Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

411–420 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#411

Post by rnk »

randomhodler84 wrote: post #406
phone8675309 wrote: post #402

Earlier quoted context omitted.

Okay, but you didn’t answer my question. I’m not talking about the "dumbest user" - I’m talking about a regular person who is currently paid in dollars and understands how to use a debit card. What benefits does making money programmable provide that is not offset by this person having to take time out of their day to audit every transaction and understand how the code making up the transaction interacts with all of…

You got me. The tech is useless, it’s actually a giant fraud perpetrated by public traded corporations to steal our precious fluids. The miners are actually watt vampires. Numbers don’t actually exist, it was a trick invented by the ancients. Blockchains just convert pudding into breakfast. Enjoy meat juice day!

You don't have to be so defensive. Clearly there are issues with things like what happened here. It's like interacting with the website of your bank by sending assembler programs to transfer money. People won't be able to understand what it's doing.

Re: Social engineering scam that nearly cost me all of my ETH

#412

Post by woodruffw »

randomhodler84 wrote: post #408
woodruffw wrote: post #401

Earlier quoted context omitted.

> Larger pools doing that would be subtracting energy from the honest side, and adding it to the dishonest side Why would that be the case? It isn't necessarily zero-sum; the more realistic scenario is that the remaining honest participants ramp up their energy consumption in an attempt to prevent the attack. But that's still only the most boring of the many, many latent threats to Bitcoin. Solar flares and electroni…

To be fair, most human technology is vulnerable to these. The nice thing about a distributed ledger is that as long as one copy remains it can be bootstrapped back to full form. One Pi sitting in Africa could do it. Try that with your banks SQL db backups, which all tapes disks and ssds were erased in the solar storm.

“Technology” is the operative word. Cash works just fine.

Once again: the bar for cryptocurrencies to clear isn’t to be “as good as” traditional finance. They have to do better, given the additional middlemen and costs they shoulder on all of us.

You’ve failed to demonstrate that they clear that bar: a single surviving backup of a distributed ledger isn’t distributed in either the trust or failure senses, and is thus no better (and possibly worse!) than us trying to piece the world’s financial system back together from everybody’s paper receipts. Oh, and the whole “cash” thing continues to work.

Re: Social engineering scam that nearly cost me all of my ETH

#413

Post by harambae »

bryans wrote: post #208
chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

> scammers are getting more creative and advanced in technique including standing up professional front end websites to give the appearance of legitimacy It seems like this is becoming the minimum standard for scam operations. For example, there is currently a BTC phishing scam going around that tries to convince the user they've accidentally received an email meant for someone else, which just happens to include a l…

This whole type of setup is why there's the expression "you can't cheat an honest man"

Re: Social engineering scam that nearly cost me all of my ETH

#414

Post by harambae »

paulluuk wrote: post #378
xwdv wrote: post #220

Earlier quoted context omitted.

Ah yes, a world where taxes don’t exist and the S&P always returns 10%-20% a year and everything you really want in life is dirt cheap. Nah, I want cars, some homes, a yacht and a hot ass babe to pleasure me and raise nice children as we travel the world and dress fancy.

You think you need more than 170k per year to own a yacht, travel the world and dress fancy? I'm guessing you haven't actually done any of these things before, then. Outside of silicon valley, 170k per year is a huge amount of money. Especially if you're going to travel outside of North America and Europe.

>to own a yacht

Yes. Probably not for the other things.

Re: Social engineering scam that nearly cost me all of my ETH

#415

Post by harambae »

randomhodler84 wrote: post #176
axiosgunnar wrote: post #173

Earlier quoted context omitted.

We should make it blatantly clear and public that we will not he bailing out banks, pension funds etc that will inevitably get burned on some crypto scam.

I would rather make it clear that the cryptoeconomy will not bail out fiat currencies when they fail. The first government to get a fat stack of Bitcoin probably wins. Game theory intensifies.

Time will tell. Meanwhile, watching Peter Schiff and the president of El Salvador troll each other on Twitter is fairly amusing.

https://twitter.com/nayibbukele/status/1467216871846027274

Re: Social engineering scam that nearly cost me all of my ETH

#416

Post by harambae »

scyclow wrote: post #382
magicalhippo wrote: post #85

Earlier quoted context omitted.

So besides getting scammed, what use are these ERC20 for?

They're basically receipts for putting money into a lending pool. In this case he's lending about $130 million, on which he's earning interest, and can get his money back by redeeming those tokens.

My apologies for being so ignorant on crypto lending, but I'm not even sure where I'd look up the details of how this system works.

When Thomas puts that money into the lending pool, what happens if the borrower defaults? Did the borrower put up some non-liquid collateral? Did someone do a background/credit check? Who takes the loss, is it split across the pool?

I understand how traditional bank loans work, I'm a little lost how much risk is being taken by the loan issuer here.

Re: Social engineering scam that nearly cost me all of my ETH

#418

Post by harambae »

sizzle wrote: post #360

How much of his ETH was at stake here?? Why did they go through so much effort to target him on the hopes that he would 1. Have a large sum of coins 2. Be foolish enough to reveal said account. I love that he wasted 2 weeks of these scumbags and exposed them. I hope they can trace their email address and nab the real people.

>on the hopes that he would 1. Have a large sum of coins

This part wasn't a guess, it's publicly available information known from the outset

Re: Social engineering scam that nearly cost me all of my ETH

#419

Post by betwixthewires »

dcolkitt wrote: post #323
betwixthewires wrote: post #264

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You…

This isn’t how it works. With ERC20 you “approve” tokens. That allows the specific contract you approve to spend up to a specific tokens at that specific address. Things that a random smart contract cannot do: 1) Spend more tokens than the amount you approved. 2) Spend any other tokens besides the specific type that you approved. (E.g. can’t steal your NFT or USDC) 3) Spend tokens at any other wallet address even if…

I'm very much aware of how ERC20 contracts work, I've written them.

I'm glad the standard for approval of control of wallets is being deprecated for one with more granularity and security, and I hope it solves this problem.

But that is how it works. The idea that I have a wallet as an extension in my web browser, and people can deliver me any transaction they like, with a "yes" button decorated however they like in the form of a web app, it absolutely does mean that I need to know how to read solidity to be safe and that I must audit every transaction I'm interested in signing. And an engineer would take that for granted, but if that's the standard UX, again, this isn't ready for grandma, not even close.

What ethereum should've done was be a little more slow moving with adding features and maintain mist so that a standard UI feature set could be expected by users.

Re: Social engineering scam that nearly cost me all of my ETH

#420

Post by betwixthewires »

ikt wrote: post #389
DoctorOW wrote: post #316

Earlier quoted context omitted.

When I heard about Ethereum this was my exact fear. Programmable money sounds like a terrible idea from the perspective of business owner. Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet? That is of course assuming the code isn't able to break out of any other protections there might be and pay for the ETH I'm getting with my data.

> Does this mean I have to check every transaction I enter to run arbitrary code with full access to my wallet? No, for the same reason you don't check the code on every website you visit, if you want to be even more secure then just stick to blue chips like aave, curve, etc you can see how much is sitting in popular defi contracts here: https://www.defipulse.com/ You also don't give an ethereum contract full access…

> You're talking like one accidental misclick and all your money is gone.

This is literally happening right now all over the place. Just go to any reddit cryptocurrency sub and do a search for "free token scam." People are finding free tokens in their wallets, trying to spend them and having their wallets emptied.

I don't check code on every website I visit because websites can't just empty my life savings with no recourse.

Post reply on HN