29 ms·

Social engineering scam that nearly cost me all of my ETH

434 points by floetic 5y ago

rasz 5y ago
Note to self: -invite Thomas to a private Airbus VTOL demo day in another city -buy him first class ticket -offer to send a limo to the airport -send a limo with a big guy holding a wrench -instant $100mil profit
keithalewis 5y ago
News flash: you were social engineered into buying ETH in the first place.
- buttocks 5y ago
  If a scammer scams you out of a scam, do you come out ahead?
  - deleted 5y ago
    [deleted]
  - keithalewis 5y ago
    It worked for PT Barnum.
- randomhodler84 5y ago
  Eth is a premine scam sure, but the dude has $130M Of it, so I don’t think he is crying over that part
  - MPSimmons 5y ago
    How much purchasing power does that afford? If he wanted to buy an island, pay for it to have infrastructure added, and then also hire security and business payroll, could he actually exchange the Eth to the applicable currencies? I know the numbers line up, but is that amount of liquidity in the system?
    - randomhodler84 5y ago
      Good question. Mostly yes, but it would take some coordination. At $100M you would want to split trade across exchanges and probably some defi too, but yeah, you could. Eth has about $10M/-2% on major exchanges. Not that you would need to convert to fiat. If you ran your own island, just pay for goods and labor in Bitcoin or Ether directly.
    - capableweb 5y ago
      > could he actually exchange the Eth to the applicable currencies? I know the numbers line up, but is that amount of liquidity in the system? Yes, Coinbase, Binance and other big exchanges offer OTC trading where you can trade pretty large amounts without impacting the market at large.
      - Qub3d 5y ago
        Counter-point: there is currently another submission on HN suggesting that crypto "off-ramps" are really problematic and difficult at the moment. https://news.ycombinator.com/item?id=30322296 https://news.ycombinator.com/item?id=30322296
        capableweb 5y ago
        Breaking news: "off-ramps" to centralized currencies is centralized. It's not difficult if the source of your cryptocurrencies is legitimate, while difficult if you have a hard time explaining how it's legitimate. I think the system works as intended.
        Qub3d 5y ago
        I'm confused then, are you in support of cryptocurrency? Because what you're describing (the "system") sounds an awful lot like reinventing banks from first principles but much less efficiently. If that is how it's intended to function then why are we bothering with this at all? And aside from KYC issues, another recently posted article pointed out that when a single individual tried to unload around a 1500 BTC (%0.03 of the coins in circulation at the time) it caused a liquidity crisis that crashed the market by 20%.[1] In this case the individual in the Twitter thread has an amount of ETH of that magnitude. Basically because crypto is performing the job of a speculative asset it results in the liquidity issues that you would see in things like company stock. [1]: https://blog.dshr.org/2022/02/ee380-talk.html?m=1 https://blog.dshr.org/2022/02/ee380-talk.html?m=1 (see footnote 11. The gist is that this sale put enough pressure on the order books that a lot of leverage positions cascaded into selling as well causing the flash crash)
  - hanniabu 5y ago
    Given your username and how salty you are, I'm going to assume you invested in Bitconnect and lost everything b/c you didn't do your own research.
    - randomhodler84 5y ago
      Haha nice one! the world is not anymore the way it used to be, mm mm NO NO No! Bitconeeeeeeeeeeeeeeeect wooo bitconnect! We are coming and we are coming in waves. We are starting and to actually go all over the world. We all built the entire world. Me? Im just out there fiat mining, stacking sats…
    - dang 5y ago
      Please don't cross into personal attack. We ban accounts that do that, and we've had to warn you about this kind of thing before. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- selestify 5y ago
  Low-quality comment.
  - bitcharmer 5y ago
    I'd say GP's comment contributes more to the discussion than yours.
    - selestify 5y ago
      Debatable. GP basically ignores all the interesting parts of the article being posted in order to simply say the usual spiel about how much HN hates crypto. The relevance to the original article is close to nil. I'm calling them out for that -- perhaps in a way that's too terse, but at least I'm not completely derailing the conversation like they're doing. But thank you for prompting a longer response from me.
- throwaway8174 5y ago
  I paid off all my student loan debt and bought a house last summer because I got scammed into buying ETH about 2 years ago. Thanks for your insight though.
  - pessimizer 5y ago
    That just means that you were part of the scam. Hell; somebody approvingly reading this comment might be the bagholder of the future, shooting himself after all of his savings have evaporated into some ETH tycoon's pocket who dumped before the market locked up.
    - whatshisface 5y ago
      Now that the bag holders include major investment houses... Well, if it's possible for a scam to have a successful "exit," that's what happened. They used their funny money to tap in to the real funny money. If all cryptocurrencies went to 0 tomorrow I wouldn't be surprised at all if some part of the "real" financial infrastructure got caught and there had to be bailouts, which we've learned is what happens when the wrong people lose a bet. There's too much money in the system now for it to all be from mom-and-pop marks. That's just not a viable explanation at these market capitalizations. That's not to say that average people aren't going to find out that they're long crypto - but it'd be in the way they found out they were long real estate.
    - throwaway8174 5y ago
  - Grim-444 5y ago
    As a thought experiment, replace crypto in this situation for beanie babies. You managed to buy a bunch of beanie babies before a beanie baby craze started, and sold them at exorbitant prices to other people coming in that were convinced that beanie baby prices would only keep skyrocketing. You took their money, and now I guess as long as they're the bag holders still holding beanie babies when it all falls apart and they become worthless, and not you, it's all good. As long as you managed to make a profit and get out in time it wasn't a scam.
- suikadayo 5y ago
  If that’s the case, I’ve seen way more of that “social engineering” in the Bitcoin community. At least there are uses for ETH
- dang 5y ago
  Please don't post this sort of generic flamebait to HN. It leads to repetitive, predictable, and ultimately nasty threads. And of all the classic flamewar topics this one is probably the most predictable—just what this site is not supposed to be for (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=curiosity%20repetition%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...). If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it. Note this one: "Avoid [...] generic tangents."
TigeriusKirk 5y ago
These scammers went to impressive lengths. They say that often the secret of a magic trick is to put in far more prep work than anyone thinks is reasonable. Con games work the same way. In this case, the effort is worth since the target has something like $175 million in a wallet. The payoff is massive. Worth noting, though, that for all the fancy footwork the point of failure for the scam is him being willing to work with his main wallet rather than a one-off, and when he showed hesitation, they got too impatient. Good security practices were still the answer.
- badRNG 5y ago
  > when he showed hesitation, they got too impatient. This seems to be the common factor among scams, cons, and social engineering strategies. Rushing people will have them bypass protocol, training, and security practices. It's a universal "hack" for our brains; we do things we otherwise wouldn't when rushed. Security practices are like a rituals, standards of behavior that we just don't have time for right now. "The funds are only available for the next hour"; "You will be prosecuted if you don't do X"; "Per the CFO, we need to spend these funds before end of day."
  - kenjackson 5y ago
    I do wonder if they were more patient and said to themselves “let’s build more trust over the next three months” if they would’ve been able to get him to use his main wallet? Great story though. I never realized these smart contracts could be so obtuse and malicious. That needs to be fixed.
    - Nextgrid 5y ago
      Yes - they could've just kept churning out more NFTs for him to "stake" and catch him off-guard when he used his main wallet by accident or maybe even give him legitimate returns (that they bankroll) to convince him to use his main wallet intentionally to get higher returns.
- nfw2 5y ago
  The lengths they went through were mind-boggling to me until he mentioned he has 9 figures sitting in a public wallet. Then it made a lot of sense. At first I thought he had maybe a few hundred thousand, partly because he was happy to accept the free help from a stranger. It's still pretty impressive how competently these scammers were able to discuss and deliver the VTOL work, the Space Falcon game, and entrepreneurial strategy.
dpeck 5y ago
Generalizing, anytime someone is giving you a “gift” but is putting expectations on how you receive it (in this case the wallet destination) that should be a huge red flag. Whether that’s cryptocurrency or a sandwich.
- HWR_14 5y ago
  Most people who invite me over for a sandwich would be insulted if I entered their house, took the sandwich they made me and left. In fact, I probably would never get invited over again.
  - sillysaurusx 5y ago
    Meanwhile I wish someone would come over to take one of my sandwiches. It turns out that human contact in covid’s era is hard to come by. You’re probably right though. But if you ever find yourself near Lake St Louis, MO, feel free to raid our fridge.
    - pritambaral 5y ago
      Your parents is trying to say the same thing: that you'd appreciate some [meaningful] human contact. They suspect you wouldn't invite them again if all they did was raid your fridge, and not even say so much as a "hi".
  - shbooms 5y ago
    true, but if they invited you in and told you had to go stand on a very specfic place in the room, facing a certain direction and to only start eating when they said so, that would be very suspicious and likely result in you opting out.
    - nightfly 5y ago
      Like sitting at the dining room table, and eating only after saying grace?
  - randomhodler84 5y ago
CommieBobDole 5y ago
