Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

41–50 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#41

Post by tylersmith »

kelp wrote: post #32

This was an absolutely fascinating and chilling story. The thing that struck me about it is the scam didn't work for a few reasons: 1. He typically had a practice of not using his main wallet for things like this. 2. He got wary and actually read the smart contracts. This is a level of technical competence required that's going to mean most people have to offload this to a trusted intermediary. And then what's the po…

The purpose of decentralization is solely censorship resistance. It has nothing to do with consumer protections, consumer education, or easier to check software.

Re: Social engineering scam that nearly cost me all of my ETH

#42

Post by kenjackson »

muh_gradle wrote: post #33

I don't understand why in the world Thomas wouldn't directly communicate via phone and video chat to any of these people first before doing serious business and potentially traveling across the country for random anonymous folks on Discord. Social engineering is so much easier when you engage in faceless, voiceless communication. This could've been shut down so much more easily if they put a real human being to match…

How would that help? Are you thinking it might be easier to prosecute with a voice or image file?

Re: Social engineering scam that nearly cost me all of my ETH

#43

Post by scyclow »

sidcool wrote: post #18

I feel incredibly dumb for not getting the details of how it happened.

He had $130 million wrapped up in an ERC20 token called Aave wETH (aWETH). ERC20 tokens let you approve another address to spend those tokens on your behalf. Basically, the scammers tried to trick him into approving all of his Aave wETH by creating a fake website designed to make him think that he's approving a different token with the same aWETH symbol.

Re: Social engineering scam that nearly cost me all of my ETH

#44

Post by vmception »

sidcool wrote: post #18

I feel incredibly dumb for not getting the details of how it happened.

Hacker sends NFT to Thomas.

Since NFT's are subject to heavy criticism of their existence, a lot of people are developing extra things you actually can do with them. The market is interested in that being done right, so its interesting to be a part of projects that are trying. This extra thing required Thomas sending the NFT to another service they developed. Smart contracts in Ethereum Virtual Machine environments (EVMs) have to be primed to recognize asset. So there is something called an Approval. When Thomas interacted with this contract it did the approval for the NFT, and also an approval for aWETH a token associated with that project.

aWETH is the ticker symbol for a token that project created called Armstrong ETH. The namespace for ticker symbols has many collisions as there are many tokens. So people aren't too worried about that, a token's ID is its contract address which does not have collisions.

In this case, this was the actual phishing attempt.

Their project did indeed use a token called Armstrong ETH, but their approval was for aWETH which is Aave Eth, an asset collateralized by liquid valuable actual Ether. It is also redeemable for actual Ether.

So if Thomas approved the use of their project from his main account, the hacker would have been able to use another function written in their smart contract that leveraged the approval of aWETH (the Aave Eth) to take it all away from Thomas. He has $100m of that.

Very close one for him.

Re: Social engineering scam that nearly cost me all of my ETH

#45

Post by aqme28 »

randomhodler84 wrote: post #21
sillysaurusx wrote: post #15

Earlier quoted context omitted.

Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last mon…

There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.

Easier to see assets on something like debank or zapper https://debank.com/profile/0xb1e9d641249a2033c37cf1c241a01e7...

https://zapper.fi/account/0xb1e9d641249a2033c37cf1c241a01e71...

Re: Social engineering scam that nearly cost me all of my ETH

#46

Post by muh_gradle »

kenjackson wrote: post #42
muh_gradle wrote: post #33

I don't understand why in the world Thomas wouldn't directly communicate via phone and video chat to any of these people first before doing serious business and potentially traveling across the country for random anonymous folks on Discord. Social engineering is so much easier when you engage in faceless, voiceless communication. This could've been shut down so much more easily if they put a real human being to match…

How would that help? Are you thinking it might be easier to prosecute with a voice or image file?

It's an extremely basic check. If I'm going to be getting on a plane to see someone, I want to do a basic background check.

Re: Social engineering scam that nearly cost me all of my ETH

#48

Post by tylersmith »

sidcool wrote: post #18

I feel incredibly dumb for not getting the details of how it happened.

He has around $130mm of a token called aWETH, which stands for Aave Wrapped ETH and means he has that much ETH deposited into the Aave app. The attacker tried to trick him into giving their contract control over his aWETH under the guide of being a different, useless, token that they were just trying out.

If he approved their contract to be allowed to control his aWETH they'd take it all.

Re: Social engineering scam that nearly cost me all of my ETH

#49

Post by kenjackson »

badRNG wrote: post #7
TigeriusKirk wrote: post #3

These scammers went to impressive lengths. They say that often the secret of a magic trick is to put in far more prep work than anyone thinks is reasonable. Con games work the same way. In this case, the effort is worth since the target has something like $175 million in a wallet. The payoff is massive. Worth noting, though, that for all the fancy footwork the point of failure for the scam is him being willing to wor…

> when he showed hesitation, they got too impatient. This seems to be the common factor among scams, cons, and social engineering strategies. Rushing people will have them bypass protocol, training, and security practices. It's a universal "hack" for our brains; we do things we otherwise wouldn't when rushed. Security practices are like a rituals, standards of behavior that we just don't have time for right now. "The…

I do wonder if they were more patient and said to themselves “let’s build more trust over the next three months” if they would’ve been able to get him to use his main wallet?

Great story though. I never realized these smart contracts could be so obtuse and malicious. That needs to be fixed.

Re: Social engineering scam that nearly cost me all of my ETH

#50

Post by shbooms »

HWR_14 wrote: post #9
dpeck wrote: post #4

Generalizing, anytime someone is giving you a “gift” but is putting expectations on how you receive it (in this case the wallet destination) that should be a huge red flag. Whether that’s cryptocurrency or a sandwich.

Most people who invite me over for a sandwich would be insulted if I entered their house, took the sandwich they made me and left. In fact, I probably would never get invited over again.

true, but if they invited you in and told you had to go stand on a very specfic place in the room, facing a certain direction and to only start eating when they said so, that would be very suspicious and likely result in you opting out.
Post reply on HN