
>>kisamo+(OP)
Computer Fraud and Abuse Act covers any unauthorized access regardless of how the credentials were obtained or... magically guessed.
replies(3): >>lupire+q1 >>nybble+Z9 >>ada198+ja
3. seibel+h1[view] [source] 2022-02-08 17:20:50
>>kisamo+(OP)
If a bank accidentally leaves a sack of cash on the sidewalk and you take it, it is not yours. Plus they didn't declare any of the money and instead laundered it through a bunch of sham companies and fraudulent users on crypto exchanges.
replies(1): >>toomuc+03
4. knorke+i1[view] [source] 2022-02-08 17:20:53
>>kisamo+(OP)
If bitcoin has legal ownership, then the means by which you stole it doesn't seem relevant.

Are you essentially asking if bitcoin has ownership?

I would assume that using someone else's credentials (wallet private key) without permission to make changes to a system (the bitcoin blockchain) is in itself illegal, yes.

IANAL.

5. shemno+p1[view] [source] 2022-02-08 17:21:22
>>kisamo+(OP)
I can't see how they can get away from it not being theft. No durable argument could be made in court they thought it was there to take, there is no way they didn't know it was someone else's property.
replies(1): >>nverno+y5
◧◩
6. lupire+q1[view] [source] [discussion] 2022-02-08 17:21:22
>>realce+W
Also, grand larceny applies if you guess the code to unlock a car.
replies(1): >>bpodgu+Ca
7. ngokev+Y1[view] [source] 2022-02-08 17:23:23
>>kisamo+(OP)
From the article, they aren't necessarily being charged with the hack itself
replies(1): >>sschue+E3
8. runeks+F2[view] [source] 2022-02-08 17:26:07
>>kisamo+(OP)
Wouldn't it still be laundering?
◧◩
9. toomuc+03[view] [source] [discussion] 2022-02-08 17:27:16
>>seibel+h1
Even if the bank accidentally put the money in your bank account and it’s reasonable to believe that it’s not yours, you can be held liable if you spend it or withhold it from the bank.
10. pc86+A3[view] [source] 2022-02-08 17:29:16
>>kisamo+(OP)
Knowing the key doesn't immediately mean that your access is authorized. This isn't equivalent to finding a $20 bill on the ground so there's not really any corollary to stumbling across it.
◧◩
11. sschue+E3[view] [source] [discussion] 2022-02-08 17:29:20
>>ngokev+Y1
So they where hired to launder the money? Wouldn't the FBI try to make a deal to catch the people who executed the hack?
replies(1): >>ngokev+l8
◧◩
12. nverno+y5[view] [source] [discussion] 2022-02-08 17:35:29
>>shemno+p1
Regardless, I don't think ignorance would be a valid legal defense, despite whether someone recognizes random sequences of bits as personal property or not.
◧◩◪
13. ngokev+l8[view] [source] [discussion] 2022-02-08 17:47:04
>>sschue+E3
Just saying in the article that's what they're being legally charged for, and that already comes with hefty maximum sentences.

They are clearly associated with the hack, but that can be tacked on after further investigation and cross-examination. The money laundering is an easier opening target.

◧◩
14. nybble+Z9[view] [source] [discussion] 2022-02-08 17:52:43
>>realce+W
In the scenario outlined there would be no unauthorized access to any systems, whether owned by Bitfinex or anyone else, so I really don't see how the CFAA could possibly apply here. As for the cryptocurrency network itself, the protocol is that anyone who has the private key is authorized to spend the corresponding funds—how the key was obtained is irrelevant.

Of course, correctly guessing a 256-bit random private key is exceedingly unlikely, though if they key is based on a lower-entropy password (a "brain wallet") then the odds of a correct guess improve dramatically.

replies(1): >>thered+Qz
◧◩
15. ada198+ja[view] [source] [discussion] 2022-02-08 17:53:54
>>realce+W
I’m so confused how this holds up in a distributed system like Bitcoin.

There is this ownerless software running.

I don’t see it as theft.

◧◩◪
16. bpodgu+Ca[view] [source] [discussion] 2022-02-08 17:54:53
>>lupire+q1
It applies even if the car isn't locked... it applies any time you take something you know isn't yours.
17. oh_sig+6i[view] [source] 2022-02-08 18:24:47
>>kisamo+(OP)
Yes. If you guess my house key shape, that doesn't give you a right to enter my house, even if you can now unlock the front door.
◧◩◪
18. thered+Qz[view] [source] [discussion] 2022-02-08 19:36:06
>>nybble+Z9
CFA would likely consider a bitcoin wallet a "system". You weren't authorized to access funds in that wallet.

And even if it weren't that's no different than guessing someone's bank account number and paying for purchases that way. Its still someone else's money and its still stealing.

replies(1): >>nybble+u71
◧◩◪◨
19. nybble+u71[view] [source] [discussion] 2022-02-08 22:05:58
>>thered+Qz
> CFA would likely consider a bitcoin wallet a "system". You weren't authorized to access funds in that wallet.

We don't have to guess. The CFAA refers to unauthorized access to computers, not "systems". The Bitcoin network is not a computer, and someone posting a transaction signed with some key, however that key was obtained, is using the network as intended and not accessing either the Bitcoin network as a whole or the individual computers comprising the Bitcoin network in an unauthorized manner.

> And even if it weren't that's no different than guessing someone's bank account number and paying for purchases that way.

It is different, because in that scenario you're claiming to be the designated account owner, a specific legal person authorized by contract to direct the bank to pay money from that account—not just someone who knows the account number. You generally have to sign a statement to that effect in addition to providing the account details. If you aren't the account holder then you're committing fraud. (Though practically speaking it's really a bit ridiculous that merely knowing the account number—something printed on every check and hardly a closely-held secret—is considered sufficient to set up a direct debit.)

By design, Bitcoin doesn't care about your real-world identity; it only cares about whether you know the private key.

> Its still someone else's money and its still stealing.

Wrong on both counts. Bitcoins are an abstract concept, much like points in a game. They are governed by voluntary consensus among Bitcoin users according to a particular specialized system of rules, and not your private property. In short, they're "yours" only as long as the network says they're "yours". If other Bitcoin users stop recognizing those bitcoins as "yours" for whatever reason—a blockchain fork, a change in the consensus rules, someone else guessing your private key and spending them—you have no legal recourse. There are no physical goods involved which you could sue to have returned to you, and no legally-binding contracts between you and any other participants in the Bitcoin network which you could claim were breached by the change.

20. manque+wc1[view] [source] 2022-02-08 22:32:21
>>kisamo+(OP)
It is theft whether your door was unlocked or I break your window and then steal your stuff.
[go to top]