BTC Sessions - Lightning Attack Vectors, Liquid Timelock Issue, $2B Of Fake Gold In China EP076

Episode Date: June 29, 2020

SUPPORT THE SHOW: LEDN offers Bitcoin backed loans – Sign up and get $50 free https://bit.ly/385JAPd Get Wasabi wallet and enjoy your privacy https://wasabiwallet.io/ Coincards lets you use Bitcoin and Lightning to easily buy gift cards and top off your mobile! https://coincards.com/us/?ref=btcsessions MY ALL-ENCOMPASSING GUIDE TO GETTING STARTED WITH BITCOIN https://www.btcsessions.ca/post/how-to-buy-sell-and-use-bitcoin-in-canada Buy Bitcoin in Canada on Coinberry and get $20 after your first $50 purchase https://app.coinberry.com/invite/c5d52730857 Get the Ledger Backup Pack – Includes Ledger Nano X & S https://shop.ledger.com/products/ledger-backup-pack?r=faca NordVPN helps with your internet privacy – Get 70% off https://nordvpn.org/btcsessions Buy Bitcoin in Canada using Shakepay and get $10 for free after your first $100 purchase: https://shakepay.me/r/HUQFI60 If you value my work and would like to send me a tip, they are always appreciated! LIGHTNING tips: https://tippin.me/@BTCsessions SHOW RESOURCES: $2B of fake gold discovered in China https://asia.nikkei.com/Spotlight/Caixin/Mystery-of-2bn-of-loans-backed-by-fake-gold-in-China Chase Bank “error” temporarily drains customer accounts over the weekend https://decrypt.co/33955/a-technical-issue-seemingly-emptied-chase-bank-customer-accounts Lightning Network attack could create chaos https://cointelegraph.com/news/researchers-say-new-lightning-network-attack-could-create-chaos https://medium.com/@jonahar/flood-loot-a-systemic-attack-on-the-lightning-network-5c3dac7bba24 Liquid Timelock issue temporarily centralizes key ownership https://medium.com/blockstream/patching-the-liquid-timelock-issue-b4b2f5f9a973 Over $100M of BTC now tokenized on Ethereum https://decrypt.co/33921/bitcoin-wrapped-on-the-ethereum-blockchain-reaches-101-million RGB Beta drops – smart contracts on Bitcoin https://github.com/LNP-BP/FAQ/blob/master/Presentation%20slides/RGB%20Technology%20Guide%2C%20part%20I.pdf https://github.com/LNP-BP/FAQ/issues/11 BTCPay adds pull payments and easy refunds https://blog.btcpayserver.org/btcpay-server-1-0-5-0/ 10 tips to use Bitcoin more privately https://www.bitcoinqna.com/post/10-tips-for-interacting-with-bitcoin-more-privately

Wasabi wallet and fairly private. What's up everyone? I'm Ben with the BTC sessions and this is your daily session. Before we dive in, of course, shout out to sponsors of the show, leaden.io. Now I've been working with these guys for well over a year now and they have a variety of services that you can use your Bitcoin for. So the first thing I ever used them for was their Bitcoin backed loans. In my case, I was in a pinch. I needed to get my hands on dollars, but I didn't want to sell my Bitcoin because, one, it's a taxable event, and two, I was worried I was going to have to buy back at a higher price point. So I was able to deposit my Bitcoin. I got a loan to my bank account within 24 hours.

It could be Canadian dollars or US dollars. When you pay that back, you get your Bitcoin back. Now, they've also got a couple of their services. They've got their Bitcoin and USDC savings accounts, and they just bumped up the interest rates on those. You can get up to. to 8.8% annually. And then they've got their B2X offering. This uses the same loan mechanism to instantly buy more Bitcoin. That effectively doubles your Bitcoin on the spot.

So if you want to check them out, there's a link in these show notes down below. And if you use that link to get a loan, then they'll actually give you 50 bucks worth of Bitcoin for free. And secondly, we have coin cards. Now I've been using these guys for quite some time. The first time I ever used them was six years ago,

hard to believe and they've been growing and expanding since then. Really, really simple. You can buy gift cards with Bitcoin. They accept it on main chain. They accepted lightning. And then also if you got a bag of shit coins and you want to unload them and pick up something of value, you can always get some gift cards here. They've got pretty much everything you would need. They're in Canada and the US and they're looking at expanding as well. So I do recommend you check them out. I've had nothing about good experiences with them. You can check them out. Again, link in the show notes down below.

