Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
The Almighty Buck Crime

Is Coinbase Closing Accounts For Paying Ransoms With Bitcoins? (coindesk.com) 202

Even as some comparnies are stockpiling bitcoins so they can quickly pay ransom demands, security firms that try paying those ransoms may face losing their accounts on Coinbase. Slashdot reader Mosquito Bites quotes a report from CoinDesk: Less than a year ago, Vinny Troia, CEO and principal security consultant of Night Lion Security and a certified white hat hacker, was sent a compliance form by US bitcoin exchange Coinbase, where he had an account. Coinbase wanted to know how Troia was using bitcoin and his account. "I told them I run a security firm. I pay for ransoms and buy documents on the dark web when clients request it," Troia told CoinDesk. The ransoms Troia helps his clients pay are those stemming from ransomware attacks, which have surged in number over the past few years. Many, like the well-publicized WannaCry attack, are asking for bitcoin.

And the documents? Troia said, "We do breach investigations a lot of times. If a fraudster is saying they're selling my client's stolen documents, the only way to make sure they have what they say they have is to buy those documents." According to Troia, Coinbase "did not like that at all." Coinbase then asked the IT expert whether he had a letter from the Department of Justice giving him permission to do those things. No, Troia said. Upon further research, Troia has not found that any such permission exists. But, "I have my clients authorizing me to do this," he said. Coinbase sent Troia back an email explaining that those actions were against the exchange's rules and shut down his account... "My entire family is blocked from Coinbase," he said.

This discussion has been archived. No new comments can be posted.

Is Coinbase Closing Accounts For Paying Ransoms With Bitcoins?

Comments Filter:
  • Punt coinbase? (Score:5, Informative)

    by Ritz_Just_Ritz ( 883997 ) on Monday June 19, 2017 @03:37AM (#54645709)

    Vote with your feet. There are other exchanges.

    • Re:Punt coinbase? (Score:5, Informative)

      by michelcolman ( 1208008 ) on Monday June 19, 2017 @05:23AM (#54645957)

      Why do you even need an exchange for this kind of thing? Just use a wallet app, nobody can tell you what you can and cannot do with it.

      (That doesn't mean I endorse paying ransoms, of course)

      • Re:Punt coinbase? (Score:4, Insightful)

        by harryk ( 17509 ) <.harryk20022002. .at. .yahoo.com.> on Monday June 19, 2017 @09:42AM (#54646895) Homepage

        The issue is really about purchasing bitcoin (especially at significant volumes). Coinbase is more of a retail outlet, while GDAX is the exchange. And yes, you can use Local Bitcoin at about a 17% markup (depending on location) but if he's trying to run a business having a mark-up that high sucks.

        Really the issue is Coinbase and they super paranoia for risk avoidance. On the one hand, you can't blame them for protecting their business from auditors/regulators and the power they weild. On the other hand, they're really the only reputable place you can buy bitcoin in the US without paying ridiculous fees. Sure, you can setup accounts at Cex.IO, or Bitfinex (the latter of which is not currently accepting US deposits) but international wires are kind of a pain to deal with.

        What really needs to happen, IMO, is Coinbase needs to be clearer on activity they will and will not tolerate/accept risk for and there should be more of a discussion on how that risk is evaluated. Risk/Compliance departments aren't always so harsh on what they don't accept, Coinbase is definitely taking the extreme position in many of these cases making it more and more difficult for reputable purchasers to make legitimate buys.

        • Since when does a bank have liability or say in how you spend your funds? At worst they have a reporting obligation for suspicious transaction patterns and since they don't deal in cash I don't see that applying here.
          • Ask the pot growers

          • Re: (Score:3, Informative)

            Operation Choke Point

            To quote Wikipedia:

            "Operation Choke Point is an initiative of the United States Department of Justice that was announced in 2013, which is investigating banks in the United States and the business they do with payment processors, payday lenders, and other companies believed to be at higher risk for fraud and money laundering.

