I do not work for Coinbase and do not in any way speak for or represent them. This post was hastily written and is probably full of typos!
This is my attempt to clarify the possibilities that might be going on, based on various Coinbase employee statements.
First, I should highlight that there has been a good amount of confusion created by the replay attacks going on between the "two" Ethereum chains. So much so that it seems to have confused just about everyone, including me, as to the details of what's going on with Coinbase's ETH/ETC (and other ETH/ETC).
I put "two" in quotes because at the moment it's more like there are "1.25 Ethereum chains" because of the replay attacks, which are causing almost every transaction to get mirrored on the other chain. Replay attacks are possible because Ethereum's hard fork did not take steps to make Ethereum transactions invalid on the original chain. Instead, all transactions are valid on both chains unless special smart contracts are used to distinguish between them (and most users probably aren't doing this).
Here's an example of such confusion, taken from the Coinbase blog:
At this time, Coinbase has no plans to support ETC, although we will continue to monitor the situation and evaluate customer demand. Please do not attempt to send ETC to your Coinbase account.
"Please do not attempt to send ETC to your Coinbase account."
For anyone who understands replay attacks, that should be a very confusing statement. It is not that people are deliberately sending ETC to Coinbase. They are in fact sending ETH, but in the process, their ETC is being sent along with it.
So it's very likely the case that most of the ETH that Coinbase received had corresponding ETC with it.
How is it that some people were getting "free ETC"? You can have a look at the description of this process as described by Andrew T. DeSantis, paraphrased here:
- Send BTC to Coinbase
- Transfer instantly that BTC to GDAX (Coinbase's fancy trading platform)
- Trade BTC for ETH on GDAX
- Transfer that ETH back to Coinbase
- Transfer that ETH then to Poloniex (unclear whether skipping Step 4 and doing a direct transfer is possible)
- Poloniex should "credit" you ETC for that ETH
- Sell ETH and ETC for BTC
- Send BTC back to Coinbase (repeat)
Why is this "free"? Because you never payed for the ETC. Coinbase charged their customers not ETH+ETC, but ETH.
Note that this is by no means the only possible thing that could have gone wrong!
So if you didn't pay for the ETC then who did?
The answer seems to be ... nobody. And this means that somebody is getting screwed, and that somebody is likely whoever Coinbase got their ETH from (via the GDAX exchange). These people were selling their ETH for BTC thinking that they were just selling ETH, but because Coinbase chose to "not support" and just ignore ETC (instead of splitting it as they should have), these customers effectively gave away their (or someone else's) ETC.
According to Coinbase employee Charlie Lee, this was because the Ethereum Foundation recommended that they ignore replay attacks.
I have no idea if this is true, but I personally find it hard to believe because the Ethereum Foundation knew about these types of problems and gave explicit instructions (pre-fork) on how to deal with them, as seen for example in this post by Vitalik.
Now, what first alerted me to this whole situation was just a rumor from yesterday that said:
unconfirmed but reliable source told me that [Coinbase] probably have received enough replayed ETC to cover any outgoing replay ETC
So now that we have more hindsight, what could it mean to "cover any outgoing replay ETC" using "replayed ETC" -- in the context of what we've described above?
Well, first it should be stated that you cannot "use replayed ETC" that you've received to "cover" some other ETC without first separating it using, for example, the smart contract that Vitalik described. This would be a very active step, and it would also clearly be theft (even worse than just unwittingly passing along ETC that someone didn't mean to give you).
Coinbase's GDAX posted two tweets that might clear up what's going on.
The first tweet says:
We wanted to provide some clarity to GDAX users who are concerned with the recent Ethereum hard fork. GDAX supports trading and withdrawals only for the ETH (Ethereum) network and currently does not support ETC (Ethereum Classic). Customers are advised not to deposit ETC or any unsupported digital currency to GDAX.
- 100% of ETC associated with ETH balances at the time of the hard fork are secured in GDAX cold storage
- We plan to allow withdrawal of an amount of ETC that corresponds to ETH balances at the time of the hard fork. We'll be working on this feature over the coming weeks and will provide updates via this Twitter account.
ETC associated with ETH sent to GDAX after the hard fork is not supported by GDAX. We currently do not have plans to support ETC trading on GDAX (although we are not philosophically opposed to any particular hard fork or coin). We will continue to monitor the situation and evaluate customer demand for new digital assets to add to the platform.
So, a few notes on this:
- Saying that "100% of the ETC associated with ETH balances" is secured appears to be a disingenuous statement. As multiple users confirmed in the "free ETC" attack, it means that a whole bunch of that "associated ETC" is now gone and no longer in Coinbase's possession.
- That they say they will (at some point in the future) "plan to allow" ETC to be returned to those who had ETH with them pre-fork, suggests that they're going to get ETC from ... somewhere. They might buy it, or they might, as the rumor suggests, use a splitting smart contract to keep replayed ETC for themselves and then send that to these lucky few customers. And some of it might actually be the ETC that belongs to those customers (if they haven't yet touched it).
- It is not clear yet what they will do for all those other customers who are buying ETH through Coinbase/GDAX if that ETH comes with shadow ETC. Charlie says that they haven't yet "closed the loophole" and they "may or may not". Clearly, not closing the loophole suggests that more people will continue to get screwed out of their ETC, and that cannot be acceptable.
The second GDAX tweet, posted not too long after the first, says:
As a reminder: don't attempt to send ETC to @GDAX. GDAX is not supporting or storing any incoming ETC.
Again, here we have this confused implication that people are purposefully sending ETC, when most of the ETC that's passed through Coinbase is being sent unwittingly thanks to constant ongoing replay attacks.
Conclusion: Coinbase Slocked Up, Possibly Even Criminally
"Something doesn't add up at @Coinbase."
Coinbase is at least culpable for passing along client's ETC (on the selling side) that it did not compensate them for, and this is a serious screwup. That they "may or may not" stop this practice is insane, probably criminal.
They should not only give ETC to those customers who had ETH with them at the time of the hard fork, but they should also give ETC to those other customers whose ETC they sent flying through the blockchains, uncompensated, due to their own incompetence.
And in the meantime they should suspend trading until they fix all these problems.
If you want to prevent yourself from getting screwed, this link contains some useful resources.
Coinbase what a gem. If you told me that initial vision of coinbase was written on a used condom, the founders of coinbase sold their small cap jockstrap washing company to a loanshark for nickles on the dollar, then got meeting with a VC guy from a homeless shelter to foot the bill. Then went on a hiring spree, stocking their customer service and support group with third rate towing companies phone operator rejects, managers from used car lots, and people who squeegie your window with dirty water at a stop light. And whose crown jewel of a hire was their head developer, a ablutophobia suffering, mentally challenged, sex addicted stuttering kleptomaniac with entitlement issues whose cousin of the guy who had a developers credit for creating Atari's Pong.......I'd immediately stop what i was doing, challenge you to a fight, dial 911, light a fire in my big announcement chimney & press play on my VHS then proceed to bludgeon you with frozen 2 ft garden hose lengths as the smoke billows out the chimney alerting all religions of a heretic while i scream to anyone that will listen that you have egregiously and falsely lied and vastly overqualified a known entity. Then let you deal with the aftermath as i slowly walk away, formulating the letter i will write to the Better Business Association, not to stop, until i sit down on my couch to watch the video from the Ring playing in a loop, courtesy of my aforementioned pressing of the play button.