
Coinbase Exchange - sjcsjc
https://exchange.coinbase.com/
======
sillysaurus3
_Coinbase is insured against hacking, internal theft, and accidental loss in
an amount that covers maximum value of bitcoin we hold in online storage at
any given time._

When marketers advertise in bad faith, you could end up with a bad product. In
this case, however, you could end up losing your money.

Unless you have multisig control over your coins, do not put large sums into
this exchange unless you want to lose your money.

 _98% of customer bitcoin is stored entirely offline._

This means the vast majority of users don't have multisig control over their
coins, since multisig-protected coins can't be put into offline storage.

Let's recap Coinbase's technical problems over the years:

Here's someone who sent $35k to Coinbase and never received coins until they
made a big deal about it on HN:
[https://news.ycombinator.com/item?id=6929705](https://news.ycombinator.com/item?id=6929705)

Here's someone with the same story, but $10k instead of $35k:
[https://news.ycombinator.com/item?id=6933360](https://news.ycombinator.com/item?id=6933360)

Here's Coinbase leaking emails and full names:
[https://news.ycombinator.com/item?id=7507493](https://news.ycombinator.com/item?id=7507493)

Here's a Coinbase engineer saying "there are a few lingering issues" in
response to transactions being delayed for days (sometimes over a week) and
BTC not being able to be withdrawn:
[https://news.ycombinator.com/item?id=5427985](https://news.ycombinator.com/item?id=5427985)

And now they're trying to pretend like your coins are completely safe. They're
not. If Coinbase becomes insolvent and goes bankrupt, you won't get your coins
back. It happened to Mt. Gox, it sucked for me, and if it happens to Coinbase
it's going to suck for you.

Don't put more than a few bucks into this, or whatever you're comfortable with
losing.

~~~
vanzard
> They're trying to pretend like your coins are completely safe. They're not.

Nothing is completely safe, not even traditional banks. FDIC insurance has
many limits and restrictions (eg. it does not cover safe deposit boxes). In
2014 the national bank in Bulgaria had a catastrophic bank run who left
depositors like you and me unable to access their money (to this day they
still don't have their money -
[http://www.forbes.com/sites/francescoppola/2014/08/18/the-
bu...](http://www.forbes.com/sites/francescoppola/2014/08/18/the-bulgarian-
banking-disaster/)). In 2013 customers of the bank of Cyprus lost between 50%
and 100% of their deposits over 100 000 euros
([http://www.bloomberg.com/news/2013-07-30/cyprus-sets-levy-
on...](http://www.bloomberg.com/news/2013-07-30/cyprus-sets-levy-on-bank-of-
cyprus-uninsured-depositors-at-47-5-.html)). And so on. It is a good reminder
that a crisis causing you to lose money can happen at ANY financial
institution. Every year there are millions of people losing money who thought
was "safe".

That's why it is always a good advice to diversify, to not keep all your eggs
in one basket, etc. Bitcoin is no exception.

With that said, it is fair to remark that Coinbase is still probably one of
the safest places to keep your coins "online" for day to day usage.

~~~
pistle
There's 0% safe and 100%, for everything else it's equal?

FDIC is tested and backed by something beyond corporate assurances about
insurance policies.

Does that policy pay out upon bankruptcy?

Agreed. Diversify. But, US banks are still demonstrably lower risk (with
stipulations) thanks to FDIC than, currently, a bitcoin exchange.

------
tptacek
I'm an aspiring trading tech nerd and would love more details on how this was
built --- particularly, how it was tested. What kind of test data used? How
were test orders matched and executed? Were there simulated traders on both
ends?

I've actually seen how this is done on a couple major US exchanges and was
surprised by how minimal the tooling was. It created major (but fun)
challenges for security testing.

~~~
chollida1
I can't speak as to how coinbase tested their specific exchange, but having
written 4 trading systems and some exchange code, I can probably answer many
of the questions you have.

Email in my profile...

