3 ms·

I like how they are charging 10% more if you pay with Bitcoin than with Monero. I think commerce would greatly improve if other networks had Tor clients, espec

I like how they are charging 10% more if you pay with Bitcoin than with Monero. I think commerce would greatly improve if other networks had Tor clients, especially because of the stablecoin and private stablecoin availability as of this year. All EVMs as well as Tendermint networks have no out of the box solutions for Tor nodes and connectivity. But they both have ways for ERC20 tokens to have a great degree of privacy. One Tendermint network called Secret Network has private smart contract execution, and a variety of bridges. So as all tokens are smart contracts the metadata and variables would not be visible onchain. sDAI would be more useful for commerce if the nodes and wallets could easily resolve over Tor. Is anybody working on that?

WrtCdEvrydy 6y ago
> I like how they are charging 10% more if you pay with Bitcoin than with Monero. I smell a business opportunity... Kick off a ransomware attack and accept Bitcoin or a Shitcoin at a 30% discount. Some shitcoins have such little liquidity... a 50k buy would push their price off by hundreds of percentage points. You can even refund their money back after they pay... a modern day pump/dump. The thing about being an ethical player in unethical markets is coming up with ideas that could make you richer but not wanting break laws / be a terrible person.
- vmception 6y ago
  Illiquid asset pumping is the best way to launder the money in the crypto space. AccountA has bought or owns the illiquid asset using clean money, in advance. AccountB has the ransom proceeds in the more liquid digital asset. AccountB eventually buys the illiquid asset and pumps it. All the blockchain detectives are still following AccountB across many more addresses and blockchains, hoping and praying and imagining that one of the touched accounts needs fiat so that a human identity can be assigned to the funds. But that never happens. AccountA has the 8,000% or other arbitrarily high gain and nobody can distinguish them from any other crypto trader, as these kinds of gains are commonplace. All the trading can (and should) occur onchain without any financial intermediary, as there would be no transaction size limits or issue moving the funds, compared to odd activity on a business' centralized custodial exchange. AccountB connected accounts are saddled with the illiquid asset. Maybe organic growth has occurred from fear of missing out and AccountB can resell, but that is just an embellishment and icing on the cake. AccountB connected accounts can also create the liquidity pool, or create the yield farming opportunities to incentivize others to join the liquidity pool. And if AccountB really never cares about the funds, they can also burn the bearer liquidity pool share, providing confidence to the market that they can always trade at high volumes onchain.
  - TheColorYellow 6y ago
    I don't get how Account B gets to the point of extracting value from the illiquid asset after purchasing? Seems like they either, 1) sell periodically or as the assets value appreciates, but this is generally unreliable and tough or 2) create a liquidity pool or yield farming opportunities For 1, this isn't necessarily reliable but it seems like the most plausible popular case. For 2, given the previously mentioned challenge of the illiquid asset, how does it work to provide incentive in liquidity pooling and yield farming? Note, that I'm less well aware of the mechanics of 2 so perhaps its also a fundamental ignorance issue.
    - vmception 6y ago
