Beware of Bittrex blocking withdrawals for "security" reasons

[alyssa85]

I stopped using polo after support issues they are still struggling to solve.

I have started using bittrex as an alternative and now they are disabling accounts without prior notice in the name of investigation 

We need decentralized exchange platform where we can trade freely and anonymously.

A decentralised exchange already exists:

https://openledger.info/

It's built on top of the bitshares platform. Here is some more information about it:

https://medium.com/@openledger/openledger-and-bitshares-your-security-in-mind-acb48b8a0fe0

[1715101879]

1715101879

[1715101879]

1715101879

[1715101879]

1715101879

[1715101879]

1715101879

[1715101879]

1715101879

[1715101879]

1715101879

[h311m4n]

What is the problem to verify your account? Is there everybody has shady deals and you afraid to get them out? I don't think Bittrex will be share your data with somebody.

Again, it's not about if verifying your account is good or bad. Everyone has their own reason why they want to take that path or not. I just don't like the way it's done. And again, what guarantee do you have they won't use your data? As I stated before, it has to be my own decision and not Bittrex'. Imposing it like this without any notice or due diligence is wrong, they probably know it, but they don't care. As a customer, you have simply no choice but either to comply or get out.

In the end, this sort of behavior puts fear in the market and it's bad for everyone. Like it or not, centralized exchanges like this still hold a lot of power in the crypto world. As of today, decentralized exchanges are still in beta stages and you have no other choice but go through them for most altcoins if you want to cash out.

Personally, it's not like I have some shady activity on the side I want to hide. But you just can't trust any 3rd party with your personal data.

[vlom]

they should have informed me about the change. now i have an account with coins and can't withdraw anything.



thats what they tell me after the login. but after i followed the link they write:



mhh, what now.

and what about this:

my bittrex account is legacy too i withdraw BTC today, more than 3 BTC..it went out.

i would like to test it. but in don't want to sell my alt with a loss. and i don't want to download further blockchains. so i will wait and hope that my account won't be locked.

[vlom]

What is the problem to verify your account? Is there everybody has shady deals and you afraid to get them out? I don't think Bittrex will be share your data with somebody.

have you ever clicked "About"? Do you know with whom you are dealing? Nope. They want my name and my ID and don't tell me on their website with whom i will be dealing.

[alyssa85]

I logged in there yesterday to see how things were going..
I was right away confronted with some verification crap.. not happening.
I did not join and support crypto to fork over my picture ID to AML/KYC govt complaint exchange businesses.
If you all value crypto you will reject this bullshit NOW.

Oh and recap time..
Cryptsy told me they lied to users and froze their accounts when a govt related request was made.
Get it ?

Spot on. I'm getting Cryptsy vibes as well. Have you seen the withdrawal fees on Bittrex - they're about ten times Poloniex's. And of course Cryptsy did this too just before the end.

[thenite0wl]

about a week ago i logged in and saw the verify page, which spooked me, i searched to see if others were having the same issue but didn't find much, but i decided to withdraw most of my coins. just now i withdrew the rest. in all it was less than half a btc but i still dont like the approach. ive had an account there since 2014 and it says im a legacy user, 1337 btc daily, but you cant trust that. so i guess ill find other ways of exchanging. i hope dex's finally take off.

[Spoetnik]

Decentralized exchanges are coming.  Komodo Platform's BarterDEX is in the works.  I opened a Bittrex account recently and went through all that hassle.  I think they did this to conform to KYC.  Bittrex is based in the US and if they don't collect basic information they would face serious legal consequences.  I lost a lot when Cryptsy folded so I don't keep anything in an exchange that I can't afford to lose.  This collections of data will only get worse until more decentralized exchanges pop up.

It's not a decentralized exchange if it has a "coin" attached to it.. and they all do.
It then becomes a scheme coin.. and almost certainly yet another scammy ICO "coin".

[b4h4mu7]

Bittrex is a honeypot, just like Poloniex is a honeypot. They get users trading there then once volume spikes they blackmail you to verify your account in order to withdraw. Anyone with a decent amount of Bitcoin on there is a "security" reason. In theory, they could just freeze everyone's accounts citing security reasons and force traders into a drawn out legal battle for years citing "compliance" issues.

If you were a state level actor and you wanted to gain a database of all bitcoin/altcoin traders - what better way than to use an exchange in this manner?
If you were a criminal organization - what better way to get a database of high net worth traders (whales) than hacking an exchange?

Best get your funds off there to avoid theft. Legacy accounts are also being locked until verification so don't think you're grandfathered in.

