6 ms·

As far as I can understand 1. The user had 1,400 BTC in an old wallet using this software 2. An old version of the software was vulnerable to phishing 3. The

As far as I can understand 1. The user had 1,400 BTC in an old wallet using this software 2. An old version of the software was vulnerable to phishing 3. The user attempted to use the software, and was phished 4. Massive payday for the scammers Really unfortunate - and goes to show with software you manage yourself you need to be diligent about making sure it's updated. For all the shit coinbase gets, it's difficult to lose your coins in this manner.

Ansil849 6y ago
> For all the shit coinbase gets, it's difficult to lose your coins in this manner. Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are vulnerable to phishing. So no, Coinbase is not immune to losing coins in this manner. If Coinbase wanted to prevent being vulnerable to phishing they would i) only allow U2F 2FA, and ii) make U2F mandatory for all accounts.
- nemothekid 6y ago
  1. AFACT the user was phished in a manner that was specific to this platform. It's not really comparable to clicking a nasty link in an email. Whether you chose to use U2F or TOTP, the risks is upfront. The user in this case was running official software - there was no URL to check. 2. The vector of the attack isn't important. The user ultimately lost his coins because he wasn't running the latest version of the software. He could have have easily lost his shirt from an RCE. That is much more difficult on a managed SaaS platform.
eastbayjake 6y ago
It was my understanding that the user had installed a version of the Electrum wallet that was not from the official source at electrum.org. (But agree - it was really difficult to identify the core issue from this string of GitHub comments.)
- crtasm 6y ago
  They were running an old official version which has a serious issue allowing the full node servers it connects to to pop up a message. e.g. "You need to upgrade - click here" - that led to the malware.
  - nodesocket 6y ago
    And there is no way to track down the node server that popped up this malicious message? Take it offline?
    - fluffything 6y ago
      Yes, electrum.org maintains a blacklist. That won't stop a phisher that just made 16 million dollars though. Spawning a new server costs cents.
brianwawok 6y ago
Also, I think it's just the reason that crypto-currency will fail. If you trick me into an ACH transfer of 16 million, there will a) Trigger some random human based audits at my bank before the money can leave (likely involve some phone calls) b) Have actual recourse, like court orders to hold the funds at the other bank c) Take some amount of time to happen, to allow for A & B It's not perfect, and it has bugs.. but I would never store actual money of value in crypto anything.
- lgregg 6y ago
  This is exactly the reason why I don’t use crypto currencies.
- swyx 6y ago
  unless a bank wouldnt serve you, like for sizable parts of the economy.
  - deleted 6y ago
    [deleted]
  - eanzenberg 6y ago
    Sizable, like 2%?
    - eanzenberg 6y ago
      I looked it up. 6% of Americans don’t have a bank account. Doesn’t say whether they could go ahead and get one, or they choose not to. Sizable?
      - soco 6y ago
        Correct me please if I'm wrong, but I'd say most of those folks not served by a bank wouldn't have the skills to manage bitcoins either.
      - brianwawok 6y ago
arcticbull 6y ago
Ah I remember when my bank app had a bug and someone stole $15 million dollars from me then when I asked for help they said not your keys not your dollars. Such is life!
nodesocket 6y ago
How do we confirm this actually happened? Perhaps I am being cynical, but people have been know to embellish and lie on the internet before? Shouldn't we be able to follow these funds on the ledger?
- Hackbraten 6y ago
  https://news.ycombinator.com/item?id=24334393 https://news.ycombinator.com/item?id=24334393

Ansil849 6y ago

> For all the shit coinbase gets, it's difficult to lose your coins in this manner. Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are vulnerable to phishing. So no, Coinbase is not immune to losing coins in this manner. If Coinbase wanted to prevent being vulnerable to phishing they would i) only allow U2F 2FA, and ii) make U2F mandatory for all accounts.

nemothekid 6y ago
1. AFACT the user was phished in a manner that was specific to this platform. It's not really comparable to clicking a nasty link in an email. Whether you chose to use U2F or TOTP, the risks is upfront. The user in this case was running official software - there was no URL to check. 2. The vector of the attack isn't important. The user ultimately lost his coins because he wasn't running the latest version of the software. He could have have easily lost his shirt from an RCE. That is much more difficult on a managed SaaS platform.

eastbayjake 6y ago

It was my understanding that the user had installed a version of the Electrum wallet that was not from the official source at electrum.org. (But agree - it was really difficult to identify the core issue from this string of GitHub comments.)

crtasm 6y ago
They were running an old official version which has a serious issue allowing the full node servers it connects to to pop up a message. e.g. "You need to upgrade - click here" - that led to the malware.
- nodesocket 6y ago
  And there is no way to track down the node server that popped up this malicious message? Take it offline?
  - fluffything 6y ago
    Yes, electrum.org maintains a blacklist. That won't stop a phisher that just made 16 million dollars though. Spawning a new server costs cents.

brianwawok 6y ago

Also, I think it's just the reason that crypto-currency will fail. If you trick me into an ACH transfer of 16 million, there will a) Trigger some random human based audits at my bank before the money can leave (likely involve some phone calls) b) Have actual recourse, like court orders to hold the funds at the other bank c) Take some amount of time to happen, to allow for A & B It's not perfect, and it has bugs.. but I would never store actual money of value in crypto anything.

lgregg 6y ago
This is exactly the reason why I don’t use crypto currencies.
swyx 6y ago
unless a bank wouldnt serve you, like for sizable parts of the economy.
- deleted 6y ago
  [deleted]
- eanzenberg 6y ago
  Sizable, like 2%?
  - eanzenberg 6y ago
    I looked it up. 6% of Americans don’t have a bank account. Doesn’t say whether they could go ahead and get one, or they choose not to. Sizable?
    - soco 6y ago
      Correct me please if I'm wrong, but I'd say most of those folks not served by a bank wouldn't have the skills to manage bitcoins either.
    - brianwawok 6y ago

arcticbull 6y ago

Ah I remember when my bank app had a bug and someone stole $15 million dollars from me then when I asked for help they said not your keys not your dollars. Such is life!

nodesocket 6y ago

How do we confirm this actually happened? Perhaps I am being cynical, but people have been know to embellish and lie on the internet before? Shouldn't we be able to follow these funds on the ledger?

Hackbraten 6y ago
https://news.ycombinator.com/item?id=24334393 https://news.ycombinator.com/item?id=24334393