It is risky to keep bitcoins at an exchange, says a recent academic paper from Leiden Law School (Leiden University). In the event of a bankruptcy or other problem, it is not always clear which law applies. Users usually get the short end of the stick and legally often turn out to be little more than one of many creditors.

From their own experience, bitcoiners regularly warn about the dangers of exchanges, but these risks are now also mentioned in an academic publication entitled “The Failed Hopes of Disintermediation: Crypto-custodian Insolvency, Legal Risks and How to Avoid Them” .

Exchanges & intermediaries

Many bitcoiners use intermediaries such as exchanges. They do this, for example, to be able to trade, but sometimes also because they find it easy to leave the security of the bitcoins to others. For the users, it feels like just a place where they keep ‘their’ bitcoins, but it is not always clear from a legal point of view whether ‘their’ bitcoins are still there at all, according to the paper.

“Thus, through crypto-custody, a crypto-investor gives up his direct rights to the blockchain, but gains the comfort of being able to (indirectly) dispose of those rights even when he loses his private key. From the crypto-investor’s perspective , the user agreement or crypto-custody contract with his crypto-custodian has therefore become the gateway to his rights relating to ‘his’ bitcoin.”

With bitcoin exchanges, you do not transfer the management of your private keys to the exchange, but instead you send the bitcoins from your bitcoin address to a bitcoin address of the exchange. From the moment they get there, the exchange owns them and the user gets a credit in return.

Exactly what that means and which law applies depends on local law. This differs per country and not every country has specific legislation for digital currencies. Exchanges are often located in faraway places, which can be an additional hurdle in case of problems.

Separated or in one heap

The paper points out that the way an exchange works is important if something goes wrong. Are client funds mixed together or kept separate?

Although it makes little legal difference, the researchers argue, the chance that ‘your’ bitcoins are still there is greatest when an exchange uses separate bitcoin addresses where incoming transactions (UTXOs) remain unaffected.

However, most exchanges do not guarantee to leave incoming transactions (UTXOs) unaffected, according to the paper. They often only guarantee the total value of all bitcoins from all customers. They are therefore contractually free to send the incoming transactions (UTXOs) from one customer to the other customer.

“However, most crypto-custodians do not commit not to spend any specific unspent transaction output received from its customers. Instead, the crypto-custodian only commits to maintain the total value of all coins or unspent transaction outputs received from its customers and, once the customer in question requests a transfer of bitcoins, the crypto-custodian has contracted to be at liberty to use transactions outputs resulting from one or more other customers as input for that transfer.”

For example, Bitcoins that one deposits are then paid out to another user who makes a withdrawal. Behind the scenes, the exchange keeps track of the balance. It is very difficult to claim ownership of specific bitcoins in such cases. What remains is a much weaker contractual claim.

This was the case, for example, with the well-known hack on MtGox, a bitcoin exchange where some 850,000 BTC in customer funds were stolen in 2014, resulting in bankruptcy. According to the court, the remaining bitcoins were owned by the exchange and could therefore be used to pay off various debts. Users of the exchange could join the queue with the other creditors. A similar situation occurred with the more recent hack on the Italian Bitgrail.

There are still similar risks today. For example, the paper points out that the terms and conditions of Coinbase, one of the largest US exchanges, do not guarantee that customer funds will not be mixed. Users would also have no certainty about which part of the Coinbase Group actually manages the funds.

Failed disintermediation

The researchers conclude that the efforts of the early cypherpunks to create a network of security transports free of interference from governments, banks and other intermediaries did not succeed. After all, many bitcoiners still manage their bitcoins with the help of intermediaries, with all the associated risks.

“The founding fathers of cryptocurrencies wished to free value transfers from the interference of governments, banks, brokers and other intermediaries. It was the control by, and frequent failure of such intermediaries, as well as the high transaction costs arising from their involvement that created a fertile environment for Bitcoin?????s origins. In reality, however, disintermediation has not occurred. A large number of bitcoins and other cryptocurrencies are stored with crypto-exchanges. While such custody may be attractive because it is (usually) free of charge and user-friendly, it creates significant risks related to the possible insolvency of crypto-custodians.”

Much has been written about the risks of exchanges and their role, but a small nuance is perhaps in order here. Data from Glassnode Studio shows that exchanges currently manage an estimated 2.5 million BTC. That’s about 12% of the total amount of bitcoins there will ever be and about 13.5% of the current circulating amount. That is not a small amount, but whether that is a failure as the title of the paper implies is perhaps debatable.

Improvements

The paper concludes with a number of suggestions for improvements. For example, users of exchanges should be informed in advance whether exchanges may use customer funds for other transactions. In addition, clarification and international coordination is desirable with regard to which law applies: contractual or property law.

To protect users, the researchers propose prohibiting exchanges from reusing customer funds for other purposes. To limit the risk of this, exchanges should be obliged to store customer funds in separate bitcoin addresses. In addition, users should have a kind of priority right with regard to their digital currency.

Such a policy would likely have far-reaching technological implications for exchanges and would be impractical in many cases because the base layer Bitcoin network has a block time of 10 minutes and transaction fees apply. Keeping funds segregated and unmixed at separate Bitcoin addresses would mean that transactions would have to take place on the Bitcoin network when two users of the exchange trade with each other. That would increase costs and significantly slow down service. However, the paper does not make any statements about this. On the other hand, it is quite possible that the Lightning Network will remove these barriers in the future.

It appears once again that there are risks involved in handing over bitcoins to third parties. You really only have real certainty when you manage your private keys via your own wallet: “Not your keys, not your coins” . Therefore, use exchanges to trade, but preferably not to store bitcoins for a longer period of time.

You can read the paper “The Failed Hopes of Disintermediation: Crypto-custodian Insolvency, Legal Risks and How to Avoid Them” on the SSRN website.