      AccountB doesn't have to make more money as it directly or indirectly transferred all the liquid assets to AccountA (and many other people). In a liquidity pool kind of exchange, AccountB would have simply put all its liquid assets into the liquidity pool, in exchange for removing the illiquid asset into AccountB's custody. The liquidity pool maintains prices based on a ratio of two assets in the pool, so the illiquid asset would have quite how price after this activity. AccountA would have just sold its holdings of the illiquid asset back into the liquidity pool at a coincidentally favorable time. AccountA can also have been a liquidity provider, and when they unbundle their liquidity pool share it will have more of the liquid asset and less of the illiquid asset. Many possibilities, permissionless. If it must be said, AccountA is yours too and is just for reintegrating the illicit proceeds into the economy without trying to do something more convoluted like running a permissionless SaaS business with fake customers spending Monero for domain name lookups. But, AccountB can attempt to make its assets more liquid again. You just go on Telegram and pump it in speculator groups, buy off some youtubers. How much are you laundering? You can keep a few thousand dollars in liquidity for negotiations. AccountB should also provide liquidity itself. Just launch a yield farm contract, copy and paste, change the input and output token address, redeploy, lock a substantial portion of the illiquid token inside of it (or pay off a more coveted yield farming project like Pancake or Polygon to list a farm and pay farmers in their token). Make the yield high.
    - TeMPOraL 6y ago
      > I don't get how Account B gets to the point of extracting value from the illiquid asset after purchasing? My understanding is, accounts A and B are both controlled by the same person/group. Account A always deals with clean money and pretends to do speculative investing; account B uses dirty money to pump illiquid assets. An example scenario, as a simplified list of transactions: | Time | From | To | Amount | Note | |------+---------+--------+------------+-------------------------------------------| | 0 | Pocket | A | 10 $GOOD | Initial investment. | | 0 | - | B | - | Created account for criminal activity. | |------+---------+--------+------------+-------------------------------------------| | 10 | A | Market | 10 $GOOD | Exchanged liquid $GOOD for illiquid | | 10 | Market | A | 1000 $BAD | $BAD at 1:100. | |------+---------+--------+------------+-------------------------------------------| | 100 | Victims | B | 3000 $GOOD | Crime - e.g. ransomware payments. | |------+---------+--------+------------+-------------------------------------------| | 150 | B | Market | 3000 $GOOD | Buying up $BAD to generate interest and | | 150 | Market | B | 1500 $BAD | pump its value. | |------+---------+--------+------------+-------------------------------------------| | 200 | A | Market | 1000 $BAD | Buying back $GOOD for temporarily liquid | | 200 | Market | A | 5000 $GOOD | $BAD at 5:1. | |------+---------+--------+------------+-------------------------------------------| | 500 | B | Market | 1500 $BAD | If $BAD didn't collapse, recovering some | | 500 | Market | B | 100 $GOOD | of more stable asset at 1:15; can be used | | | | | | to repeat the trick later. | In this scenario, criminals turned $3000 of dirty $GOOD in account B into $5000 of clean $GOOD in account A. If they were good with OPSEC, there's no connection between accounts A and B - from outside, it looks like the owner of account A got lucky speculating on crypto, and owner of account B was a dumb criminal that made a bad investment. Hell, if criminals are sure of their OPSEC, they could even go as far as paying taxes for their gains on account A, reinforcing the image that A is owned by some random, legitimate investor (but that could bite them hard if law enforcement realizes there's a connection between accounts B and A). Account B is never cashed out - it's used only for purposes of pumping illiquid cryptocurrencies, and eventually abandoned.
throwaway481048 6y ago
What are EVMs, ERC2, and sDAI? I do not believe your objective is to confuse or obstruct, but additional context would help understand the unique value of your contribution. This is coming from someone with a recent BSc in Computer Engineering yet still completely unaware of these acronyms & references.
- vmception 6y ago
