Yea, we wouldn’t want anyone doing anything illegal with crypto… 🙄
MIT Students Stole $25 Million In Seconds By Exploiting ETH Blockchain Bug, DOJ Says
Submitted 5 months ago by 0nekoneko7@lemmy.world to technology@lemmy.world
Comments
Frog-Brawler@kbin.social 5 months ago
shortwavesurfer@monero.town 5 months ago
We also wouldnt want anyone doing anything illegal with dollars, euros, yen, etc. Crypto is money and all money will be used for illegal things
Ibaudia@lemmy.world 5 months ago
True, but Crypto has been awash with scams from its inception. Blockchain inherently rewards those who engage with it deceptively since access to tokens = ownership, there are no take backsies, 0 consumer protections, and it’s global.
hark@lemmy.world 5 months ago
This is a prime example of why the “code is law” selling point for smart contracts is a disaster waiting to happen. Proponents claim you won’t need lawyers, arbitrators, courts, etc, but in reality you’ll need all those and on top of that programmers to write and verify smart contracts.
mPony@lemmy.world 5 months ago
“code is law” can become “might makes right” without oversight. Those who lobby against oversight are a problem.
ShittyBeatlesFCPres@lemmy.world 5 months ago
US Attorney Damian Williams said the scheme was so sophisticated that it “calls the very integrity of the blockchain into question.”
If that’s actually true, they should be given a sentence of time served and a job writing useful software.
shrugal@lemm.ee 5 months ago
It’s not. They tricked some MEV-Boost bots into doing bad trades.
assassin_aragorn@lemmy.world 5 months ago
Still highlights a vulnerability doesn’t it? The system is only as secure as the most vulnerable piece.
Kyrgizion@lemmy.world 5 months ago
More likely they’ll get the Mitnick treatment.
possiblylinux127@lemmy.zip 5 months ago
They are good at fraud
possiblylinux127@lemmy.zip 5 months ago
It is wrong to criminalize him. He found a bug and got a reward. Bring him in to fix the bug and to make it better. If you start scaring away people hunting for bugs and exploits for fun you will end up being exploited by a much nastier target.
Etterra@lemmy.world 5 months ago
It’s a victimless crime really.
A_Random_Idiot@lemmy.world 5 months ago
Its all imagination and pixie dust anyway.
Like trying to arrest someone for theft cause they took a jar of sand home, and some delusional lunatic goes “OMG YOU CANT TAKE THAT, THATS MONEY, EACH GRAIN IS WORTH 80,000 DOLLARS!”
General_Effort@lemmy.world 5 months ago
I’ll try a simple explanation of what this is about, cause this is hilarious. It’s the kind of understated humor, you get in a good british comedy.
For a payment system, you must store who owns how much and how the owners transfer the currency. Easy-peasy. A simple office PC can handle that faster and cheaper than a blockchain. But what if the owner of the PC decides to manipulate the records? No problem, you just go to the police with your own records and receipts and they go to jail for fraud. Their belongings are sold off to pay you damages. That’s how these things have worked since forever. It’s how businesses keep track of their debts.
Just one little problem: What if the government wants your money. Maybe you don’t want to pay your taxes, or some fine. Or maybe you have debts you don’t want to pay, like your alimony. Perhaps the government wants to seize the proceeds from a drug deal. They can just go to the record keeper and force them to transfer currency.
This is where cryptocurrencies come to the rescue (as it were). There are different schemes. ETH (Ethereum) uses validators. The validators are paid to take care of the record-keeping. The trick is, that you have to put down ETH as a collateral (called staking) to run a validator. If you manipulate the record/blockchain, then the other validators will notice and raise the alarm. That results in you losing your collateral.
This means the validators can remain anonymous. You don’t need to know their identities to punish them for fraud. You just take their crypto-money. They need to remain anonymous so that the government (or the mob) can’t get to them.
This is where it gets hilarious. These 2 brothers operated fraudulent validators. The stake/the collateral didn’t matter at all. The whole scheme didn’t matter. It was a horrible waste of money and effort. The indictment even details how they tried to launder the crypto. That is, how they tried to transfer it, so that it couldn’t be traced on the blockchain. The indictment even has the search queries they used to look up the info on how to do that.
