To what degree can Bitcoins on a hard disk be protected against hacking?

Question

This is a question that came to my mind after reading this other question from someone who had "found a heap of BTC" on a hard drive. In that persons case they had originally been purchased many years ago.

The questions I wanted to ask is about a possibly scenario where the exchange from which he bought these Bitcoins has since been hacked.

The questions I have:

1. Isn't Bitcoin always also somewhere online and not just solely on the hard drive?
2. If Bitcoin is always also online (e.g. at some exchange / repository), and the online repository has been hacked, could that guy in the other question get his BTCs back based on the data he has on his hard disk (or: what data would he need to have on the HD in order to be able to get his BTCs back in the event they are stolen from the online repository)?

Update: with the reference to "repository" I did not mean that there is a central repository. Just that when BTCs are purchased through exchanges such as Coinbase, the BTC is often stored at a repository at such an exchange. The question was about what happens to the BTCs if the exchange is hacked, as happened to e.g. Yapizon and Bithumb.

Answer 1

You should completely forget about the notion of a Bitcoin being "located" online or on a particular computer. It isn't a good metaphor for the way the currency actually works.

There are addresses, each one with an associated private key. Each address has an associated balance; if the balance is greater than 0, then some bitcoins "belong" to that address. The blockchain or transaction register, which contains information about the balances of all addresses, is stored "online" by all nodes on the Bitcoin network. This is maybe what you are thinking of when you say "Bitcoin is somewhere online".

However, to actually spend coins, you have to have the private key, with which you can create a transaction sending some coins from the address to some other address. The private key is an actual piece of data that can be stored on a particular computer (or a phone, or a piece of paper, etc). It is normally held only by the owner of the coins, and not by anyone else.

When a customer buys coins on an exchange, initially the coins are held by the exchange itself, which means that they belong to an address whose private key is held only by the exchange. They just update their internal books to indicate that this customer is now entitled to withdraw those coins (see below). The customer doesn't have a copy of that private key. If the exchange is hacked at this point and its private keys are accessed, the attacker can transfer the coins to his own address. After that happens, the exchange's private keys become useless and can no longer control what happens to the coins, but the attacker can spend them as he pleases. The coins have effectively been stolen by the attacker. Neither the exchange nor the customer can get them back. The exchange might reimburse the customer, but that is strictly between the exchange and the customer, and the Bitcoin protocol itself cannot force this to happen.

The customer can also withdraw the coins, by instructing the exchange to transfer them to a new address, of which the customer (and only the customer) holds the private key. After this is done, the customer is the only one who controls those coins; the exchange's private key is now useless. If the exchange is hacked at this point, nothing happens to those coins. However, if the customer is hacked (or accidentally erases her private key, etc), then she loses the coins. The exchange cannot do anything to help recover them, since it never had a copy of the customer's private key. (In the case of hacking, the private key wouldn't help anyway.)

Answer 2

That is not how Bitcoin works.

First of all, there Bitcoin is decentralized, so there is no "central repository". Secondly, there is no such an object of a "Bitcoin". When you own Bitcoin, you don't have any actual objects (i.e. no data, file, or physical good) that is a Bitcoin. Rather what you have are unspent transaction outputs that only you can spend. These outputs are part of transactions which are included in blocks in the blockchain. Everyone who runs a full node either retains a copy of the blockchain or has downloaded it before and fully verified it.

The majority of unspent transaction outputs are a type of output that requires you to create a digital signature with a private key whose public key has a hash that matches the one that is specified in the output. When people say that they have found Bitcoin on their hard drives, what they mean is that they have found private keys which are allowed to spend from some unspent transaction outputs. As their name implies, private keys are private and are only meant to be known by one person. So if someone had private keys on a hard drive somewhere and no one had a copy of those private keys, then that person's Bitcoin would be safe. He can still receive Bitcoin without exposing those private keys to the internet.

Since the signing algorithm used by Bitcoin (called ECDSA) is known to be secure (for now), the security of your Bitcoin is dependent on the systems on which you have your private keys stored. So if the private keys were on a hard drive (and only the hard drive) which was not connected to the internet, they would be very secure as someone would have to steal the drive in order to have a chance of accessing the private keys. Conversely, if you have your private keys on a hard drive that is in a machine connected to the internet, if you were to get some malware, that malware could search through your disks and steal any files containing private keys back to the attacker. Now the attacker can access your private keys and spend the Bitcoin, so your Bitcoin is stolen.