  Only a few universities are teaching this stuff right now. In any case: EVM is "Ethereum Virtual Machine", a similar concept to the JVM "Java Virtual Machine". EVMs are one the most common technology for deployment of arbitrary execution within distributed networks. These kinds of functions and applications are colloquially called smart contracts. The biggest distributed network with this technology being simply called "Ethereum" or "Ethereum mainnet". But any code deployed on Ethereum mainnet is deployable on any other EVM environment, such as Polygon, Avalanche, Binance Smart Chain, Tron, Ethereum Classic, Hashgraph, or Quorum which was stewarded by JP Morgan for a few years for internal enterprise use. With the other common smart contract network being Tendermint also colloquially referred to as Cosmos. There are a couple of standard classes with a certain protocol of functions on all these networks. One standardized class is called ERC20, which is a fungible token standard. Deploying this kind of class ensures that you have created an asset with a name, ticker symbol, quantity, and a transfer function. Therefore ERC20 just is a quick way to refer to an additional asset. Assets that represent something the market wants or is familiar with or is redeemable for something the market likes therefore have certain monetary values associated with them. Some communities representing other networks have different protocol names for the same concept, for example, the Binance Smart Chain community has a token standard called BEP20 which is mostly contrived marketing but it could also have tweaks to the ERC20 standard, you have to read them. No different than reading the IETF's REST protocol standard for each function, and then seeing how it is implemented slightly differently across different browsers, devices and frameworks. DAI is an ERC20 asset that maintains convertibility with $1 US Dollar. It is collateralized by a basket of assets, some completely digital assets and some that are backed by real world assets from centralized issuers. When it comes to ERC20 naming styles, the market has resorted to prefixes for now. So on the Secret Network (which uses Tendermint/Cosmos technology instead of EVM), assets that enter it from bridges are called sAssets. So DAI that enters the Secret Network would be sDAI. Where it will inherit the private nature of the network. Specifically the current state of the functions such as quantity, transfer(to, from) would all be unknown from looking at the blockchain.
paulpauper 6y ago
probably because btc is epxpensive and hard to launder
- vmception 6y ago
  Yes, it is nice to see the market adjusting. There are only a few cryptocurrency networks with robust Tor infrastructure for now. There should be more but the stewards haven't prioritized it, for the most part many nodes and wallets for other networks are UDP, which is a major hurdle as Tor requires TCP exclusively. Bitcoin and Monero do not have this limitation, but Monero is the only private by default one and has a large mixture set to stay easily obfuscated.
toomim 6y ago
> I like how they are charging 10% more if you pay with Bitcoin than with Monero. Source? How much are they asking for?
- vmception 6y ago
  There is a screenshot in the article in the Ransomware as a Service (Raas) section.
jay_kyburz 6y ago
Is it illegal to pay the ransom?
- vmception 6y ago
  There is an argument for that. Haven't heard of prosecutions for doing so.
- speed_spread 6y ago
  At least for public services in Canada, it is. Which serves as as a deterrent since attackers are guaranteed to _not_ get money. Also whips management into more than CYA-and-wait IT security.
pamplemoose 6y ago
I recently learned of zkDai[1]. Do you have any thoughts on this or the Aztec protocol? [1] https://medium.com/aztec-protocol/introducing-zkdai-into-the-aztec-private-rollup-203bd1b5164c https://medium.com/aztec-protocol/introducing-zkdai-into-the...
- vmception 6y ago
  It is just too expensive for the Ethereum network and not a large enough mixing set (haven't looked recently though) and nobody accepts it therefore requiring you to exit it if you want anything, but exiting will reveal who you are because there is nobody else it could be. Privacy on the Ethereum network remains just Ether in Tornado Cash. edit: oh cool Aztec actually transitioned to the Optimistic Rollup. That is different than their prior smart contract and requires new analysis. I recall their article last year or before about doing a "zk zk rollup" and I didn't keep following.
crazypython 6y ago
Bitcoin full node– which processes and verifies all transactions– uses only 7GB disk space. It doubles as a wallet, and it has native bidirectional Tor support.