A good rule of thumb is if somebody you've just met introduces you to someone with an exciting new NFT project that they want your help testing, you're probably being scammed. While NFTs probably have some useful purpose that will emerge eventually, for now you should consider any proposal or offer that involves the term 'NFT' as having about the same value as any offer involving the term 'Nigerian prince'.
- Nextgrid 5y ago
  The "problem" in this case is that the victim himself is all-in on NFTs and crypto.
  - suikadayo 5y ago
    No, victim himself has said in his post that he doesn’t really dabble in the NFT community
  - Qub3d 5y ago
    Well, yes and no. They are clearly all-in on crypto (and who wouldn't be, if I made 100 million on tulip bulbs I'd probably be all-in on tulips, too) but they do state in the featured thread that they "aren't really an NFT guy". Certainly not a great look to have >$100 million in an asset sitting in a single account of any form, though.
pluc 5y ago
Don't do it if you don't understand what you're doing.
- contravariant 5y ago
  I'm not entirely convinced this isn't just the same as 'don't do it'.
  - pluc 5y ago
    When it comes to crypto, 95% of the projects are by people who do not understand it themselves and were sold on it by someone whose sole purpose is to broaden crypto's financial reach and who worked tirelessly to make sure it's obscure/redundant enough that you don't understand it unless you're a developer attempting to implement it or seriously skilled at due diligence. They ran their whitepaper through their advisors to ensure it was clear yet didn't give anything away in terms of how it worked or how the authors get their kickbacks.
- hypertele-Xii 5y ago
  So, don't go to school?
raverbashing 5y ago
"extremely thorough social engineering" Not really, it seems like the usual being extra flattering to earn favours (or worse). The first two messages would have raised several red flags with me. > He's currently working at Ubisoft and offers to help with 3D design and animation Like if I worked for Ubisoft I'd have time to do 3D design for free for some other company.
- jsnell 5y ago
  > Like if I worked for Ubisoft I'd have time to do 3D design for free for some other company. Why is that so hard to believe? It's like suggesting that no professional software engineer would ever contribute code for free into an open source project in their free time. My basic assumption if somebody send a patch to an open source project is not that I'm being social engineered -- it is that they're either using the software or interested in the domain.
  - Nimitz14 5y ago
    I think because the stereotype is that in a gaming company work life balance tends to not be that good.
- Kiro 5y ago
  Most people helping out like this have normal day jobs. Why would working at Ubisoft be different?
- djur 5y ago
  The social aspects of the crypto community are very interesting. The "WAGMI" mindset encourages a kind of freewheeling magnanimity where strangers will offer to help people get involved, give away free coin, bail out people who got scammed, etc. No doubt this is often genuine goodwill, but it's also an effective technique for recruitment (it's longstanding practice for evangelical religions and MLMs), and it creates a situation where a lot of self-interested people looking to get rich quick are mingling in an environment where it's perfectly common to make generous offers with no expectation of return. It's like going to a tech meetup where there are a lot of people working on startups, and who might buy a few rounds at the bar afterwards in exchange for maybe attracting an interested investor or cofounder, but where there's a chance that drinking a seemingly normal beer might give them access to your bank account.
ajross 5y ago
I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And I trust banks, mostly. Who in their right mind trusts contracts someone sends you on Discord? And yet...
- muh_gradle 5y ago
  > Who in their right mind trusts contracts someone sends you on Discord? Exactly. That's where the gullibility is really visible... This is basically a steroid version of "I am Nigerian royalty and I need you to give me money" emails. Your first instinct should always be skepticism.
- chrisco255 5y ago
  I don't trust them. Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. They can snap their fingers and freeze your funds and hold it indefinitely, without a warrant. I admit that the Approval UX for wallets and tokens needs to be improved. Unlimited spend approvals should always be flagged in the UX. And approvals should be atomic (single transaction only, with a clearly listed cap, by default). There are some EIP proposals addressing this, but they will be a ways off from standardization.
  - leshow 5y ago
    > Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. The protest is illegally blocking much of downtown Ottawa, as a result GoFundMe decided to refund the donors. That's far from a "rug"
    - matkoniecz 5y ago
      Note that GoFundMe decision to refund is a change from its previous one that happened only after outcry.
chrisco255 5y ago
This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave when you lend out your assets for interest. The aETH is redeemable for the underlying asset. The scammers created a fake NFT project associated with space and drones, and proceeded to give Thomas a free one, but asked that he stake it (or deposit it into a smart contract), to earn yield in the form of Armstrong ETH, a token they made up that had the same acronym as Aave's (aETH). The catch was that when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them. However, what wasn't normal is that the approval was actually for Aave ETH. If he had only looked at the front end of the scam site, it wasn't obvious what was going on. However, a quick glance at Etherscan revealed that he had signed off on an unlimited spend approval for Aave ETH. Luckily, he had done so on a fresh wallet and not his main wallet that has $100M in aETH. When the scammers tried to get him to stake a second NFT from his main account, he got suspicious and discovered the truth. This scam was specifically targeted at Thomas, and orchestrated over multiple weeks, for the specific assets in his primary wallet. Couple takeaways: - divide your assets across multiple wallets. New wallets are free. Don't put all your eggs in one basket. - use a hardware wallet or an audited battle tested smart contract such as Gnosis Safe for storing significant sums of money. - always verify your transactions - avoid associating your public identity with your main wallet / vault address - be careful, scammers are getting more creative and advanced in technique including standing up professional front end websites to give the appearance of legitimacy
- sillysaurusx 5y ago
  Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last month. Thank you for the breakdown.
randomhodler84 5y ago
Note; dude has $123M in aave wrapped ethereum that he almost granted a scammer access to. Scammers ripping off scammers. Why would you waste time with open source aircrafts. Aircrafts are a regulated thing. Nobody wants to fly in your science project. Put some of that 123 million into starting an actual company. DAOs are bullshit.
- negamax 5y ago
  That's a horrible take on a legit person and project.
  - hn_throwaway_99 5y ago
    Did you take a look at arrowair.com? Everything about that screams "art project". None of it makes sense. There are extreme engineering, economic, and legal challenges to doing have of what they are proposing, so the first thing they are investing in are their crypto projects? Because crypto crypto future future? I don't necessarily think the author is a scammer, but the whole project is the equivalent of "I'm going to launch a rocket to the moon" and then the first thing you do is open a nice website and launch a new token.
  - randomhodler84 5y ago
    You would honestly ride in his ‘open source’ VToL? and use his air taxi service? I don’t think this is legit at all.
  - Nextgrid 5y ago
    The aircraft and/or taxi service might be legit but all the crypto around it is useless complexity at best or a complete scam at worst. If you legitimately wanted to develop an aircraft taxi service, you do not need to involve crypto in any way. Even if you wanted to accept it for payments it's an auxiliary component that merely accounts for it and converts to fiat at some point. The DAO or whatever crypto bullshit is intertwined with it is absolutely a scam.
    - randomhodler84 5y ago
sidcool 5y ago
I feel incredibly dumb for not getting the details of how it happened.
- scyclow 5y ago
  He had $130 million wrapped up in an ERC20 token called Aave wETH (aWETH). ERC20 tokens let you approve another address to spend those tokens on your behalf. Basically, the scammers tried to trick him into approving all of his Aave wETH by creating a fake website designed to make him think that he's approving a different token with the same aWETH symbol.
  - magicalhippo 5y ago
    So besides getting scammed, what use are these ERC20 for?
    - scyclow 5y ago
      They're basically receipts for putting money into a lending pool. In this case he's lending about $130 million, on which he's earning interest, and can get his money back by redeeming those tokens.
      - harambae 5y ago
        My apologies for being so ignorant on crypto lending, but I'm not even sure where I'd look up the details of how this system works. When Thomas puts that money into the lending pool, what happens if the borrower defaults? Did the borrower put up some non-liquid collateral? Did someone do a background/credit check? Who takes the loss, is it split across the pool? I understand how traditional bank loans work, I'm a little lost how much risk is being taken by the loan issuer here.
        scyclow 5y ago
        Aave's documentation [1] is pretty good if you're interested in doing a deeper dive. But yeah, it's a collateralized loan where the borrower stakes some ETH. So the idea is that I can take $100 worth of ETH and put that up as collateral for a $75 loan. And if the value of my collateral drops due to the ETH<>USD exchange rate I have to stake more collateral. If I don't (or if the exchange rate moves below a certain point) then my collateral is automatically liquidated at a discount. So in this case, if the value of my collateral falls to $80 the contract will put it up for sale at $75 -- this creates an arbitrage opportunity, so the liquidation will likely happen very quickly. There are other lending protocols where you can stake other assets (NFTs, other tokens, etc.), but this is my understanding of how Aave works. [1] https://docs.aave.com/faq/ https://docs.aave.com/faq/