~~~
sandGorgon
could I ask a quick question here ? I have written a few ecommerce payment
carts and reconciliation systems - I have built the maker checker processes
and batch processes that account for refunds/erroneous txns, etc.

I have two big specific questions in exchanges :

1\. injecting new inventory - But I could probably think of an exchange built
using a couple of queues in rabbitmq and a few python workers... but this will
not give me subsecond latency. What would you choose to build a super low
latency eventing system using current off-the-shelf components ?

2\. the order matching system. does the choice of programming language make a
difference ? probably the matching system is where you need strong type
checking.

I suppose that the maker-checkers and EOD reconciliation remains the same.

@tptacek - I dont understand your question about testing. do you refer to
testing of sub-microsecond latencies/race conditions ? Is there even a way to
simulate that (Jepsen?)

------
apaprocki
There are 14 states are listed here:
[https://www.coinbase.com/legal/licenses](https://www.coinbase.com/legal/licenses)

Alabama, Arkansas, Delaware, Georgia, Idaho, Iowa, Kansas, Mississippi, New
Hampshire, New Jersey, North Dakota, Puerto Rico, Washington, West Virginia

Sounds like they haven't updated that page because I was able to login and I'm
in NYC.

edit: Screenshot here [https://imgur.com/AdAX1LM](https://imgur.com/AdAX1LM)

edit2: USD Wallet link lists states:
[https://support.coinbase.com/customer/portal/articles/178054...](https://support.coinbase.com/customer/portal/articles/1780543-what-
is-the-usd-wallet-)

Alabama (AL) Arkansas (AR) California (CA) Delaware (DE) Georgia (GA) Idaho
(ID) Illinois (IL) Indiana (IN) Iowa (IA) Kansas (KS) Massachusetts (MA)
Mississippi (MS) Missouri (MO) Montana (MT) New Hampshire (NH) New Jersey (NJ)
New Mexico (NM) New York (NY) North Dakota (ND) Puerto Rico (PR) South
Carolina (SC) Washington (WA) West Virginia (WV) Wisconsin (WI)

~~~
jzwinck
The USD Wallet list is the relevant/complete one for the exchange. The list is
also on this page:
[https://support.coinbase.com/customer/portal/articles/182667...](https://support.coinbase.com/customer/portal/articles/1826671-what-
countries-are-supported-for-coinbase-exchange-)

~~~
Animats
The USD Wallet List is the list of states in which they _claim_ to have
licenses. The list at
[https://www.coinbase.com/legal/licenses](https://www.coinbase.com/legal/licenses)
seems to be the list of where they actually do. I checked NY and CA yesterday,
and Coinbase isn't a listed money transmitter in either state.

Such pseudo-compliance is troubling. It suggests other problems. Remember,
over half of Bitcoin exchanges have failed, usually taking user deposits with
them.

~~~
jnbiche
> The USD Wallet List is the list of states in which they claim to have
> licenses.

No, it's the list of states that the wallet _supports_. Essentially, it's a
list of states in which they believe they have the right to operate legally.
Several of those states listed, for example, have no money transmission
license requirements.

And I believe NY has said that any enforcement will only happen after the
Bitlicense is in place.

I'm sure Coinbase has problems we're not aware of (any rapidly growing
business does), but they're clearly striving for legal compliance, arduous and
farcical though those legal requirements may be.

~~~
Animats
The legal requirements are hardly "farcical", considering the "take the money
and run" business practices of the more than half of Bitcoin exchanges that
have gone bust. California does have requirements for money transmitters, and
Coinbase is not on the list. The list:
([http://www.dbo.ca.gov/Licensees/money_transmitters/money_tra...](http://www.dbo.ca.gov/Licensees/money_transmitters/money_transmitters_directory.asp)).

The list on line is current. I just called the California Department of
Business Oversight to check. _Coinbase is not a licensed money transmitter in
California._ (When I mentioned Coinbase, the Business Oversight asked "did you
just call about that"? I hadn't; others are asking them about Coinbase.)

