Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Crypto drainer” template facilitates theft

blog.confiant.com

Post reply on HN
Print view View original

81–90 of 228 posts

Re: “Crypto drainer” template facilitates theft

#81

Post by scoofy »

reydequeso wrote: post #65
scoofy wrote: post #10

Regulation can be bad, but it can also be good. People think of history like it was wonderful, but it was full of cons and scams. Reputation matters, and people with reputations charge a premium for it. Some of the best aspects of regulations is exactly to remove the reputation tax by mandating everyone follow the same practices as the trusted institution. The real sad aspect is that the crypto-libertarians of today…

>who is going to read a book about 19th century finance What recommendations do you have?

you can start with the investopedia entry:

https://www.investopedia.com/terms/w/wildcat-banking.asp

here's a whitepaper from the Atlanta Fed,

caution PDF:

https://maysweb.tamu.edu/sage/wp-content/uploads/sites/16/20...

Re: “Crypto drainer” template facilitates theft

#82

Post by zeven7 »

dcolkitt wrote: post #62
PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

It depends on the website and the wallet, but either way the wallet app tells you what permissions it's giving the website. My guess is people don't pay attention or think about it. But it's not as parent described "the way the crypto community designed it". It's actually the opposite. The crypto community designed wallets that give you control over what third parties are allowed to do with your accounts. It's a lot more than what debit cards offer (I say debit cards because credit cards do of course offer a good rollback system).

Re: “Crypto drainer” template facilitates theft

#83

Post by melony »

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

Yeah they should pay Plaid a grand a month for that privilege instead.

Re: “Crypto drainer” template facilitates theft

#84

Post by happyopossum »

bko wrote: post #75
gowld wrote: post #66

Earlier quoted context omitted.

What does a user see? How should a user investigate a transaction to check what it does? Is there any good automated explanation/visualization of the effect of a transaction?

This is what I do: When a site initiates a transaction, you can see the address you're interacting with. You should then look up the address on etherscan to see if it has public code and a lot of transactions. Then you should search that address in google and see if the main site links to it. A lot of projects have a list of addresses in their github. You can also inspect the function code. Once you're comfortable, y…

> When a site initiates a transaction, you can see the address you're interacting with. You should then look up the address on etherscan to see if it has public code and a lot of transactions. Then you should search that address in google and see if the main site links to it. A lot of projects have a list of addresses in their github. You can also inspect the function code. Once you're comfortable, you should add it to your saved addresses on your wallet and next time you'll see the name of the address

Oh, that’s it? So simple.

Re: “Crypto drainer” template facilitates theft

#85

Post by bogwog »

cvccvroomvroom wrote: post #60

My next billion dollar apps will be disposable crypto wallets and currently obscure website accreditation.

My next billion dollar app will be a service that unlocks anyone's doors and gives you directions to their valuables (with augmented reality ofc). That way, you can directly steal from people without the complexity and carbon footprint of traditional cryptocurrency and NFT projects.

Re: “Crypto drainer” template facilitates theft

#86

Post by AgentME »

mrep wrote: post #77
spinny wrote: post #68

Earlier quoted context omitted.

the wallet in question is probably metamask, a browser extension. it injects a web3 provider in `window.ethereum`. connecting the wallet is done by calling `window.ethereum.enable()`, this pops up a dialog asking you to connect an address to the website. it just tels the extension that the website is allowed to interact with the extension This article is about phishing in the context of cryptos. Silent signing doesn'…

I have a CS degree and have worked at FAANG for 6 years and that was straight gibberish to me. I guess maybe because I have only worked at FAANG using traditional tech and not crypto startups?

I think that explanation was just a little too jargony.

If you have the Metamask browser extension (or another compatible web3 extension) and press its browser button to enable it while on a webpage, then the webpage can see your wallet address and suggest transactions for you to make. When that happens, the browser extension then shows a window under its own control explaining the transaction and allows you to choose to sign or reject the transaction.

The webpage never sees anything about your wallet if you don't activate the extension on the page specifically, it never sees your private keys, and it can never silently sign a transaction from you.

Re: “Crypto drainer” template facilitates theft

#87

Post by cvccvroomvroom »

bogwog wrote: post #85
cvccvroomvroom wrote: post #60

My next billion dollar apps will be disposable crypto wallets and currently obscure website accreditation.

My next billion dollar app will be a service that unlocks anyone's doors and gives you directions to their valuables (with augmented reality ofc). That way, you can directly steal from people without the complexity and carbon footprint of traditional cryptocurrency and NFT projects.

Tell August, Ring, and Nest you have a new auditing API designed exclusively for them coupled with a value-add homeowners asset inventory management app. ;)

Re: “Crypto drainer” template facilitates theft

#88

Post by trompetenaccoun »

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

It turns out you're not the first person to realize that this is an issue. If you'd actually read up on cryptocurrency wallets before commenting, you might have found there are multiple solutions for this out already, including one of the most popular Ethereum wallets called Argent, which let's you set limits.

Basically the fraud described is a twist on the classic "Musk giving away BTC" scam that's all over Youtube because Google is apparently unable to prevent it. You have to be fairly naive to fall for it in the first place. But ok, no victim-blaming. The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is. Same as having a withdrawal limit on your bank card. And you can also whitelist wallets, the contract then automatically blocks any transfers to untrusted wallets. If the user manually overrides this by getting his guardians to agree, there's no stopping them of course.

Ultimately you won't be able to protect everyone. A determined enough fool can also go to Western Union and mail money to the scammer. In the US they have those prepaid card scammers. Or they come to your home, telling you they're police and need to inspect your valuables. Yes, that's a real actual scam that exists in Europe.

Re: “Crypto drainer” template facilitates theft

#89

Post by cvccvroomvroom »

walrus01 wrote: post #78
cvccvroomvroom wrote: post #55

When a scam is nearly indistinguishable from another scam, something else is inherently wrong.

it's like a turducken of scams: crypto, NFT, NFT-drainer-siphon

Perhaps the next inception is the NFT-drainer-siphon-drainer that spoofs the collection and botnet sites to trick the scammers into relocating funds into the wrong place. At some point, fencing these worthless NFTs will be needed.

Hmm.. create a botnet to sell NFTs on Insta.

Re: “Crypto drainer” template facilitates theft

#90

Post by renewiltord »

technion wrote: post #18
renewiltord wrote: post #8

So let me get this straight. You just connect your Wallet to a random website and let them run arbitrary smart contracts? That's wild, man. Surely there's gotta be some concern here that someone could take your shit. I'm just surprised there isn't a privacy.com equivalent for this, like a limited-view wallet that lets you create sub-wallets for interaction with various services. Or if there is, perhaps it's not famou…

Nothing stops a person making a new wallet with limited assets for interaction with less reputable websites. Web3 culture has made this quite difficult in practice. For example, it's quite normalised to say "new exciting nft project, only available to existing owners of expensive nfts". This sort of thing is considered an ownership perk. And it's why those discord hacks were so damaging, a statement like that was mad…

Thanks for explaining. To you, and peer commenters.
Post reply on HN