kelp 5y ago
This was an absolutely fascinating and chilling story. The thing that struck me about it is the scam didn't work for a few reasons: 1. He typically had a practice of not using his main wallet for things like this. 2. He got wary and actually read the smart contracts. This is a level of technical competence required that's going to mean most people have to offload this to a trusted intermediary. And then what's the point of all the decentralization ideology? Because we just re-invented banks.
- tylersmith 5y ago
  The purpose of decentralization is solely censorship resistance. It has nothing to do with consumer protections, consumer education, or easier to check software.
  - dehrmann 5y ago
    Censorship and consumer protections go together since they're both roles regulators play.
    - tylersmith 5y ago
      Decentralization can't provide consumer protections regardless of what regulators do. The one thing it can do is resist censorship and things indistinguishable from censorship, like software failure.
  - elil17 5y ago
    What exactly is censored when you use paper currency?
    - randomhodler84 5y ago
      The amount. A real example is CNY, which is limit to 100 yuan notes, deliberately to make it hard to move large sums. 1000 USD bills exist but are very rare. 1000 euro note exists but I think that’s on the way out. Your point that cash is censorship resistant is good, yes and we need to make sure it remains, however the physical limitations are defacto censorship.
muh_gradle 5y ago
I don't understand why in the world Thomas wouldn't directly communicate via phone and video chat to any of these people first before doing serious business and potentially traveling across the country for random anonymous folks on Discord. Social engineering is so much easier when you engage in faceless, voiceless communication. This could've been shut down so much more easily if they put a real human being to match the messages. When things actually matter, I need more than just a Discord avatar and a handle to identify someone.
- kenjackson 5y ago
  How would that help? Are you thinking it might be easier to prosecute with a voice or image file?
  - muh_gradle 5y ago
    It's an extremely basic check. If I'm going to be getting on a plane to see someone, I want to do a basic background check.
    - kenjackson 5y ago
      But what are you checking with a call? That just seems like creating a false sense of security since there is virtually no additional “useful” information that is being sent over the audio channel above and beyond what is in text.
      - muh_gradle 5y ago
        I'm checking to see if this Linh Nguyen that some random Discord user referenced me is the Linh in front of me on Zoom. A phone call isn't ideal, but it's still better than nothing. At the very least, there's one more identifying factor though that may help with spotting any scams, but yes, it can be false sense of security if you rely purely on it. If I'm John Doe and I made some merge requests to your open source project for a couple of weeks, is that alone really enough to potentially meet me in some city far from yours? That's essentially what the author was prepared to do.
ttiurani 5y ago
"She tells me a bit about her metaverse project, Space Falcon. I'm not really sold on it, but I'm not really an NFT person so I didn't have any reason to think it was a bad idea either.[...] It seems kind of like a get-rich-quick scheme, but again, that's kind of how I see a lot of NFTs. With all that she's doing for Arrow, there's no harm in showing a little support." The real takeaway from this is that it's dangerous to break your moral compass and sense of reality to the point where you think helping out people who are pushing an obviously fraudulent business, is ok and normal.
- grp000 5y ago
  I don't see it that way at all. The NFT vector is arbitrary. The point was to drain his accounts and nothing more. If a less suspicious method was available, I'm sure the scammers would have taken that one.
  - matkoniecz 5y ago
    Is there any case of NFT that is not some combination of get-rich-quick scheme, Ponzi scheme, search for a bigger fool, FOMO-powered stupidity, extracting money from naive people or satire of NFT? And NFT part adds anything substantial and is not replaceable by regular transfer (either transfer of money or BTC-like)?
    - MPSimmons 5y ago
      I'm not convinced it isn't crypto itself, and NFT is just an extension of that.
      - randomhodler84 5y ago
        It’s degrees of suspension of disbelief. Software is just tricking sand into to thinking. I have no issue believing that an imaginary consensus stored ledger in thousands of computers all secured by massive amounts of energy and limited to 21M units over 100 years might be valuable. The ability for people to copy this software idea? Not valuable. The ability for people to issue new tokens on existing chains? Not valuable. The ability for people to post and sell jpegs, Not valuable. Only original ideas are scarce. It’s the first step vs the n-th step.
vmception 5y ago
The other thing to understand is that legitimate interactions look just like this in the crypto space.
- randomhodler84 5y ago
  Scammers ripping each other offer on discord. Today it’s apes, next week it will be houses. I can’t believe they can convince people to lend liquidity to bridges, myself.
  - blueboo 5y ago
    Houses? How about pension funds, top-flight companies, countries… a lot of smart and powerful folks are face-planting into this griftspace
    - vmception 5y ago
      Its the wealth redistribution people have been hoping for Cant keep your assets? Someone else who can code can! Looking forward to the technocrat plutocracy I’m being facetious as I think there will continue to be a balance and cat / mouse game.
      - randomhodler84 5y ago
        My fear is it just becomes another side show. Ethereum is going to become ebay. Yeah you can trade rare coins but it’s mostly just trash changing hands and clogging up the mail system.
    - axiosgunnar 5y ago
      We should make it blatantly clear and public that we will not he bailing out banks, pension funds etc that will inevitably get burned on some crypto scam.
      - randomhodler84 5y ago
dshpala 5y ago
Could someone please explain what's terrifying in the function spendWalletAWETH()? Just two lines... Is the idea that tokenToBeApproved.allowance() can do bad things? Code: https://twitter.com/thomasg_eth/status/1492663290715152384/photo/1 https://twitter.com/thomasg_eth/status/1492663290715152384/p...
- randomhodler84 5y ago
  Onlyowner modifier means the contract creator can call this function and transfer all the funds from the victims wallet (if they have previously approved). Tokentobeapproved is a variable declared in the contract. It will be pointing at the aWETH contract, which is the claim token for ETH on aave, a money market.
oefrha 5y ago
This highlights how scary it is to interface your savings with these “smart contracts”. Most people have no way to know what they’re actually going to do; the tiny slice of people capable of investigating can hardly remain vigilant at all times. Like, if you ask me to log into something with my bank account, all alarm bells would go off; if you ask me to stake this, approve that with my eth wallet, well, just another weird smart contract thing, right?
- sterlind 5y ago
  Yeah this makes me terrified of Ethereum. This kind of scam just wouldn't work on BTC. You're passing tokens around. At fanciest you're time-locking wallets or using M of N signatures. You're not like, installing arbitrary code in your bank account. I find ETH very technically interesting but it feels like it's full of sentient foot-guns.
tasha0663 5y ago
> a DAO working to build open-source VTOL aircraft and air taxi protocol The most reasonable conclusion is that the hacker was sent from the future to try to avert the creation of DAO-controlled flying cryptodrones.
- alphachloride 5y ago
  Haha! When I read it, I had a moment of uncertainty: is this a story about one scammer scamming another?
fortran77 5y ago
And this is going to replace money?
- threeseed 5y ago
  More replacing traditional money laundering and fraud.
- TrackerFF 5y ago
  More like: This is going to replace banks Imagine if every person you interact with could "be their own bank", and define the logic between your transactions. It's fully transparent, so you can audit it as much as you want to - but still, that's the amount of headache you'd have to deal with, to fully trust the other part. There are lots of upsides to this, but there's no shame in saying: No, I'd rather not. I'll keep trusting the trust-based system I've been using since forever.
ryan93 5y ago
His opensource VTOL project may be one the most delusional crypto projects out there.
- harambae 5y ago
  I'm also surprised there aren't more comments on this. Why does aeronautical engineering require cryptocurrency?
sireat 5y ago
I am curious why is all of Thomas 100M+ in a single wallet ? Also it seems strange to hold most of it in aETH, wouldn't you want to diversify a bit?
deleted 5y ago
[deleted]
pepesza 5y ago
Financial privacy is a must-have, not a nice-to-have feature. Financial privacy does not prevent one from being able to pay taxes. But it definitely prevents this type of attacks.
karmakaze 5y ago
When I hear "NFT", my mind goes into binary options mode, then tunes out.
alienalp 5y ago
If you don't remember which smart contracts you have gave permissions of which coins you can check from debank. And you can also cancel one by one. It is not possible for humans to use ethereum without interacting with proxy. Front ends always can be comprimesed. When interacting with smart contracts approving spending is most important interaction to be careful about.
birdyrooster 5y ago
Boo fuckin hoo
adam_arthur 5y ago
Imagine Bill Gates stored all his money in cash in a room in his house. That's probably more secure than crypto, where click of a button can siphon it all away. At least with physical money you have to be able to carry it, and physically present to steal. I'm sure there are strategies like using multiple wallets etc, but overall it will never be mainstream if you put the onus of security on the individual. Literally just typo-ing an address can disappear all of your money.
cmckn 5y ago
> The aWETH that I approved was not Armstrong ETH, but rather Aave's aWETH. On my main address, almost all of my ETH is sitting in Aave... Just one example, but this entire thread is Greek to me. What the hell is “staking an NFT”? I am feeling so left behind by this crypto nonsense. Is this what getting old is like? (I’m not yet old)
- nfw2 5y ago
