Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anatomy of a cryptocurrency scam

practicalsecurity.substack.com

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Anatomy of a cryptocurrency scam

#61

Post by mashlol »

hamasho wrote: post #53

I recently watched John Oliver's video[1] about the "pig butchering" scam. It's a brutal scheme where scammers invest months in building fake relationships, gain a ton of trust, and then rob all of their money. Even though I'm pretty tech-savvy, I'm not sure I could totally avoid falling for this. These scammers don't ask for money directly; they casually mention how they're making big bucks through crypto trading on…

I watched the video but I wasn't fully sure what the scam was. Where it became unclear to me was where it transitioned from a chat to an app.

The app mentioned in his video (MetaTrader 5) is still up - and seems actually legit... at least I think?

So is the scam that they send links to fake versions of the app? How'd the reviews look legit then? Or is there some sort of scam they run on the app where they actually have control of your account?

EDIT: nevermind, I found this[1] post that explains it - the app connects to brokers and is not one itself. So they basically just make a fake brokerage and convince you to use it. So John Oliver's explanation was a bit lacking on that part, and misleading/incorrect about MetaTrader 5 itself.

[1] https://old.reddit.com/r/explainlikeimfive/comments/1b4070o/...

Re: Anatomy of a cryptocurrency scam

#62

Post by lolinder »

yieldcrv wrote: post #59
lolinder wrote: post #58

Earlier quoted context omitted.

I think you're missing my point, which is that in the middle of describing an environment where you can't be confident of anyone's honesty, you acknowledged that even the "legit" actors who aren't trying to scam you are trying to keep things a secret from their "community" so that it can appear to them that everything is happening organically. What that says to me is that you're in a community of scammers, so it's ha…

I understood your point was that all participants including the token creators are scammers, and I didn't entertain you on it, shifting away from the semantics of that word as its an impossible standard for people that want to navigate that space There is more nuance to it than that. The exchanges themselves will revoke a listing if it leaks in advance, turning the entire community against the founders for failing to…

> shifting away from the semantics of that word as its an impossible standard for people that want to navigate that space

It's not about semantics, it's about the facts of what you're describing:

> The founders dont want it to leak that they paid or merely engaged a consultant, as a well done marketing campaign and “organic” results are what attracts people.

This is fraud. It's probably fraud in the legal sense, but it's absolutely fraud in the ethical sense.

"Organic" results attract people to a crypto project not just as some kind of personal preference, they attract people because a truly organic result is evidence of a project that isn't going to just be a money sink. Faking results in order to attract people is fraud (ask Elizabeth Holmes) and individuals who can persuade themselves that it's not will tend to be dishonest.

You can't distinguish between the scammers and the "legit" consultants because you exist in a world where dishonesty is the norm. They're all behaving dishonestly, it's just difficult to tell which ones are out to get you.

Re: Anatomy of a cryptocurrency scam

#63

Post by tbrownaw »

SkipperCat wrote: post #24
georgeecollins wrote: post #22

One thing I feel like I have learned from Reddit/ TikTok is the average person is terrible with money. Some VCs argue we should lower the bar to investing to democrative it. I am all for democracy, but maybe we would be better served if the average person didn't try to be a tycoon.

One of workplace tragedy in America is how we moved from professionally managed pensions to individual 401k retirement plans. Most folks have no business deciding asset allocation, managing risk, etc.

Pensions have extra counterparty risk.

I've also heard things that sound like they tend to have sharp eligibility cutoffs or amount calculations. There aren't issues with a 401k if I keep changing employers every few years. And you can't play stupid games with taking lots of overtime for your final year to boost retirement benefits beyond what they "should" be.

Re: Anatomy of a cryptocurrency scam

#64

Post by shombaboor »

nradov wrote: post #11
Algemarin wrote: post #4

This scam is successful because it is predicated on the same appeal that ventures like lotteries, sweepstakes, slot machines, or giveaways have (albeit accentuated with a seemingly guaranteed win, that these other ventures don't have): the belief that you can just luck into a giant treasure chest of money by expanding minimal effort. Broadly, this is a modern version of what's known as an advance-fee fraud, which has…

The difference is that while lotteries and casinos are out to take your money they're at least honest about it. If you win they'll pay out in real money. They're not rug pull scams.

they're heavily regulated which is a good thing. the odds are completely transparent.

