Crypto Currency Fraud

Unbounded
#52

I watched all of “The Problem With NFTs”. The video makes some good points and has some interesting stuff about NFC scams and culture. There are many technical errors (and some political views thrown in), but they don’t make that much of a difference to the main point of the video.

One thing I wasn’t sure of (and hadn’t heard about) that was mentioned, but explained poorly, is an exploit where someone is sent an NFT and this leads to their wallet being drained.

The article I link is probably for a different attack than the example from the video, but the effect is the same.

I don’t know how this isn’t just pure negligence on the part of OpenSea (it’s their site and service), but there are more issues that limit chances for error correction along the way. Those limitations apply to the whole Ethereum ecosystem, and all other chains built on the same tech (like Ethereum Classic).

It sounds like one of the reasons that this exploit exists is that Metamask – the main Ethereum wallet used in Web3, which is a browser-addon – has really bad UX around transactions.

Like, when you make a transaction you’ll see the destination address, ETH value, tx fee, and the data payload. But there’s no way for Metamask to have any idea what the payload does – it can’t do that for every possible smart contract out there. So it can’t show anything useful to the user (note: there are some special cases built in, like for ERC-20 tokens). So, in essence, a bit of JS can do a bait-and-switch. The user thinks they’re clicking “delete”, but really that ends up like draining all their NFTs (if it tried to drain ETH then the user at least has a chance to notice). The metamask transaction prompts for delete and drain would look basically identical. Unless the user like copied the data payload and deserialized it, they’d have no idea what it actually does. (Maybe metamask has done something about this as a special case, but in principle this is the norm that I remember)

This article is from October but the example in the video happened around Dec 27 I think, based on the timestamp of the reply (the incident was also listed on web3isgoinggreat.com on 28th dec)

“So, we decided to check what will happened if we would create malicious art that contains code in it, for example an .SVG image. We created a simple .SVG file and uploaded it with a simple payload,” researchers explained in a Wednesday analysis. “By clicking on the art and opening it in anther tab or clicking on the links on the page, our SVG will be executed under https://storage.opensea.io subdomain; at this point, we have a SVG file with JavaScript capabilities.”

image
image1413×797 137 KB

(Apparently the guy replying sees the recent southpark NFT thing as a good thing, too)

#53

https://www.tiktok.com/@aamirazh/video/7056947817859779886

#54

This link doesn’t seem to work either. I guess it’s b/c the uploader deleted it.

#55

From memory, that one was about using NFTs as money laundering (sell it to yourself).

1 Like
#56

The link works fine for me

#57

It seems to have been something on my end I guess.

Edit: I just checked the link on my iPad, the device that I had the problem on, and the link is working there as well now.

#58

I didn’t like the victim blaming by Asmongold. Interesting video though.

#59
  • cross-chain fancy blockchain system gets hacked
  • 120k ETH stolen
  • venture capital fund replaces ETH to keep system propped up
#60

part 2

#61
1 Like
#62

A long Twitter thread about a nearly successful social attack:

#63

She then tells me more about Space Falcon. It seems kind of like a get-rich-quick scheme, but again, that’s kind of how I see a lot of NFTs. With all that she’s doing for Arrow, there’s no harm in showing a little support.

crypto founder guy thinks (and admits in public in writing) that there is “no harm” in using his reputation to support an NFT get rich quick scheme as a favor for someone who is doing him favors. what a rotten ecosystem crypto is? or are most people this bad?

he also admits dangerous gullibility (in public, in writing) – no one should trust whatever crypto stuff he’s building. he doesn’t seem to recognize that he did things very wrong. his perspective is so warped that he thinks basically anyone would probably have fallen for it, and he’s blameless, and there’s no shame in getting lucky.

#64

The DeFi/Web3 tribe is worse than crypto generally, and crypto is worse than most ppl.

My impression is that most people think being matter-of-fact negative about someone’s project or startup is bad and mean; and an excuse for this is like ‘what’s the harm?’. But ppl are willing to hear criticism more with that sort of thing b/c you can’t make a business work if it tries to fake reality.

But with crypto – particularly the DeFi/Web3 tribe, which this guy is in – it’s way worse. Plus, since there’s been so many, like, irrationally successful projects, I think that’s sort of taken as evidence that being negative is wrong and doesn’t pay off. Big caveat: there’s plenty of calling-out of scams by some tribes, or has been in the past at least, but those tribes have other problems.

Yeah. I think crypto ppl will overlook that and use the excuse that he’s doing something positive by writing up the attack.

Also, my guess is that if someone in the crypto space says this (or something like it), they’ll either be ignored or brigaded.

