Exodus Bitcoin Wallet: $490k swindle • Hacker News Board

Re: Exodus Bitcoin Wallet: $490k swindle

#131

Post by loloquwowndueo » Wed, Feb 21, 2024, 4:01 AM UTC

neilv wrote: post #16

> They likely saw a button like this in the "App Centre", which gave them some confidence in the application. [...] Furthermore the title of the Snapcraft web frontend says "Snaps are containerised software packages that are simple to create and install. They auto-update and are safe to run." Sounds like assurances made by UX and Marketing, which engineering might've been able to tell them they can't make. If it ends…

You assume sales and marketing listen to engineering. At Canonical, they do not.

Source: I’m a former Canonical employee.

Re: Exodus Bitcoin Wallet: $490k swindle

#132

Post by farrarstan » Wed, Feb 21, 2024, 4:09 AM UTC

reidjs wrote: post #116

threeseed wrote: post #72

Earlier quoted context omitted.

Crypto-currency isn't about the technology. It's a political experiment centred around replacing the existing financial system. And the mistake there is that people in the crypto space are ignorant about how that world works. Namely that there is such a large overlap with the government that you're in essence trying to disrupt governments. Which is a losing battle.

I don’t think it’s a battle. At least one government has adopted cryptocurrency to a small extent. No technology is “about” the technology, the other poster mentioned the Internet, very few care about how it works, they care about what they can with it.

[dead]

Re: Exodus Bitcoin Wallet: $490k swindle

#133

Post by fuddle » Wed, Feb 21, 2024, 4:10 AM UTC

Do we know how much was transferred to the attackers wallet in total from all attacks?

Re: Exodus Bitcoin Wallet: $490k swindle

#134

Post by sowbug » Wed, Feb 21, 2024, 4:18 AM UTC

codetrotter wrote: post #9

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And si…

Since BIP-32, receive and change addresses have been generated from a single seed, never from outside sources. Hardware wallets verify this.

It's much more likely you'll fall victim to malware that waits until you're on an exchange website, and substitutes the attacker's receive address for the exchange's. You think you're depositing funds in your account, but they vanish instead. This is basically the same attack as fake escrow instructions emailed to people buying a home.

Re: Exodus Bitcoin Wallet: $490k swindle

#135

Post by aeternum » Wed, Feb 21, 2024, 4:25 AM UTC

itsoktocry wrote: post #101

aeternum wrote: post #79

Earlier quoted context omitted.

Ah yeah clearly not ready in fact neither is traditional finance: https://www.aura.com/learn/i-got-scammed-on-venmo-what-do-i-... https://help.venmo.com/hc/en-us/articles/235171088-Cancel-Pa... A fool and their money..

Do you not see the difference between a Venmo transaction and Bitcoin transaction? With Bitcoin, a small mistake or oversight and you money is gone, and unrecoverable. So you can point and laugh at people getting scammed on Venmo, but you need "normies" to adopt BTC.

It's the same with Venmo, I have a few friends that have sent money to random people never to see it again.

There's really very little crypto-specific here, convincing someone to transfer funds to a scammer-controlled account is one of the oldest financial tricks in the book. It's still very common with bank wires.

Re: Exodus Bitcoin Wallet: $490k swindle

#136

Post by px43 » Wed, Feb 21, 2024, 4:27 AM UTC

acdha wrote: post #125

csomar wrote: post #119

Earlier quoted context omitted.

Beyond being an anecdotal point myself, you do read other people's experience online. I don't have concrete statistics; however, I do know that even big institutions get scammed with no recovery (ie: I recall the Bangladeshi central bank being swindled for tens of millions of dollars because of SWIFT and not being able to recover that money. If the Central Bank of a nation doesn't have a recourse for such an amount,…

This is a great example: most of the fraudulent transactions were blocked by the NY Federal Reserve – $850M – and of the remaining $101M, a significant amount was recovered: https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery https://www.bbc.com/news/stories-57520169 Not perfect, but 90-something percent better than no recourse. More importantly, it’s also not a given that individuals lose everything as opposed to…

That was a complete dumb luck accident due to a spelling mistake.

https://www.independent.co.uk/news/world/asia/spelling-mista...

