Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

51–60 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#51

A good rule of thumb is if somebody you've just met introduces you to someone with an exciting new NFT project that they want your help testing, you're probably being scammed. While NFTs probably have some useful purpose that will emerge eventually, for now you should consider any proposal or offer that involves the term 'NFT' as having about the same value as any offer involving the term 'Nigerian prince'.

The "problem" in this case is that the victim himself is all-in on NFTs and crypto.

Re: Social engineering scam that nearly cost me all of my ETH

#52

I don't understand why in the world Thomas wouldn't directly communicate via phone and video chat to any of these people first before doing serious business and potentially traveling across the country for random anonymous folks on Discord. Social engineering is so much easier when you engage in faceless, voiceless communication. This could've been shut down so much more easily if they put a real human being to match…

"Discord" by itself is a pretty big red flag to be honest. I would personally not engage in any business or industry where that is the main communications platform.

Re: Social engineering scam that nearly cost me all of my ETH

#53

Earlier quoted context omitted.

How would that help? Are you thinking it might be easier to prosecute with a voice or image file?

It's an extremely basic check. If I'm going to be getting on a plane to see someone, I want to do a basic background check.

But what are you checking with a call? That just seems like creating a false sense of security since there is virtually no additional “useful” information that is being sent over the audio channel above and beyond what is in text.

Re: Social engineering scam that nearly cost me all of my ETH

#54
post #20

Note; dude has $123M in aave wrapped ethereum that he almost granted a scammer access to. Scammers ripping off scammers. Why would you waste time with open source aircrafts. Aircrafts are a regulated thing. Nobody wants to fly in your science project. Put some of that 123 million into starting an actual company. DAOs are bullshit.

That's a horrible take on a legit person and project.

The aircraft and/or taxi service might be legit but all the crypto around it is useless complexity at best or a complete scam at worst.

If you legitimately wanted to develop an aircraft taxi service, you do not need to involve crypto in any way. Even if you wanted to accept it for payments it's an auxiliary component that merely accounts for it and converts to fiat at some point.

The DAO or whatever crypto bullshit is intertwined with it is absolutely a scam.

Re: Social engineering scam that nearly cost me all of my ETH

#56
post #55

Could someone please explain what's terrifying in the function spendWalletAWETH()? Just two lines... Is the idea that tokenToBeApproved.allowance() can do bad things? Code: https://twitter.com/thomasg_eth/status/1492663290715152384/p...

Onlyowner modifier means the contract creator can call this function and transfer all the funds from the victims wallet (if they have previously approved).

Tokentobeapproved is a variable declared in the contract. It will be pointing at the aWETH contract, which is the claim token for ETH on aave, a money market.

Re: Social engineering scam that nearly cost me all of my ETH

#57

Earlier quoted context omitted.

Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last mon…

There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.

[deleted]

Re: Social engineering scam that nearly cost me all of my ETH

#58

Earlier quoted context omitted.

I see. But.. why? Isn’t that a remarkably bad idea? Or is there some crypto advantage to keeping every last coin in the same basket? Other than it being a flex.

There’s no advantage, just laziness. A wallet like that shouldn’t be easy to access and should never be used for for anything other than funding their other hot wallets.

Concentration of funds is a great advantage for borrowing.

Re: Social engineering scam that nearly cost me all of my ETH

#59
post #7

Earlier quoted context omitted.

> when he showed hesitation, they got too impatient. This seems to be the common factor among scams, cons, and social engineering strategies. Rushing people will have them bypass protocol, training, and security practices. It's a universal "hack" for our brains; we do things we otherwise wouldn't when rushed. Security practices are like a rituals, standards of behavior that we just don't have time for right now. "The…

I do wonder if they were more patient and said to themselves “let’s build more trust over the next three months” if they would’ve been able to get him to use his main wallet? Great story though. I never realized these smart contracts could be so obtuse and malicious. That needs to be fixed.

Yes - they could've just kept churning out more NFTs for him to "stake" and catch him off-guard when he used his main wallet by accident or maybe even give him legitimate returns (that they bankroll) to convince him to use his main wallet intentionally to get higher returns.

Re: Social engineering scam that nearly cost me all of my ETH

#60
post #9
post #4

Generalizing, anytime someone is giving you a “gift” but is putting expectations on how you receive it (in this case the wallet destination) that should be a huge red flag. Whether that’s cryptocurrency or a sandwich.

Most people who invite me over for a sandwich would be insulted if I entered their house, took the sandwich they made me and left. In fact, I probably would never get invited over again.

I’d be more worried about being poisoned. Who is giving away free sandwiches? Ya’ll far too trusting. Zero trust is the only way to go.
Post reply on HN