Exchange Vircurex Freezes Withdrawals, Claims Lack of Reserves

Beijing-based virtual currency exchange Vircurex has frozen most of its digital currency withdrawals effective immediately, claiming it no longer has the reserves to cover customer requests.

The freeze will affect all bitcoin, litecoin, feathercoin and terracoin withdrawals. A message on Vircurex's site says it will create a new balance type called 'Frozen Funds' covering all balances in the aforementioned currencies. The company maintains it won't be shutting down, saying it intends to "gradually pay back the losses".

That Vircurex had a reserve shortfall had been known for some time, though not the exact amount. It froze BTC/LTC withdrawals in January 2013 after reporting that wallets had been compromised, but still allowed deposits in those currencies to continue. The attacker had apparently exploited a vulnerability in Ruby on Rails posted online just the day before.

The company pledged to cover the losses from its own income and had been doing so until yesterday, when "large fund withdrawals in the last weeks" completely depleted its cold wallet reserves.

While Vircurex's volumes and deposits were nowhere near Mt. Gox's levels, the story is significant thanks to the similarities: hackers supposedly lift thousands of bitcoins from an exchange, the exchange desperately tries to cover the loss before users sense something more serious is up and start a run, leading to a withdrawal freeze.

It has raised questions about exchanges operating fractional reserve systems, either openly (as in Vircurex's case) or covertly, in both cases due to a theft.

There are now calls for online exchanges and wallets to prove their reserves somehow, possibly using a cryptographically secure proof of inclusion and proof of reserves system such as a Merkle Tree, or hash tree.

South Korean exchange Korbit announced recently it would be the first major exchange to offer such a service with its opt-in 'BitTrust' system. Since 21st March, 57 of Korbit's users have signed up to participate, covering a total balance of over 580 BTC. It has kept BitTrust opt-in only for now due to trade-off in transparency vs. 100% balance privacy.

Vircurex opened for business in October 2011, and traded between BTC, USD or EUR, plus up to 18 other cryptocurrencies against each other, eliminating some less popular coins over time.

Users on bitcointalk first started noticing bugs interfering with trading and withdrawals around late February and early March, which grew in number until this week's problems. The site then apparently stopped any-to-any currency trades late last week before announcing the freeze.

Losses will be paid back according to a 'top-down/bottom-up' distribution logic, according to the site announcement. That means 50% of available funds will be used to pay the largest balance holders and the other 50% the smallest, meeting somewhere in between.

"All users will eventually receive their funds, though the timeframe depends on the monthly volume available," the announcement continued, saying the logic guaranteed new users would not be penalized and thus supporting the platform's operations until all amounts have been returned.

Exchange data image via Shutterstock