4 ms·

Sorry for this possibly stupid question - really not into crypto space (and not in small part because of these types of stories). But, these hackers walked awa

by ejb999 5y ago

Sorry for this possibly stupid question - really not into crypto space (and not in small part because of these types of stories). But, these hackers walked away with $320M in ether, but is what they did actually illegal or did they just exploit a flaw in the code that allowed them to make huge profits on someone else's mistake, but wasn't actually illegal? Does the FBI even get involved with cases like this? or is it just the wild west out there, and may the best hacker win?

whatever1 5y ago
The better feature is that it is also irreversible. Irreversible contracts with holes that you cannot dispute in a court of law.
- koonsolo 5y ago
  It's not really irreversible, it's irreversible by consensus. So if there is a consensus to roll back, it can be done. And in fact it has been done in the past https://levelup.gitconnected.com/how-ethereum-reversed-a-50-million-dao-attack-cee528d8c030 https://levelup.gitconnected.com/how-ethereum-reversed-a-50-...
  - whatever1 5y ago
    It is done only if the supreme leaders decide to push for a fork. They did it once, and it is not clear what criteria they used to do so. Should we expect that the core dev team will push for a fork again? If so, what is the threshold for future scams? 100M? 10? If I get scammed of $100k don’t I deserve my money back? Are we going to create a fork for every dispute, or are we going to just ignore all disputes? The whole thing does not work.
    - koonsolo 5y ago
      Seems to work. Everyone can decide for their own if they want to use the fork or not. Like I say, it's a consensus. Remember Ethereum Classic? Well, that network was powered by those who didn't agree with that rollback. Isn't it better to make up your own mind than to have some 'leader' decide for everyone? Welcome to decentralization.
rafale 5y ago
I don't think we could say they walked away yet. Cashing that money is going to be much harder than the hack itself imo. They might have already compromised themselves if any of their interactions with the contract, including past interactions when they were still experimenting with the exploit, was not properly annonymized (used tor + vpns + public internet Hotspot). There are a few companies that specialize in tracking blockchain hackers. Not to mention law enforcement.
- franknstein 5y ago
  Do you think this amount of money could be used to pump up some other crypto and safely (legally) profit on that instead of simply cashing the money and getting caught?
  - rafale 5y ago
    The blockchain is public. If the hacker(s) try that, it would be know and the funds will tracked as they move across coins and accounts . They could use a mixer to launder the funds but that may make it even harder to cash out because exchanges will lock your account if u deposit from an address that's remotely related to a mixer output address.
jesusthatsgreat 5y ago
If you see an ATM churning out free cash, do you take it and say nothing? You are after all profiting on someone elses mistake... It's the same situation. Taking money that is not yours is a punishable crime. It's that simple.
- ejb999 5y ago
  Is it though the same thing? obviously taking cash spewing out of an ATM is illegal - but I honestly not sure if this is the same thing. I am thinking more along the lines (made up example), you studied the trading in certain stocks and figured out a pattern where big investors were always buying huge blocks of stock XYZ right before the close, and so the price went up - if you picked up on that, and then front-ran those trades and then sold them back to the big buyer while they are buying at the close - you are not doing anything illegal - you are exploiting inefficiencies in the system (and making a pile of dough.) Not a perfect analogy I know - Just trying to understand where this 'hack' falls on that spectrum of exploiting inefficiencies vs sticking a gun in someones face.
  - danielvf 5y ago
    This hack was by defeating access controls - it at least can't argue that it was just good trading.
  - bombcar 5y ago
    The law takes intent into play - a case of note was https://www.nytimes.com/2021/02/16/business/citibank-revlon-loan.html https://www.nytimes.com/2021/02/16/business/citibank-revlon-... - the ruling basically said "normally, this would be a reversible mistake, but the particulars indicate it wouldn't be". The fact that the "owners" of the code fixed the code before it was exploited would come down heavily on the "illegal/fraud" side of things if it were litigated. If, however, they knew about it, and there were cases of it being done, and explicitly did nothing it possibly could be argued to be intentional.
pornel 5y ago
Legality is a concept that exists only under a jurisdiction of a government. Blockchains are supposed to be sovereign, code-is-law, free from governmental meddling. So by the spirit of the blockchain concept and smart contracts, it couldn't be illegal, nothing can. Everything happened exactly to the letter of the contract, and there's no judge to disagree. Of course there's recurring theme of crypto users shouting "fuck governments, we're censorship-resistant!" on the way up, and "that was illegal, I'm calling the FBI!" on the way down.
danielvf 5y ago
Contrary to what most people on hacker news seem to believe, or believe others believe, yes, it's a crime, and yes, the FBI / law enforcement is often involved. (But don't seem to catch people.) In US law, theft is taking someone's property with the intent of depriving them of it permanently. It's very established in US cases that cryptocurrencies are property. The taking part is very public record. I don't think it would be hard to prove that someone intended to steal this money, given all the work involved that is publicly viewable. It is indeed a Wild West in crypto land, but not because stealing is legal, rather because the odds of getting caught are slim, and so successful bandits keep right going.
- Miner49er 5y ago
  Has this actually been tested in court? Has someone been convicted of stealing when exploiting a bug in a smart contract?
  - qayxc 5y ago
    That'd be interesting to know. I'd think that the involved parties would rather not take the "official" route, because that could force them to disclose business practices that might be questionable. It looks as if staying unregulated and operating "in the shadow" is more important to the crypto world than legal security. It seems as if you can't have both.
- albrewer 5y ago
  > theft is taking someone's property with the intent of depriving them of it permanently I don't disagree with you here, but in this case the asset was freely given. The giving was a mistake, but from what I understand if someone sends you something you're under no obligation to send it back to them.
hashmal 5y ago
Laws around cryptocurrencies vary widely between countries. In a good chunk of them, while not considered to be "money", bitcoins are viewed as "digital assets" (that you maybe have to report for taxes) and as such theft laws fully apply (but of course the thief still has to be found and not be on the other side of the world...)
TrackerFF 5y ago
Laws are laws - cryptocurrencies aren't necessarily exempt from following laws. I know the crytpo folks like to repeat the "CODE IS LAW" mantra, but it's not that simple. Imagine that that you write some complex contract which basically makes the signee to hand over everything they own to you. And you get them to sign that contract. If it had been that simple, then you could just mail out such contracts to the whole country, and go collect your new fortune. But we know it's not that simple. Likewise with smart contracts. A "hacker" could argue that they fulfilled some criteria, which then activated some contract - but my guess is that it would legally end up in the same way as with the above example.
hogrider 5y ago
Just a matter of time before a tax heaven declares they can bring over these stolen funds for a puny fee. Then it's legal under that jurisdiction. Say Iran wanted to do this to have some revenue to offset sanctions, no one can stop it.

