<p>The Bitcoin Wiki (in the linked article for multisig) cites <a href="https://bitcointalk.org/index.php?topic=507297.msg5594085#msg5594085" rel="nofollow noreferrer">a post on BitcoinTalk</a> describing nearly the same problem that you did:</p>
<blockquote>
<p>Suppose I am working with a company that wants to accept Bitcoin for international trades.</p>
<p>The company, for security reasons, would not want a single one of its employees to have access to the company BTC wallet's password. Any transaction would have to meet the approval of more than one employee.</p>
<p>Is this possible already? If not, how could it be implemented with public-key cryptography?</p>
</blockquote>
<p>One common solution to this problem is <a href="https://en.bitcoin.it/wiki/Multisignature" rel="nofollow noreferrer"><em>multisignature</em></a> (commonly abbreviated as <em>multisig</em>).</p>
<p>Most Bitcoin transactions (the ones created by users like you and me) require only one signature — that of the owner of the private key that corresponds to the Bitcoin address. Multisig comes into play by requiring a certain number of signatures for a transaction to be verified. The Bitcoin Wiki <a href="https://en.bitcoin.it/wiki/Multisignature#Multisignature_Transactions.5B3.5D" rel="nofollow noreferrer">gives a few examples</a> of this. The following examples use <code>M-of-N transactions</code>, meaning that <code>M</code> users (out of <code>N</code> users who are able to sign the transaction) must sign the transaction for it to be verified:</p>
<blockquote>
<p>1-of-2: Husband and wife petty cash account — the signature of either spouse is sufficient to spend the funds.</p>
<p>2-of-2: Husband and wife savings account — both signatures are required to spend the funds, preventing one spouse from spending the money without the approval of the other</p>
<p>2-of-3: Parents’ savings account for child — the kid can spend the money with the approval of either parent, and money cannot be taken away from the child unless both parents agree</p>
</blockquote>
<p>Specifically in regards to your question, 10 executives or employees of a Bitcoin exchange may have the private keys associated with a <a href="https://en.bitcoin.it/wiki/Multisignature#Multisignature_Addresses" rel="nofollow noreferrer">multisignature address</a>; a combination of any 5 of those private keys may be required to send bitcoins from this address (this is a <code>5-of-10 transaction</code> in the <code>M-of-N transaction</code> format).</p>
<p>This doesn't guarantee the bitcoins won't be stolen. 5 &quot;evil&quot; employees could collude to steal the bitcoins without the other 5 &quot;good&quot; employees knowing. However, this is a much more trustworthy system than a single employee being able to steal all the bitcoins (as could happen with a &quot;standard&quot; bitcoin address if an &quot;evil&quot; employee had access to the private key).</p>
<p>However, you might notice some flaws with this in regards to a Bitcoin exchange. Wouldn't it get tiresome for the 5 employees to constantly sign a transaction to provide withdrawals to users? The answer is yes, which is why companies implement a &quot;hot wallet&quot; — a wallet that holds a fraction of the bitcoins the company actually owns (the rest of the bitcoins are in a &quot;cold wallet&quot;, which would probably be the multisig address). I'm not sure of the exact process exchanges use to send bitcoin from the cold wallet to the hot wallet (and I'm sure it differs from company to company), but I would guess that every once in a while, if the hot wallet is running low on bitcoin, <code>M</code> employees would verify a transaction from the multisig wallet to the hot wallet.</p>
<p>The hot wallet is totally susceptible to being stolen by a single &quot;evil&quot; employee (since it's most likely not a multisig wallet for efficiency, and thus has only one private key), or to being stolen by a thief, but companies would much rather only lose a fraction of their bitcoins (a hot wallet) than all of their bitcoins (a cold wallet).</p>

CC BY-SA 3.0
2016-12-03T09:26:32.683Z
Very interesting. I totally buy that this is a feasible approach, both mathematically and practically. Thanks a lot for sharing.
aioobe
CC BY-SA 3.0
2016-12-03T01:52:33.107Z
2016-12-03T09:09:03.640Z
2020-06-16T11:10:03.350Z
busterroni
<p>How do an online service such as a Bitcoin exchange prevent some sysadmin from transferring assets from its users to him self (like in the bitcoin case, a secret wallet of his own) and take off to Bahamas?</p>

<p>I mean if I'm able to log in to their site, transfer or withdraw my assets at any time, it seems to me like <em>someone</em> on the inside could do the same for large amount of users with little effort? I'm thinking for instance of a DB admin or someone responsible for authentication.</p>

<p>If there's no satisfying answer to this (like a mechanism that requires cooperation of <em>N</em> people for such attack to succeed), I think I've reached my limit on how much of my money I can trust an online company with.</p>

CC BY-SA 3.0
2016-12-02T08:11:41.900Z
Posted this at security.stackexchange.com because I thought it was much more related to computer security than the specifics of bitcoin. The question is about protecting any digital asset really. If it could be migrated back to security I'd be happy.
aioobe
CC BY-SA 3.0
2016-12-02T10:10:58.893Z
It's not on topic on Security Stack Exchange in its current form.
Rory Alsop
CC BY-SA 3.0
2016-12-02T10:13:42.770Z
Care to elaborate why?
aioobe
CC BY-SA 3.0
2016-12-02T10:15:54.547Z
Your question asks what controls prevent an admin of bitcoin transferring funds to himself. That is very specific to bitcoin.
Rory Alsop
CC BY-SA 3.0
2016-12-02T10:17:23.230Z
Not really. It could be any digital asset. I see it plainly as a question about information security. May I try to reformulate the question on security.SE, and leave out all references to bitcoin?
aioobe
CC BY-SA 3.0
2016-12-02T10:18:40.440Z
Happy to chat in the DMZ - Security Stack Exchange chat, rather than here.
Rory Alsop
<trust>
How to avoid "single point of trust" in online bitcoin exchange sites
aioobe
# How to avoid "single point of trust" in online bitcoin exchange sites