With that, let's dive into the news. So today's show has a bit of a theme. And I would say the theme is don't trust, verify, and not your keys, not your coins. Because a lot of this has to do with counterparty risk. The first story here from the Nekai Asian Revees, view, the title of the article is mystery of two billion of loans backed by fake gold in China. Pretty much self-explanatory here, but let's just read a little bit from the article.

More than a dozen Chinese financial institutions, mainly trust companies, loaned 20 billion yuan or 2.8 billion U.S. dollars over the past five years to Wuhan King Gold Jewelry, Inc., with pure gold as collateral and insurance policies to cover. any losses. King Gold is the largest privately owned gold processor in central China's Hubei province. Its shares are listed on the NASDAQ Stock Exchange in New York. The company is led by Chairman I'm going to butcher this name. I apologize, but Gia Zihong, I hope, an intimidating ex-military man, who is the controlling shareholder? What could go wrong? Well, plenty, as at least some 83 tons of gold bars used as collateral turned out to be nothing but gilded copper.

That has left lenders holding the bag for the remaining 16 billion yuan of loans outstanding against the bogus bars. The loans were covered by 30 billion yuan of property insurance policies issued by state issuer PICC property and Casualty Co-Limited and other small issuers. So again, the lesson here, and this, it has a lot to do with why we even needed Bitcoin in the first place. We were on a gold standard before. But the issue with that was if you've got a piece of paper that's supposed to be backed by X amount of gold, are you auditing the vault yourself? And when you go deeper into that, if you did audit the vault yourself, as we've now seen, did you audit the quality of the gold yourself? are you capable of doing so?

And so those weaknesses in gold itself led to the issuance of more paper money than gold that was backing it. And instances like this, you can see that loans and value were allocated to gold bars that did not exist in the first place. And so when you see something like this, this is what Bitcoin aims to fix. Bitcoin does indeed fix this because if you are running a node, then you essentially own the vault. You are checking the validity not only of whether or not you actually do hold and receive the gold, in this case, the Bitcoin. But the validity and the quality of the Bitcoin, you are actually verifying if the Bitcoin is real and sits within the consensus rules of the entire network.

To verify gold, first you have to audit the vault and then you have to check the quality of the gold itself. And Bitcoin removes both of those and puts it in an easy software stack where as long as you're running the program, you're golden, we'll say. Let's move on from there. Now, this one, again, I guess more in the lines of not your keys, not your coins. Not your cash. Not your cash, I suppose. Anyways, a technical issue seemingly emptied Chase Bank customer accounts. Now, I will say beforehand that this was a technical error and people did actually get access to their funds in the end. But regardless, let's read a little bit about what happened. Numerous clients of New York-based Chase Bank, the subsidiary of financial giant J.P. Morgan Chase and the sixth largest bank worldwide, discovered that their accounts were seemingly emptied or received some extra money on Sunday morning. As it turned out, the irregularities occurred due to a technical issue as Chase Bank's spokesperson told the news. Now, further fueling customers' worries, the bank's customer support service was reportedly closed at the time.

Chase Bank's clients were left to post about sudden disappearances of money from their accounts on Twitter, claiming to have suffered losses ranging from hundreds of dollars to more than a hundred grand. There is a tweet here from a guy named Bernie Kozar. He wrote, over $100,000 is missing from my fucking business account. Hashtag Chase Bank. And again, some people were a little worried particularly because, you know, end of the month coming up. They have mortgages, different things, a lot of, a lot of end of the month expenses coming up. And when it's a weekend and there's no customer service going on, you're wondering if that money's going to be in there when all these expenses come due Monday morning, Tuesday morning. Now, it was resolved. Whale Panda on

Twitter, infamous crypto Twitter personality. He did say, he tweeted out, their reports Chase Bank accounts are not displaying the correct balance. Rumors about it being hacked. It might just be a failed database migration or updates since this happened during the night from Saturday to Sunday. He also pointed out that some accounts had increased funds as opposed to losses, and he ended up being retroactively correct in this case. But still, it does kind of also point out that, number one, Bitcoin doesn't close. Now, there isn't technical support, of course, but Bitcoin, the network itself is just running 24-7, and if you're running your own node, you can verify everything is correct on the network at any point.

