Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fake job offer took down Axie Infinity

theblock.co

Post reply on HN
Print view View original

311–320 of 364 posts

Re: A fake job offer took down Axie Infinity

#311

Post by spaceman_2020 »

Retric wrote: post #249
spaceman_2020 wrote: post #242

Earlier quoted context omitted.

The people holding the bag right now mostly got in because of the allure of quick profits. And if they didn't sell even after making incredible (paper) returns, they have their own greed to blame. Bitcoin was $6,000 in March 2020. It hit $63,000 in April 2021. And if you didn't sell that top, it hit $67,000 again in November 2021. Even now, it has dropped less than Netflix, a supposed bluechip. I don't know what's th…

I lost nothing, but I can empathies with people who are screwed. It’s not that Bitcoin or any alt coin has X paper value right now, it’s nobody can get out without someone else getting stuck holding the bag. The underlying system is predatory because mining isn’t free so it’s a negative sum game where people have already cashed out. I remember being saddened when it was less than 1/1,000th isn’t current value I reali…

> nobody can get out without someone else getting stuck holding the bag

That's true for practically every asset class. If you sold your Netflix stock at $600, someone had to buy it at $600 as well. And now they're out of $430.

There's a losing counterparty in every winning trade.

Re: A fake job offer took down Axie Infinity

#312

Post by jazzyjackson »

password4321 wrote: post #228
jandrese wrote: post #124

What an incredible story. In fact it is so incredible that it smells a bit funny to me. Are we sure this heist wasn’t an inside job? Axie was collapsing under its own weight and an employee decided to swipe all of the crypto after making up this crazy job offer PDF story to cover their tracks.

I'm amazed I had to scroll down this far to find the obvious explanation: a rug pull with a press release so the perpetrator doesn't have to fake their own death. Edit: I thought the lack of details was fishy but the following would be tough to fake: the FBI has attributed North Korea-based Lazarus Group, highly skilled hackers, to the Ronin Validator Security Breach. The US Government, specifically the Treasury Depa…

perhaps NK makes some side cash and notoriety from their "claim-responsibility-as-a-service" service, for a 5% fee we'll say we did it!

bonus free VPN endpoint and exploit library to make it look like it was us!

Re: A fake job offer took down Axie Infinity

#313

Post by solumos »

Barrera wrote: post #234

> Validators fulfill various functions in blockchains, including the creation of transaction blocks and the updating of data oracles. Ronin uses a so-called “proof of authority” system for signing transactions, concentrating power in the hands of nine trusted actors. This paragraph perfectly encapsulates everything wrong with the way promoters sell Ethereum. Smart contracts can do little of interest beyond straight m…

> This paragraph perfectly encapsulates everything wrong with the way promoters sell Ethereum... That information comes from "oracles", or what the article calls "validators".

Validators and Oracles are two different things entirely. That factual error aside, this is like saying that the US Federal Reserve is a weak system because Lehman Brothers and the MBS market failed.

Regardless, The Oracle Problem is already incredibly obvious and well-documented[0][1][2][3].

[0] - https://blog.chain.link/what-is-the-blockchain-oracle-proble...

[1] - https://encyclopedia.pub/entry/2959

[2] - https://cointelegraph.com/magazine/2021/12/30/can-blockchain...

[3] - https://www.proquest.com/docview/2524524192

Re: A fake job offer took down Axie Infinity

#314

Post by [deleted] »

elif wrote: post #206

Is this the moment we need for LaTeX to become standard? pdf is clearly to blame here imo. This guy isn't the only one to trust it. It seems like the entire legal profession, for instance, should be crippled by this vulnerability disclosure, if true.

[deleted]

Re: A fake job offer took down Axie Infinity

#315

Post by Fomite »

rmbyrro wrote: post #99
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

The main problem was using a machine that had access to half a billion dollars to also browse the web and do stuff like applying for jobs. If you're gonna have access to such amount of money, it's worth buying a dedicated machine and using it very, very cautiously.

Seriously. This is standard practice for even fairly innocuous human subjects data, and it astonishes me when it's not done elsewhere.

Re: A fake job offer took down Axie Infinity

#316

Post by tluyben2 »

hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

I removed my profile from LinkedIn 2 years ago because it was starting to get crazy; I got calls and emails from obvious scammers every day. The problem is that when I introduce myself, people always get suspicious of me not having a LinkedIn profile. Someone needs to reinvent a professional network.

Re: A fake job offer took down Axie Infinity

#317

Post by seibelj »

quxbar wrote: post #253
Apocryphon wrote: post #72

I've got to say, this is an incredibly cyberpunk article. > Ronin, the Ethereum-linked sidechain that underpins play-to-earn game Axie Infinity, lost $540 million in crypto to an exploit in March. While the US government later tied the incident to North Korean hacking group Lazarus, full details of how the exploit was carried out have not been disclosed. It's not in William Gibson's style, sounds more like Bruce Ster…

Axie was always a pyramid scheme, not an actually enjoyable game. Being able to write off $540 million in crypto loss and ALSO keep the coin? Sounds like a pretty neat way to end a scheme.

I know some equity investors in this who would disagree strongly with how beneficial the end game turned out to be

Re: A fake job offer took down Axie Infinity

#318

Post by DJHenk »

kornhole wrote: post #209
da39a3ee wrote: post #140

Earlier quoted context omitted.

Huh? I've used my company laptops for my personal life for the last 15 years. Why would I want to carry two laptops everywhere? I travel. I barely remember what a personal laptop is.

I think you are joking to bait us. At least use a VM running a VPN within it. It won't protect you from screen captures or keyloggers your employer put on your machine, but it will segregate files and network activity.

It is not that weird. For several jobs now I got a laptop from work and it was agreed upon beforehand that I could install Linux on it. I trust a machine that I installed myself.

Re: A fake job offer took down Axie Infinity

#319

Post by maury91 »

I tend to separate work and life affairs, and using the work computer to talk to recruiters sounds bad to me, it is something I feel more ethical to do on my personal computer. This would have easily prevented the hacking because only the personal computer would have got hacked

Re: A fake job offer took down Axie Infinity

#320

Post by DJHenk »

tluyben2 wrote: post #316
hn_throwaway_99 wrote: post #4

Two points to highlight from this article: 1. LinkedIn is an absolute godsend for bad guys, allowing easy targeting of everyone in the company with spear phishing emails and texts. I know many security professionals no longer use their real name, and don't list the real name of their company, because they know it's such a great hacking vector. Not sure what/whether LinkedIn can do anything about this. 2. I wish there…

I removed my profile from LinkedIn 2 years ago because it was starting to get crazy; I got calls and emails from obvious scammers every day. The problem is that when I introduce myself, people always get suspicious of me not having a LinkedIn profile. Someone needs to reinvent a professional network.

A few months ago I searched and found a new job without having a Linkedin profile. Was no problem at all, especially as a developer. If someone asks you can tell then that you got fed up with the recruitment spam and they will understand and nod. I did have a personal website though. Doing it without any online presence at all would be harder I guess, as it was a remote job in another country.
Post reply on HN