It’s all a sham. The one thing that crypto is supposed to do: Foil the government. And it doesn’t work.
When people want to buy crypto on the blockchain, they put out a request so that a validator will execute that transaction and record it on the blockchain. So, while the request is waiting, a bot comes along and scans it. It may be that a purchase changes the exchange value of a currency. In that case, the bot adds 2 more transactions. First, to buy that currency before the original request, and to sell it afterward. The original request drives up the price in between the buy and sell, so that the bot makes a profit for its operator. The original request has to pay a little extra. That’s where the profit comes from.
Sound shady? I hope not, because that’s what the victims did.
The accused operated their own validators. At the right time, they put out their own buy request to lure in a bot. When the bot proposed the bundled transactions, their validators feigned acceptance. But then switched out the lure transaction of buying for selling.
The indictment makes a fairly good argument. It’s like there is a “contract” between these automatic systems. The trading bot wants the bundled transactions to be carried out exactly so. The validator feigns agreement, but does not follow through.
Wrench@lemmy.world 5 months ago
That sounds a lot like what I understood how etrade platforms like Robinhood work when I was reading up on the GME shorts fiasco.
I definitely only have a surface level understanding of it, but it sounded like the stock brokers have a buffer in-between the transaction request to buy/sell, and they first try to handle that locally within their portfolio, before expanding to external trades. And if there’s a favorable internal trade, brokers like Robinhood siphon out a little something something for themselves.
Sounds like people are getting busted for doing essentially the same thing Wallstreet has been doing for decades. Again.
General_Effort@lemmy.world 5 months ago
It reminded me of high-frequency trading.
Mind, the people who do that are the victims here!
I didn’t explain how exactly they were harmed. It’s actually kinda funny, too.
It costs virtually nothing to create crypto-tokens. So that’s what people do. Do some wash trades, slip some money to influencers to hype their new token as the next big thing, then offload the whole supply and run with the money. The “investors” quickly discover that these tokens are only good for one thing: To sell to a greater fool. At that point, there are no more buyers.
The accused obtained such useless tokens. The indictment doesn’t say how. I guess they simply bought it for next to nothing.
Effectively, they tricked the victims’ bots into buying these tokens at face value. The victims were left with crypto supposedly worth $25 million but in reality unsellable. If this was stealing $25 million, then I wonder about the legality of selling these crypto tokens in the first place.
Eventually, all crypto is like that. Some cryptocurrencies are used as payment systems, but eventually something better must come along. Then that currency becomes unsellable. Someone must always be left holding the bag, as it is said in crypto circles.
I think they are guilty of fraud. But I do wonder: If we are to accept that leaving someone with worthless crypto is equal to stealing money, what does that mean for the legality of crypto as a whole?
podperson@lemm.ee 5 months ago
Man - that comma in the second sentence murdered my brain.
n3m37h@sh.itjust.works 5 months ago
Isn’t that just ‘high frequency trading’?
General_Effort@lemmy.world 5 months ago
I thought the same thing, but mind: That’s what the victims did. See my other reply going into this more.
Shurimal@kbin.social 5 months ago
Nice! Too bad they got caught, though.
No sympathy for cryptobros and trading bots.
walter_wiggles@lemmy.nz 5 months ago
Lesson learned: always use your girlfriend’s browser to look up how to do crime.
ivanafterall@kbin.social 5 months ago
You'd think these guys would know how to open a private Firefox session.
possiblylinux127@lemmy.zip 5 months ago
More likely they should know who to use Tor
Imgonnatrythis@sh.itjust.works 5 months ago
Whoa. A slashdot link? Remember when that wasn’t a cesspool, but it’s been awhile. For an ars technica summary this was extremely disappointing with regards to details.
My only take away here is that we really should make H.E.B (highly educated brothers) a part of the vernacular.
CosmicTurtle0@lemmy.dbzer0.com 5 months ago
I’m honestly very surprised that site is still around. Like digg.