And let's say you have a failure of a wallet where you're holding Bitcoin. You can, as a last resort, you can always take your keys from that wallet and import them to a different wallet that is functioning. if you're not running your own node and you're just holding your own keys. So, yeah, I mean, it just kind of beckons to some of the improvements on Bitcoin. Now, non-Bitcoin stuff was not the only thing to see some threats of counterparty risk pop up over the past few days. Technology being built on top of Bitcoin has also seen some interesting, I mean, not direct attacks as of yet, but some pointers to Bitcoin base layer, regular Bitcoin, being the most secure version of using Bitcoin. And when you move beyond that, there can be security vulnerabilities.

And you need to take that into account when you decide where you're allocating your funds. So moving on here, researchers say a new Lightning Network attack could. create chaos. And so this is an article on Coin Telegraph. A study published on June 29th revealed a way to drain Bitcoin wallet's funds on the Lightning Network by exploding a bottleneck in the system. According to the flood and loot, a systemic attack on the Lightning Network paper, Jonah Harris and Aviv Zohar from the Hebrew University of Israel evaluated a systemic attack on Lightning Network that allows for the theft of Bitcoin funds that were locked in payment channels. Now, it is a little complex the way that this attack is able to be rolled out.

I am still trying to wrap my head around it, but more or less, the way that it would work is you would have two lightning nodes, if you're the attacker. If you're an attacker, you have a lightning node where you're sending from and a lightning node where you're receiving to, and then you'd have a bunch of intermediaries in between the routing nodes, other people that you've created Lightning Network channels with. So a channel is when you are holding funds between you and another individual, and that other individual would have funds between them and another individual, and it makes this kind of intricate web of funds that can be kind of shuffled around every time a payment is executed and eventually settled to the main

Bitcoin blockchain. So the thing that happens here is that you would send a payment to yourself, but in the end, your other node, you would purposely make it non-responsive. And when that happens, the intermediary node, the person in the middle that has a channel with you, actually tries to send back funds. And I believe at that point, when you are unresponsive, you're basically trying to take advantage of a way of, there's a bit of a timeout that can happen. And if it runs out, then you force the individual to settle to the main blockchain. You essentially force this person to close out the channel with you and allocate the refund back to you. And then in the end, you're receiving node on the other end actually does pull the funds through. So someone in the middle ends up

getting screwed, the victim in the middle, they refund you, but they've also unknowingly pushed funds to the other side of the channel, which are then pushed towards your other lightning node. Now, in order to achieve this, it seems that you would need to attack multiple channels at once. and the idea is you try to fill up a Bitcoin block full of these settlement payments. And it should be said that they need around 85 channels to guarantee. They need to attack 85 different channels to guarantee that this will get them some money. But if the blocks are getting fuller, then you need far less than that. So this could be a problem.

anyways i i don't want to butcher the explanation that's too much but just know that it's kind of like a denial of service where they try to flood all these different requests and and hit like a a timeout period where they get refunded on the main chain as well as obtain the lightning network funds on the other end of the channel um so we'll see how how this plays out um they don't say that there's any discernible fix to this that I read through this post here, but we'll see. I don't know. Bitcoiners are an inventive bunch. I imagine something can be done here. Now, has this been done in the wild? I don't think so. I haven't seen anything of the sort so far. Will it be done? I don't know. but as always only allocate stuff to lightning that that you need to have there i use it i usually

just kind of have change there um if i need some quick payments i usually don't have more than a hundred 200 bucks sitting in lightning and a lot of the time it isn't utilized right away um sometimes i have far less than that sitting in lightning so um in my view right now given that on-chain fees are still pretty reasonable. You can get away a lot of the time with one Satoshi per byte, which is very, very small. You're spending a couple pennies. I tend to, if I know I'm going to be doing a bunch of transactions,