Trying to run an exchange with just a money transmitter license is sleazy.
Especially for a business hiding behind a mail drop in SF's homeless district.
They need to be a registered broker/dealer to be taken seriously.

------
dperfect
Let's hope they aren't using MongoDB to power the exchange platform. The
Coinbase careers page seems to suggest they still use MongoDB[1], though to be
fair, it also lists postgreSQL (I'm only aware of Toshi[2] using postgreSQL at
the moment).

I'm not saying it'd be impossible for MongoDB to be used effectively for a
trading platform, but it'd be a _lot_ more difficult than other options.

Not trying to spark a debate here about MongoDB (it's great for certain
applications). This has, however, been brought up previously as a concern
about Coinbase (and they've denied accusations of lost money relating to it).
Whether or not it's actually been a real problem in the past, I believe the
concern is still valid.

[1]
[https://www.coinbase.com/careers/9275](https://www.coinbase.com/careers/9275)

[2] [https://github.com/coinbase/toshi](https://github.com/coinbase/toshi)

EDIT: Downvoters - care to explain why such a key piece of infrastructure for
an application like this isn't a valid topic for discussion, or at least why
my opinion isn't valid?

~~~
adrianmacneil
It's a valid point. So, so put your mind at ease: the exchange (as well as all
backend services we've built recently) is built with Postgres.

------
comboy
For lurkers:
[http://bitcoinity.org/markets/coinbase/USD](http://bitcoinity.org/markets/coinbase/USD)

------
serf
Verifying my identify by asking me cross streets near residences that I
haven't lived since I was 2 or 3 years old is a _REALLY_ poor way to establish
what my identity may be, especially since I have previously verified my bank
account.

I promptly failed it, and was told to wait 24 hours.

What kind of child has the spatial awareness to memorize cross streets near
their first homes at that age? I could have perhaps inquired with the folks
who owned those houses when I was a child (my parents), had the queries not
been partnered with a 4 minute timer..

This identity verification is nearly as bad as coin.mx's random address lookup
verification, but at least that one fails me all together without making me
guess at cross streets like an ass.

~~~
bobbles
Google maps?

Or do the streets no longer exist as they did earlier?

------
jscheel
Grrrr, not available in TN. Of course. What specifically should we petition
our representatives for? What kind of licensing does Coinbase need? Money
transmitter, currency exchange, etc?

~~~
jzwinck
Money Transmitter License.

~~~
jscheel
Ah, thanks! Will hit them up.

------
raamdev
Using Google Chrome, I had to turn off "Click to play" Plugins and switch back
to the default of "Run all content" in Chrome's Content Settings, otherwise
visiting
[https://exchange.coinbase.com/trade](https://exchange.coinbase.com/trade)
(while logged into my Coinbase account) showed nothing but a blank page with a
background color (i.e., there were no grey boxes where I could "Click to
play", as I would've expected).

~~~
pokstad
Hmmm, I run Safari with no flash plugin and it worked fine for me.

------
nicpottier
Looks pretty great at first glance, certainly trust Coinbase more than any
other BTC player.

Kind of interesting that Coinbase is competing with itself on ways of buying
BTC.

Their standard "buy" mechanism currently has BTC at ~$282, while the last
trade was ~$278 on the exchange.

~~~
jafaku
But they will charge a 1% fee on the exchange, which in this case would be
2.78. Another difference (I think) is that they often cancel your order as
brokers (many people have complained of buying, and then when the price goes
up Coinbase rejects their buy order), but not as exchange.

------
finnn
/trade was initially a blank page, but after allowing both gravatar.com and
olark.com to run 3rd party javascript, it loaded up. It seems that blocking
them again after loading the page once doesn't affect it.

------
brianbreslin
Florida: Not available in your state.