            This operation, disclosed in an August 2013 Wall Street Journal story, has been accused of bypassing due process; the government is pressuring the financial industr

        • by Cito ( 1725214 )

          I use Gox , about 11 bitcoins worth

          it's safe right?

      • If you don't mine bitcoins yourself, then you need to use an exchange to get them for money.
    • Exactly, a bank/exchange has no business even asking its clients how they choose to spend their funds let alone passing judgement about it.
  • Good (Score:3, Interesting)

    by Anonymous Coward on Monday June 19, 2017 @03:41AM (#54645719)

    Good.

    It's because asshole pricks like your clients buy bitcoins, pay the ransom, then go complaining to their bank or credit card provider that the payment was unauthorised or a result of blackmail, and try to do a chargeback against the innocent bitcoin merchant. Or gets them locked out of their accounts while being investigated for fraud.

    So you can just fuck off and buy your bitcoins somewhere else.

    • Yes, good for Coinbase for taking a stand. Ransomeware exists because people pay ransoms, it's as simple as that. To take this further: is there any way an exchange could facilitate the tracing of Bitcoin payments?

    • Re:Good (Score:5, Insightful)

      by swb ( 14022 ) on Monday June 19, 2017 @07:37AM (#54646287)

      When I read the summary, I thought to myself that "white hat" hackers are merely facilitating a security economy by buying hacks, documents, etc. They may not specifically commit criminal hacks and may actually be "defenders" of their clients, but in a lot of ways they kind of look like just middle men.

      I'm pretty sure there's been plenty of cons run where "the bad guys" steal something and a person claiming to be a "good guy" approaches the victim and says "I'm a white hat, I have contacts and can get your stuff back" and then they transfer the money to the bad guys in exchange for the goods. Meanwhile, does it matter in this transaction whether they belonged to the bad guys all along or whether they were independent good guys?

      From an economics perspective, it sounds like a distinction without a difference. Same transactions take place, with the only difference being that if the "good guy" really is an independent agent, it might actually cost more because the good guy will extract their own fee for handling the transaction (which, if he was a bad guy, may have also been rolled in for appearance sake).

  • by Anonymous Coward

    Security companies should not be allowed to act as front companies for cybercriminals anymore than they should be allowed to assassinate people for pay. Let's hope there's a criminal investigation as well. Perhaps this one was even directly involved in the original crimes, not only encouraging them...

    • by Shoten ( 260439 ) on Monday June 19, 2017 @07:25AM (#54646239)

      Security companies should not be allowed to act as front companies for cybercriminals anymore than they should be allowed to assassinate people for pay. Let's hope there's a criminal investigation as well. Perhaps this one was even directly involved in the original crimes, not only encouraging them...

      You're not paying attention.

      The security company wasn't accepting payment on behalf of ransomware actors. They were facilitating the payment TO ransomware actors on behalf of companies that aren't familiar with bitcoin and have no accounting methodology to make such a payment before the ransomware runs out. They were a front for the victims, not the criminals.

      It's akin, in a rough way, to what K&R companies like Control Risk do when it comes to ransoms in the real world. There are right ways and wrong ways to pay a ransom, and they are intimately familiar with the difference. As a result, they step in when one of their clients has a kidnapping situation and manage the whole thing to help get the person back safely. And yes, this usually does involve paying the ransom.

      The real motive by Coinbase is probably a fear that they'll be accused of helping facilitate criminal activity. Bitcoin exchanges are on the narrow edge of falling under regulation, but it could also go another way (*cough*Liberty Reserve*cough*) for any particular exchange if the regulators in their country feel that they are guilty of money laundering. As a result, Coinbase is taking proactive measures to be able to prove that they, well, proactively avoid facilitating crime. I don't necessarily agree with it, but I can at least see where it came from.