  Same, and I am probably younger than this guy. My really basic understanding after reading very slowly is he got some crypto asset from scammer, and he needed to approve lending it out to get some sort of crypto interest on it. But approving the "lending X out" action apparently looks exactly like the same as the "give Y away" action if you don't look closely at the contract. Maybe it's just ignorance, but the whole system seems like a mess to me.
  - hypertele-Xii 5y ago
    In the same way as if you lend cash to someone, you have to read the contract you're both signing attesting to the fact they owe you that amount, or they can just disappear with the cash.
- The_rationalist 5y ago
- progval 5y ago
  This seems to be vocabulary invented by a specific app (probably to sound cool by association, because of Proof of Stake), described in the screenshot here: https://twitter.net/thomasg_eth/status/1492663229784408065 https://twitter.net/thomasg_eth/status/1492663229784408065 As far as I understand, it's just a synonym for "lending" here. They even use the word "leasing" for the people on the other side.
  - 0x64 5y ago
    "Staking" was definitely not invented by this protocol as a term, and is not really related to the consensus protocol, barring the fact that you lock up ("stake") some underlying token in a smart contract. Various protocols offer staking as a way to lock funds, which might distribute a pre-existing token allocation to the people staking as a form of interest. This could be done for a myriad of reasons, like getting a governance token in exchange, or in order to limit the liquidity/dumping of new tokens. I can't say that I were too well versed on what has been happening in the defi space in the last year, but it's definitely not a new term.
axiosgunnar 5y ago
Some friends and acquaintances keep bugging me that I should get into crypto... but I would be too scared of loosing it all in one day, be it to a scam, sending to an non-existing address, loosing my hardware wallet etc. Tbh I would feel safer having 10k in cash (at home at least) than in crypto. At least the attack vectors (fire, burglary) are known and tangible. Imagine founding a startup, working your ass off living off ramen for a few years, every day worrying that it all might be for naught, and then through a combination of skill, determination and luck you do make it and your startup is worth a few millions... and then suddenly you make a small mistake and lose all your shares! This is how crypto feels to me. Maybe I am just not made for crypto.
lifeisstillgood 5y ago
A couple of things shook me about this - firstly I guess is the amount that was up for stealing - 100M just "sitting there" seems crazy - how many other multi-multi millionaires have their wealth just sitting in one bank account? Second scam is the wrong word. A confidence scam originally mean the mark had to bring a suitcase of cash to give confidence to the scammers that he had the means to join their get-rich scheme - and of course he would walk away with a suitcase of old newspapers. But this is almost a new kind of crime - he did not present or move his money, he did not give away any keys. it is the very mechanism of money transmission that is the issue. SWIFT is rarely seen as part of crimes - but crypto is pointing towards a new world. Imagine "permissioned blockchains" ie Bank Of England coins, this would still be a real viable scam. Proving you did not mean for people to take your 100M and rapidly move it would be a slow process. Stop orders would be a common place activity, potentially holding up long chains of transactions. Even without permission-less crypto the move to a digital native currency is a long process
- jazzyjackson 5y ago
  > 100M just "sitting there" seems crazy By virtue of converting the ETH to AAVE wrapped ETH, they're earning interest by loaning out the underlying ETH. Who is taking out loans and paying interest for ETH I have no idea. Plus, even without the AAVE wETH, they expect ETHs value to accrue faster than any other asset, so there's no cost to letting the money just sit, as opposed to your USD in savings depreciating over time.
radicalriddler 5y ago
Surprised this hasn't been commented already but: https://threadreaderapp.com/thread/1492663192404779013.html https://threadreaderapp.com/thread/1492663192404779013.html God I hate twitter threads, especially 32 tweets long!
herodotus 5y ago
So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me. Surely this says that the world at least of ETH (whatever that is) is really really broken!
- dlubarov 5y ago
  I don't think the NFT is very important here; basically the scammer's website asked the victim's wallet to sign a message, using the private key that holds their ETH. It looks like the message in this case would have given the attacker permission to transfer the victim's aWETH, which represents ETH that has been deposited into an Aave lending pool. These transfer permissions are something all ERC-20 tokens support. Typically users will only sign messages sent from trusted websites, just as they would only install software from trusted sources. Or they can sign a questionable message from a separate wallet which doesn't hold much value, as the victim did here. Granted, this isn't a great situation. It can be hard to know which websites to trust, and even trusted websites can be hacked and then send malicious messages to unsuspecting users.
- labrador 5y ago
  According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things. at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, that’s right, there’s no offer/confirmation step in sending tokens back and forth, someone who knows your wallet can just drop stuff right into it, so, like, pin that somewhere in your brain. Line Goes Up – The Problem With NFTs https://youtu.be/YQ_xWvX1n9g?t=4970 https://youtu.be/YQ_xWvX1n9g?t=4970
  - dlubarov 5y ago
etamponi 5y ago
Someone else already commented on this, but doesn't _everybody_ just realize that this is way too complicated and error prone? Signigning a token (whatever that means, I never saw so much nonsensical jargon in my life) gives a random person possible access over _all_ of your money??!! And this _by design_ can't be audited by a central authority that guarantees against scams. If I had to read the source code of all my wire transfers, I'd probably just barter my services for some milk and bread, it definitely seems smarter.
betwixthewires 5y ago
I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You want code to be law? This shit isn't ready for the mainstream, and some of these architectural decisions are indicative of engineers who are in over their heads (but that's almost all code nowadays, even mine). They build a mechanism that enables me, at the click of a button, to give away control of my fortune, and they designed the system so that anyone can design whatever interface they like to get you to sign any transaction they like. It's laughable. I'm in disbelief. And this is web3? No thanks, I think I'll stick with bitcoin or whatever, keep it simple. At least I can tell what a bitcoin transaction does without having to learn a programming language.
- orasis 5y ago
  When it comes to code, we’re all in over our heads. I can reason about significantly more complexity than most developers I know and it’s still laughable how little complexity I can manage.
- ikt 5y ago
  Think of all the scams happening over TCP/IP every day! They built this thing where anyone can pretend to be a bank website? No checks or security? It's laughable. I'm in disbelief. And this is the web?
  - betwixthewires 5y ago
    I never said I expect ethereum or web3 or whatever to be entirely scam free. I said that having the ability to send anyone any transaction and to their eyes have it look like any other sort of interaction they like unless they can read solidity and audit the code themselves is a very very large security hole.
  - markstos 5y ago
    There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank. At least Chrome tracks malicious websites. By comparison, there seem to be no checks in place to prevent writing an ethereym contract that drains a victim’s wallet.
Johnny555 5y ago
I'm a software engineer and consider myself tech savvy but understood only about 10% of the mechanics of this scam
AtlasBarfed 5y ago
I stopped reading at NFT.
northernexposur 5y ago
Everyone should watch this: https://m.youtube.com/watch?v=YQ_xWvX1n9g https://m.youtube.com/watch?v=YQ_xWvX1n9g
creatonez 5y ago
So is building an open source vertical takeoff and landing aircraft and accompanying air taxi service part of reality, or part of the blockchain?
ggm 5y ago
Until it's in a bank, he doesn't have $100m. Not that it wouldn't have sucked to lose his potential millions but they are hypothetical value right now. I'd have diversified. Some cash, some ETF, some property. A lot of tax, now or in the future. I wouldn't complain about the tax, even after there's enough for a lifetime. (And yes I know both property and ETF can decline in value, but here's the thing: when you see their book value it's a damn sight more real) Remember, unless I am very mistaken he didn't put $80m of real money in, to secure an amazing 20% ROI which out in your real world would be normally exciting. So the net effect of fees, gas, AML, tax even taking 50% makes him as rich as croesus compared to most people for very low initial input. Do we know what real world $ went in to bootstrap? (I know this story is mostly about the social engineering, which is of course the real problem)
deleted 5y ago
[deleted]
perryizgr8 5y ago
> I'm the founder of Arrow, a DAO working to build open-source VTOL aircraft and air taxi protocol. I don't understand why a startup working on aircraft design is linked to crypto at all. If you have $100M in ETH, the first thing to do is to convert it to USD and put it in a bank, preferably a large one. Then use the money to run your startup. Why would you keep your money in a crypto wallet? Why would you model your startup as a DAO?
sizzle 5y ago
How much of his ETH was at stake here?? Why did they go through so much effort to target him on the hopes that he would 1. Have a large sum of coins 2. Be foolish enough to reveal said account. I love that he wasted 2 weeks of these scumbags and exposed them. I hope they can trace their email address and nab the real people.
- harambae 5y ago
  >on the hopes that he would 1. Have a large sum of coins This part wasn't a guess, it's publicly available information known from the outset
pyb 5y ago
If I understand the gist of the commens so far, he's sitting on 100 million US dollars, and is hoping to build some crypto enhanced flying cars using free labour from volunteers he found on Discord?

