Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds arrest couple, seize $3.6B in hacked Bitcoin funds

washingtonpost.com

Post reply on HN
Print view View original

601–610 of 901 posts

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#601

Post by pshc »

hnburnsy wrote: post #584
pshc wrote: post #552

Earlier quoted context omitted.

Yeah, a hardware wallet is good, although for a billion dollars, 100 hardware wallets would be better. Could even go so far as to split a private key into seven horcruxes using Shamir's Secret Sharing and bury them in locations around the world. Memorizing a seed phrase leaves you vulnerable to a $5 wrench attack, I wouldn't recommend it.

The famous Bitcoin family reportedly spread their hardware wallets across the globe. https://www.cnbc.com/2021/08/11/bitcoin-family-hides-bitcoin...

Wow.

> Taihuttu has two hiding spots in Europe, another two in Asia, one in South America, and a sixth in Australia.

> We aren’t talking buried treasure – none of the sites are below ground or on a remote island – but the family told CNBC the crypto stashes are hidden in different ways and in a variety of locations, ranging from rental apartments and friends’ homes to self-storage sites.

I hope this is all a decoy or else it’s the worst opsec I’ve seen since about five hours ago.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#602

Post by throwaway22032 »

loceng wrote: post #366
throwaway22032 wrote: post #28

Earlier quoted context omitted.

Most cryptocurrencies are designed such that the concept of "returning" stolen funds is not really meaningful. The best analogue is cash. If you want to return the cash you need to physically find it and move it back.

So we pretend to treat it like cash and ignore that we can track and know exactly what digital currency is stolen? That's your proposed solution?

No, you're using words that I don't think are meaningful in the context of what a cryptocurrency is.

Assuming you can't physically track down a thief and seize control, the technical best case you can achieve with Bitcoin is to blacklist specific transaction outputs e.g. you can choose not to accept them. You can't prevent others from accepting them, but you could for example as a governmental body add them to a global blacklist of sorts and legally forbid exchanges from accepting transactions which have at some historical point interacted with those blacklisted transaction outputs.

With the use of Lightning or coinjoin or various other privacy preserving protocols you're going to end up in a situation in which you have to taint the entire coinbase (e.g. all coins) eventually; the ultimate endgame of doing that would be to "ban Bitcoin" on exchanges.

With something like Monero or ZCash there's no serial number to track in the first place so you have no ability to blacklist anything; your only option is to refuse to accept those currencies at all.

These are possible legal avenues you can go down. But _returning_ the funds is mathematically impossible without somehow gaining access to the private keys that control them.

The fact that there is no "solution" here is an explicit goal of most of the cryptocurrencies that I'm aware of. It's certainly the reason that I'm interested in the space; it's non-custodial, as cash is.

If someone steals your car, takes it abroad and you don't know where it is, it's gone. There is no solution. Goodbye car. So it goes. If I could add a mechanism that drove it back to me, I wouldn't want it for a host of reasons.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#603

Post by DyslexicAtheist »

GekkePrutser wrote: post #558
danso wrote: post #3

The statement of facts is linked to from the press release, and describes generally how the Feds were able to trace the stolen funds (they found a file listing private keys, after gaining access to the suspect's cloud storage) https://www.justice.gov/opa/press-release/file/1470186/downl... > The 2017 transfers notwithstanding, the majority of the stolen funds remained in Wallet 1CGA4s from August 2016 until January 3…

Wow. Such hacking prowess. Such bad opsec. Weird. Ps not condoning the theft but I just find it strange that people with the skills to steal this much get caught using bog standard cloud storage. You'd think they could afford something better ;) Something along the lines of "you don't take notes on a criminal f** conspiracy" :)

> I just find it strange that people with the skills

people in Tech will yak-shave choosing the "correct" cypher. Then get pwned by an implementation detail like a bug in enigmail.

1) Hacking, 2) opsec and 3) tradecraft are totally different skills. The most dangerous people (to themselves) are the ones who cover only one of 3. The more advanced among them _know_ they lack in the other areas, but think they can compensate going even deeper on whatever they already know.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#604

Post by rococode »

xapata wrote: post #311
albroland wrote: post #6

fwiw, it appears one of the named here is a YC Alum: https://news.ycombinator.com/user?id=il https://www.linkedin.com/in/unrealdutch/

Interesting that the hack occurred in 2016, and in the same year he left MixRank.