      • Re: (Score:3, Informative)

        > The real motive by Coinbase is probably a fear that they'll be accused of helping facilitate criminal activity. Bitcoin exchanges are on the narrow edge of falling under regulation,

        I suspect that, since many exchanges do facilitate quasi-legal and illegal activity, it's important in business terms for them to avoid any involvement in clearly illegal activity that has the kind of paper trail or provenance that a security firm such as Control Risk might provide. An exchange for an illegal activity, such

      • The real motive by Coinbase is probably a fear that they'll be accused of helping facilitate criminal activity.

        I really do not understand this. I've never heard of a bank closing someone's account because they used the money in it to pay a ransom. Surely if there is no danger to the bank from facilitating payment of a ransom in fiat currency why would there be any danger to Coinbase for doing the same in Bitcoin? The people committing the crime here are those extorting the ransom, not those who pay it whatever your position may be on paying ransoms.

      • They're channeling money to organised crime. Legal or not, that makes them crooks in my book.
  • Is it illegal? (Score:5, Informative)

    by muphin ( 842524 ) on Monday June 19, 2017 @03:50AM (#54645743) Homepage
    As discussed here Cyber extortion - legality of ransom payments and the approach of businesses and insurers [taylorwessing.com] it shows under international law, cyber extortion payments arent illegal unless they are terrorism related.

    I dont believe Coinbase should be denying access to legitimate funds, that arent terrorism related, unless they want to get regulated... this would be the first step to ruining their little monopoly.
    • What does legality have to do with anything?

      Coinbase can choose who their customers are and who they give service to, just like any brick & mortar store, or any other internet service provider.

      • And everybody can choose to tell Coinbase to mind their own fucking business when it comes to what funds are being used for. They aren't a regulatory body.

        • They aren't a regulatory body, but they also aren't a regulated body either - this is the equivalent of going to a chinese medicine doctor instead of a sexual health clinic when your john thomas is oozing green puss.

          • by Shoten ( 260439 )

            They aren't a regulatory body, but they also aren't a regulated body either - this is the equivalent of going to a chinese medicine doctor instead of a sexual health clinic when your john thomas is oozing green puss.

            Yes, but the day is coming when that will change. And they know it. If you were in their shoes, what would you want those regulations to look like? They'll be crafted to deal with what happens before they are written.

    • Re:Is it illegal? (Score:4, Informative)

      by Richard_at_work ( 517087 ) <[moc.liamg] [ta] [ecirpdrahcir]> on Monday June 19, 2017 @04:35AM (#54645817)

      Could it possibly be that Coinbase are themselves concerned that they will get into trouble for aiding and abetting due to the very transactions this guy wants to do, as currently they are not regulated and therefor have no scope within any regulation to be allowed to permit transactions to known fraud accounts while holding no responsibility for that transaction.

      A basic cover your ass situation. "Cyber extortion payments" may not strictly be illegal, but certainly an aiding and abetting criminal activity case can be made against any exchange which facilitates them...

      • by mysidia ( 191772 )

        A basic cover your ass situation. "Cyber extortion payments" may not strictly be illegal, but certainly an aiding and abetting criminal activity case

        It is probably bad for the long-term viability of cryptocurrency to be associated/understood as a medium for making ransom payments.

        On the other hand: Once you have your coins, is it ANY of Coinbases' fucking business what you choose to use your money for after you take it out of the exchange?

        This would be as stupid as the bank questioning what you will d

        • This would be as stupid as the bank questioning what you will do with$10,000 cash you are withdrawing occassionally. Why withdraw? Because it's my fucking money, and my right to privacy in my business affairs is a fundamental right.

          They may not ask you what you are doing with it, but they are required to report [wikipedia.org] the transaction to the government. You can thank the drug war and the "small government" Republicans (as well as the "big government" Democrats). As long as people keep voting for these authoritarian jackwads these kinds of laws will continue to be made. The new Attorney General is ramping the drug war back up, because so far we have spent trillions of dollars with no appreciable impact on drug supply or demand, so obviously

          • by mysidia ( 191772 )

            They may not ask you what you are doing with it, but they are required to report the transaction to the government.