Note that the rest of the money disappeared quite effectively.

Re: Exodus Bitcoin Wallet: $490k swindle

#137

Post by laverya » Wed, Feb 21, 2024, 4:29 AM UTC

fuddle wrote: post #133

Do we know how much was transferred to the attackers wallet in total from all attacks?

Only if the attacker only transferred funds to one wallet.

I could also see a sophisticated attacker holding off on draining wallets until the amount contained started to drop or increased past a threshold. Draining funds as soon as a user attempts to setup the app gets you a few suckers but also means you'll be reported quickly. Giving everyone a failure message while recording the recovery key might let you go significantly longer before discovery.

Re: Exodus Bitcoin Wallet: $490k swindle

#138

Post by nntwozz » Wed, Feb 21, 2024, 4:34 AM UTC

whimsicalism wrote: post #106

nntwozz wrote: post #42

On a tangent, my neighbor came to me about a month ago and asked if I was a "hacker"? He's around 75 and has known me for maybe 20 years, we're not close friends but we run into each other every now and then and he knows I work with IT; I'm about half his age. Long story short, I find out he needs help to retrieve his bitcoin wallet because he's lost $300k. I spend an hour looking around his devices and find out he's…

If he has children you should try to get them involved.

The sad thing is his wife was wondering where all the money has gone, I was the first one he told about this.

He was saving it for his grandchildren and he basically had a meltdown when I told him he's probably been scammed.

I felt really bad and also uncomfortable with the whole situation, I gave him a hug and told him to get in touch with his bank and tell them everything he told me.

Not likely that they'll help him but I just didn't know how to deal with the situation.

Re: Exodus Bitcoin Wallet: $490k swindle

#139

Post by ravenstine » Wed, Feb 21, 2024, 4:36 AM UTC

LASR wrote: post #111

ravenstine wrote: post #50

Earlier quoted context omitted.

If it's being used as a "savings account", there really isn't a meaningful difference, although it can be superior because a hardware wallet is more likely to be targeted for an exploit than some rando thumb drive that no one knows the location of or knows exists. This goes against everything that r/bitcoin would say, but lots of those users are similar to those infosec guys who consider all electronics "unacceptably…

Well the big difference is that keys can't be accessed in a hardware wallet. If you accidentally plug in the USB drive into some untrusted box, you could potentially have everything stolen. > some rando thumb drive that no one knows the location of or knows exists You still have this option with a hardware wallet. eg: > some rando hardware wallet that no one knows the location of or knows exists

> Well the big difference is that keys can't be accessed in a hardware wallet.

In theory.

> If you accidentally plug in the USB drive into some untrusted box, you could potentially have everything stolen.

This is like saying that no one should own a gun because you might point it straight at your own head and pull the trigger.

> You still have this option with a hardware wallet. eg:

Yes, that is true, but a hardware wallet is an extra piece of hardware that needs to be actively used to provide HD wallet keys for transactions. If all a person wants to do is store BTC for the very long term, then this approach is more complicated and hazardous than storing a non-HD wallet key pair on some physical medium; this is because a hardware wallet failure can result in loss of the ability to sign transactions, and chances are you're storing the seed phrase separately. Again, just for long term storage, there's next to no advantage between storing a seed phrase for an HD wallet and storing private and public keys. Depending on what a person intends to do with their money, a hardware wallet may provide zero value over the least complicated approach. Unless someone is paranoid over other people or the government knowing their balance, a single public address is more straight forward than managing an HD wallet.

Re: Exodus Bitcoin Wallet: $490k swindle

#140

Post by achiang » Wed, Feb 21, 2024, 5:09 AM UTC

It has been 10 years since I left Canonical (on good terms), but what popey describes (hi popey) about the intentional lack of human review in the Snap store sounds very Canonical to me.

I agree with all the recommendations - add human gates. Yes, it's expensive, but still far cheaper than the unbounded reputational damage that just occurred around the untrustworthiness of the store (hi Amazon).