In detail, I see multiple problems here:

#1 Insurance (of lack thereof)

If Bittrex is hacked, they don't provide any insurance for crypto funds. If you are waiting for support to "verify" your account because you want to withdraw funds and they are hacked. Who is liable? Most developed nations provide government backed insurance to banks in the event they are robbed. Bittrex is not a bank and they don't directly deal in fiat unless you request a wire transfer. Despite this, they are imposing "bank level security" on all users. Banks require personal information so that your funds become insured by respective national insurance programs. I don't see any benefit here for the end user.

#2 No Legal precedent for trading data

Is there any law compelling them to require verification for cryptocurrency withdrawal limits when not dealing with fiat? If there is, then shouldn't there be a law to download a cryptocurrency wallet? Where does this end? Cryptocurrency is just data. Should I need to verify my ID when downloading a file or an image? Equally ridiculous - should I be required to have verify the same information when trading MMO items on some MMO exchange? If you think thats ridiculous, some items in these MMOs are worth more than a Bitcoin: http://www.therichest.com/rich-list/most-popular/10-of-the-most-expensive-virtual-items-in-video-games/

The Hong Kong finance minister is correct with his assessment, “Bitcoin is not a currency. Just like your armour in World of Warcraft, since we don’t regulate those, we won’t be regulating Bitcoin.” -John Tsang HK Finance Minister
- https://www.economist.com/news/china/21603499-rule-law-continues-appeal-still-different

In addition, AML/KYC applies to fiat currency. Most developed nations have agreed that cryptocurrency is not money. If an exchange is not dealing in fiat (what government classifies as money) then where is the precedent?

https://www.theguardian.com/technology/2016/jul/26/bitcoin-not-real-money-miami-judge

#3 Verification data exposes traders to criminal organizations

The recent Equifax hack has shown that even fortune 500 companies with billions invested in securing personal data are susceptible to hacks which in turn expose the most private information for identity theft. What happens if Bittrex or Poloniex is hacked? It wouldn't be out of the realm of possibility for personal information on traders (name, address, photo ID, crypto networth) to end up on the black market and sold to the highest bidder. What's to stop criminal organizations from targeting high net worth traders for kidnapping and torture until they reveal their bitcoin wallet passwords?

If you think about this possibility then the personal information on traders becomes more valuable than the actual Bitcoin on the exchanges. Not only can they come rob your house and your valuables like cold storage, but they can also ransom your family members or who knows what.

If the Jamaicans are doing it (no offense to any) you can guarantee that more sophisticated organized cartels and mafias are doing it. It just hasn't hit the news yet.
http://infocoin.net/en/2017/10/16/jamaican-police-say-traffickers-are-turning-to-bitcoin/

[StarofBTC]

I stopped using polo after support issues they are still struggling to solve.

I have started using bittrex as an alternative and now they are disabling accounts without prior notice in the name of investigation 

We need decentralized exchange platform where we can trade freely and anonymously.

Honestly, decentralized exchange is really good and would go a long way since most of these centralized exchange are just not different from the banks we have always had to face in the past.
However, I guess we are stuck at this stage and until then, we might just have to make do with the ones we have after judging how best they serve us,.

[geopolisch]

So a friend of mine was trying to withdraw a certain amount of coins from Bittrex (around 1 BTC) and was faced with the need to now become verified on Bittrex to withdraw anything above 0.025BTC (accounts created prior to the 1st of August have a limit of 0.025BTC, newer accounts have 0 (lol)).

I don't know how many of you use Bittrex, if this is old news and just a copycat of another topic, but I felt like it needed to be put out there.

This is what they state:

"Due to the large number of leaked username and password databases, we are making changes to withdrawals to limit the damage of unauthorized access to your account.  This is not a substitute to having strong and unique passwords, protecting your email account, and having 2 factor authentication on your Bittrex account.  Bittrex strongly encourages you to have 2 factor authentication.  "

Ok, I'm all for security, but if people dealing cryptos are stupid enough to put qwertz1234 as their password and not enable 2FA, it's their own fault for being stupid.

Then comes the fun part (all from their support section):
-----------
"Withdraw Limits

1. If your password has been changed, you cannot make a withdrawal for 24 hours
2. If your account does not have 2FA, you are limited to withdrawing up to 1 BTC (or equivalent) per day ==> wtf, I had 2FA enabled forever yet my limit is 0.025? So with less security you have a bigger limit. Wow. Much sence. Very secure.

