17 ms·
Hamilton teen embroiled in FBI probe, fingered in $46M cryptocurrency theft
- NicoJuicy 5y ago> "Just the fact that everyone on earth thinks that Bitcoin is crazy, and no one is telling me why, doesn’t matter,” Says the biggest known victim of a crypto heist in a private person. Ain't this ironic. I guess I should spell out that centralization is a feature?
- ashconnor 5y agohttps://archive.md/5oAva https://archive.md/5oAva
- glofish 5y agoWhen random teen can easily steal $46M from a "Bitcoin pioneer" what hope is that for regular folks could make safe use of said value store?
- Jerrrry 5y agoThe issue is that most communication is centralized between two companies, Verizon and ATT, and those companies have employees that are very, very fallible. We need to decentralize our communication infrastructure.
- mym1990 5y agoNo real reason to point the finger at people at Verizon and ATT are more fallible than others. Almost anyone can fall for social engineering if done right/often enough. I know you probably think you're too smart to be fooled like that, but that's exactly how you'll fall to a scam.
- Jerrrry 5y agoThe people Verizon/ATT are more fallible, because of the implicit risk/threat model that is imposed on us by duopolistic infrastructure. They have vastly more power without the required training. This asymmetry makes them larger targets, and therefore, more fallible. ATT/Verizon employees are the weakest link in almost all threat models, including our national one. I don't think I am personally infallible; and I am/used to be the reason you have to take cyber, social engineer, and spear attack trainings every year. It is because I know the true weakest links (humans with unrelegated access) that compel me to remind others: do not use SMS for 2FA. There are other ways of getting the nonce/temporal secret to the end-user without pitting the security to a overworked 27 year old druggy CSR in upstate new york.
- mym1990 5y agoEh to be honest your whole argument fell apart as I read the last few words. Hope you change your outlook on the world, for your own good.
- mindslight 5y agoThat's a problem for sure, but it's not the problem here. The problem here is cryptocurrency trustees implementing snake oil "2FA" using the PSTN, which was never intended to provide the needed security properties.
- azth 5y agoIt will take some time for the infrastructure to mature.
- djbusby 5y agoAnd until then? We just say "oh, fraud, oh well"?
- VWWHFSfQ 5y agoThis is what banks and credit card companies do already. It's the cost of doing the business. If someone steals your credit card and uses it then you're not responsible, the bank is. And you get your money back. But there's no such recourse or security for individuals in this new system.
- azth 5y agoStraw man argument.
- cactus2093 5y agoIt's been 10 years, meanwhile everyone is hyping up how awesome and fast-moving the "web3" space is and how all the best developers have left their day jobs and are building for it. What's taking so long?
- DennisP 5y agoThe bitcoins were stored on a centralized exchange using a phone number as 2FA. Banks and brokerage accounts can be hacked the same way, though at least they'll make you whole if you catch it soon enough. To really secure bitcoins, a hardware wallet or a passphrase in a safe deposit box are both pretty simple options that nontechnical people use all the time. Neither is expensive and both are widely known.
- 1024core 5y ago> a passphrase in a safe deposit box are both pretty simple options _If_ you can get a safe deposit box in your bank, that is. My local bank (Chase) is always sold out of boxes. Sure, you'll next say: change your bank. But the other one (BoA) is also out. My point is, it's not such an easy option as you're making it out to be.
- neilv 5y agoWhen I shopped for a local bank branch that had safe deposit boxes (maybe decade ago), one of the bankers told me a lot of banks and branches were trying to get rid of their boxes, and not wanting to include boxes in new branches. I managed to get a box in the basement of the BofA in Harvard Square back then, and kinda wish I'd kept it, since I doubt I could get one today.
- deleted 5y ago[deleted]
- sombremesa 5y agoFunnily enough my bank very recently made me sign an agreement which precluded me from subleasing my safe deposit box. Maybe this is the next arbitrage opportunity.
- diveanon 5y agoMaybe stop going to big corporate banks? I got one last week without any issue.
- UncleMeat 5y ago
- lvass 5y agoThe stolen sum was taken from a centralized, bank-like account. Not your keys, not your coins. Given how incredibly likely people are to trust these untrustworthy organizations, not much hope regular folks can be safe.