434 points by floetic 5y ago

rasz 5y ago

Note to self: -invite Thomas to a private Airbus VTOL demo day in another city -buy him first class ticket -offer to send a limo to the airport -send a limo with a big guy holding a wrench -instant $100mil profit

keithalewis 5y ago

News flash: you were social engineered into buying ETH in the first place.

buttocks 5y ago
If a scammer scams you out of a scam, do you come out ahead?
- deleted 5y ago
  [deleted]
- keithalewis 5y ago
  It worked for PT Barnum.
randomhodler84 5y ago
Eth is a premine scam sure, but the dude has $130M Of it, so I don’t think he is crying over that part
- MPSimmons 5y ago
  How much purchasing power does that afford? If he wanted to buy an island, pay for it to have infrastructure added, and then also hire security and business payroll, could he actually exchange the Eth to the applicable currencies? I know the numbers line up, but is that amount of liquidity in the system?
  - randomhodler84 5y ago
    Good question. Mostly yes, but it would take some coordination. At $100M you would want to split trade across exchanges and probably some defi too, but yeah, you could. Eth has about $10M/-2% on major exchanges. Not that you would need to convert to fiat. If you ran your own island, just pay for goods and labor in Bitcoin or Ether directly.
  - capableweb 5y ago
    > could he actually exchange the Eth to the applicable currencies? I know the numbers line up, but is that amount of liquidity in the system? Yes, Coinbase, Binance and other big exchanges offer OTC trading where you can trade pretty large amounts without impacting the market at large.
    - Qub3d 5y ago
      Counter-point: there is currently another submission on HN suggesting that crypto "off-ramps" are really problematic and difficult at the moment. https://news.ycombinator.com/item?id=30322296 https://news.ycombinator.com/item?id=30322296
      - capableweb 5y ago
        Breaking news: "off-ramps" to centralized currencies is centralized. It's not difficult if the source of your cryptocurrencies is legitimate, while difficult if you have a hard time explaining how it's legitimate. I think the system works as intended.
        Qub3d 5y ago
        I'm confused then, are you in support of cryptocurrency? Because what you're describing (the "system") sounds an awful lot like reinventing banks from first principles but much less efficiently. If that is how it's intended to function then why are we bothering with this at all? And aside from KYC issues, another recently posted article pointed out that when a single individual tried to unload around a 1500 BTC (%0.03 of the coins in circulation at the time) it caused a liquidity crisis that crashed the market by 20%.[1] In this case the individual in the Twitter thread has an amount of ETH of that magnitude. Basically because crypto is performing the job of a speculative asset it results in the liquidity issues that you would see in things like company stock. [1]: https://blog.dshr.org/2022/02/ee380-talk.html?m=1 https://blog.dshr.org/2022/02/ee380-talk.html?m=1 (see footnote 11. The gist is that this sale put enough pressure on the order books that a lot of leverage positions cascaded into selling as well causing the flash crash)
- hanniabu 5y ago
  Given your username and how salty you are, I'm going to assume you invested in Bitconnect and lost everything b/c you didn't do your own research.
  - randomhodler84 5y ago
    Haha nice one! the world is not anymore the way it used to be, mm mm NO NO No! Bitconeeeeeeeeeeeeeeeect wooo bitconnect! We are coming and we are coming in waves. We are starting and to actually go all over the world. We all built the entire world. Me? Im just out there fiat mining, stacking sats…
  - dang 5y ago
    Please don't cross into personal attack. We ban accounts that do that, and we've had to warn you about this kind of thing before. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
selestify 5y ago
Low-quality comment.
- bitcharmer 5y ago
  I'd say GP's comment contributes more to the discussion than yours.
  - selestify 5y ago
    Debatable. GP basically ignores all the interesting parts of the article being posted in order to simply say the usual spiel about how much HN hates crypto. The relevance to the original article is close to nil. I'm calling them out for that -- perhaps in a way that's too terse, but at least I'm not completely derailing the conversation like they're doing. But thank you for prompting a longer response from me.
throwaway8174 5y ago
I paid off all my student loan debt and bought a house last summer because I got scammed into buying ETH about 2 years ago. Thanks for your insight though.
- pessimizer 5y ago
  That just means that you were part of the scam. Hell; somebody approvingly reading this comment might be the bagholder of the future, shooting himself after all of his savings have evaporated into some ETH tycoon's pocket who dumped before the market locked up.
  - whatshisface 5y ago
    Now that the bag holders include major investment houses... Well, if it's possible for a scam to have a successful "exit," that's what happened. They used their funny money to tap in to the real funny money. If all cryptocurrencies went to 0 tomorrow I wouldn't be surprised at all if some part of the "real" financial infrastructure got caught and there had to be bailouts, which we've learned is what happens when the wrong people lose a bet. There's too much money in the system now for it to all be from mom-and-pop marks. That's just not a viable explanation at these market capitalizations. That's not to say that average people aren't going to find out that they're long crypto - but it'd be in the way they found out they were long real estate.
  - throwaway8174 5y ago
- Grim-444 5y ago
  As a thought experiment, replace crypto in this situation for beanie babies. You managed to buy a bunch of beanie babies before a beanie baby craze started, and sold them at exorbitant prices to other people coming in that were convinced that beanie baby prices would only keep skyrocketing. You took their money, and now I guess as long as they're the bag holders still holding beanie babies when it all falls apart and they become worthless, and not you, it's all good. As long as you managed to make a profit and get out in time it wasn't a scam.
suikadayo 5y ago
If that’s the case, I’ve seen way more of that “social engineering” in the Bitcoin community. At least there are uses for ETH
dang 5y ago
Please don't post this sort of generic flamebait to HN. It leads to repetitive, predictable, and ultimately nasty threads. And of all the classic flamewar topics this one is probably the most predictable—just what this site is not supposed to be for (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=curiosity%20repetition%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...). If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it. Note this one: "Avoid [...] generic tangents."

TigeriusKirk 5y ago

These scammers went to impressive lengths. They say that often the secret of a magic trick is to put in far more prep work than anyone thinks is reasonable. Con games work the same way. In this case, the effort is worth since the target has something like $175 million in a wallet. The payoff is massive. Worth noting, though, that for all the fancy footwork the point of failure for the scam is him being willing to work with his main wallet rather than a one-off, and when he showed hesitation, they got too impatient. Good security practices were still the answer.

badRNG 5y ago
> when he showed hesitation, they got too impatient. This seems to be the common factor among scams, cons, and social engineering strategies. Rushing people will have them bypass protocol, training, and security practices. It's a universal "hack" for our brains; we do things we otherwise wouldn't when rushed. Security practices are like a rituals, standards of behavior that we just don't have time for right now. "The funds are only available for the next hour"; "You will be prosecuted if you don't do X"; "Per the CFO, we need to spend these funds before end of day."
- kenjackson 5y ago
  I do wonder if they were more patient and said to themselves “let’s build more trust over the next three months” if they would’ve been able to get him to use his main wallet? Great story though. I never realized these smart contracts could be so obtuse and malicious. That needs to be fixed.
  - Nextgrid 5y ago
    Yes - they could've just kept churning out more NFTs for him to "stake" and catch him off-guard when he used his main wallet by accident or maybe even give him legitimate returns (that they bankroll) to convince him to use his main wallet intentionally to get higher returns.
nfw2 5y ago
The lengths they went through were mind-boggling to me until he mentioned he has 9 figures sitting in a public wallet. Then it made a lot of sense. At first I thought he had maybe a few hundred thousand, partly because he was happy to accept the free help from a stranger. It's still pretty impressive how competently these scammers were able to discuss and deliver the VTOL work, the Space Falcon game, and entrepreneurial strategy.

dpeck 5y ago

Generalizing, anytime someone is giving you a “gift” but is putting expectations on how you receive it (in this case the wallet destination) that should be a huge red flag. Whether that’s cryptocurrency or a sandwich.

HWR_14 5y ago
Most people who invite me over for a sandwich would be insulted if I entered their house, took the sandwich they made me and left. In fact, I probably would never get invited over again.
- sillysaurusx 5y ago
  Meanwhile I wish someone would come over to take one of my sandwiches. It turns out that human contact in covid’s era is hard to come by. You’re probably right though. But if you ever find yourself near Lake St Louis, MO, feel free to raid our fridge.
  - pritambaral 5y ago
    Your parents is trying to say the same thing: that you'd appreciate some [meaningful] human contact. They suspect you wouldn't invite them again if all they did was raid your fridge, and not even say so much as a "hi".
- shbooms 5y ago
  true, but if they invited you in and told you had to go stand on a very specfic place in the room, facing a certain direction and to only start eating when they said so, that would be very suspicious and likely result in you opting out.
  - nightfly 5y ago
    Like sitting at the dining room table, and eating only after saying grace?
- randomhodler84 5y ago

CommieBobDole 5y ago

A good rule of thumb is if somebody you've just met introduces you to someone with an exciting new NFT project that they want your help testing, you're probably being scammed. While NFTs probably have some useful purpose that will emerge eventually, for now you should consider any proposal or offer that involves the term 'NFT' as having about the same value as any offer involving the term 'Nigerian prince'.