Re: Anatomy of a cryptocurrency scam

#65

Post by Animats »

smeej wrote: post #23

This is...not realistic on any level. I've been professionally investigating cryptocurrency scams/thefts/fraud since 2017. This is at least twice as convoluted a process as is necessary to separate people from millions and millions of dollars in cryptocurrencies if the site stays up for a week. People don't bother spinning up stuff like this when the easy stuff works just fine.

Yeah.

That particular scam sounds like the old "binary option" scams out of Israel. Those involved large numbers of people, typically recent immigrants to Israel, working in call centers to con people. The scam binary options brokers were not only rigged, cashing out was next to impossible. Those were finally shut down, after the Times of Israel published a many-part expose, "Predators work at night"[1] Also, one of the big operations tried spamming Wikipedia really hard, which resulted in so much pushback that it attracted significant negative attention to the scams. The people behind those scams were not punished much, and pivoted to crypto, "contracts for difference", and other related scams.

For the simple scams, see r/metaverse-blockchain. This is currently full of pump and dump memecoin scams, promoted as such. Get in and out before the dump is the pitch. Of course, the issuers of the coin are guaranteed a gain, while, collectively, everybody else loses.

There is no "metaverse" component to these coins any more. There used to be claims that the money being raised was going to develop a 3D virtual world. A very few of the "metaverse" coins actually got something going, but most just took the money and ran. Even the ones that got something going didn't do a very good job. The result either looked awful or was so expensive to run server side that they could only run it for special events.

There's several new crap memecoins each week. The promotions look like they come from a template. This looks like a low-effort operation.

Where's the SEC when you need them? (Mostly dealing with higher-dollar scams, actually. They bring the hammer down on one or two crypto scams per month, but there are so many.)

[1] https://www.timesofisrael.com/tel-aviv-binary-options-firm-a...

Re: Anatomy of a cryptocurrency scam

#66

Post by yieldcrv »

lolinder wrote: post #62
yieldcrv wrote: post #59

Earlier quoted context omitted.

I understood your point was that all participants including the token creators are scammers, and I didn't entertain you on it, shifting away from the semantics of that word as its an impossible standard for people that want to navigate that space There is more nuance to it than that. The exchanges themselves will revoke a listing if it leaks in advance, turning the entire community against the founders for failing to…

> shifting away from the semantics of that word as its an impossible standard for people that want to navigate that space It's not about semantics, it's about the facts of what you're describing: > The founders dont want it to leak that they paid or merely engaged a consultant, as a well done marketing campaign and “organic” results are what attracts people. This is fraud. It's probably fraud in the legal sense, but…

yes and its really great that exchanges have been disintermediated by liquidity pooling systems. a lot of these extortionate practices were because projects use to need exchanges for any liquidity, so exchanges gatekept that. and now thats not necessary. anybody can spin up a permanent liquidity pool within 1 second.

regardless, purchasers should be more discerning as the technology provides the necessary transparency. many are discerning. many arent and those purchasers and the people they are influenced by have created a culture of strange metrics to judge a project by - such as growth of members in a chat channel, or mentions, or exchange listings. Playing along with that isn't fraudulent unless saying something happened for a reason it didnt. What you are describing to me is analogous to suggesting an organization directly tell all the technical analysis traders that their charts had nothing to do with anything, and if the organization didn't say that then its fraud.

In any case, crypto assets would work just as well if their creators said “they’re connected to this consultant” but for now thats just an omission thats necessary because the consultants tend to be in a position to harm the projects and its not clear they’ve delivered until the separate exchange moves forward with the listing.

I wouldn't consider that fraud on the project’s side in any sense, but I can see why you think that is - where either Ive created a protective layer of rationale for myself or the entire ecosystem is fraudulent and any individual’s way of navigating that is irrelevant. I don’t agree with that assessment, my contribution is to point out that there is a niche of scammers that absolutely will do meticulous, convoluted fraudulent things reminiscent of what the article has shown. And if you want to know about that niche, then I’ve detailed it. If you dont, this isnt really the thread for generalized crypto sentiment but I’m sure there will eventually be others on hackernews and you’ll find someone to entertain what you actually want to talk about.

