Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

311–320 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#311

Post by chrisco255 »

leshow wrote: post #35
chrisco255 wrote: post #22

Earlier quoted context omitted.

I don't trust them. Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. They can snap their fingers and freeze your funds and hold it indefinitely, without a warrant. I admit that the Approval UX for wallets and tokens needs to be improved. Unlimited spend approvals should always be flagged in the UX. And approvals should be atomic (single transaction only, with a clearly listed…

> Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. The protest is illegally blocking much of downtown Ottawa, as a result GoFundMe decided to refund the donors. That's far from a "rug"

A private company intervened in the sending of money between private individuals. You can arbitrate that all you want, but it doesn't change the fact that they shouldn't have that power in the first place. GoFundMe is not politically neutral.

Re: Social engineering scam that nearly cost me all of my ETH

#312

Post by stevage »

pengwing wrote: post #305
dimgl wrote: post #238

Earlier quoted context omitted.

I'm surprised anyone reading this story wouldn't conclude that the real takeaway is to just not engage with cryptocurrency at all. This ecosystem is so convoluted it just turns me off at every level.

Taking a high-velocity ride in a cage of aluminum? I don't want to engage with that at all. I am so surprised that safety measures such as airbags and seat belts are discussed. Obviously cars are too dangerous to exist.

From day one, cars were understandable by ordinary people and useful to them. They have become more complex, but always useful.

Crypto is neither understandable nor useful.

Re: Social engineering scam that nearly cost me all of my ETH

#313

Post by chrisco255 »

ricardobeat wrote: post #177
chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

I’m curious, does anyone know Thomas, or how did they amass 100M in ETH? The websites provide absolutely no identity of anyone involved (as is very common for crypto). The Twitter account is 4 months old. No mention of the person or the Arrow company on the internet previous to this episode seems to exist. Other than looking at the chain records, how should we believe that any of these stories are true?

I know of Thomas through the Rocketpool community Discord (a decentralized Ethereum staking pool). He's a regular on there. And I'm one of 90ish members in the Arrow Discord. It's a super early stage startup that's still in the conceptualization phase. I don't know how he got his capital, I don't know his background. But he's been an engaged member of the RPL community and seems genuine in his interest for drone transportation. A lot of this is still available in the Discord chat history.

Re: Social engineering scam that nearly cost me all of my ETH

#314

Post by de_nied »

dimgl wrote: post #238
chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

I'm surprised anyone reading this story wouldn't conclude that the real takeaway is to just not engage with cryptocurrency at all. This ecosystem is so convoluted it just turns me off at every level.

I think there is value in being able to write up an online contract (code) that is able to manage money for two parties without needing to go to a bank or some third party to act as the middleman.

It's the same thing as reading the terms and conditions.

Re: Social engineering scam that nearly cost me all of my ETH

#315

Post by skim_milk »

dlubarov wrote: post #296
skim_milk wrote: post #182

Earlier quoted context omitted.

How would one "accidentally" wire transfer millions of dollars? At $10k in America, KYC and AML laws force banks to step through extra layers of verification to wire such amount. It's virtually impossible for someone to accidentally wire millions, which would likely involve a mandatory in-person meeting with the bank customer to verify their credentials and purpose. If somehow you get through an in-person meeting wit…

> At $10k in America, KYC and AML laws force banks to step through extra layers of verification Isn't that only for cash transfers? > which would likely involve a mandatory in-person meeting with the bank customer At least at Chase and Fidelity, wires can be done over the phone with no limit. > to verify their credentials and purpose I've never seen a banker really help to verify wire instructions, as in contacting t…

Yes, the banking industry won't do much to prevent Aunt Senile from wiring $80k to Nigeria, although I doubt they make it easy. Hell, I couldn't even phone-authorize a wire of 8k to buy a car two states over, but I guess that's just my bank. Had to bloody pay for the car on credit card, no joke.

But the scenario in the OP is only possible in cryptocurrencies. You can't put a button on a website "Click here to send a JPEG through email for $3.50*" with the fine print "*and also 100 million dollars" and expect that to ever work out with the legacy banking system. Only in cryptoland could someone ever accidentally yeet 100 million dollars in a few seconds by visiting a website and clicking a button.

Re: Social engineering scam that nearly cost me all of my ETH

#316

Post by DoctorOW »

betwixthewires wrote: post #264

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You…

When I heard about Ethereum this was my exact fear. Programmable money sounds like a terrible idea from the perspective of business owner. Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet? That is of course assuming the code isn't able to break out of any other protections there might be and pay for the ETH I'm getting with my data.

Re: Social engineering scam that nearly cost me all of my ETH

#317

Post by akersten »

DoctorOW wrote: post #316
betwixthewires wrote: post #264

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You…

When I heard about Ethereum this was my exact fear. Programmable money sounds like a terrible idea from the perspective of business owner. Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet? That is of course assuming the code isn't able to break out of any other protections there might be and pay for the ETH I'm getting with my data.

No, no, of course you don't have to check every contract you engage with. At least, not with the help of my conveniently-IPO'ing DAO wETH unwrapper leaser startup. We'll take care of the heavy lifting, you sit back, relax, and pay us no mind (really, please, do not look behind the curtain). We're a Series F company filling the totally coincidental grift-shaped hole where Ethereum left off - contact our sales team on Discord if you're interested!

Re: Social engineering scam that nearly cost me all of my ETH

#319

Post by ggm »

Until it's in a bank, he doesn't have $100m. Not that it wouldn't have sucked to lose his potential millions but they are hypothetical value right now.

I'd have diversified. Some cash, some ETF, some property. A lot of tax, now or in the future. I wouldn't complain about the tax, even after there's enough for a lifetime. (And yes I know both property and ETF can decline in value, but here's the thing: when you see their book value it's a damn sight more real)

Remember, unless I am very mistaken he didn't put $80m of real money in, to secure an amazing 20% ROI which out in your real world would be normally exciting. So the net effect of fees, gas, AML, tax even taking 50% makes him as rich as croesus compared to most people for very low initial input.

Do we know what real world $ went in to bootstrap?

(I know this story is mostly about the social engineering, which is of course the real problem)

Re: Social engineering scam that nearly cost me all of my ETH

#320

Post by Consultant32452 »

skim_milk wrote: post #182
koonsolo wrote: post #162

Earlier quoted context omitted.

I guess you haven't seen "The Tinder Swindler" on Netflix? Also here in Belgium, plenty of people are getting scammed by wire transfer, and no way to get their money back. I think you have overly optimistic view on banks or the court system giving your money back.

How would one "accidentally" wire transfer millions of dollars? At $10k in America, KYC and AML laws force banks to step through extra layers of verification to wire such amount. It's virtually impossible for someone to accidentally wire millions, which would likely involve a mandatory in-person meeting with the bank customer to verify their credentials and purpose. If somehow you get through an in-person meeting wit…

I recently bought a house. My title company made a BIG deal about fraud. Basically, people figure out you're in the process of buying a house, pretend to be your title company, and give you their wire info instead of the real info. You wire a giant pile of house down payment to the bad guys, and they walk. You will not get that $ back.
Post reply on HN