Nextgrid 5y ago
The "problem" in this case is that the victim himself is all-in on NFTs and crypto.
- suikadayo 5y ago
  No, victim himself has said in his post that he doesn’t really dabble in the NFT community
- Qub3d 5y ago
  Well, yes and no. They are clearly all-in on crypto (and who wouldn't be, if I made 100 million on tulip bulbs I'd probably be all-in on tulips, too) but they do state in the featured thread that they "aren't really an NFT guy". Certainly not a great look to have >$100 million in an asset sitting in a single account of any form, though.

pluc 5y ago

Don't do it if you don't understand what you're doing.

contravariant 5y ago
I'm not entirely convinced this isn't just the same as 'don't do it'.
- pluc 5y ago
  When it comes to crypto, 95% of the projects are by people who do not understand it themselves and were sold on it by someone whose sole purpose is to broaden crypto's financial reach and who worked tirelessly to make sure it's obscure/redundant enough that you don't understand it unless you're a developer attempting to implement it or seriously skilled at due diligence. They ran their whitepaper through their advisors to ensure it was clear yet didn't give anything away in terms of how it worked or how the authors get their kickbacks.
hypertele-Xii 5y ago
So, don't go to school?

raverbashing 5y ago

"extremely thorough social engineering" Not really, it seems like the usual being extra flattering to earn favours (or worse). The first two messages would have raised several red flags with me. > He's currently working at Ubisoft and offers to help with 3D design and animation Like if I worked for Ubisoft I'd have time to do 3D design for free for some other company.

jsnell 5y ago
> Like if I worked for Ubisoft I'd have time to do 3D design for free for some other company. Why is that so hard to believe? It's like suggesting that no professional software engineer would ever contribute code for free into an open source project in their free time. My basic assumption if somebody send a patch to an open source project is not that I'm being social engineered -- it is that they're either using the software or interested in the domain.
- Nimitz14 5y ago
  I think because the stereotype is that in a gaming company work life balance tends to not be that good.
Kiro 5y ago
Most people helping out like this have normal day jobs. Why would working at Ubisoft be different?
djur 5y ago
The social aspects of the crypto community are very interesting. The "WAGMI" mindset encourages a kind of freewheeling magnanimity where strangers will offer to help people get involved, give away free coin, bail out people who got scammed, etc. No doubt this is often genuine goodwill, but it's also an effective technique for recruitment (it's longstanding practice for evangelical religions and MLMs), and it creates a situation where a lot of self-interested people looking to get rich quick are mingling in an environment where it's perfectly common to make generous offers with no expectation of return. It's like going to a tech meetup where there are a lot of people working on startups, and who might buy a few rounds at the bar afterwards in exchange for maybe attracting an interested investor or cofounder, but where there's a chance that drinking a seemingly normal beer might give them access to your bank account.

ajross 5y ago

I still fail to understand how the smart contract metaphor of "here is some obfuscated code from a third party, please give it access to all your money, kthx" has managed to survive at all. I mean, really, no one saw this coming? It's just the Trust Problem all over again. Decentralized reliance on automatic software still requires trust that the authors of the software won't scam you. It all comes down to trust. And I trust banks, mostly. Who in their right mind trusts contracts someone sends you on Discord? And yet...

muh_gradle 5y ago
> Who in their right mind trusts contracts someone sends you on Discord? Exactly. That's where the gullibility is really visible... This is basically a steroid version of "I am Nigerian royalty and I need you to give me money" emails. Your first instinct should always be skepticism.
chrisco255 5y ago
I don't trust them. Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. They can snap their fingers and freeze your funds and hold it indefinitely, without a warrant. I admit that the Approval UX for wallets and tokens needs to be improved. Unlimited spend approvals should always be flagged in the UX. And approvals should be atomic (single transaction only, with a clearly listed cap, by default). There are some EIP proposals addressing this, but they will be a ways off from standardization.
- leshow 5y ago
  > Just last week, GoFundMe rugged a bunch of funds sent for a legitimate political protest. The protest is illegally blocking much of downtown Ottawa, as a result GoFundMe decided to refund the donors. That's far from a "rug"
  - matkoniecz 5y ago
    Note that GoFundMe decision to refund is a change from its previous one that happened only after outcry.

chrisco255 5y ago

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave when you lend out your assets for interest. The aETH is redeemable for the underlying asset. The scammers created a fake NFT project associated with space and drones, and proceeded to give Thomas a free one, but asked that he stake it (or deposit it into a smart contract), to earn yield in the form of Armstrong ETH, a token they made up that had the same acronym as Aave's (aETH). The catch was that when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them. However, what wasn't normal is that the approval was actually for Aave ETH. If he had only looked at the front end of the scam site, it wasn't obvious what was going on. However, a quick glance at Etherscan revealed that he had signed off on an unlimited spend approval for Aave ETH. Luckily, he had done so on a fresh wallet and not his main wallet that has $100M in aETH. When the scammers tried to get him to stake a second NFT from his main account, he got suspicious and discovered the truth. This scam was specifically targeted at Thomas, and orchestrated over multiple weeks, for the specific assets in his primary wallet. Couple takeaways: - divide your assets across multiple wallets. New wallets are free. Don't put all your eggs in one basket. - use a hardware wallet or an audited battle tested smart contract such as Gnosis Safe for storing significant sums of money. - always verify your transactions - avoid associating your public identity with your main wallet / vault address - be careful, scammers are getting more creative and advanced in technique including standing up professional front end websites to give the appearance of legitimacy

sillysaurusx 5y ago
Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last month. Thank you for the breakdown.

randomhodler84 5y ago

Note; dude has $123M in aave wrapped ethereum that he almost granted a scammer access to. Scammers ripping off scammers. Why would you waste time with open source aircrafts. Aircrafts are a regulated thing. Nobody wants to fly in your science project. Put some of that 123 million into starting an actual company. DAOs are bullshit.

negamax 5y ago
That's a horrible take on a legit person and project.
- hn_throwaway_99 5y ago
  Did you take a look at arrowair.com? Everything about that screams "art project". None of it makes sense. There are extreme engineering, economic, and legal challenges to doing have of what they are proposing, so the first thing they are investing in are their crypto projects? Because crypto crypto future future? I don't necessarily think the author is a scammer, but the whole project is the equivalent of "I'm going to launch a rocket to the moon" and then the first thing you do is open a nice website and launch a new token.
- randomhodler84 5y ago
  You would honestly ride in his ‘open source’ VToL? and use his air taxi service? I don’t think this is legit at all.
- Nextgrid 5y ago
  The aircraft and/or taxi service might be legit but all the crypto around it is useless complexity at best or a complete scam at worst. If you legitimately wanted to develop an aircraft taxi service, you do not need to involve crypto in any way. Even if you wanted to accept it for payments it's an auxiliary component that merely accounts for it and converts to fiat at some point. The DAO or whatever crypto bullshit is intertwined with it is absolutely a scam.
  - randomhodler84 5y ago

sidcool 5y ago

I feel incredibly dumb for not getting the details of how it happened.

scyclow 5y ago
He had $130 million wrapped up in an ERC20 token called Aave wETH (aWETH). ERC20 tokens let you approve another address to spend those tokens on your behalf. Basically, the scammers tried to trick him into approving all of his Aave wETH by creating a fake website designed to make him think that he's approving a different token with the same aWETH symbol.
- magicalhippo 5y ago
  So besides getting scammed, what use are these ERC20 for?
  - scyclow 5y ago
    They're basically receipts for putting money into a lending pool. In this case he's lending about $130 million, on which he's earning interest, and can get his money back by redeeming those tokens.
    - harambae 5y ago
      My apologies for being so ignorant on crypto lending, but I'm not even sure where I'd look up the details of how this system works. When Thomas puts that money into the lending pool, what happens if the borrower defaults? Did the borrower put up some non-liquid collateral? Did someone do a background/credit check? Who takes the loss, is it split across the pool? I understand how traditional bank loans work, I'm a little lost how much risk is being taken by the loan issuer here.
      - scyclow 5y ago
        Aave's documentation [1] is pretty good if you're interested in doing a deeper dive. But yeah, it's a collateralized loan where the borrower stakes some ETH. So the idea is that I can take $100 worth of ETH and put that up as collateral for a $75 loan. And if the value of my collateral drops due to the ETH<>USD exchange rate I have to stake more collateral. If I don't (or if the exchange rate moves below a certain point) then my collateral is automatically liquidated at a discount. So in this case, if the value of my collateral falls to $80 the contract will put it up for sale at $75 -- this creates an arbitrage opportunity, so the liquidation will likely happen very quickly. There are other lending protocols where you can stake other assets (NFTs, other tokens, etc.), but this is my understanding of how Aave works. [1] https://docs.aave.com/faq/ https://docs.aave.com/faq/

kelp 5y ago

This was an absolutely fascinating and chilling story. The thing that struck me about it is the scam didn't work for a few reasons: 1. He typically had a practice of not using his main wallet for things like this. 2. He got wary and actually read the smart contracts. This is a level of technical competence required that's going to mean most people have to offload this to a trusted intermediary. And then what's the point of all the decentralization ideology? Because we just re-invented banks.