3. Please check below to see what limit your account falls under.
Unverified Accounts created before 08/01/17: 0.025 BTC (or equivalent) per day ==> Hey, I mister miseeks, look at meee
Unverified Accounts created on or after 08/01/17: 0 BTC (or equivalent) per day
Basic Accounts: 3 BTC (or equivalent) per day with two-factor enabled. ==> I'm fine with that
Enhanced Accounts: 100 (or equivalent) BTC per day with two-factor enabled"

-----------

So I go ahead and enter some bogus name and address in their basic validation form. Hey, you can't blame a guy for trying: no official document is required for a basic account and nothing on their page states you have to input correct information (or I missed it). I click on the apply button and it says "verifying public records" or some other shit. Obviously, their results turn up empty. But oh wow, I can't even re-apply for a basic account with "correct" information. The only thing you can do from there is get an enhanced account where you need to take a selfie of yourself etc. Which is exactly what I, and any person involved into cryptos, don't want. I don't know the people at Bittrex.

Trying not to cringe...

Now, ok, I probably fucked myself I guess. But still, this poses a number of questions:

1. For one, I have never received notification from Bittrex that at some point in time, I would have to upgrade my account or be limited to 0.025 BTC a day
2. What public records are they looking up to check your info? What if I'm not in the public records they query? Imagine you have 2-3 BTCs on there that you can no longer withdraw
3. What happens if you unintentionally misspell your name or address?
4. Even if I get verified, take a nice smiling picture of myself and send over all my info, what guarantee do I have they won't use my information for other purposes? I tell you: not a single one! I don't know the people at Bittrex, and if a company I deal with starts to just change their T&C like that, stopping me from having access to my funds, you sure as fuck can't trust them.

I already knew you couldn't trust exchanges, but I thought this should be pointed out (again). Everyone should leave Bittrex (or any exchange for that matter) and stash their coins in their own wallets at home.

I know some or a lot of you will go ahead and say "big deal, just get verified and be done with it". Fuck no! This is not what the cryptos where made for. And at the very least, Bittrex should have communicated, which they haven't, and they should have made their due diligence and let people withdraw their fund before implementing all this BS. I'm sorry but this looks like a hostage situation or a play to identify everyone. Call me paranoid if you want, but their leverage is very simple and efficient: either you give them all your info or say bye bye to your coins and deal with the pain of withdrawing small amounts every day, for which you will of course pay the fees every time :-).

Lucky me, I only have like 0.06 BTC on Bittrex. I have opened a support ticket on their support page, no reply in 24 hours...

I totally agree with you that effective communication to users is very necessary and everyone should be very well informed heads on before even being a user. Although, they are just trying to find a way to just assist some stupid guys like you said who are careless about their security protect their asset in a way but should not have been at the expense of the other. I have been using bittrex though and I really have not had any issue with withdrawal, although I just had to do the enhance verification, whatever! to at least get an easy ride.

Anyone who isn't a trader though, should not really bother putting their funds in exchanges knowing what has happened in the past. But some of us just have to trade as well for a living, and so far bittrex just seems to be the best option.

[alyssa85]

#2 No Legal precedent for trading data

Is there any law compelling them to require verification for cryptocurrency withdrawal limits when not dealing with fiat? If there is, then shouldn't there be a law to download a cryptocurrency wallet? Where does this end? Cryptocurrency is just data. Should I need to verify my ID when downloading a file or an image? Equally ridiculous - should I be required to have verify the same information when trading MMO items on some MMO exchange? If you think thats ridiculous, some items in these MMOs are worth more than a Bitcoin: http://www.therichest.com/rich-list/most-popular/10-of-the-most-expensive-virtual-items-in-video-games/

There isn't any at all. And what's more American rules for withdrawing fiat only need verification if you are withdrawing more than $2000 a day.

The regulation is about looking for money laundering, so people constantly withdrawing large amounts. It most certainly is not about saying you have a grand total of $1000 in your account, you need to verify. It's ridiculous.

When an exchange is doing something no govt requires, you have to ask why.

[FuzzyQuant]

Yeah, this is far from best practices...

I am disappointed, but this space has a very wild-west connotation to it. Everyone will try to protect their gains/situation as best they can and, in the case of Trex, they want to cover their regulatory-compliance ASAP, but they way they are going about doing it is less than ideal.

I definitely agree with what was said here that other exchanges should be expected to follow.

Have your own wallets folks!

[tyz]

What is the problem to verify your account? Is there everybody has shady deals and you afraid to get them out? I don't think Bittrex will be share your data with somebody.

have you ever clicked "About"? Do you know with whom you are dealing? Nope. They want my name and my ID and don't tell me on their website with whom i will be dealing.

Check the address of the company here https://bittrex.com/Home/Contact
Check the people behind the company here https://bittrex.com/home/about