Why don't they have a list public of this? Also is this going to drive state
based VPNs?

~~~
jzwinck
There is a public list, though perhaps not linked from the page you were on:
[https://support.coinbase.com/customer/portal/articles/178054...](https://support.coinbase.com/customer/portal/articles/1780543-what-
is-the-usd-wallet-)

The exchange currently trades BTC-USD, which means you must have a USD
balance, and for that to be allowed you must be in one of the above listed
states. If you live in a state which is not yet supported, you can write to
your state representatives and let them know your wishes.

~~~
brianbreslin
When I checked the help page earlier that link was giving me a 404. good to
know.

------
contingencies
Consultant to a competing exchange in an unofficial capacity here.

My impression is that Coinbase is basically operating in their previous (non-
exchange) business in a manner that is not at all to the letter of current US
law; the 'beg for forgiveness' model. A lack of regulatory enforcement of
their position, combined with expansion in to other business areas basically
points toward the corruption of the US regulatory system. At this point I'd
bet that some calls using pre-established relationships between their
investors / board members and regulators are going on. This is the reason why
other companies do not like doing business in the US: government meddling /
selective enforcement, arbitrary decisions, painfully expensive/slow moving
licensing and approvals processes, ultimately resulting in an unfair market.

 _On both sides of the Atlantic, it is only a little overstated to say that we
preach individualism and competitive capitalism, and practice socialism._ \-
Milton Friedman, 1994, from the introduction to _The Road to Serfdom_ by F.A.
Hayek.

------
pibefision
Is this the first Exchange in USA? What about Kraken? I've been using Kraken
and works great.

~~~
jafaku
It's the first _licensed_ (as money-transmitter) exchange. The first non-
licensed was Gox I guess. And Kraken is European I think.

------
hagope
Cool! I've place a sell order for 0.94495180 at $300 ... lets see if it
fills... A few things I noticed that could be improved.... 1) an easier way to
enter orders for qty and price (like a way to copy my BTC balance to the sell
box or a dial) ... 2) I didn't like the price indicator on the right of the
chart, how it jumps around when you mouseover the chart its confusing... the
price should follow the cursor and the rightmost price should show the current
price

~~~
film42
I'm wondering what the lifetime of an order is. On the stock market, many
orders are canceled if they're not fulfilled in that trading day. An exchange
like this works a bit different. Could anyone shed some light?

~~~
jafaku
Some Bitcoin exchanges have two options for orders: "Immediate or cancel" and
"Good until cancelled".

------
nawitus
"and accidental loss in an amount that covers maximum value of bitcoin we hold
in online storage at any given time"

What about the value in the offline storage?

~~~
jafaku
Let's hope they are using a good multi-signature scheme.

------
bunkydoo
Not yet in my state :( Looks great though, can't wait until the regulatory
issues and what-not get resolved. This could be really really cool.

------
mod
Why would they insure the online bitcoins, or at least--why do that without
insuring the offline bitcoins?

The offline bitcoins are more secure, by almost any measure, and so should be
easier and cheaper to insure. Further, they're the overwhelming majority of
the bitcoins, and a 98% loss would sure hurt worse than a 2% loss.

~~~
hristov
Insurance prices are usually based on the maximum possible loss as well as the
probability of loss. Insuring only the online bitcoins means your maximum loss
is 50 times less than if you had insured all. Insurance will be much cheaper.

You argue that the probability of loss of the offline bitcoins should be much
smaller, but I don't think insurance companies will go along with this
argument. Insurance companies are skeptical and conservative by nature. And
they have absolutely no trust in human beings. And from the point of view of
human intervention offline bitcoins are about as vulnerable as online ones.

------
kaa2102
I see many comments about what's wrong with Coinbase. What would a secure
bitcoin exchange look like? A few of the features have been thrown out, e.g.,
little or no hot storage, two-factor authentication, (some) insured deposits,
multisig-protection, decentralized services, etc.

------
heliodor
You can get the price charts from:

[https://pizzacharts.com/c/BTC/USD/Coinbase%20Lunar/](https://pizzacharts.com/c/BTC/USD/Coinbase%20Lunar/)

Interestingly, there were 4300 pre-launch trades, probably from testing.

PS: I'm one of the Pizzacharts cofounders.

------
cddotdotslash
California (VPN): Not available in your state New York: Not available in your
state