            I guess so, sure they can report the transaction, since the transaction will be subject to reporting, but after it is done,
            then where I choose to put my cash or whomever or whatever I choose to buy and/or spend it with is none of their business,
            beyond that point Neither they nor the government will have any right to inquire further, and furthermore,
            I have a right to keep those affairs priva

          • You seem to misunderstand the motives for ramping up the drug war. What that does is convict more people, ruin their lives, and send them to prison at the taxpayers' expense, and that is very good for the private prison industry that takes government funding to use slave labor.

        • Its Coinbases business as much as it is a club owners business to know if people are dealing drugs on their premises - its on their premises which makes it their business.

          You could easily transfer everything to your own local wallet and conduct the transaction there, and then Coinbase wouldnt have any business having an issue.

    • Re: (Score:3, Insightful)

      by Shoten ( 260439 )

      As discussed here Cyber extortion - legality of ransom payments and the approach of businesses and insurers [taylorwessing.com] it shows under international law, cyber extortion payments arent illegal unless they are terrorism related.

      I dont believe Coinbase should be denying access to legitimate funds, that arent terrorism related, unless they want to get regulated... this would be the first step to ruining their little monopoly.

      They aren't worried about "international law" (which, incidentally, is barely a thing unless you are a war criminal or something else so egregious that most of the world is willing to support a method around prosecuting you.) They're worried about local laws, which are a lot more real. The absence of relevant criminal statutes under international law will not protect you against regulatory or criminal proceedings in nations where you operate.

      They're worried about being blamed for money laundering, so they

      • by Cederic ( 9623 )

        They're worried about being blamed for money laundering

        That's my bet too. Getting put out of business and/or senior staff getting prosecuted for violations of AML laws is a very real risk and a sensible one for them to mitigate.

        It's one thing reporting likely money laundering activity to the relevant authorities, but when you're dealing in currency exchange it's also rather useful to be able to highlight that you're not accepting as customers people that habitually make payments for criminal activity.

        There's plenty of legitimate activity to be making money on,

    • I dont believe Coinbase should be denying access to legitimate funds, that arent terrorism related

      Nothing in the summary or story says anything about denying access to his funds. You just sort of pulled that out of nowhere.

      This is a story about a company that doesn't want to work with a guy who profits off of ransom payments (you didn't think he was doing this for free, did you?).

    • The article you cite seems to be based on ignoring _local_ law and its interaction with federal and international law. In the USA, extortion is normally considered a state matter, not a federal or international one. But as soon as the offence crosses state or international lines, it can easily become one.

      Please, be careful what you read from such an article. At least in the USA, there is considerable _state_ law about extortion. Much of it is easily discoverable at http://statelaws.findlaw.com/c... [findlaw.com]. While

    • unless they want to get regulated...

      Without the threat of regulation Coinbase would just be an exchange, like every other non-judgmental currency exchange in the world, and I'm sure they'd much rather not do this extra work.

      But, in the real world, they're a US company in the crosshairs of the Federal Reserve and if they are already not feeding all of their data to the NSA (in which case they might actually be looking to protect customers) then they're at risk of that happening any time now.

  • Looks like I am changing my wallet provider.
  • Bitcoin becomes more restrictive than the traditional banks
  • Abiding by the law (Score:4, Interesting)

    by petes_PoV ( 912422 ) on Monday June 19, 2017 @04:39AM (#54645831)

    Coinbase sent Troia back an email explaining that those actions were against the exchange's rules and shut down his account.

    That seems reasonable. Coinbase is an american company. There are laws against financing or facilitating the financing of terrorist and/or criminal activities.