by ejb999 5y ago

whatever1 5y ago

The better feature is that it is also irreversible. Irreversible contracts with holes that you cannot dispute in a court of law.

koonsolo 5y ago
It's not really irreversible, it's irreversible by consensus. So if there is a consensus to roll back, it can be done. And in fact it has been done in the past https://levelup.gitconnected.com/how-ethereum-reversed-a-50-million-dao-attack-cee528d8c030 https://levelup.gitconnected.com/how-ethereum-reversed-a-50-...
- whatever1 5y ago
  It is done only if the supreme leaders decide to push for a fork. They did it once, and it is not clear what criteria they used to do so. Should we expect that the core dev team will push for a fork again? If so, what is the threshold for future scams? 100M? 10? If I get scammed of $100k don’t I deserve my money back? Are we going to create a fork for every dispute, or are we going to just ignore all disputes? The whole thing does not work.
  - koonsolo 5y ago
    Seems to work. Everyone can decide for their own if they want to use the fork or not. Like I say, it's a consensus. Remember Ethereum Classic? Well, that network was powered by those who didn't agree with that rollback. Isn't it better to make up your own mind than to have some 'leader' decide for everyone? Welcome to decentralization.

rafale 5y ago

I don't think we could say they walked away yet. Cashing that money is going to be much harder than the hack itself imo. They might have already compromised themselves if any of their interactions with the contract, including past interactions when they were still experimenting with the exploit, was not properly annonymized (used tor + vpns + public internet Hotspot). There are a few companies that specialize in tracking blockchain hackers. Not to mention law enforcement.

franknstein 5y ago
Do you think this amount of money could be used to pump up some other crypto and safely (legally) profit on that instead of simply cashing the money and getting caught?
- rafale 5y ago
  The blockchain is public. If the hacker(s) try that, it would be know and the funds will tracked as they move across coins and accounts . They could use a mixer to launder the funds but that may make it even harder to cash out because exchanges will lock your account if u deposit from an address that's remotely related to a mixer output address.

