The DAO gets exploited for $150 million. Bitfinex is hacked for over $60 million.
Many of you have read the headlines. Some of you have logged the losses. All of us are waiting to see how this all shakes out. Most of all, everyone has their own idea about what should happen as a result. The truth is that we are at a crossroads and how we (as an industry) deal with these issues may well tell the tale of how we are accepted (or rejected) by the world at large. Our credibility is at stake.
But first, what actually happened?
Scenario One: The DAO gets (technically legally) clipped for millions of ETH. Ethereum leadership forces a hard fork which basically attacks a flawed (but ultimately legal) contract, then a cyber hit squad is deployed to get the Ether back -- the Ether that was legally exploited through the fault of a badly written smart contract written into the DAO.
Scenario Two: Hong Kong-based Bitfinex gets hacked for $65 Million. The company then spreads the loss among its clients to the tune of 36% across the board -- with not even a whiff of compensation or, seemingly, a scintilla of demonstrable concern for their client's welfare.
These scenarios are concerning because in both instances, there seems to be an underlying violation of trust -- in two very distinct ways.
First, as the DAO core moved to a hard fork, it became obvious that even though it is marketed as decentralized, it still has an acting "central authority" that can and will intervene on otherwise legal actions. This injures the immutability standards that it has been touting, and exposes the uncomfortable fact that any transaction can be attacked at the whim of "management". It's a problem, if only an image one because this could have been used as a teachable moment.
The lesson is simple: be very careful when coding smart contracts, because the DAO is going to maintain its integrity no matter what. That lesson, as painful as it may be, would sink in fast.
This situation is made somewhat more questionable by the emergence of a team of so-called "white hat" coders, who were able to "recover" 7 Million ETC (around $16 Million as of this writing) of the exploited ETC. This would be all well and good, except that they were not retrieving stolen ETC, they were stealing exploited ETC. There is a difference.
"Exploited", in this case, means that someone took advantage of a code issue within the smart contract and simply lifted what was legally there to take. It is perhaps unethical, but it may not actually be theft (the jury is still out on this). So, in this case the "white hats" may be the actual thieves, as they have stolen 7 Million ETC in the name of "recovery". Tricky ethics, to be sure.
By the way, in the words of Cointelegraph:
"It is not... fully clear who exactly transferred the (7 Million) ETC and what they plan to do with the funds, but... we’d assume it would be returned to the rightful owners."
So, in other words, who knows what the hell is going to happen.
Moving to Bitfinex. This is certainly a case of theft, perpetrated by some person or group. So at least the moral integrity of the story holds up. But does it?
In an article on BBC online, it was announced that the HK company will spread the losses (36% of inventory) across the span of their clients. Let that seep in... Everyone is 36% down on their Bitcoin investment with Bitfinex, as of today. No insurance, no responsibility, no integrity, and no action taken by the company to make restitution of any kind. This should be raising some eyebrows.
At least here, we may be able to offer a solution that can help set things straight. What if Bitfinex, without the aid of bank-like insurance schemes simply did something along the lines of the following fix: For taking the 35% hit in their deposits, Bitfinex clients might receive some kind of clawback or restitution by receiving a percentage of future rises in the price of Bitcoin from Bitfinex's holdings for a fixed amount of time, say a year. Something like this would go a long way in proving that Bitcoin is a community that cares about fairness.
This might not be the ultimate solution, but the amazing financial minds in our industry should be able to come up with something better than reducing the holdings of their clients, with no compensation plan. Even banks have plans for this contingency, so the current action by Bitfinex basically tells the world that banks are a better place to store your value.
Isn't this our Grand Social Experiment? Is it not the time when we reverse the "nefarious practices of traditional banks" and create a new world of value through digital trust networks where code is law... or at least we play a different and better game? Or is this already a dream deferred?
I suspect that regardless of one's position, these two incidents expose a weak underbelly in our industry -- and our community ethos -- that we need to address immediately. There seems to a disconnect here between the ideals that many of us champion, and what actually happens when industry leadership is challenged with tough, but necessary, growing pains. Both entities were considered to have some of the best leadership and technology in the blockchain space; both have also enjoyed considerable funding in their respective ways.
I know that the core devs of the DAO have good intentions. I don't know the Bitfinex peopeo well, but until now they have had a decent reputation. That said, all of this is very new and as with any work in progress there are, and will continue to be, tough decisions to be faced every day. However, whatever the cost to us as entrepreneurs in the short run, these challenges must be addressed in ways that are faithful to the goals of immutability, trust and fairness.
If we fail to deliver on our promise, we only have ourselves to blame.