Re: Anatomy of a cryptocurrency scam

#67

Post by TacticalCoder »

wslh wrote: post #3

I suggest you the following exercise to see it with your own eyes: enter a Telegram channel on a top 100 cryptocurrency, say that you are trying to recover your wallet and... Suddenly a lot of scammer will contact you in less than 5' with techniques that you cannot imagine are real. For example, telegram handles with the same name as the channel admin but using unicode characters to make tou think it is the same acco…

> For example, telegram handles with the same name as the channel admin but using unicode characters to make tou think it is the same account.

Ah yes, homograph/homoglyph attacks. Bruce Schneier warned about that decades ago. He predicted all these homograph/homoglyph attacks.

Work for domain names too seen that there can be internationalized domain names.

Re: Anatomy of a cryptocurrency scam

#68

Post by TacticalCoder »

TheDudeMan wrote: post #6
wslh wrote: post #3

I suggest you the following exercise to see it with your own eyes: enter a Telegram channel on a top 100 cryptocurrency, say that you are trying to recover your wallet and... Suddenly a lot of scammer will contact you in less than 5' with techniques that you cannot imagine are real. For example, telegram handles with the same name as the channel admin but using unicode characters to make tou think it is the same acco…

What is the standard solution to this type of phish? This problem did not exist in the ASCII world, of course. Unicode is useful, but what is the best way to prevent this malicious use of it?

> What is the standard solution to this type of phish?

For domain names I use a "corporate" setting in Firefox, disallowing the use of DoH/DoT: to make sure that every single domain name resolution goes through my own local DNS resolver.

And my firewall inspects every packet on port 53 and rejects any packet containing "xn--" (the way they encode Unicode chars in ascii URLs).

For text: my editor is configured to display in bold, fluo, on a dark background any character that is no a visible ASCII char (except newlines and spaces) and "zero width" char are forced to have a width.

But it's a losing battle: too many people don't understand the security implication of using Unicode everywhere.

The most enraging in all this is how stupid these homoglyph/homograph attacks are to pull off: any dumbfuck can pull it off. The bar is insanely low.

Re: Anatomy of a cryptocurrency scam

#69

Post by rr808 »

Best crypto scam I see right now is the (MEV) bot scam. There are a bunch of promoted videos like below. Just download some code, connect it to your ETH wallet and you'll make 20-50-100% profits daily. I reported some over a month ago but still up. Has nearly half a million views.

https://www.youtube.com/watch?v=dK6U9P9pt6A

Re: Anatomy of a cryptocurrency scam

#70

Post by lolinder »

yieldcrv wrote: post #66
lolinder wrote: post #62

Earlier quoted context omitted.

> shifting away from the semantics of that word as its an impossible standard for people that want to navigate that space It's not about semantics, it's about the facts of what you're describing: > The founders dont want it to leak that they paid or merely engaged a consultant, as a well done marketing campaign and “organic” results are what attracts people. This is fraud. It's probably fraud in the legal sense, but…

yes and its really great that exchanges have been disintermediated by liquidity pooling systems. a lot of these extortionate practices were because projects use to need exchanges for any liquidity, so exchanges gatekept that. and now thats not necessary. anybody can spin up a permanent liquidity pool within 1 second. regardless, purchasers should be more discerning as the technology provides the necessary transparenc…

> If you dont, this isnt really the thread for generalized crypto sentiment

This isn't generalized crypto sentiment. I actually find the rehashed arguments about crypto on HN rather exhausting and don't tend to participate much.

What this is is a thread about crypto scams, in particular a crypto scam that preys on dishonest people by taking advantage of their dishonesty. You provided a great illustration of a similar type of scam by mentioning how you've seen how many scammers take advantage of the widespread secrecy in the crypto token world, which secrecy you say exists in order to better attract buyers by not letting on the various ways in which the creator is manipulating things behind the scenes with the aid of a paid consultant.

It seems to me that a discussion of pervasive dishonesty creating a hotbed for scammers is totally relevant to TFA and to your original comment.

Post reply on HN