Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

291–300 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#291

Post by kyboren »

woodruffw wrote: post #172
randomhodler84 wrote: post #170

Earlier quoted context omitted.

Then you missed the point of this whole thing. Some of us would rather die with the keys then let the State steal funds from them. Cryptocurrency is the first technology that lets you take wealth to the grave and keep it there.

Look: if you want to clutch those hashes to the grave, more power to you. I think the Federalist Papers' authors wouldn't know whether to laugh or cry, but that's the wonderful thing about this little American Experiment of ours. But don't delude yourself into thinking that any meaningful number of people, even cryptocurrency believers, share your position. It's all fun and games until the Men with Sticks show up, an…

I think you mean keys, not hashes.

> But don't delude yourself into thinking that any meaningful number of people, even cryptocurrency believers, share your position.

You'd be surprised.

Re: Social engineering scam that nearly cost me all of my ETH

#292

Post by TrackerFF »

fortran77 wrote: post #99

And this is going to replace money?

More like: This is going to replace banks

Imagine if every person you interact with could "be their own bank", and define the logic between your transactions. It's fully transparent, so you can audit it as much as you want to - but still, that's the amount of headache you'd have to deal with, to fully trust the other part.

There are lots of upsides to this, but there's no shame in saying: No, I'd rather not. I'll keep trusting the trust-based system I've been using since forever.

Re: Social engineering scam that nearly cost me all of my ETH

#293

Post by ryan29 »

thebean11 wrote: post #245
ryan29 wrote: post #188

Earlier quoted context omitted.

I own one. All the blockchain domains are a dream come true for squatters and scammers. I'll take the oversight, stability, accountability, and mutability of ICANN and the current registry/registrar system every single time given the choice.

Come on, there is realistically nothing stopping you from hosting a scam on a normal ICANN domain. What accountability are you talking about?

The registrars are obligated to prevent fraud and abuse. If they fail to do that job you can appeal directly to the registry. If the registry doesn't do anything you can appeal to ICANN.

All of them are within the scope of the legal system, so if you send a police report demonstrating fraud to a registrar or registry and they fail to act you have some recourse. If their inaction results in increased damages they've opened themselves to liability and you could sue them. The possibility alone is enough that everyone has published polices detailing how they deal with those situations. As long as you follow the rules you can get a domain taken away from a bad actor. It's not easy, but it's possible if someone is doing enough harm.

So yeah, you can host a scam on a normal ICANN domain. It's what happens afterwards that matters. In ICANN land you get one chance to run your scam because the victim can make an appeal to authority to have you shut down. In blockchain land it's tough luck for you.

As an example, this [1] looks like PayPal's wallet. What do they do about this [2] wallet which owns paypals.eth (alongside sqaree.eth, chasebanks.eth, etc.)? They have two choices AFAIK. The first is to pay whatever the owner demands for those domains. The second is to take the risk of the owner selling those domains to someone that wants to use them for phishing.

There are exactly two winners in the blockchain version; the domain squatter and a would be scammer. In the existing system a high value domain owner like PayPal will have an established procedure for dealing with bad actors that infringe on their trademark and dealing with typo squatting like that is probably as simple as sending a template they have to the corresponding registry.

1. https://app.ens.domains/address/0x527FC48f1CA8b41DF3E870F5DE...

2. https://app.ens.domains/address/0x7731652a9F7F48F77E94a8675F...

Re: Social engineering scam that nearly cost me all of my ETH

#294

Post by [deleted] »

betwixthewires wrote: post #264

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You…

[deleted]

Re: Social engineering scam that nearly cost me all of my ETH

#295

Post by [deleted] »

dimgl wrote: post #238
chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

I'm surprised anyone reading this story wouldn't conclude that the real takeaway is to just not engage with cryptocurrency at all. This ecosystem is so convoluted it just turns me off at every level.

[deleted]

Re: Social engineering scam that nearly cost me all of my ETH

#296

Post by dlubarov »

skim_milk wrote: post #182
koonsolo wrote: post #162

Earlier quoted context omitted.

I guess you haven't seen "The Tinder Swindler" on Netflix? Also here in Belgium, plenty of people are getting scammed by wire transfer, and no way to get their money back. I think you have overly optimistic view on banks or the court system giving your money back.

How would one "accidentally" wire transfer millions of dollars? At $10k in America, KYC and AML laws force banks to step through extra layers of verification to wire such amount. It's virtually impossible for someone to accidentally wire millions, which would likely involve a mandatory in-person meeting with the bank customer to verify their credentials and purpose. If somehow you get through an in-person meeting wit…

> At $10k in America, KYC and AML laws force banks to step through extra layers of verification

Isn't that only for cash transfers?

> which would likely involve a mandatory in-person meeting with the bank customer

At least at Chase and Fidelity, wires can be done over the phone with no limit.

> to verify their credentials and purpose

I've never seen a banker really help to verify wire instructions, as in contacting the intended recipient. Normally they just ask the sender if they've verified the instructions, if they understand that the wire is irreversible, etc.

Of course when it gets to the bank's wire department, they make some attempt to block suspicious wires. But they're guessing based on limited info, as they don't typically contact the sender or recipient.

> I'm sure you'll still be able to recover that money back because banks are required to actually validate transactions of that size with KYC, AML, etc. laws

From what I've heard, fraudsters will (indirectly) transfer funds to e.g. a Nigerian bank and cash out there. It doesn't always succeed, but it does sometimes, or wire fraud wouldn't exist.

Re: Social engineering scam that nearly cost me all of my ETH

#297

Post by yholio »

xwdv wrote: post #220
paulluuk wrote: post #164

Earlier quoted context omitted.

Couldn't you already do that right now? If you put your wealth into S&P 500 you should be able to live from roughly 170K USD per year.

Ah yes, a world where taxes don’t exist and the S&P always returns 10%-20% a year and everything you really want in life is dirt cheap. Nah, I want cars, some homes, a yacht and a hot ass babe to pleasure me and raise nice children as we travel the world and dress fancy.

> hot ass babe to pleasure me and raise nice children

Boy, are you in for a nasty surprise. But don't come crying to us, old men who warned you that what you really should want is a nice cabin near a lake with plenty of fish and an absolutely plain ass woman.

Re: Social engineering scam that nearly cost me all of my ETH

#298

Post by woodruffw »

thebean11 wrote: post #290
woodruffw wrote: post #281

Earlier quoted context omitted.

Okay. In what "literal" sense of the word is Bitcoin secured by electricity? The need for electricity seems to be Bitcoin's greatest practical liability, since the entire network depends on it.

The more electricity is used to secure it, the more electricity is required to attack it

I think that fits more into "ridiculous economic Chinese finger trap" than "security feature." It's similar to calling gold's physical weight a security feature, but at least there's a consistent and non-economic relationship between how much gold you have and how hard it is for someone to pick it up and walk away with it.

(It's also not immediately obvious that "more electricity" is needed to attack it, since a handful of extant larger pools could just conspire as-is.)

Re: Social engineering scam that nearly cost me all of my ETH

#299

Post by unityByFreedom »

betwixthewires wrote: post #264

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You…

Haha, I was never on board with crypto and this is far worse. It's like fast tracking the usual crypto scam.

Also this guy seems rather green in term of internet scams,

> Scammers are getting smarter. Before now, the best scam I've really encountered is basically "hi this is tech support please share your private key so we can help"

Post reply on HN