tylersmith 5y ago
The purpose of decentralization is solely censorship resistance. It has nothing to do with consumer protections, consumer education, or easier to check software.
- dehrmann 5y ago
  Censorship and consumer protections go together since they're both roles regulators play.
  - tylersmith 5y ago
    Decentralization can't provide consumer protections regardless of what regulators do. The one thing it can do is resist censorship and things indistinguishable from censorship, like software failure.
- elil17 5y ago
  What exactly is censored when you use paper currency?
  - randomhodler84 5y ago
    The amount. A real example is CNY, which is limit to 100 yuan notes, deliberately to make it hard to move large sums. 1000 USD bills exist but are very rare. 1000 euro note exists but I think that’s on the way out. Your point that cash is censorship resistant is good, yes and we need to make sure it remains, however the physical limitations are defacto censorship.

muh_gradle 5y ago

I don't understand why in the world Thomas wouldn't directly communicate via phone and video chat to any of these people first before doing serious business and potentially traveling across the country for random anonymous folks on Discord. Social engineering is so much easier when you engage in faceless, voiceless communication. This could've been shut down so much more easily if they put a real human being to match the messages. When things actually matter, I need more than just a Discord avatar and a handle to identify someone.

kenjackson 5y ago
How would that help? Are you thinking it might be easier to prosecute with a voice or image file?
- muh_gradle 5y ago
  It's an extremely basic check. If I'm going to be getting on a plane to see someone, I want to do a basic background check.
  - kenjackson 5y ago
    But what are you checking with a call? That just seems like creating a false sense of security since there is virtually no additional “useful” information that is being sent over the audio channel above and beyond what is in text.
    - muh_gradle 5y ago
      I'm checking to see if this Linh Nguyen that some random Discord user referenced me is the Linh in front of me on Zoom. A phone call isn't ideal, but it's still better than nothing. At the very least, there's one more identifying factor though that may help with spotting any scams, but yes, it can be false sense of security if you rely purely on it. If I'm John Doe and I made some merge requests to your open source project for a couple of weeks, is that alone really enough to potentially meet me in some city far from yours? That's essentially what the author was prepared to do.

ttiurani 5y ago

"She tells me a bit about her metaverse project, Space Falcon. I'm not really sold on it, but I'm not really an NFT person so I didn't have any reason to think it was a bad idea either.[...] It seems kind of like a get-rich-quick scheme, but again, that's kind of how I see a lot of NFTs. With all that she's doing for Arrow, there's no harm in showing a little support." The real takeaway from this is that it's dangerous to break your moral compass and sense of reality to the point where you think helping out people who are pushing an obviously fraudulent business, is ok and normal.

grp000 5y ago
I don't see it that way at all. The NFT vector is arbitrary. The point was to drain his accounts and nothing more. If a less suspicious method was available, I'm sure the scammers would have taken that one.
- matkoniecz 5y ago
  Is there any case of NFT that is not some combination of get-rich-quick scheme, Ponzi scheme, search for a bigger fool, FOMO-powered stupidity, extracting money from naive people or satire of NFT? And NFT part adds anything substantial and is not replaceable by regular transfer (either transfer of money or BTC-like)?
  - MPSimmons 5y ago
    I'm not convinced it isn't crypto itself, and NFT is just an extension of that.
    - randomhodler84 5y ago
      It’s degrees of suspension of disbelief. Software is just tricking sand into to thinking. I have no issue believing that an imaginary consensus stored ledger in thousands of computers all secured by massive amounts of energy and limited to 21M units over 100 years might be valuable. The ability for people to copy this software idea? Not valuable. The ability for people to issue new tokens on existing chains? Not valuable. The ability for people to post and sell jpegs, Not valuable. Only original ideas are scarce. It’s the first step vs the n-th step.

vmception 5y ago

The other thing to understand is that legitimate interactions look just like this in the crypto space.

randomhodler84 5y ago
Scammers ripping each other offer on discord. Today it’s apes, next week it will be houses. I can’t believe they can convince people to lend liquidity to bridges, myself.
- blueboo 5y ago
  Houses? How about pension funds, top-flight companies, countries… a lot of smart and powerful folks are face-planting into this griftspace
  - vmception 5y ago
    Its the wealth redistribution people have been hoping for Cant keep your assets? Someone else who can code can! Looking forward to the technocrat plutocracy I’m being facetious as I think there will continue to be a balance and cat / mouse game.
    - randomhodler84 5y ago
      My fear is it just becomes another side show. Ethereum is going to become ebay. Yeah you can trade rare coins but it’s mostly just trash changing hands and clogging up the mail system.
  - axiosgunnar 5y ago
    We should make it blatantly clear and public that we will not he bailing out banks, pension funds etc that will inevitably get burned on some crypto scam.
    - randomhodler84 5y ago

dshpala 5y ago

Could someone please explain what's terrifying in the function spendWalletAWETH()? Just two lines... Is the idea that tokenToBeApproved.allowance() can do bad things? Code: https://twitter.com/thomasg_eth/status/1492663290715152384/photo/1 https://twitter.com/thomasg_eth/status/1492663290715152384/p...

randomhodler84 5y ago
Onlyowner modifier means the contract creator can call this function and transfer all the funds from the victims wallet (if they have previously approved). Tokentobeapproved is a variable declared in the contract. It will be pointing at the aWETH contract, which is the claim token for ETH on aave, a money market.

oefrha 5y ago

This highlights how scary it is to interface your savings with these “smart contracts”. Most people have no way to know what they’re actually going to do; the tiny slice of people capable of investigating can hardly remain vigilant at all times. Like, if you ask me to log into something with my bank account, all alarm bells would go off; if you ask me to stake this, approve that with my eth wallet, well, just another weird smart contract thing, right?

sterlind 5y ago
Yeah this makes me terrified of Ethereum. This kind of scam just wouldn't work on BTC. You're passing tokens around. At fanciest you're time-locking wallets or using M of N signatures. You're not like, installing arbitrary code in your bank account. I find ETH very technically interesting but it feels like it's full of sentient foot-guns.

tasha0663 5y ago

> a DAO working to build open-source VTOL aircraft and air taxi protocol The most reasonable conclusion is that the hacker was sent from the future to try to avert the creation of DAO-controlled flying cryptodrones.

alphachloride 5y ago
Haha! When I read it, I had a moment of uncertainty: is this a story about one scammer scamming another?

fortran77 5y ago

And this is going to replace money?

threeseed 5y ago
More replacing traditional money laundering and fraud.
TrackerFF 5y ago
More like: This is going to replace banks Imagine if every person you interact with could "be their own bank", and define the logic between your transactions. It's fully transparent, so you can audit it as much as you want to - but still, that's the amount of headache you'd have to deal with, to fully trust the other part. There are lots of upsides to this, but there's no shame in saying: No, I'd rather not. I'll keep trusting the trust-based system I've been using since forever.

ryan93 5y ago

His opensource VTOL project may be one the most delusional crypto projects out there.

harambae 5y ago
I'm also surprised there aren't more comments on this. Why does aeronautical engineering require cryptocurrency?

sireat 5y ago

I am curious why is all of Thomas 100M+ in a single wallet ? Also it seems strange to hold most of it in aETH, wouldn't you want to diversify a bit?

deleted 5y ago

[deleted]

pepesza 5y ago

Financial privacy is a must-have, not a nice-to-have feature. Financial privacy does not prevent one from being able to pay taxes. But it definitely prevents this type of attacks.

karmakaze 5y ago

When I hear "NFT", my mind goes into binary options mode, then tunes out.

alienalp 5y ago

If you don't remember which smart contracts you have gave permissions of which coins you can check from debank. And you can also cancel one by one. It is not possible for humans to use ethereum without interacting with proxy. Front ends always can be comprimesed. When interacting with smart contracts approving spending is most important interaction to be careful about.

birdyrooster 5y ago

Boo fuckin hoo

adam_arthur 5y ago

Imagine Bill Gates stored all his money in cash in a room in his house. That's probably more secure than crypto, where click of a button can siphon it all away. At least with physical money you have to be able to carry it, and physically present to steal. I'm sure there are strategies like using multiple wallets etc, but overall it will never be mainstream if you put the onus of security on the individual. Literally just typo-ing an address can disappear all of your money.

