Bitcoin Hosted Wallets
Hosted wallets, also known as web wallets, can be thought of as basically online bitcoin bank accounts. As a bank customer you don’t hold possession of your money. Instead, you have entrusted someone else to your funds and simply make requests to deposit and withdraw. These funds live with a central authority that can be forced to seize funds at the request of government or chose to not send funds at their discretion. Privacy is also significantly reduced with these services.
These wallets offer the convenience of access through multiple locations, pretty much anywhere you have access to a browser, with some services also giving you convenient mobile applications. Security and backups are entirely handled by the company/service that is holding your coins. You access your funds via a login and password similar to accessing your standard online banking account. Trust is the key word here, and users need to do there due diligence before trusting online wallet services. Note that every bitcoin exchange is effectively a hosted wallet since users do not have access to the private keys of their bitcoin.
One additional concern is the coalescing of bitcoin from many people into one central location such as an exchange. In the words of popular bitcoin podcaster, +Adam B. Levine, hosted wallets create a “pinata” effect, luring thousands of people to hack away at the pot hoping to bust it open for the big reward. Why rob a home when you can rob a bank? The following snippet is from a presentation by Alan Reiner, CEO of Armory, during the Las Vegas Bitcoin Convention in Dec 2013. It shows the amount of bitcoin lost or stolen due to trust in 3rd party hosted wallets.
On the positive note, it is more difficult for hackers to brute force login and passwords of accounts on hosted wallets and the addition of two factor authentication can help improve that security even more. In addition, just like online banking accounts, forgotten passwords can be recovered using email verification.
Probably the most successful and well-known hosted wallet for the US market is coinbase.com. Having started as simply a web based wallet, they’re best known for providing the easiest way for US customers to purchase and sell Bitcoin online by linking a bank account to a Coinbase account and making a purchase or sell order at their current exchange price.
Although this article is primarily focused on wallets, I thought it would be prudent to mention a few things about the buy and sell features of Coinbase. Although Coinbase offers the only way to purchase Bitcoins by linking a bank account in the US, customers should be aware that Bitcoin purchases are not guaranteed to fully execute. Due to the fraud risk in selling Bitcoin in exchange for a bank transaction, Coinbase makes first-time customers wait four to five days at minimum to make purchases over .1 BTC. During that time, they use anti-fraud heuristics to determine if the customer is high-risk. Many frustrated customers have made purchases at a specific price to find out that their purchase was denied by Coinbase after Bitcoin had increased in value, sometimes upwards of 50%.
To help prevent a complete loss of customer funds from hacker attempts, services like Coinbase frequently place a significant portion of customer Bitcoins in off-line cold storage, keeping only a small percentage of funds in the online “hot wallet” to transfer to and from various accounts. Hackers gaining access to their servers would only have asked to the funds in the hot wallets. This helps safeguard the majority of funds, but at the expense of guaranteed liquidity. I once made a send request from my Coinbase account and had to wait 18 hours for the money to get sent (not the confirmation, but just the announcement). Had this been a transaction for a merchant, we would’ve been looking at a very awkward situation. Very likely, Coinbase had run out of funds in their hot wallet, and required someone to physically walk over to their cold storage to transfer funds back online.
The general recommendation is to only leave the amount of money in hosted wallets that you can afford to lose. With respect to exchange services, unless one is actively trading between fiat and Bitcoin, it’s generally recommended to move money off exchange services to an actual wallet where the user owns their own private keys. For the sake of actually using the wallet for merchant transactions, I would definitely advise against relying on a hosted wallet.
The following services would fall under the category of hosted wallets:
Inputs.io (closed down. 1000s of BTC lost)
Mtgox.com (update. closed down with over 140k bitcoin lost)