- tigereyeTO 5y agoPeople steal USD from companies and people all the time. "What hope is that for regular folks could make safe use of said USD?"
- DeathArrow 5y ago>When random teen can easily steal $46M from a "Bitcoin pioneer" what hope is that for regular folks could make safe use of said value store? That's easy. Regular folks don't have $46M to store. Also being rich doesn't mean you always take the best decisions.
- n3dm 5y ago[flagged]
- DennisP 5y agohttps://archive.md/5oAva https://archive.md/5oAva
- ziddoap 5y agoFor those without subscriptions. https://outline.com/3CRjpe https://outline.com/3CRjpe >That post has since been taken down, but many comments included criticism for leaving such a large amount of Bitcoin accessible on a phone. Not to victim blame, but it really is odd to me that someone would leave any amount of BTC on their phone, let alone millions of dollars worth. >The Hamilton teen faces charges of theft over $5,000 and possession of property or proceeds of property obtained by crime I've always wondered why the line is drawn at $5,000. It's mildly interesting that stealing $46M and stealing $5,000 result in equivalent charges.
- amcoastal 5y agoI feel like everyone knows why the line is drawn at such a value. So people like us can't afford to commit crimes, but the rich can.
- not2b 5y agoIn many cases the amounts were written into the law so long ago that money was worth maybe 20x as much, or more.
- hanniabu 5y agoAnd that's why we really need to start assigning equations rather than static amounts in bills
- seszett 5y agoIt's not exactly that, but in Belgium penalties written in law are an amount that is multiplied by a factor that is regularly updated. It went from 5.5 to 6 in 2011, then to 8 in 2017 and is still there AFAIK. It seems a bit haphazardly managed to me, but it's something.
- bpodgursky 5y agoAlternatively we could maintain a stable currency people can rely on as a store of value.
- Jerrrry 5y agoanother bitcoin bandit bites the dust. I bet he bought an xbox gamertag from the most recent exploit. These kids really do think the 3 letter agencies arent watching, no matter how many of their close friends get v&. The blockchain is forever, and the statue of limitations no longer applies. That verizon/att employee from 2018 will get caught, he will give up an alias, and the feds are interested, now that the coins have value. and assuming the feds arent dirty (they are), you have 5 years to run. If the fed assigned to your case decides he wants the coin personally, you have 5 monthes.
- paulpauper 5y agolol way too premature to say that. if he gets off easy by being a youth, he can still walk away with tens of millions of dollars. If the rest of the btc cannot be recovered, likely when he is released from jail or custody, assuming he is even convicted, he will still have it. If he is not extradited and charged in the US, then he is pretty much guaranteed to exit with his fortune intact. Canada has pretty lenient justice system.
- the_optimist 5y agoWhat's the likelihood that the other $39M is parked with the prosecuting agents? https://www.justice.gov/usao-ndca/pr/former-federal-agents-charged-bitcoin-money-laundering-and-wire-fraud https://www.justice.gov/usao-ndca/pr/former-federal-agents-c...
- Jerrrry 5y agoNot 0.
- deleted 5y ago[deleted]
- jaywalk 5y agoIf you're going to steal a large amount of Bitcoin, you should probably have a plan on what you're going to do with it that doesn't include buying a gaming username that can be trivially traced back to you once you use it.
- DeathArrow 5y agoIt seems some financial crimes/frauds are easy to commit even for a not very clever individual.
- 323 5y agoIt's easy to steal bitcoin (for some definition of easy). The hard part is cashing it out. As Breaking Bad used to say, what criminals want is to pay taxes on their criminal proceeds.
- miohtama 5y agoHere is my guide for laundering Bitcoin https://capitalgram.com/posts/how-to-money-launder-bitcoin/ https://capitalgram.com/posts/how-to-money-launder-bitcoin/ - it should give some useful tips.
- 323 5y agoAnyone using your guide will be caught if the FBI goes after them. Your guide basically says use Binance/OTC, a fake ID and this bank. And you have zero stuff about actual money laundering - ie, justifying $46 mil suddenly appearing in your name.
- paulpauper 5y agopro tip: you don't have to launder $46 million at once. you can treat it like a lottery annuity and just skim off a little here and there.