WrtCdEvrydy 6y ago

> I like how they are charging 10% more if you pay with Bitcoin than with Monero. I smell a business opportunity... Kick off a ransomware attack and accept Bitcoin or a Shitcoin at a 30% discount. Some shitcoins have such little liquidity... a 50k buy would push their price off by hundreds of percentage points. You can even refund their money back after they pay... a modern day pump/dump. The thing about being an ethical player in unethical markets is coming up with ideas that could make you richer but not wanting break laws / be a terrible person.

vmception 6y ago
Illiquid asset pumping is the best way to launder the money in the crypto space. AccountA has bought or owns the illiquid asset using clean money, in advance. AccountB has the ransom proceeds in the more liquid digital asset. AccountB eventually buys the illiquid asset and pumps it. All the blockchain detectives are still following AccountB across many more addresses and blockchains, hoping and praying and imagining that one of the touched accounts needs fiat so that a human identity can be assigned to the funds. But that never happens. AccountA has the 8,000% or other arbitrarily high gain and nobody can distinguish them from any other crypto trader, as these kinds of gains are commonplace. All the trading can (and should) occur onchain without any financial intermediary, as there would be no transaction size limits or issue moving the funds, compared to odd activity on a business' centralized custodial exchange. AccountB connected accounts are saddled with the illiquid asset. Maybe organic growth has occurred from fear of missing out and AccountB can resell, but that is just an embellishment and icing on the cake. AccountB connected accounts can also create the liquidity pool, or create the yield farming opportunities to incentivize others to join the liquidity pool. And if AccountB really never cares about the funds, they can also burn the bearer liquidity pool share, providing confidence to the market that they can always trade at high volumes onchain.
- TheColorYellow 6y ago
  I don't get how Account B gets to the point of extracting value from the illiquid asset after purchasing? Seems like they either, 1) sell periodically or as the assets value appreciates, but this is generally unreliable and tough or 2) create a liquidity pool or yield farming opportunities For 1, this isn't necessarily reliable but it seems like the most plausible popular case. For 2, given the previously mentioned challenge of the illiquid asset, how does it work to provide incentive in liquidity pooling and yield farming? Note, that I'm less well aware of the mechanics of 2 so perhaps its also a fundamental ignorance issue.
  - vmception 6y ago
    AccountB doesn't have to make more money as it directly or indirectly transferred all the liquid assets to AccountA (and many other people). In a liquidity pool kind of exchange, AccountB would have simply put all its liquid assets into the liquidity pool, in exchange for removing the illiquid asset into AccountB's custody. The liquidity pool maintains prices based on a ratio of two assets in the pool, so the illiquid asset would have quite how price after this activity. AccountA would have just sold its holdings of the illiquid asset back into the liquidity pool at a coincidentally favorable time. AccountA can also have been a liquidity provider, and when they unbundle their liquidity pool share it will have more of the liquid asset and less of the illiquid asset. Many possibilities, permissionless. If it must be said, AccountA is yours too and is just for reintegrating the illicit proceeds into the economy without trying to do something more convoluted like running a permissionless SaaS business with fake customers spending Monero for domain name lookups. But, AccountB can attempt to make its assets more liquid again. You just go on Telegram and pump it in speculator groups, buy off some youtubers. How much are you laundering? You can keep a few thousand dollars in liquidity for negotiations. AccountB should also provide liquidity itself. Just launch a yield farm contract, copy and paste, change the input and output token address, redeploy, lock a substantial portion of the illiquid token inside of it (or pay off a more coveted yield farming project like Pancake or Polygon to list a farm and pay farmers in their token). Make the yield high.
  - TeMPOraL 6y ago
    > I don't get how Account B gets to the point of extracting value from the illiquid asset after purchasing? My understanding is, accounts A and B are both controlled by the same person/group. Account A always deals with clean money and pretends to do speculative investing; account B uses dirty money to pump illiquid assets. An example scenario, as a simplified list of transactions: | Time | From | To | Amount | Note | |------+---------+--------+------------+-------------------------------------------| | 0 | Pocket | A | 10 $GOOD | Initial investment. | | 0 | - | B | - | Created account for criminal activity. | |------+---------+--------+------------+-------------------------------------------| | 10 | A | Market | 10 $GOOD | Exchanged liquid $GOOD for illiquid | | 10 | Market | A | 1000 $BAD | $BAD at 1:100. | |------+---------+--------+------------+-------------------------------------------| | 100 | Victims | B | 3000 $GOOD | Crime - e.g. ransomware payments. | |------+---------+--------+------------+-------------------------------------------| | 150 | B | Market | 3000 $GOOD | Buying up $BAD to generate interest and | | 150 | Market | B | 1500 $BAD | pump its value. | |------+---------+--------+------------+-------------------------------------------| | 200 | A | Market | 1000 $BAD | Buying back $GOOD for temporarily liquid | | 200 | Market | A | 5000 $GOOD | $BAD at 5:1. | |------+---------+--------+------------+-------------------------------------------| | 500 | B | Market | 1500 $BAD | If $BAD didn't collapse, recovering some | | 500 | Market | B | 100 $GOOD | of more stable asset at 1:15; can be used | | | | | | to repeat the trick later. | In this scenario, criminals turned $3000 of dirty $GOOD in account B into $5000 of clean $GOOD in account A. If they were good with OPSEC, there's no connection between accounts A and B - from outside, it looks like the owner of account A got lucky speculating on crypto, and owner of account B was a dumb criminal that made a bad investment. Hell, if criminals are sure of their OPSEC, they could even go as far as paying taxes for their gains on account A, reinforcing the image that A is owned by some random, legitimate investor (but that could bite them hard if law enforcement realizes there's a connection between accounts B and A). Account B is never cashed out - it's used only for purposes of pumping illiquid cryptocurrencies, and eventually abandoned.

