“Crypto drainer” template facilitates theft • Hacker News Board

Re: “Crypto drainer” template facilitates theft

#141

Post by darcys22 » Thu, Jun 16, 2022, 1:53 AM UTC

caylus wrote: post #117

Others in the thread have mentioned that the MetaMask wallet provides a warning prior to allowing a site like this to access the wallet. For reference, this appears to be an example of that warning: https://github.com/MetaMask/metamask-extension/issues/11337 Transcript: "Signing this message can have dangerous side effects. Only sign messages from sites you fully trust with your entire account. This dangerous method…

There is a difference between signing a transaction and signing a string. The warning you have linked pops up when a signing of a string occurs and warns that if the person embeds a transaction in that string you are signing whatever transaction they have made.

There is a new method they have for signing strings that does not allow a transaction to be signed so its safer.

The crypto drainer seems to directly be sending the NFTs and assuming that the user cant understand the transaction and what its actually doing.

Re: “Crypto drainer” template facilitates theft

#142

Post by joshgroban » Thu, Jun 16, 2022, 2:14 AM UTC

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

You don't know what you're talking about.

Re: “Crypto drainer” template facilitates theft

#143

Post by cowtools » Thu, Jun 16, 2022, 2:17 AM UTC

jensvdh wrote: post #111

giaour wrote: post #69

Earlier quoted context omitted.

Users might think to themselves, I give my credit card number to all kinds of sites; how is this any different? The internet has kind of conditioned all of us to be OK with passing around complex payment instruments without paying too much attention. If you're a hardcore believer in cryptocurrency as a political project, you almost certainly understand the difference and see the "code is law" dark forest as a feature…

Because credit cards have consumer protection and laws and regulations. Crypto has none of that.

Credit cards wouldn't need such stringent "protection" and surveilance if they were secure and dependable in the first place.

Of course cryptocurrencies do not have such regulations. the purpose of cryptocurrency is to facilitate exchange with untrusted parties.

Re: “Crypto drainer” template facilitates theft

#144

Post by PragmaticPulp » Thu, Jun 16, 2022, 2:19 AM UTC

trompetenaccoun wrote: post #88

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

It turns out you're not the first person to realize that this is an issue. If you'd actually read up on cryptocurrency wallets before commenting, you might have found there are multiple solutions for this out already, including one of the most popular Ethereum wallets called Argent, which let's you set limits. Basically the fraud described is a twist on the classic "Musk giving away BTC" scam that's all over Youtube…

> If you'd actually read up on cryptocurrency wallets before commenting, you might have found there are multiple solutions for this out already, including one of the most popular Ethereum wallets called Argent, which let's you set limits.

You're making a great example of the victim-blaming I mentioned in my comment: That anyone who is surprised by their money disappearing clearly just didn't do all of the right research and use the right wallets and set all the right options to set the right limits and so on and so on.

Obviously there are right ways to navigate the crypto space and not get burned, but the issue is that the crypto community seems to think it's okay that everything is complicated and prone to new users making mistakes that people are routinely losing huge amounts of money due to not being 100% up to date on the right way to do everything.

> The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is.

Yep, sounds easy. To avoid losing everything you just have to set up a smart contract and then...

I can't believe this stuff passes for reasonable suggestions in the crypto world.

Re: “Crypto drainer” template facilitates theft

#145

Post by luxuryballs » Thu, Jun 16, 2022, 2:19 AM UTC

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

I’d probably blame the victim if they kept their USD as 1 dollar bills scotch taped to the outside of their clothing though.

I think it’s the nature of crypto that part of the benefit comes from the cost of it being up to the individual to maintain. Selling a product/service that consumes crypto or holds it easily might be the answer (like a bank is to usd), now the individual is giving up the keys though.

There’s a trade-off there that is very cool because it only exists because bitcoin adds the option of more reliably securing the money “all by yourself” rather than needing a bank due to physical limitations.

In that sense there are many crypto holders out there that may wish they had just kept it on Coinbase…

TLDR the cost of having it be serious to use crypto is well worth it for the power and value of crypto itself, it’s like the cost otherwise paid to run a bank, put into a different form, the average economy of carelessness

Re: “Crypto drainer” template facilitates theft

#146

Post by cowtools » Thu, Jun 16, 2022, 2:20 AM UTC

Gigachad wrote: post #113

jensvdh wrote: post #111

Earlier quoted context omitted.

Because credit cards have consumer protection and laws and regulations. Crypto has none of that.

The crypto space is rediscovering the financial system from first principals. At least by the end they can hopefully appreciate that the original government controlled system actually works the way it does for a reason.

The crypto space isn't rediscovering anything. Speculative investors and other noobs are discovering cryptocurrency for the first time.

Re: “Crypto drainer” template facilitates theft

#147

Post by quickthrower2 » Thu, Jun 16, 2022, 2:24 AM UTC

dcolkitt wrote: post #62

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

It depends on the site of course.

It is easy to create a site that asks you to provide your wallet private phrase. The DNS MyEtherWallet hack that I vaguely recall exploited this.

On the other hand, good crypto citizens will just use the web3 library that will request permissions on an ad-hoc basis from your wallet extension (such as MetaMask).

However even then you can scam someone using social engineering: Just tell them "how" to do XYZ. E.g. "To get your free mini-monkey NFT, just connect your wallet with your bored ape, and when the confirm box pops up from metamask just click OK".

The fiat equivalent of course is a site that asks you to log into paypal and send them $1000 - but that is way more obvious than the crypto equivalent, where you interact with a smart contract and it isn't necessary clear ahead of time what will happen. Especially as smart contracts might be used for, for example user registration. If the user registration endpoint asks for money then you could get scammed that way.

Re: “Crypto drainer” template facilitates theft

#148

Post by Gigachad » Thu, Jun 16, 2022, 2:29 AM UTC

cowtools wrote: post #146

Gigachad wrote: post #113

Earlier quoted context omitted.

The crypto space is rediscovering the financial system from first principals. At least by the end they can hopefully appreciate that the original government controlled system actually works the way it does for a reason.

The crypto space isn't rediscovering anything. Speculative investors and other noobs are discovering cryptocurrency for the first time.

All of these scams, crashes, and exploits are things that happens previously with regular currencies and have since been regulated away. Now crypto comes in with unregulated currency and runs in to every issue the regulations existed to prevent.

Re: “Crypto drainer” template facilitates theft

#149

Post by bombcar » Thu, Jun 16, 2022, 2:31 AM UTC

gowld wrote: post #74

bombcar wrote: post #13

Earlier quoted context omitted.

You can create a different wallet for each transaction, and do all sorts of complicated things, but nobody does. Just like you could pay your phone bill with a prepaid Visa each month just in case they overcharged you.

But why isn't it fully automated, like Apple Pay or privacy.com?

Because the main purpose of crypto has been number go up. I suspect monero (which I think is the privacy one?) has something more in that area.

Re: “Crypto drainer” template facilitates theft

#150

Post by roflyear » Thu, Jun 16, 2022, 2:42 AM UTC

ikt wrote: post #134

jensvdh wrote: post #109

Earlier quoted context omitted.

Problems that have been solved by regular banking decades ago. Jesus Christ the stupidity of crypto amazes me every day.

> Problems that have been solved by regular banking decades ago. https://www.savings.com.au/news/scamwatch-2021 Australians lost a record $323 million to scams in 2021 -- So glad they solved fraud prevention 'decades ago'.

How do ya get your scammed cryptocurrency back, again?