- 323 5y agoSome years ago a Dutch teen bought a house with $100k money from stolen bitcoin. He was caught and arrested because he couldn't justify the money. You also need to worry about algos that 10 years from now will analyze bank transfers, purchases ...
- miohtama 5y agoJust move to a place where they do not worry about justifying the money https://news.ycombinator.com/threads?id=miohtama#29331616 https://news.ycombinator.com/threads?id=miohtama#29331616
- vmoore 5y agoSo some exchanges use TOTP 2FA (which is more secure than SMS). And some people like to copy their 2FA 'seed' which is usually a QR code that they store somewhere securely. Amazing how a simple QR code (or even a recovery code) can be worth so much.
- jrootabega 5y agoIf you own a lot of crypto and it's still protected by SMS auth, you need to disable that (edit: in favor of OTP). If you can't, you need to buy a dozen prepaid sim cards and use them randomly. Or pay someone to do it for you. Very cheap in comparison to a theft.
- sombremesa 5y ago> you need to disable that Might need a bit more elaboration there. You want people to turn off 2fa?
- jrootabega 5y agoIn favor of offline OTP I meant. Although there's a case to be made that having no mfa might be more secure than SMS mfa, if that can be used to recover access to your account (at which point it is no longer Mfa, but just a)
- raverbashing 5y agoOr maybe anyone that claims to be a security person worth their salt (on the companies doing 2fa) need to sunset SMS 2fa and use OTP instead, at least
- jrootabega 5y agoTrue, and coinbase appears to do that (I say "appears to" because I don't know what they would do if I actually tried to reset my password and cajoled them into using my phone number to do it.) Unfortunately, some orgs, and even more unfortunately, some banks, still require/force SMS mfa.
- UncleMeat 5y agoOTP is only marginally safer than SMS. Phishing is a far more common threat than SIM-swapping.
- throwvirtever 5y agoWouldn't a dozen prepaid SIM cards mean 12 times as many things to defend? Also wouldn't anyone you paid to "do it for you" need to be trusted, undermining the no-trust principle of cryptocurrencies?
- hsnewman 5y agoThis, along with the energy requirements of crypto is why I don't/won't put any money in it.
- hunterb123 5y agoUnder that reasoning you shouldn't interact with any humans or technology at all. There should be a rule against regurgitating talking points without adding to the discussion, but I'll humor you. I invest solely in crypto because the banks and federal reserve have scammed the common people more than any sole individual. The government prints money knowing full well the common person will bear the burden of inflation.
- misiti3780 5y agoHonest question: We are all the bitcoin multi-millionaires storing their coins? It seems like in an ideal world, you would use https://trezor.io https://trezor.io and put that in a safety deposit box, or maybe use Coinbase Vault, but I am generally curious what is the current consensus on the safest ways to store these piles of digital money.
- londons_explore 5y agoMove all the coins to a new wallet. Make that wallet have a split private key, such that say there are 13 keys, and any 9 are required to access the funds. Distribute those 13 keys, on paper, in sealed envelopes, to 13 different locations. Make each location have at least basic access control - either a door lock, or held by someone you trust with specific instructions about who is allowed to access the paper. Distribute instructions to trusted friends on where to find the 13 things, and what conditions are needed to access them. For example "Hand over to londons_explorer only. If you know he is dead, hand the key to XYZ person. If you cannot contact XYZ for over 5 years, destroy the envelope."
- pshc 5y agoThere's no consensus because there's no best answer. Here's an example of what you could do. Generate a new seed phrase on a hardware wallet. Encrypt the seed phrase using https://github.com/FiloSottile/age https://github.com/FiloSottile/age and print out the encrypted seed. Store the paper in a safety deposit box. Keep the hardware wallet at home in a safe. Write down the encryption key and the hardware PIN in an envelope to be opened in the event of your death. All that said, this particular example is vulnerable in that you could be held at gunpoint and lose everything. So next we start talking about cold wallets vs hot wallets...
- Scoundreller 5y ago> Generate a new seed phrase on a hardware wallet Now you're depending on the random number generation of a hardware wallet. And (possibly) depending on its method of deriving multiple private keys from a single seed phrase.