There’s dishonesty on his part about his gullibility too – like he starts with (emph mine)

I’ve been targeted in an extremely thorough social engineering scam that nearly cost me all of my ETH.

But if he’d just paid attention to the red flags and actually done some due diligence then it would never have worked. I think crypto ppl might think the lesson from this thread is about reading smart contracts…

Also, he did get scammed out of 1 ETH, like $3k USD. (Image in 22/)

Some details about these two projects (b/c the sites aren’t going to stick around forever)

Arrow’s twitter bio:

Arrow is a community with the mission of building vertical-takeoff aircraft that are affordable and accessible to everyone through an air taxi network.

Arrow’s home page text above the fold:

We’re Bringing Point to Point Air Travel to Everyone

Fly between any two points on Earth, using open source hardware from a global team

Why would we even want that? Then again, this thomasg guy says (his 3rd msg in the discord screenshot):

I’m pretty sure my dream life would be to just live on a spaceship and cruise around exploring the universe

picard_facepalm.gif

I also looked at the other one a bit. One of the funny things is I think the twitter guy wasn’t intending to imply that the legit space falcon project is a get-rich-quick scheme (mb partially why his tweet said what it said), but, well…

Space Falcon’s twitter bio:

Intergalactic #SOLANA metaverse featuring PvP space shooter game with premium Sci Fi NFTs.

Around the fold of their home page (bold white text + stroke is mine)

spacefalcon
spacefalcon815×528 80.3 KB

#65

I wouldn’t have been harsh if he’d said nothing about it in public. I didn’t think he needed to be negative. I wasn’t asking for that. Just don’t be positive about it (a thing you believe is basically a scam). Don’t go actively help and thereby contribute to people losing money (the blatant harm that he has to bury his head in the sand to evade).

Yeah. Writing it up is a very good thing. But it also revealed a bad attitude to the issues.

#66

Hackers Steal About $600 Million in One of the Biggest Crypto Heists

Ronin Network says thieves took Ether, USDC tokens on March 23
Bridge hacks can threaten the ecosystem of decentralized apps

https://www.bloomberg.com/news/articles/2022-03-29/hackers-steal-590-million-from-ronin-in-latest-bridge-attack

(bloomberg has an anti-bot thing that prevented the preview showing up)

#67

This article is basically a quote from a podcast with emphasis from the editor. SBF is the crypto guy; Levine and Weisenthal are hosts (I think). The subtitle of the article is “Sam Bankman-Fried explains “yield-farming” to Bloomberg.”

archive.today link

I included the emphasis from the FT editor in this quote.

One reason I thought this was notable (that wasn’t emphasized by the FT editor) is Weisenthal’s point about economic productivity. (the point is the last paragraph of the above quote)

I think that’s the crux for an argument that blockchain is good in some ways: how is it economically productive?

e.g., bitcoin might promise that it breaks down ‘walled gardens’ of payment networks and things, but is there actually evidence to support that? Like does it provide a product that actually improves the lives’ of the unbanked? In this case: IDK; I’ve seen puff pieces about it, but no hard data either way.

#68

A bunch of Venture Capitalist firms from Silicon Valley are complicit in the general atmosphere of crypto scams. They fund them and profit off them. Here’s a major firm announcing their fourth crypto fund with $4.5 billion:

I’ve read reports that they and other VCs got out of Luna/Terra just before the crash and actually made a lot of money off that because they also got in early (and the reputations of VCs who got in then played a significant role in getting other people to believe it was safe or real, not a scam – so they fooled people using their reputations and then profited off the people they fooled).

Related, crypto scams hurt people:

https://www.wsj.com/articles/terrausd-crash-led-to-vanished-savings-shattered-dreams-11653649201

The surgeon example lost his money to a company backed by YCombinator that wrote intentionally misleading risk disclosures:

Depositing with Stablegains is not the same as depositing in the bank. The reason you can earn a high return via Stablegains is in part because of the protocols offering a much more efficient solution than banks do, but also in part because the risk profile is different. Certain risks exist that are relevant to any open digital finance protocol, whether accessed via Stablegains or another platform.

There’s no way YC invests in a plan to earn stable, high interest and doesn’t know that’s either a scam or a lie, right? Stable high interest is not a real thing. Their business plan was apparently to put the money in Luna/Terra stuff, collect 20% interest, and give their customers 15% interest.

After being initially funded by YC, they raised $3 million from VCs including additional money from YC:

#69

People’s willingness to invest (and lose) their life savings without carefully reading the terms of service says something about how much people hate reading. That’s relevant to my philosophical claims about how people need to practice reading and develop much better autopilots so it seems more like easy/fun/automatic to not just read but actually read well and follow details.

2 Likes
#70
#71