  • by Anonymous Coward

    a "security" expert that owns a "security" company should know better than to respond to "form", one not required by any federal law or regulation, asking questions from the exchange. don't hire them, folks. they don't know shit from rainbows.

    and the "news site" linked to in tfs is partially owned by that same exchange.. so is hardly unbiased. "Disclosure: CoinDesk is a subsidiary of Digital Currency Group, which has an ownership stake in Coinbase." -- not even any actual copies of the "compliance form" or

    • by Megol ( 3135005 )

      What? You really is a special kind of clueless fuck. Yeah one doesn't need to reply to a "form" (which was a form -> nothing "" about it) from a company one use the service from - but then the company doesn't need to provide any service to you either.

    • by harryk ( 17509 )

      In the 'buyers' defense, he felt he was doing nothing wrong and more than likely wanted to be honest about his usage. The issue here is honesty in this case got his account closed. The larger issue (IMO) is that once Coinbase has made a decision, there is no path to mediation that would allow the closed account holder to plead his case.

      This is not the first time Coinbase has chosen to close an account and most definitely will not be the last. What sucks is that there is no recourse for individuals with c

  • >> The ransoms Troia helps his clients pay are those stemming from ransomware attacks, which have surged in number over the past few years.

    Well, duh. Maybe if they didn't make it a successful business model in the first place, it would go away.

    I'm thinking what those companies actually need to spend their money on is better backup solutions.

    • by Anonymous Coward

      If their security and backup policies is done according to advice from security consultants who get cuts of every ransom- and blackmail payment their clients pay out, even a management actually wanting to do the right thing won't be able to do so.

  • by l0n3s0m3phr34k ( 2613107 ) on Monday June 19, 2017 @05:30AM (#54645981)
    That Coibase is asking for "a letter from the DoJ" seems very strange; especially if this isn't actually obtainable. If I was running a security company that ran into such a requirement, I would immediately engage my legal council...especially if Coinbase closing my accounts actually cost me "real world loss" in the form of me loosing access to my bitcoin wallet stored on their system. Requirements that are impossible to fulfill might constitute fraud, especially if there is a demonstrable "loss of income" due to Coinbase's activities from Troia's (currently) legal activities. Right now, there has only been a (A HREF="https://coincenter.org/entry/it-should-not-be-a-crime-to-help-victims-of-ransomware">single court case in the New York southern district court that has touched on the idea that paying ransom with bitcoin violates 18 U.S.C. 1960.
  • The government has a lot of draconian rules when it comes to regulated financial companies like Coinbase. In order to stay in business, Coinbase has to stay away from anything even remotely connected to something that looks criminal.

    The irony of this is that the FBI itself has no good answer to ransomware and has even themselves recommended that people pay the ransoms: http://www.businessinsider.com... [businessinsider.com]

    Yet the same government regulations make it nearly impossible for Coinbase to let people use their Bit

  • by Anonymous Coward

    This is an interesting pattern (which often becomes also an antipattern) which I like to call "deregulated regulation": private enterprise takes over things which used to be done by the executive and (hopefully) double-checked by courts.

    You find many examples out there, like DMCA takedown, firmware lockdown in WIFI devices, "censorship" by dominant platforms (technically not censorship, but when a platform has near-monopoly position, well... tough luck), ISP "blocking" of "pirates", yadda, yadda.

    As the "ano

    • "censorship" by dominant platforms (technically not censorship,

      Censorship is defined by the action, not who does it - that merely dictates acceptability, lack thereof, etc.

  • by Anonymous Coward

    There are, AFAIK, only two exchanges that 1) mind your privacy, 2) are out of reach of U.S. gov, and 3) comply with regulations for financial institutes, and that's Paymium and Bitstamp in the EU.

    Use Coinbase and you risk losing your Bitcoin and your personal detaisl to the U.S. gov.

  • Okay, but why would it be just the Los Angeles branch closing these accounts?