(Asked by: username_0 on 2016-12-02)

How do an online service such as a Bitcoin exchange prevent some sysadmin from transferring assets from its users to him self (like in the bitcoin case, a secret wallet of his own) and take off to Bahamas?

I mean if I'm able to log in to their site, transfer or withdraw my assets at any time, it seems to me like *someone* on the inside could do the same for large amount of users with little effort? I'm thinking for instance of a DB admin or someone responsible for authentication.

If there's no satisfying answer to this (like a mechanism that requires cooperation of *N* people for such attack to succeed), I think I've reached my limit on how much of my money I can trust an online company with.

**Tags:** trust

> **Comments:**
> **username_0**: Posted this at security.stackexchange.com because I thought it was much more related to computer security than the specifics of bitcoin. The question is about protecting any digital asset really. If it could be migrated back to security I'd be happy.  
> **username_1**: It's not on topic on Security Stack Exchange in its current form.  
> **username_0**: Care to elaborate why?  
> **username_1**: Your question asks what controls prevent an admin of bitcoin transferring funds to himself. That is very specific to bitcoin.  
> **username_0**: Not really. It could be any digital asset. I see it plainly as a question about information security. May I try to reformulate the question on security.SE, and leave out all references to bitcoin?  
> **username_1**: Happy to chat in the DMZ - Security Stack Exchange chat, rather than here.  

---

## 1 answers

### Answer by username_2 on 2016-12-03. Score: 2

The Bitcoin Wiki (in the linked article for multisig) cites [a post on BitcoinTalk](https://bitcointalk.org/index.php?topic=507297.msg5594085#msg5594085) describing nearly the same problem that you did:

> Suppose I am working with a company that wants to accept Bitcoin for international trades.
>
> The company, for security reasons, would not want a single one of its employees to have access to the company BTC wallet's password. Any transaction would have to meet the approval of more than one employee.
>
> Is this possible already? If not, how could it be implemented with public-key cryptography?

One common solution to this problem is [*multisignature*](https://en.bitcoin.it/wiki/Multisignature) (commonly abbreviated as *multisig*).

Most Bitcoin transactions (the ones created by users like you and me) require only one signature — that of the owner of the private key that corresponds to the Bitcoin address. Multisig comes into play by requiring a certain number of signatures for a transaction to be verified. The Bitcoin Wiki [gives a few examples](https://en.bitcoin.it/wiki/Multisignature#Multisignature_Transactions.5B3.5D) of this. The following examples use `M-of-N transactions`, meaning that `M` users (out of `N` users who are able to sign the transaction) must sign the transaction for it to be verified:

> 1-of-2: Husband and wife petty cash account — the signature of either spouse is sufficient to spend the funds.
>
> 2-of-2: Husband and wife savings account — both signatures are required to spend the funds, preventing one spouse from spending the money without the approval of the other
>
> 2-of-3: Parents’ savings account for child — the kid can spend the money with the approval of either parent, and money cannot be taken away from the child unless both parents agree

Specifically in regards to your question, 10 executives or employees of a Bitcoin exchange may have the private keys associated with a [multisignature address](https://en.bitcoin.it/wiki/Multisignature#Multisignature_Addresses); a combination of any 5 of those private keys may be required to send bitcoins from this address (this is a `5-of-10 transaction` in the `M-of-N transaction` format).

This doesn't guarantee the bitcoins won't be stolen. 5 "evil" employees could collude to steal the bitcoins without the other 5 "good" employees knowing. However, this is a much more trustworthy system than a single employee being able to steal all the bitcoins (as could happen with a "standard" bitcoin address if an "evil" employee had access to the private key).

However, you might notice some flaws with this in regards to a Bitcoin exchange. Wouldn't it get tiresome for the 5 employees to constantly sign a transaction to provide withdrawals to users? The answer is yes, which is why companies implement a "hot wallet" — a wallet that holds a fraction of the bitcoins the company actually owns (the rest of the bitcoins are in a "cold wallet", which would probably be the multisig address). I'm not sure of the exact process exchanges use to send bitcoin from the cold wallet to the hot wallet (and I'm sure it differs from company to company), but I would guess that every once in a while, if the hot wallet is running low on bitcoin, `M` employees would verify a transaction from the multisig wallet to the hot wallet.

The hot wallet is totally susceptible to being stolen by a single "evil" employee (since it's most likely not a multisig wallet for efficiency, and thus has only one private key), or to being stolen by a thief, but companies would much rather only lose a fraction of their bitcoins (a hot wallet) than all of their bitcoins (a cold wallet).

> **Comments:**
> **username_0**: Very interesting. I totally buy that this is a feasible approach, both mathematically and practically. Thanks a lot for sharing.  

---