cmckn 5y ago

> The aWETH that I approved was not Armstrong ETH, but rather Aave's aWETH. On my main address, almost all of my ETH is sitting in Aave... Just one example, but this entire thread is Greek to me. What the hell is “staking an NFT”? I am feeling so left behind by this crypto nonsense. Is this what getting old is like? (I’m not yet old)

nfw2 5y ago
Same, and I am probably younger than this guy. My really basic understanding after reading very slowly is he got some crypto asset from scammer, and he needed to approve lending it out to get some sort of crypto interest on it. But approving the "lending X out" action apparently looks exactly like the same as the "give Y away" action if you don't look closely at the contract. Maybe it's just ignorance, but the whole system seems like a mess to me.
- hypertele-Xii 5y ago
  In the same way as if you lend cash to someone, you have to read the contract you're both signing attesting to the fact they owe you that amount, or they can just disappear with the cash.
The_rationalist 5y ago
progval 5y ago
This seems to be vocabulary invented by a specific app (probably to sound cool by association, because of Proof of Stake), described in the screenshot here: https://twitter.net/thomasg_eth/status/1492663229784408065 https://twitter.net/thomasg_eth/status/1492663229784408065 As far as I understand, it's just a synonym for "lending" here. They even use the word "leasing" for the people on the other side.
- 0x64 5y ago
  "Staking" was definitely not invented by this protocol as a term, and is not really related to the consensus protocol, barring the fact that you lock up ("stake") some underlying token in a smart contract. Various protocols offer staking as a way to lock funds, which might distribute a pre-existing token allocation to the people staking as a form of interest. This could be done for a myriad of reasons, like getting a governance token in exchange, or in order to limit the liquidity/dumping of new tokens. I can't say that I were too well versed on what has been happening in the defi space in the last year, but it's definitely not a new term.

axiosgunnar 5y ago

Some friends and acquaintances keep bugging me that I should get into crypto... but I would be too scared of loosing it all in one day, be it to a scam, sending to an non-existing address, loosing my hardware wallet etc. Tbh I would feel safer having 10k in cash (at home at least) than in crypto. At least the attack vectors (fire, burglary) are known and tangible. Imagine founding a startup, working your ass off living off ramen for a few years, every day worrying that it all might be for naught, and then through a combination of skill, determination and luck you do make it and your startup is worth a few millions... and then suddenly you make a small mistake and lose all your shares! This is how crypto feels to me. Maybe I am just not made for crypto.

lifeisstillgood 5y ago

A couple of things shook me about this - firstly I guess is the amount that was up for stealing - 100M just "sitting there" seems crazy - how many other multi-multi millionaires have their wealth just sitting in one bank account? Second scam is the wrong word. A confidence scam originally mean the mark had to bring a suitcase of cash to give confidence to the scammers that he had the means to join their get-rich scheme - and of course he would walk away with a suitcase of old newspapers. But this is almost a new kind of crime - he did not present or move his money, he did not give away any keys. it is the very mechanism of money transmission that is the issue. SWIFT is rarely seen as part of crimes - but crypto is pointing towards a new world. Imagine "permissioned blockchains" ie Bank Of England coins, this would still be a real viable scam. Proving you did not mean for people to take your 100M and rapidly move it would be a slow process. Stop orders would be a common place activity, potentially holding up long chains of transactions. Even without permission-less crypto the move to a digital native currency is a long process

jazzyjackson 5y ago
> 100M just "sitting there" seems crazy By virtue of converting the ETH to AAVE wrapped ETH, they're earning interest by loaning out the underlying ETH. Who is taking out loans and paying interest for ETH I have no idea. Plus, even without the AAVE wETH, they expect ETHs value to accrue faster than any other asset, so there's no cost to letting the money just sit, as opposed to your USD in savings depreciating over time.

radicalriddler 5y ago

Surprised this hasn't been commented already but: https://threadreaderapp.com/thread/1492663192404779013.html https://threadreaderapp.com/thread/1492663192404779013.html God I hate twitter threads, especially 32 tweets long!

herodotus 5y ago

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me. Surely this says that the world at least of ETH (whatever that is) is really really broken!

dlubarov 5y ago
I don't think the NFT is very important here; basically the scammer's website asked the victim's wallet to sign a message, using the private key that holds their ETH. It looks like the message in this case would have given the attacker permission to transfer the victim's aWETH, which represents ETH that has been deposited into an Aave lending pool. These transfer permissions are something all ERC-20 tokens support. Typically users will only sign messages sent from trusted websites, just as they would only install software from trusted sources. Or they can sign a questionable message from a separate wallet which doesn't hold much value, as the victim did here. Granted, this isn't a great situation. It can be hard to know which websites to trust, and even trusted websites can be hacked and then send malicious messages to unsuspecting users.
labrador 5y ago
According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things. at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, that’s right, there’s no offer/confirmation step in sending tokens back and forth, someone who knows your wallet can just drop stuff right into it, so, like, pin that somewhere in your brain. Line Goes Up – The Problem With NFTs https://youtu.be/YQ_xWvX1n9g?t=4970 https://youtu.be/YQ_xWvX1n9g?t=4970
- dlubarov 5y ago

etamponi 5y ago

Someone else already commented on this, but doesn't _everybody_ just realize that this is way too complicated and error prone? Signigning a token (whatever that means, I never saw so much nonsensical jargon in my life) gives a random person possible access over _all_ of your money??!! And this _by design_ can't be audited by a central authority that guarantees against scams. If I had to read the source code of all my wire transfers, I'd probably just barter my services for some milk and bread, it definitely seems smarter.

betwixthewires 5y ago

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You want code to be law? This shit isn't ready for the mainstream, and some of these architectural decisions are indicative of engineers who are in over their heads (but that's almost all code nowadays, even mine). They build a mechanism that enables me, at the click of a button, to give away control of my fortune, and they designed the system so that anyone can design whatever interface they like to get you to sign any transaction they like. It's laughable. I'm in disbelief. And this is web3? No thanks, I think I'll stick with bitcoin or whatever, keep it simple. At least I can tell what a bitcoin transaction does without having to learn a programming language.

orasis 5y ago
When it comes to code, we’re all in over our heads. I can reason about significantly more complexity than most developers I know and it’s still laughable how little complexity I can manage.
ikt 5y ago
Think of all the scams happening over TCP/IP every day! They built this thing where anyone can pretend to be a bank website? No checks or security? It's laughable. I'm in disbelief. And this is the web?
- betwixthewires 5y ago
  I never said I expect ethereum or web3 or whatever to be entirely scam free. I said that having the ability to send anyone any transaction and to their eyes have it look like any other sort of interaction they like unless they can read solidity and audit the code themselves is a very very large security hole.
- markstos 5y ago
  There are checks in place to make difficult to buy an SSL certificate for the official domain of a bank. At least Chrome tracks malicious websites. By comparison, there seem to be no checks in place to prevent writing an ethereym contract that drains a victim’s wallet.

Johnny555 5y ago

I'm a software engineer and consider myself tech savvy but understood only about 10% of the mechanics of this scam

AtlasBarfed 5y ago

I stopped reading at NFT.

northernexposur 5y ago

Everyone should watch this: https://m.youtube.com/watch?v=YQ_xWvX1n9g https://m.youtube.com/watch?v=YQ_xWvX1n9g

creatonez 5y ago

So is building an open source vertical takeoff and landing aircraft and accompanying air taxi service part of reality, or part of the blockchain?

ggm 5y ago

Until it's in a bank, he doesn't have $100m. Not that it wouldn't have sucked to lose his potential millions but they are hypothetical value right now. I'd have diversified. Some cash, some ETF, some property. A lot of tax, now or in the future. I wouldn't complain about the tax, even after there's enough for a lifetime. (And yes I know both property and ETF can decline in value, but here's the thing: when you see their book value it's a damn sight more real) Remember, unless I am very mistaken he didn't put $80m of real money in, to secure an amazing 20% ROI which out in your real world would be normally exciting. So the net effect of fees, gas, AML, tax even taking 50% makes him as rich as croesus compared to most people for very low initial input. Do we know what real world $ went in to bootstrap? (I know this story is mostly about the social engineering, which is of course the real problem)

deleted 5y ago

[deleted]

perryizgr8 5y ago

> I'm the founder of Arrow, a DAO working to build open-source VTOL aircraft and air taxi protocol. I don't understand why a startup working on aircraft design is linked to crypto at all. If you have $100M in ETH, the first thing to do is to convert it to USD and put it in a bank, preferably a large one. Then use the money to run your startup. Why would you keep your money in a crypto wallet? Why would you model your startup as a DAO?

sizzle 5y ago

How much of his ETH was at stake here?? Why did they go through so much effort to target him on the hopes that he would 1. Have a large sum of coins 2. Be foolish enough to reveal said account. I love that he wasted 2 weeks of these scumbags and exposed them. I hope they can trace their email address and nab the real people.

harambae 5y ago
>on the hopes that he would 1. Have a large sum of coins This part wasn't a guess, it's publicly available information known from the outset

pyb 5y ago

If I understand the gist of the commens so far, he's sitting on 100 million US dollars, and is hoping to build some crypto enhanced flying cars using free labour from volunteers he found on Discord?