Hacker News new | ask | show | jobs
by DigitalSea 4207 days ago
I am a bit reluctant to trust another Bitcoin marketplace. So many of these marketplaces have failed the past year, what reason should people have to trust Buttercoin or think that they are more secure than the likes of Mt. Gox? Being a funded marketplace just means that you are more than likely to be the target of hackers trying to prove a point. I've already lost a little bit this year because of various marketplace collapses.

What protections are in place for losses? What are you procedures for storing coins (hot wallets, cold wallets, etc)? Do you have a guarantee you are willing to publicly stick by? Has your marketplace been audited and verified by a third party security firm? How often will you undertake auditing of your marketplace to ensure that it remains secure and funds are safe? If customer coins are ever compromised, will you cover 100% of the losses?

I have a few BTC, I would be more than willing to try this out, if you were more forthcoming in regards to security and your guarantees. Being a funded marketplace, I would like to think you built a decent and secure environment for Buttercoin as well as got the site audited independently by a third party security firm who perhaps specialise in financial/marketplace scripts.

I am not trying to be cynical here, Buttercoin looks great, but you can understand given the losses I have endured the past year, that I am very very hesitant to trusting another marketplace and I assume there are many out there like me who have been burnt the last year. My trust in all coin marketplaces has been broken, I just need the public reassurance you will do things differently and your policies/procedures before I move any of my BTC.

2 comments

We have been audited by independent security professionals and will continue to undergo frequent security testing (both code reviews and adversarial testing). I'll try to make the results of that more public, since you obviously shouldn't just take my word for it.

To protect against losses we're working to get insurance for deposits setup, but it's not in place yet. We're also looking at the possibility of letting people maintain custody of their coins if they don't need realtime trading. Proof-of-reserve is also planned soon to guarantee that all accounts are fully funded.

Right now, the vast majority of coins we control are in cold-storage wallets that require 4+ people to access, with most of the rest in cold-storage wallets that require 2 people to access. Only a very small amount is in a hot wallet. We're working with a partner to add custodial multi-sig to our hot wallet (and maybe cold wallets) so that even if someone compromises our machine, there's an external signatory which will be able to prevent transactions from processing.

You're right to be cautious. Even though I keep most of my bitcoins on Buttercoin, in general I wouldn't recommend that anyone use a centralized service for long-term storage. We know that people will do that though, so our security has to be up to par. Hopefully the features we roll out over the next 3-6 months will create enough transparency that you can trust us.

I like your openness. What's your role at Buttercoin? Also, how do you differentiate from Coinbase?
I'm one of the founders/CTO.

Our main difference from Coinbase is that we have an order book and real-time trading. Coinbase is great for people that want to buy some bitcoin at a fixed price and don't mind waiting a few days to get them. We focus more on businesses and traders that need to buy and sell bitcoin in real time. Adding USD is also very fast with us, usually 1 or 2 days. I think that's slightly faster then Coinbase, or was last I checked (unless you add a credit card for instant buy with lower limits). It doesn't matter as much in Coinbase's model, since they're fronting cash to lock in a price.

>So many of these marketplaces have failed the past year, what reason should people have to trust Buttercoin or think that they are more secure than the likes of Mt. Gox?

You should not. You should buy the Bitcoins, then move them to your own wallet.