PlantJam@lemmy.world 5 months ago
Sorry, the term HEB is already taken by Texas groceries.
thesmokingman@programming.dev 5 months ago
And if you didn’t know it was for “Howard E Butt” now you know and can enjoy them even more.
I fucking miss HEB.
dogslayeggs@lemmy.world 5 months ago
Remember when the slashdot effect was a thing that mattered?
0nekoneko7@lemmy.world 5 months ago
“Each brother faces “a maximum penalty of 20 years in prison for each count,” the DOJ said.” 😬 They will be going in for a long time.
Thomas Fattorusso of the IRS Criminal Investigation (IRS-CI) New York Field Office, said that investigators “simply followed the money.” 🔎💸
Miaou@jlai.lu 5 months ago
Should have stolen taxpayer’s money instead, silly them
cybersandwich@lemmy.world 5 months ago
Or raped someone. .how the fuck is this more prison time than much more serious crimes.
Presumably they can claw back some of the money too
vrighter@discuss.tchncs.de 5 months ago
not stole. Were given.
If code is law, then they just found the right way to ask. And the code gave the money to them, because they asked nicely.
possiblylinux127@lemmy.zip 5 months ago
Code isn’t law. The article above does a bad job of explaining it and makes it sound like it was just a weekend bug find. It wasn’t a bug, it was them setting up a bunch of fake entities misdirect funds.
KillingTimeItself@lemmy.dbzer0.com 5 months ago
incoming JSTOR replay in the courts, here we go!
LodeMike@lemmy.today 5 months ago
Context?
KillingTimeItself@lemmy.dbzer0.com 5 months ago
funny internet man aaron swartz stole a bunch of shit from JSTOR and was planning to release it to the public, because fuck privatized research and materials or something.
The US government was like “fuck this guy, actually get rid of him” and then he killed himself.
Frog-Brawler@kbin.social 5 months ago
Yea, we wouldn’t want anyone doing anything illegal with crypto… 🙄
shrugal@lemm.ee 5 months ago
Here is a more detailed explanation of the exploit.
So hardly an attack on any core system of cryptocurrencies.
survirtual@lemmy.world 5 months ago
So they discovered faulty code and made some money?
Can anyone explain to me how this is illegal?
The code is a contract. If someone writes bad code and loses money, then write better code - just like if someone writes a bad legal contract and loses money.
The justice system is awful.
shrugal@lemm.ee 5 months ago
Bad/Unfavorable contracts and literal deception/fraud are two different things, at least in the legal system. Not everything that’s technically possible is also allowed, obviously.
Compare it to using a security flaw to hack into a system. Technically you’re only using the official API, maybe in unusual ways but still. But you’re doing it in bad faith and causing harm, and that can make a difference.
blargerer@kbin.social 5 months ago
This is like saying they discovered how to pick a lock so deserve everything in whats locked by it.
yetAnotherUser@feddit.de 5 months ago
You withdraw cash at an ATM but the software has faulty code which causes your balance to remain the same after withdrawing any amount.
You notice this and then empty the entire ATM this way, making $200,000. I’m sure once you explain to the jury that the ATM just gave you a bad contract, they will acquit you.
possiblylinux127@lemmy.zip 5 months ago
They created a bunch of fake shell companies in foreign companies and were preparing to flee the US
Blackmist@feddit.uk 5 months ago
Doesn’t sound a huge deal different to High Frequency Trading, and Wall Street nobheads fall over themselves to exploit that.
treadful@lemmy.zip 5 months ago
Frustratingly vague for a Slashdot write-up.
Good to know the prosecutors have an understanding of what they’re prosecuting… Not even a single mention of MEV in the DoJ press release.
Kazumara@discuss.tchncs.de 5 months ago
That makes no sense to me. The mempool is public, everyone can see pending transactions.
bartolomeo@suppo.fi 5 months ago
What’s funny is that that’s a description of MEV.
I skipped “fraudulent” because neither MEV bots nor this attack can be called fraudulent imo, although MEV is definitely taking value one didn’t help create.
bartolomeo@suppo.fi 5 months ago
Let them eat MEV bot operators.