then I can do a single transaction to fund a lightning wallet, and then I can do as many transactions I want and not worry about paying Bitcoin fees. And even if the on-chain fees got to be, exorbitant, you could always do one expensive fee to fund your lightning wallet and then again not have to worry about fees from that on in. So yeah, that's my approach. Now, speaking of layers and externalities to Bitcoin, liquid. So liquid, there's a bit of, now no funds were actually directly at risk here, but it does kind of this issue that popped up

over the weekend, does kind of point to the fact that liquid is not fully trustless, right? They try to trust, minimize it in a way. So liquid is a side chain. And the way that this works is Bitcoin on the main chain gets locked up. And it gets locked up in a federated multi-signature scheme, multi-signature meaning that you need multiple signatures to unlock that Bitcoin. In this case, there are 15 different wallet holders, 15 different signatures, and you need at least 11 of them to unlock that Bitcoin. And all of these are held by large corporations, typically exchanges, in order to move those funds or to peg out those funds to send them back to the original users. So the one thing about this is that Bitcoin, when it's pegged into liquid, to create

liquid Bitcoin, which moves faster, is more confidential, and is mostly geared towards large traders, what happens is if the network is unresponsive, let's say they're trying to peg out Bitcoin, remove it from the liquid network and get that Bitcoin that was locked up available on the Bitcoin network once again. If those 11 needed signatures were not reached within a certain amount of time before the expiry of the time lock that locked up the Bitcoin. To prevent the network from stopping working, instead of 11 out of five signatures, it goes to an emergency wallet permission, which is held by Blockstream, the creator of the liquid network, and that is a simple two of three multi-signature scheme.

So all of those keys are held by Blockstream. and so it's more just meant to be as a failsafe in the in the instance of of liquid federation members ever becoming unresponsive so that bitcoin is not lost now sometimes the multi-sig scheme is not regenerated before the the time lock is up and so there'll be a period of time where Blockstream does have access to a certain amount of Bitcoin just through their two of three multi-sake. And this happened over the weekend. Now, the big issue, they had not updated kind of the time lock sequence to prevent that from happening because there hadn't been as much Bitcoin on liquid before. Now they're starting to be sizable amounts. And in this case, on Friday for a period of about 40 minutes, Blockstream had two of three access to 800 and, how much was it,

870 Bitcoin for about 40 minutes that they could have accessed using their two of three multi-sig. Now, their two of three multi-sig is apparently geographically dispersed, meaning that there are in different geographic locations and it's like deep colds, storage, it takes some effort to get to. They have never, these two of three keys have never been utilized so far in liquid history. It's short history, but, you know, so far haven't been utilized. But the fact remains that, that technically speaking, Blockstream did have access to a total of 870 Bitcoin of users pegged funds. And it was no longer at the whim of the federation members, but just solely that of block stream for that period of time.

And so, again, it just points to the fact that liquid is attempting to be as trust minimized as possible, but it's not trustless. And so you need to take that into account when you're utilizing something like liquid. I still see value in it when it comes to traders that are moving large amounts of Bitcoin inter-exchange or just exchanges deciding to move Bitcoin between themselves. I definitely see value in that because it definitely helps in reducing blockchain bloat and reducing on-chain fees for the rest of us. But do you necessarily want to park a ton of your own Bitcoin in liquid all the time? I don't know. That's kind of up to you.

Now, something that even goes further down the not your keys, not your coins, rabbit hole is this. wrapped Bitcoin on Ethereum. Wrapped Bitcoin on the Ethereum blockchain has now reached over $101 million worth. So wrapped Bitcoin is essentially fully custodial. You hand over your Bitcoin to a custodian, and then they create a token version of Bitcoin that resides on the Ethereum blockchain. So I'm just going to read a little bit from this article on Decrypt. The total amount of value of tokenized Bitcoin on the Ethereum blockchain has sharply increased

since mid-May, with over $101 million for the Bitcoin now hold in tokens such as wrapped Bitcoin, RenBTC, HBTC, IMBT, and SB, anyways, there's a whole bunch different versions of tokenized Bitcoin on Ethereum. Now, WBTc and similar tokens represent Bitcoin on the Ethereum blockchain. One tokenized Bitcoin equals one regular Bitcoin. Bitcoin can be converted into these tokens and vice versa. To achieve this, users lock up their BTC on the Bitcoin blockchain, using specialized custodian services or smart contracts. After that, the corresponding amount of tokenized Bitcoin is created on Ethereum,