throwaway481048 6y ago

What are EVMs, ERC2, and sDAI? I do not believe your objective is to confuse or obstruct, but additional context would help understand the unique value of your contribution. This is coming from someone with a recent BSc in Computer Engineering yet still completely unaware of these acronyms & references.

vmception 6y ago
Only a few universities are teaching this stuff right now. In any case: EVM is "Ethereum Virtual Machine", a similar concept to the JVM "Java Virtual Machine". EVMs are one the most common technology for deployment of arbitrary execution within distributed networks. These kinds of functions and applications are colloquially called smart contracts. The biggest distributed network with this technology being simply called "Ethereum" or "Ethereum mainnet". But any code deployed on Ethereum mainnet is deployable on any other EVM environment, such as Polygon, Avalanche, Binance Smart Chain, Tron, Ethereum Classic, Hashgraph, or Quorum which was stewarded by JP Morgan for a few years for internal enterprise use. With the other common smart contract network being Tendermint also colloquially referred to as Cosmos. There are a couple of standard classes with a certain protocol of functions on all these networks. One standardized class is called ERC20, which is a fungible token standard. Deploying this kind of class ensures that you have created an asset with a name, ticker symbol, quantity, and a transfer function. Therefore ERC20 just is a quick way to refer to an additional asset. Assets that represent something the market wants or is familiar with or is redeemable for something the market likes therefore have certain monetary values associated with them. Some communities representing other networks have different protocol names for the same concept, for example, the Binance Smart Chain community has a token standard called BEP20 which is mostly contrived marketing but it could also have tweaks to the ERC20 standard, you have to read them. No different than reading the IETF's REST protocol standard for each function, and then seeing how it is implemented slightly differently across different browsers, devices and frameworks. DAI is an ERC20 asset that maintains convertibility with $1 US Dollar. It is collateralized by a basket of assets, some completely digital assets and some that are backed by real world assets from centralized issuers. When it comes to ERC20 naming styles, the market has resorted to prefixes for now. So on the Secret Network (which uses Tendermint/Cosmos technology instead of EVM), assets that enter it from bridges are called sAssets. So DAI that enters the Secret Network would be sDAI. Where it will inherit the private nature of the network. Specifically the current state of the functions such as quantity, transfer(to, from) would all be unknown from looking at the blockchain.

paulpauper 6y ago

probably because btc is epxpensive and hard to launder

vmception 6y ago
Yes, it is nice to see the market adjusting. There are only a few cryptocurrency networks with robust Tor infrastructure for now. There should be more but the stewards haven't prioritized it, for the most part many nodes and wallets for other networks are UDP, which is a major hurdle as Tor requires TCP exclusively. Bitcoin and Monero do not have this limitation, but Monero is the only private by default one and has a large mixture set to stay easily obfuscated.

toomim 6y ago

> I like how they are charging 10% more if you pay with Bitcoin than with Monero. Source? How much are they asking for?

vmception 6y ago
There is a screenshot in the article in the Ransomware as a Service (Raas) section.

jay_kyburz 6y ago

Is it illegal to pay the ransom?

vmception 6y ago
There is an argument for that. Haven't heard of prosecutions for doing so.
speed_spread 6y ago
At least for public services in Canada, it is. Which serves as as a deterrent since attackers are guaranteed to _not_ get money. Also whips management into more than CYA-and-wait IT security.

pamplemoose 6y ago

I recently learned of zkDai[1]. Do you have any thoughts on this or the Aztec protocol? [1] https://medium.com/aztec-protocol/introducing-zkdai-into-the-aztec-private-rollup-203bd1b5164c https://medium.com/aztec-protocol/introducing-zkdai-into-the...

vmception 6y ago
It is just too expensive for the Ethereum network and not a large enough mixing set (haven't looked recently though) and nobody accepts it therefore requiring you to exit it if you want anything, but exiting will reveal who you are because there is nobody else it could be. Privacy on the Ethereum network remains just Ether in Tornado Cash. edit: oh cool Aztec actually transitioned to the Optimistic Rollup. That is different than their prior smart contract and requires new analysis. I recall their article last year or before about doing a "zk zk rollup" and I didn't keep following.

crazypython 6y ago

Bitcoin full node– which processes and verifies all transactions– uses only 7GB disk space. It doubles as a wallet, and it has native bidirectional Tor support.