Makes you wonder if he left because he realized he could hack $70m in Bitcoin, or he hacked $70m in Bitcoin because he had left and had nothing else to do (the hack happened in August and he left in May).

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#605

Post by elkos »

pdog wrote: post #215

Ilya Lichtenstein (YC S11) is the co-founder of YC-backed MixRank. Heather Morgan, his wife, is apparently a serial entrepreneur, investor, and "contributor" to Forbes.

For those unfamiliar with Forbes as a platform, forms allows for independent unpaind (by Forbes) writers to submit content on their platform. If you see a scummy crowdfunding campaign or shady start up claiming "as featured in Forbes,etc etc" that's how they do it.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#606

Post by csmajorfive »

bostonsre wrote: post #286
paulpauper wrote: post #178

Earlier quoted context omitted.

This is just unreal. this guy was living a double life of being the greatest criminal ever. So among our community was a $4 billion hacker, just nonchalantly posting. I don't think he will be commenting anytime soon again if this really is him https://news.ycombinator.com/threads?id=il like your neighbor being a serial killer or something

I don't understand why he wouldn't move to somewhere that doesn't have an extradition policy with the US. If you go down that path, it seems like you should probably be willing to abandon your life. It's the same with Ross Ulbricht, seems like it would be terrifying living with that sword of damocles hanging over your head absolutely constantly.

I find it especially baffling considering he has Russian citizenship.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#607

Post by judge2020 »

voldacar wrote: post #596
toomuchtodo wrote: post #417

Earlier quoted context omitted.

> Seems like he could have done more to distance himself. On a value system with an inherently public ledger that eventually has to hit a fiat off ramp with KYC/AML requirements? Nah. Everyone has quality opsec until they don't, and the record of your criminal activity is immutable and highly durable.

You can just sell the bitcoin for monero, then sell the monero for btc. also, as time goes on, the proportion of btc that are "dirty" approaches 1, so these chainalysis strategies become less effective, assuming you aren't stupid enough to do some criminal act then cash out at a kyc exchange the next day from the same wallet

But are there any exchanges that swap btc for monero or eth that don’t have KYC requirements? Seems like it’d need to be off-chain somewhat, unlike uniswap.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#609

Post by mannykannot »

nobody9999 wrote: post #500
mannykannot wrote: post #314

Earlier quoted context omitted.

There is what appears to be a rather amusing side-effect of this principle: “The arrests today show that we will take a firm stand against those who allegedly try to use virtual currencies for criminal purposes.” - Assistant Attorney General Kenneth A. Polite Jr. [My emphasis.] There's no reason for the Justice Dept. not to take a firm stand against those who try to use virtual currencies for criminal purposes, or sa…

>I guess that 'allegedly' was inserted here in order to forestall a claim that this statement deprived the defendants in this case of due process, if or when it comes to trial. Actually, the 'allegedly' bit was inserted because the defendants in this case are alleged to have committed some criminal act(s). They have not been proven (whether via a trial or a plea agreement) to have done so. The defendants may well be…

I se I have not made my point clear here. The quoted statement is not referring to these defendants in particular, it is referring to those who try to use virtual currencies for criminal purposes in general - yet the language appropriate for referring to specific defendants creeps in here, presumably out of concern that some people cannot tell the difference.

When a crime has been committed, it was not allegedly done by a person or persons unknown, it was actually done by whoever they were. One of the jobs of the justice department is to catch criminals, not alleged criminals.

Re: Feds arrest couple, seize $3.6B in hacked Bitcoin funds

#610

Post by easrng »

benreesman wrote: post #594
tyrfing wrote: post #225

Earlier quoted context omitted.

> they found a file listing private keys, after gaining access to the suspect's cloud storage That's backwards. It's how they wrapped it all up. The real trail is pretty clearly AlphaBay 2016/2017 transactions (under gov control around that timeframe), to KYC-flagged accounts at an exchange, with a web of accounts with real info linked together past there.

I mean, for a recent example of how this works in practice: Polygon got whacked for like 650MM last August, but all the fiat and even stablecoin exchanges blacklisted the addresses and the guy got like 5MM “bug bounty” or whatever. There might be prestige in some circles for taking down some dumbass Solidity coder, and some people seem to be getting some money out still (e.g. Wormhole). But overall I’m short Trail of…

Yeah, if you hack a contract you need to get the funds into Tornado.Cash immediately.
Post reply on HN