Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

31–40 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#31

Post by pluc »

contravariant wrote: post #8
pluc wrote: post #6

Don't do it if you don't understand what you're doing.

I'm not entirely convinced this isn't just the same as 'don't do it'.

When it comes to crypto, 95% of the projects are by people who do not understand it themselves and were sold on it by someone whose sole purpose is to broaden crypto's financial reach and who worked tirelessly to make sure it's obscure/redundant enough that you don't understand it unless you're a developer attempting to implement it or seriously skilled at due diligence. They ran their whitepaper through their advisors to ensure it was clear yet didn't give anything away in terms of how it worked or how the authors get their kickbacks.

Re: Social engineering scam that nearly cost me all of my ETH

#32

Post by kelp »

This was an absolutely fascinating and chilling story.

The thing that struck me about it is the scam didn't work for a few reasons:

1. He typically had a practice of not using his main wallet for things like this.

2. He got wary and actually read the smart contracts.

This is a level of technical competence required that's going to mean most people have to offload this to a trusted intermediary. And then what's the point of all the decentralization ideology? Because we just re-invented banks.

Re: Social engineering scam that nearly cost me all of my ETH

#33

Post by muh_gradle »

I don't understand why in the world Thomas wouldn't directly communicate via phone and video chat to any of these people first before doing serious business and potentially traveling across the country for random anonymous folks on Discord.

Social engineering is so much easier when you engage in faceless, voiceless communication. This could've been shut down so much more easily if they put a real human being to match the messages. When things actually matter, I need more than just a Discord avatar and a handle to identify someone.

Re: Social engineering scam that nearly cost me all of my ETH

#34

Post by ttiurani »

"She tells me a bit about her metaverse project, Space Falcon. I'm not really sold on it, but I'm not really an NFT person so I didn't have any reason to think it was a bad idea either.[...] It seems kind of like a get-rich-quick scheme, but again, that's kind of how I see a lot of NFTs. With all that she's doing for Arrow, there's no harm in showing a little support."

The real takeaway from this is that it's dangerous to break your moral compass and sense of reality to the point where you think helping out people who are pushing an obviously fraudulent business, is ok and normal.

Re: Social engineering scam that nearly cost me all of my ETH

#35

Post by leshow »

chrisco255 wrote: post #22
ajross wrote: post #10

I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And…

I don't trust them. Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. They can snap their fingers and freeze your funds and hold it indefinitely, without a warrant. I admit that the Approval UX for wallets and tokens needs to be improved. Unlimited spend approvals should always be flagged in the UX. And approvals should be atomic (single transaction only, with a clearly listed…

> Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest.

The protest is illegally blocking much of downtown Ottawa, as a result GoFundMe decided to refund the donors. That's far from a "rug"

Re: Social engineering scam that nearly cost me all of my ETH

#36

Post by PretzelPirate »

ajross wrote: post #10

I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And…

> Who in their right mind trusts contracts someone sends you on Discord?

No one.

> It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust.

It does, but you get to decide who you trust rather than being forced to trust one of a small number of large institutions. If you want, you can delegate your trust to a third party who will be responsible for vetting anything you interact with.

You can also choose to trust yourself or other members of your community.

This person shouldn’t trust themselves since they are too willing to go along with people who say positive things about them.

Re: Social engineering scam that nearly cost me all of my ETH

#37

Post by xwdv »

chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

To be honest, if they got this close, it’s only a matter of time before they take it all. He should strongly consider cashing out and leaving only an amount he is willing to lose in ETH.

Hell, given my distaste for crypto, if I were more unethical I may even attempt such scams, but I’d balance it out by donating the stolen money to environmental initiatives to combat global warming (after giving myself some fair compensation, I don’t have the skills to get away with hiding $100+ million).

Re: Social engineering scam that nearly cost me all of my ETH

#38

Post by muh_gradle »

ajross wrote: post #10

I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And…

> Who in their right mind trusts contracts someone sends you on Discord?

Exactly. That's where the gullibility is really visible... This is basically a steroid version of "I am Nigerian royalty and I need you to give me money" emails. Your first instinct should always be skepticism.

Re: Social engineering scam that nearly cost me all of my ETH

#39

Post by kevinventullo »

ajross wrote: post #10

I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And…

Totally agree. I heard recently discussion of putting deeds to homes on the blockchain, but having recently purchased my first home, I am 1000% okay with the paperwork and oversight and honestly friction that goes into it. The amount of regulation seems to make it very difficult to get totally ripped off, which is great since so much of the process was so opaque to me.

Re: Social engineering scam that nearly cost me all of my ETH

#40

Post by jsnell »

raverbashing wrote: post #12

"extremely thorough social engineering" Not really, it seems like the usual being extra flattering to earn favours (or worse). The first two messages would have raised several red flags with me. > He's currently working at Ubisoft and offers to help with 3D design and animation Like if I worked for Ubisoft I'd have time to do 3D design for free for some other company.

> Like if I worked for Ubisoft I'd have time to do 3D design for free for some other company.

Why is that so hard to believe? It's like suggesting that no professional software engineer would ever contribute code for free into an open source project in their free time. My basic assumption if somebody send a patch to an open source project is not that I'm being social engineered -- it is that they're either using the software or interested in the domain.

Post reply on HN