Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

21–30 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#21

Post by randomhodler84 »

sillysaurusx wrote: post #15
chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last mon…

There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01...

He could have approved a malicious contract to drain the lot.

Re: Social engineering scam that nearly cost me all of my ETH

#22

Post by chrisco255 »

ajross wrote: post #10

I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And…

I don't trust them. Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. They can snap their fingers and freeze your funds and hold it indefinitely, without a warrant.

I admit that the Approval UX for wallets and tokens needs to be improved. Unlimited spend approvals should always be flagged in the UX. And approvals should be atomic (single transaction only, with a clearly listed cap, by default). There are some EIP proposals addressing this, but they will be a ways off from standardization.

Re: Social engineering scam that nearly cost me all of my ETH

#23

Post by PKop »

randomhodler84 wrote: post #16

Note; dude has $123M in aave wrapped ethereum that he almost granted a scammer access to. Scammers ripping off scammers. Why would you waste time with open source aircrafts. Aircrafts are a regulated thing. Nobody wants to fly in your science project. Put some of that 123 million into starting an actual company. DAOs are bullshit.

He didn't grant them access on his main wallet which holds the amount you describe, he granted them access on a different wallet that didn't hold those assets. Thus "nearly" in the title.

Re: Social engineering scam that nearly cost me all of my ETH

#25

Post by sillysaurusx »

randomhodler84 wrote: post #21
sillysaurusx wrote: post #15

Earlier quoted context omitted.

Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last mon…

There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.

I see.

But.. why? Isn’t that a remarkably bad idea?

Or is there some crypto advantage to keeping every last coin in the same basket? Other than it being a flex.

Re: Social engineering scam that nearly cost me all of my ETH

#27

Post by randomhodler84 »

negamax wrote: post #20
randomhodler84 wrote: post #16

Note; dude has $123M in aave wrapped ethereum that he almost granted a scammer access to. Scammers ripping off scammers. Why would you waste time with open source aircrafts. Aircrafts are a regulated thing. Nobody wants to fly in your science project. Put some of that 123 million into starting an actual company. DAOs are bullshit.

That's a horrible take on a legit person and project.

You would honestly ride in his ‘open source’ VToL? and use his air taxi service?

I don’t think this is legit at all.

Re: Social engineering scam that nearly cost me all of my ETH

#28

Post by vmception »

sillysaurusx wrote: post #25
randomhodler84 wrote: post #21

Earlier quoted context omitted.

There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.

I see. But.. why? Isn’t that a remarkably bad idea? Or is there some crypto advantage to keeping every last coin in the same basket? Other than it being a flex.

people have always used wallets in a way very different from the best practices described 10 years ago

no address reuse is almost impossible as the wallets make it very hard as well

people don't really seem to know that Metamask gives you unlimited addresses, fwiw it is expensive to do approvals in each address

Re: Social engineering scam that nearly cost me all of my ETH

#29

Post by randomhodler84 »

sillysaurusx wrote: post #25
randomhodler84 wrote: post #21

Earlier quoted context omitted.

There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.

I see. But.. why? Isn’t that a remarkably bad idea? Or is there some crypto advantage to keeping every last coin in the same basket? Other than it being a flex.

It’s got an ENS address associated which is only used by flexers.

It’s a giant flex.

Re: Social engineering scam that nearly cost me all of my ETH

#30

Post by PretzelPirate »

sillysaurusx wrote: post #25
randomhodler84 wrote: post #21

Earlier quoted context omitted.

There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.

I see. But.. why? Isn’t that a remarkably bad idea? Or is there some crypto advantage to keeping every last coin in the same basket? Other than it being a flex.

There’s no advantage, just laziness. A wallet like that shouldn’t be easy to access and should never be used for for anything other than funding their other hot wallets.
Post reply on HN