~~~
jzwinck
Do you have a Coinbase account (non-exchange) already? What state is it
registered to?

~~~
cddotdotslash
Yes. New York.

------
quackerhacker
Wow, just looked over the API, this api method _GET /currencies_, gives me
hope that in the later future Coinbase will provide exchange rates for foreign
currencies. That would be amazingly awesome!

------
LukeHoersten
The site looks good but seems to have a ton of stability issues. The order
book keeps blanking out and when I tried to deposit some money, it froze. I
think I'll just stick with Circle for now.

------
_nickwhite
North Carolina: Coinbase Exchange is not yet available in your state.

~~~
jzwinck
Here is who you can write to if you want to encourage your state to approve
the relevant licenses:
[http://www.ncleg.net/representation/whorepresentsme.aspx](http://www.ncleg.net/representation/whorepresentsme.aspx)

~~~
mastef
filename reminds of therapistfinder

~~~
serf
Maria Bamford (a comedian) has a joke about how she calls her therapist 'The
Rapist'.

------
level09
what is the reason behind blocking this in many states and internationally ? I
would really like to send some bitcoins and use their trading platform.

~~~
detaro
Legal requirements. They are not allowed to operate in all states, and
internationally each country has its own rules for this kind of thing.

------
h2014
Make it available in the UK

------
jordsmi
Pennsylvania: Coinbase Exchange is not yet available in your state.

:(

~~~
jzwinck
Here's a page you can use in your state to find your local legislators, in
case you want to discuss the exchange licensing with them:
[http://www.legis.state.pa.us/cfdocs/legis/home/findyourlegis...](http://www.legis.state.pa.us/cfdocs/legis/home/findyourlegislator/)

------
notyourwork
Ohio: not available in your state.

~~~
jzwinck
If you want Coinbase Exchange in Ohio, you should write to your elected
representatives and discuss it with them. You can find a list and a map of
them here:
[https://www.govtrack.us/congress/members/OH](https://www.govtrack.us/congress/members/OH)

------
cryowaffle
Colorado: not available in your state

~~~
jzwinck
It's a matter of licensing. Here is one page you can use to find your
(Colorado) state representatives, whom you could contact:
[http://www.colorado.gov/esri/webmaps/my-hood.html?webmap-
id=...](http://www.colorado.gov/esri/webmaps/my-hood.html?webmap-
id=0bbdbd4450154b1c9a9827d21c862dad)

------
WillyNourson
Coinbase Exchange API, protectedd by CloudFlare ? Hum.

~~~
Buge
Bitcoin exchanges are often targeted by DDOS attacks, often as a type of
market manipulation.

------
hoopism
Completely off topic and likely to be downvoted (ugh)... but those stock blue
buttons and website format is being used more and more for for vaporware type
products/projects... I noticed today that I get an immediate negative reaction
to seeing this style.

Anyone else think bootstrap stock format (is that what this is?) has turned
into a negative connotation?

~~~
onewaystreet
>Anyone else think bootstrap stock format has turned into a negative
connotation?

Yes, but that isn't the case with Coinbase. Blue is their chosen brand color
so they use it everywhere. Bootstrap just happens to also use blue by default
so now blue buttons have become synonymous with it.

~~~
hoopism
Interesting note for branding... avoid popular stock framework colors.

~~~
wuliwong
Yea, that's actually what I was thinking from your comment and the response.
Something to consider though, has your target market seen many stock bootstrap
sites. Unless you are targeting other developers, chances are they have seen
stock bootstrap far less than we have. I've shown a lot of "regular" people
sites I spun up using bootstrap with just slight changes and I've actually
gotten a lot of comments about how nice it looks. My assumption was that they
had no idea what Bootstrap from Twitter was and had seen very few sites that
employed it.