which can be then used on its blockchain. Now, WBTC, the most popular tokenized Bitcoin by far, accounts for the lion's share of this niche, where there are currently around 8,200 Bitcoin converted into Ethereum, tokens worth roughly $74.9 million. Yeah. So it's it's it's surged quite a bit in the past month and a half here. Now the thing with this that I have more of a problem with than something like liquid

is the complexity of the main chain when it comes to Ethereum in the first place. And the now not all versions of these these pegged tokens. on Ethereum are totally custodial, but rap Bitcoin is, or WBTC, is the most custodial out of all of them from what I've seen. So, yeah, the main issue I have here is when it comes to liquid, what you're trying to do is you're trying to enjoy lower fees, confidentiality, you're trying to have it trust minimize and the simplicity of the technology on which it's built, which is based entirely on Bitcoin's technology with a few little tweaks like faster block times and confidential transactions,

you have a higher degree of security with something like this. When you jump over to Ethereum, which tries to cram all of these complexities onto the base chain, you can run into issues here. Furthermore, if you're trying to achieve faster transactions, or rather, not faster, but cheaper transactions, well, Ethereum itself, the fees have been quite high. In fact, they've been higher than Bitcoin as of late. So you're not necessarily going to enjoy cheaper fees. When it comes to security as far as or speed of confirmed transactions, as far as finance, as finance, of payments, the same amount of finality you would get out of six confirmations on Bitcoin takes double the amount of time on Ethereum. Further down that rabbit hole, you also have

the counterparty risk of the individual actually, or the rap Bitcoin that is just fully held in custodial hands. So you've got that counterparty risk there as well. Yeah, for me, it's just it's a little too far down that route. Now, if people want to go ahead and lock up their Bitcoin on Ethereum, I mean, that's fine by me. It's definitely not my cup of tea, but I suppose it contributes to the scarcity of having some Bitcoin locked up there. And if they lose it, well, that's their prerogative as well.

So to each their own. Now, something new in the same vein, RGB. RGB, beta is now live. And so what is RGB? RGB is a smart contract system that is able to manage rich state. Users, it uses a client-side validation paradigm by Peter Todd. And basically, you're able to have confidentiality.

with assets issued on Bitcoin without using a separate blockchain that has safety, scalability, there's no Bitcoin blockchain congestion, and it's future ready without any hard forks in the future. So basically, let's compare this to a few existing systems that allow you to issue assets on top of Bitcoin through a side chain or some sort of colored coins or different things. things like that. So RGB compared to liquid. RGB works with Lightning Network, as does liquid. Now, it replaces the large signatures on liquid with something called bulletproofs. Now, there's no blockchain space consumption with RGB, whereas there is some with liquid when it comes to pegging in and out.

Now, it's a universal smart contract system, and it works. works on Bitcoin main net, it does not require a federation. So a little bit more trustless. Now, compare this to Omni or colored coins or counterparty, which is also based on Bitcoin. There's, again, no blockchain consumption. So you're not basically spamming the chain and causing fees to go up. There's much higher privacy with that. And again, this works with a lightning network without modifications. Now, RGB compared to Ethereum or EOF, or other corporate blockchains. RGB, again, is not a blockchain.

It works on and with Bitcoin, the only censorship-resistant, unconfiscatable hard money. So, RGB has been around for quite some time. It's just starting to... I see a bit of a resurgence now, again, with the beta dropping. So I'm interested to see this proliferate

and build from here. But, yeah, cool. Let's move on. BTC Pay server just released a new version 1.0.5.0 is out. And so they added a few things and things like notifications. Two things stood out to me. Number one was poll payments. So this would be like if you had a subscription to something, you could pre-set up, hey, I'd like this to come out, that you could set like a total pool of money that somebody is allowed to pull from and somebody can pull the total