jesusthatsgreat 5y ago

If you see an ATM churning out free cash, do you take it and say nothing? You are after all profiting on someone elses mistake... It's the same situation. Taking money that is not yours is a punishable crime. It's that simple.

ejb999 5y ago
Is it though the same thing? obviously taking cash spewing out of an ATM is illegal - but I honestly not sure if this is the same thing. I am thinking more along the lines (made up example), you studied the trading in certain stocks and figured out a pattern where big investors were always buying huge blocks of stock XYZ right before the close, and so the price went up - if you picked up on that, and then front-ran those trades and then sold them back to the big buyer while they are buying at the close - you are not doing anything illegal - you are exploiting inefficiencies in the system (and making a pile of dough.) Not a perfect analogy I know - Just trying to understand where this 'hack' falls on that spectrum of exploiting inefficiencies vs sticking a gun in someones face.
- danielvf 5y ago
  This hack was by defeating access controls - it at least can't argue that it was just good trading.
- bombcar 5y ago
  The law takes intent into play - a case of note was https://www.nytimes.com/2021/02/16/business/citibank-revlon-loan.html https://www.nytimes.com/2021/02/16/business/citibank-revlon-... - the ruling basically said "normally, this would be a reversible mistake, but the particulars indicate it wouldn't be". The fact that the "owners" of the code fixed the code before it was exploited would come down heavily on the "illegal/fraud" side of things if it were litigated. If, however, they knew about it, and there were cases of it being done, and explicitly did nothing it possibly could be argued to be intentional.

pornel 5y ago

Legality is a concept that exists only under a jurisdiction of a government. Blockchains are supposed to be sovereign, code-is-law, free from governmental meddling. So by the spirit of the blockchain concept and smart contracts, it couldn't be illegal, nothing can. Everything happened exactly to the letter of the contract, and there's no judge to disagree. Of course there's recurring theme of crypto users shouting "fuck governments, we're censorship-resistant!" on the way up, and "that was illegal, I'm calling the FBI!" on the way down.

danielvf 5y ago

Contrary to what most people on hacker news seem to believe, or believe others believe, yes, it's a crime, and yes, the FBI / law enforcement is often involved. (But don't seem to catch people.) In US law, theft is taking someone's property with the intent of depriving them of it permanently. It's very established in US cases that cryptocurrencies are property. The taking part is very public record. I don't think it would be hard to prove that someone intended to steal this money, given all the work involved that is publicly viewable. It is indeed a Wild West in crypto land, but not because stealing is legal, rather because the odds of getting caught are slim, and so successful bandits keep right going.

Miner49er 5y ago
Has this actually been tested in court? Has someone been convicted of stealing when exploiting a bug in a smart contract?
- qayxc 5y ago
  That'd be interesting to know. I'd think that the involved parties would rather not take the "official" route, because that could force them to disclose business practices that might be questionable. It looks as if staying unregulated and operating "in the shadow" is more important to the crypto world than legal security. It seems as if you can't have both.
albrewer 5y ago
> theft is taking someone's property with the intent of depriving them of it permanently I don't disagree with you here, but in this case the asset was freely given. The giving was a mistake, but from what I understand if someone sends you something you're under no obligation to send it back to them.

hashmal 5y ago

Laws around cryptocurrencies vary widely between countries. In a good chunk of them, while not considered to be "money", bitcoins are viewed as "digital assets" (that you maybe have to report for taxes) and as such theft laws fully apply (but of course the thief still has to be found and not be on the other side of the world...)

TrackerFF 5y ago

Laws are laws - cryptocurrencies aren't necessarily exempt from following laws. I know the crytpo folks like to repeat the "CODE IS LAW" mantra, but it's not that simple. Imagine that that you write some complex contract which basically makes the signee to hand over everything they own to you. And you get them to sign that contract. If it had been that simple, then you could just mail out such contracts to the whole country, and go collect your new fortune. But we know it's not that simple. Likewise with smart contracts. A "hacker" could argue that they fulfilled some criteria, which then activated some contract - but my guess is that it would legally end up in the same way as with the above example.

hogrider 5y ago

Just a matter of time before a tax heaven declares they can bring over these stolen funds for a puny fee. Then it's legal under that jurisdiction. Say Iran wanted to do this to have some revenue to offset sanctions, no one can stop it.