- amatecha 5y ago"leaving such a large amount of Bitcoin accessible on a phone" "A SIM swap attack [...] gives the hacker access to the victim’s phone" Is it just me or this article massively misrepresenting what a SIM swap attack actually does? Unless there's more to the story, no one got access to Jones' phone. They intercepted 2FA SMSes so they could get access to a wallet service or whatever.
- ChrisArchitect 5y agoIs this Hamilton, Ontario, Canada?! Unclear Also, Josh Jones, the founder of DreamHost? wow. heh Edit: Sorry, because I read it on outline/archive I didn't see the glaring Hamilton Spectator logo at top and related Canada nav. Thanks
- smnrchrds 5y agoIt is in the text as well. > Jones first reported the theft to the Los Angeles FBI, who then brought in other U.S. and Canadian agencies as the investigation grew.
- latchkey 5y agoYes, the same Josh Jones. He also created bitcoinbuilder.com, which among other things, brokered the sale of people holding Mt. Gox bitcoin after it collapsed. If you held bitcoin on Mt. Gox, you could sell it to him and he then resold those rights. Now that it looks like there is a settlement coming next year, he is still sitting on a mountain of coin. Pretty amazing that he got hacked. He is super technical. In other words, it can happen to the best of us.
- walrus01 5y agoThis is a fine example why nobody should rely on SMS "2FA" for anything. SMS "2FA" is not actual 2FA SS7/PSTN are horribly broken. People need to stop using them entirely, whenever possible, and stick to that as a firm principle. For the same reason why scam calls and fake caller ID are epidemic. Just disregard the existence of the PSTN, even if your phone has a DID, never give it to anyone or use it for anything. I say this as someone who's worked in telecom for 20 years. Social engineering mobile phone operator customer service departments to execute a SIM swap attack is trivially easy if you already possess some basic personal info about the target. You should never rely on having something important that's only protected behind a SMS-based password reset/login authentication module.
- croutonwagon 5y agoSurprisingly it’s usually banking and investment company’s that require SMS based MFA. Including my main 401k brokerage. In those cases I keep a google voice number. It’s also the same number I use to give to anyone/any company and it’s just on do not disturb 24/7. If I need to deal with a company on that number I just turn off DND. This practice of never giving out my actual number has drastically decreased the number of “car warranty” trash calls to my actual phone. They all go to that and generally a message is never left, and the phone doesn’t ring. Sometimes I get a voicemail of 3 seconds of dead air but that’s it. I know a lot of people de-google but my thought is this isn’t a normal PSTN endpoint, and it’s not nearly as easy to sim swap, if not impossible but still works as a second factor. And I’m not aware of another service that can do it better and like it or not, google is a big target so I trust their auth over some other fly by night competitor.
- walrus01 5y agoMy strategy for people that need to reach me by voice involves a one step IVR on my own asterisk system. This IVR is linked to a DID that I give out for this purpose. It answers and has a voice greeting prompt that says something like "press five zero zero to be connected". If someone does that, x500 initiates a new outbound call to my actual number, preserving the calling party's caller ID. This cuts down on 99% of your car's extended warranty and IRS scam calls.
- bhouston 5y agoHe should have run just a failed ICO and pocketed the funds as fees to related parties. I understand this is how Metakoven, the NFT king, got his start? https://www.reuters.com/investigates/special-report/finance-crypto-sundaresan/ https://www.reuters.com/investigates/special-report/finance-... Better to claim incompetence than it is to actually steal.
- WFHRenaissance 5y agoDoes his name happen to be Freddy?
- rendall 5y agoThe headline "Teen Fingered by FBI Probe" is the missed opportunity, here. Yes, I'm immature enough to happily take the karma hit on this.
- DeathArrow 5y ago>U.S. investigators discovered that some of the stolen cryptocurrency was used to buy a unique online gaming name. Can bitcoins be tracked?
- jimmydorry 5y agoOf course. Bitcoin is an open ledger that permamently records the flow of tokens to and from each address. You may not know who owns a given address, but if you can tie an identity (by way of KYC laws) to a given address in a chain of transactions, you can "follow the money" as you will.
- DeathArrow 5y agoI hope Elon Musk keeps his bitcoins safe. :D
- thefounder 5y agoJust use webauthn...why is so hard to get that sms and otp is flawed?
- hazza_n_dazza 5y agoits funny to think that if bitcoin crashed tomorrow all this could be for $2.84c