amount or smaller amounts from that. You know, maybe you have a gym membership. Maybe you have a supplier that's that's pulling payments for product that you get from them. So you can set that up within BTC Pay Server now. They also now have an easy refund button, whereas before there was a lot of back and forth between individuals, merchants and individuals that needed a refund. So this just simplifies that. So cool to see BTC Pay server continue to innovate. And again, all of this without a trusted third party. So sweet. Good job, BTC pay. Glad to see you guys getting more grants and building. And last thing I wanted to touch on was this little article from Bitcoin Q&A. I'm really liking this website here. Bitcoin Q&A, solid. They've done some breakdowns of wallets and nodes and

kind of what's best. This is 10 tips for interacting with Bitcoin more privately. I'm just going to go through the list really quick before we sign off here. Number one, don't tell anyone. I'm kind of screwed in that department, but you don't have to tell anyone that you're using Bitcoin. Or you can be selective with who you tell. Maybe just don't do it online. Control your own keys and practice coin control. So make sure you're holding a wallet and not leaving it with a custodian. Be anonymous online. Shit. You still maybe have that choice. Use encryption tools. So using encrypted email, messaging, notes, things like that. Absolutely. Using Tor or VPN services. Now some of the Bitcoin wallets that I've covered do use Tor by default, so Samurai and Blockstream

wallet being examples of that. And I do commonly talk about Nord VPN. I use that all the time, but there are other VPN providers out there. I'll leave a link for Nord in the show notes if you want to check out Nord. But basically it hides your IP address and encrypts your browsing data. Buy from non-Kyc exchanges. So this can help with your OPSEC, of course. If you sign up to a KYC exchange where you give them their information, there is record of you and of your purchases and of that Bitcoin moving off the exchange into your own wallet, which can then be tracked.

You can use coin join to break those links, but the record is still there on the exchange. So you can use something like BISC, hoddle, huddle, packs full, things like that where you're doing peer-to-peer transactions. Number seven, run your own node. This helps prevent you leaking your IP address. And they refer to their node comparison article they did before. You can transact off-chain. Things like the Open Dime, which is basically a little USB stick that holds a Bitcoin wallet that doesn't show the private key until you break a little circuit in it, meaning that you can create physical Bitcoin, hand it to somebody,

And that person that gets the Bitcoin is not worried you're going to go home and sweep the money off of it before they're able to do so. You can also use Lightning, which again is off-chain and has added privacy benefits as it's all onion routed. And you can't quite exactly get a good picture of what's going on. It's not 100% foolproof, but it definitely adds to your privacy. Step 9, as I already said, coin join. We've got Wasabi wallet, of course. You've got Samurai wallet. You can check out those.

There's join market as well. little bit more technical to use. And you have things like pay to endpoint being implemented by things like BTC Pay server and Blue Wallet, I believe, is working on it. And I think Blockstream green. So all of these things that help mix up your coins. So it's difficult to decipher who owns what. And then finally, you can go Google free. This can be very difficult. I still find it difficult. but if you're a stickler and you really, really want to be private on the internet when using your Bitcoin, you can go Google free. You can get, oddly enough, a Google Pixel. And then you can flash it with something called Graphene OS, which is an alternative operating system that de-googles everything. It takes all of the

Google software off and is first and foremost a privacy intensive operating system. You can it as well with another type if you don't have a Google Pixel. There are other options out there, but yeah, anyways. So I'll link to this below. Solid article, lots of good resources here. With that, I'm going to sign off you guys. A little bit of a longer one today, so thanks for sticking with me. I hope you had a good weekend.

If you want to help over the show, you can do a whole bunch of different things. You can hit like, subscribe, and share if you're here on YouTube. You can also check me out on my other platform. platforms, Facebook Live, you can check me on Twitch, D-Live, Twitter, follow me on all of those, or go and listen audio only on the podcast on any platform that you listen to podcasts on. If you want to help with the show in another way, you can hit up the sponsors I mentioned down below, leaden and coin cards, there's links in the show notes. And then finally, if you want to help out, you can always pick up a hardware wallet.

If you don't have one already, start thinking about it. now if you use the affiliate link to pick up a ledger nano x or s down below that will help the show i use both but there are other great options out there i do use other options as well i like to mitigate my risk uh but be sure to check that out and finally if you really liked what you saw you can drop me a lightning network tip at my tippin dot me page that's tippin dot me slash at btc sessions and with that i'm out have yourselves a wonderful evening or a rest wonderful rest of the day and I'll see you next time for your daily session.