  • Why? (Score:2, Insightful)

    by wardrich86 ( 4092007 )
    Why the hell are people paying the ransoms in the first place? This is just encouraging more people to make these types of viruses. Make fucking backups of your shit, fire the moron that unleashed the virus in your network, restore from backup, and carry on with life.
    • by EvilSS ( 557649 )

      Why the hell are people paying the ransoms in the first place? This is just encouraging more people to make these types of viruses. Make fucking backups of your shit, fire the moron that unleashed the virus in your network, restore from backup, and carry on with life.

      Do you really think they are paying if they have good backups? Or do you expect them to rent a time machine and go back and fix/implement the backups? Yes, they should have good backups but when they don't, and when the documents that get encrypted are make or break for their company (and yes, such a thing does exist) then you pay.

    • Re:Why? (Score:5, Insightful)

      by Kjella ( 173770 ) on Monday June 19, 2017 @09:07AM (#54646715) Homepage

      Why the hell are people paying the ransoms in the first place? This is just encouraging more people to make these types of viruses. Make fucking backups of your shit, fire the moron that unleashed the virus in your network, restore from backup, and carry on with life.

      Do you really have to ask? The number of people who'll just use anything until it breaks without proper maintenance is staggering. I'll gladly admit that while computers is "my thing" there's probably something about some filters on my washing machine or leather care for my couch or oiling the terrace boards I don't do. If you start asking when somebody last checked my electrical system, plumbing etc. I get even more "eh..." and if my car didn't have to be checked every two years by law I'd probably forget all about that too.

      Backups are the computer equivalent of painting the garage, it's always almost at the top of your list but mysteriously enough never reaches the top. I finally caved in and decided to hire a maid service not because I can't scrub a toilet but whenever that floated to the top of my TODO list I kept putting it off over and over again. So I understand people, should have had backups. Should have tested the backups. Should have patched Windows. Should have updated their anti-virus. Except they never got around to it.

    • Tragedy of the commons. We're all better off if nobody ever pays a ransom demand, since that will mostly stop people from trying to extort ransom. However, I may well be better off paying a ransom if my files or a family member are held hostage. I would go to considerable lengths to get my wife or son back safe from kidnappers. A business looking at hundreds of thousands of dollars in lost business or something else might well figure that paying a few thousand is in their best interest.

  • If only there was a way to conduct financial transactions beyond the reach of 3rd-party interference!

  • In some jurisdictions it is illegal to knowingly do business with criminals... By giving criminals money you are encouraging further crime by demonstrating that crime does pay, and many police forces will come down pretty hard on this.

    Obtaining documents that you believe may have been illegally obtained from your clients is also questionably legal, you are collecting evidence which is the job of law enforcement, and there is also the chance that those aren't your clients documents and your obtaining something totally illegal.

  • The first prohibited use in their terms of use

    Unlawful Activity: Activity which would violate, or assist in violation of, any law, statute, ordinance, or regulation, sanctions programs administered in the countries where Coinbase conducts business, including but not limited to the U.S. Department of Treasury's Office of Foreign Assets Control ("OFAC"), or which would involve proceeds of any unlawful activity; publish, distribute or disseminate any unlawful material or information

    Paying someone to obtain stolen goods is illegal in many places.
    The user didn't have authority from DoJ to recover stolen goods on someone else's behalf.

    If you see someone with your stolen stuff, you tell the police. You don't pay some random guy to do your dirty work.

    Repo agents, etc, are authorised by the government to do their work.

    Buying stolen goods from someone that you know are stolen is illegal.

  • This asshole should be in prison! You DO NOT pay ransoms. It should be against federal law to pay ransoms like this. You're supporting terrorists, drug dealers, and at the very least, criminal groups overseas. That in itself is illegal so why not extrapolate it to making paying ransoms illegal. Every single ransom this asshole pays encourages more people to do the same thing because it makes money. This idiot needs to be stopped.

He who is content with his lot probably has a lot.

Working...