11 ms·

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to em

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave when you lend out your assets for interest. The aETH is redeemable for the underlying asset. The scammers created a fake NFT project associated with space and drones, and proceeded to give Thomas a free one, but asked that he stake it (or deposit it into a smart contract), to earn yield in the form of Armstrong ETH, a token they made up that had the same acronym as Aave's (aETH). The catch was that when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them. However, what wasn't normal is that the approval was actually for Aave ETH. If he had only looked at the front end of the scam site, it wasn't obvious what was going on. However, a quick glance at Etherscan revealed that he had signed off on an unlimited spend approval for Aave ETH. Luckily, he had done so on a fresh wallet and not his main wallet that has $100M in aETH. When the scammers tried to get him to stake a second NFT from his main account, he got suspicious and discovered the truth. This scam was specifically targeted at Thomas, and orchestrated over multiple weeks, for the specific assets in his primary wallet. Couple takeaways: - divide your assets across multiple wallets. New wallets are free. Don't put all your eggs in one basket. - use a hardware wallet or an audited battle tested smart contract such as Gnosis Safe for storing significant sums of money. - always verify your transactions - avoid associating your public identity with your main wallet / vault address - be careful, scammers are getting more creative and advanced in technique including standing up professional front end websites to give the appearance of legitimacy

sillysaurusx 5y ago
Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last month. Thank you for the breakdown.
- negamax 5y ago
  Yes, he has $100M+ in Aave Eth in one wallet. You can see this on etherscan
- randomhodler84 5y ago
  There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01e717c2f6c76 https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.
  - sillysaurusx 5y ago
    I see. But.. why? Isn’t that a remarkably bad idea? Or is there some crypto advantage to keeping every last coin in the same basket? Other than it being a flex.
    - vmception 5y ago
      people have always used wallets in a way very different from the best practices described 10 years ago no address reuse is almost impossible as the wallets make it very hard as well people don't really seem to know that Metamask gives you unlimited addresses, fwiw it is expensive to do approvals in each address
    - randomhodler84 5y ago
      It’s got an ENS address associated which is only used by flexers. It’s a giant flex.
    - PretzelPirate 5y ago
      There’s no advantage, just laziness. A wallet like that shouldn’t be easy to access and should never be used for for anything other than funding their other hot wallets.
      - nootropicat 5y ago
        Concentration of funds is a great advantage for borrowing.
xwdv 5y ago
To be honest, if they got this close, it’s only a matter of time before they take it all. He should strongly consider cashing out and leaving only an amount he is willing to lose in ETH. Hell, given my distaste for crypto, if I were more unethical I may even attempt such scams, but I’d balance it out by donating the stolen money to environmental initiatives to combat global warming (after giving myself some fair compensation, I don’t have the skills to get away with hiding $100+ million).
- randomhodler84 5y ago
  It’s like the televangelist. Money affinity scamming. You need to conspicuously show your wealth on chain so people think God (vitalik) made them rich. Unless you flex with your $100M in aave on your main with an ENS name, how will your victims know you are rich and worthy?
  - xwdv 5y ago
    If I had $100M, I find it hard that I’d care that much about things. I barely give a fuck now and my net worth is only 1/58th of that. I’d probably just build a passive income stream and chill the rest of my life.
    - paulluuk 5y ago
      Couldn't you already do that right now? If you put your wealth into S&P 500 you should be able to live from roughly 170K USD per year.
      - xwdv 5y ago
        Ah yes, a world where taxes don’t exist and the S&P always returns 10%-20% a year and everything you really want in life is dirt cheap. Nah, I want cars, some homes, a yacht and a hot ass babe to pleasure me and raise nice children as we travel the world and dress fancy.
        5y ago
MereInterest 5y ago
I like the takeaways, though I'd also add an additional one, that you should use systems that have reversible transactions. That way, when you fall victim to fraud, you can use the court system to recover your losses.
- hashimotonomora 5y ago
- randomhodler84 5y ago
  This is just saying “that’s what you get for playing with crypto you degenerate”. The fact is wires can also be irreversible and you cannot use the court system as a blunt instrument outside your jurisdiction. The value transmission medium isn’t the problem here.
  - amptorn 5y ago
    Can a smart contract make a wire transfer with your knowledge?
  - gonehome 5y ago
    Yeah the op comment wasn’t made in good faith. Try getting your money back when getting scammed via venmo or PayPal - rarely any better, and if you’re selling you’re more likely to get scammed with those services than crypto.
    - woodruffw 5y ago
      I have done multiple clawbacks via payment processors. In each case, I escalated (vendor -> processor -> my bank -> CFPB) until the dispute was resolved to my satisfaction. In nearly all cases, no separate restitution was required: the processor or my bank was able to reverse or halt the ACH transaction before the money settled. In the handful of cases where settlement had already happened, they were able to countermand the transaction.
      - 5y ago
dom96 5y ago
For somebody with $100M+ I find it strange how excited Thomas got about the prospect of some strangers setting up a meeting with some random founders. With that much money would it be that difficult for Thomas to set up a meeting with them on his own?
- verve_rat 5y ago
  He might have the wealth, but he is nouveau riche. He probably doesn't have the connections and hasn't experienced enough of the rich people world to see what those connections look like. He probably (subconsciously) thought this was a start of that sort of thing.
- djur 5y ago
  Yes, isn't it interesting how people who own crypto valued at hundreds of thousands or millions of dollars rarely act like people with that much money, get involved in the kind of business deals or social engagements that people with that much money do, etc.? It's also interesting how many of the assets they tend to purchase are themselves part of the crypto ecosystem. How many people, given $300k, would go and buy exclusive access to an online monkey avatar?
- AlexCoventry 5y ago
  Yes, and I think he just set himself up as an even bigger target, because he's revealed that he has personal, immediate custody over $100m. His next attackers are likely to get much more personal and direct.
ricardobeat 5y ago
I’m curious, does anyone know Thomas, or how did they amass 100M in ETH? The websites provide absolutely no identity of anyone involved (as is very common for crypto). The Twitter account is 4 months old. No mention of the person or the Arrow company on the internet previous to this episode seems to exist. Other than looking at the chain records, how should we believe that any of these stories are true?
- chrisco255 5y ago
  I know of Thomas through the Rocketpool community Discord (a decentralized Ethereum staking pool). He's a regular on there. And I'm one of 90ish members in the Arrow Discord. It's a super early stage startup that's still in the conceptualization phase. I don't know how he got his capital, I don't know his background. But he's been an engaged member of the RPL community and seems genuine in his interest for drone transportation. A lot of this is still available in the Discord chat history.
  - floodyberry- 5y ago
    when he invites you to get in on the ground floor of an amazing opportunity, I suggest you take him up on it. He's rich so it definitely won't be a scam!
    - chrisco255 5y ago
      My impression of him is that he's a decent guy who got targeted by scammers who knew he was rich. I've participated in the ground floor of plenty of opportunities. Some of them work out, some of them don't. But the ones that do more than make up for the ones that don't.
      - floodyberry- 5y ago
        Your reading comprehension is stellar!
inopinatus 5y ago
There's a more general takeaway, and it's one every developer discovers for themselves, sooner or later: - People don't read what's in front of them. I've seen this emerge in a vast array of fields. No matter how much we highlight specific details, for all our efforts in red-flagging irreversible actions, folks will often blitz past a confirmation dialog, nag screen, or notification message, without internalising the details or the risks. For those in financial technology, as in this specific example, irreversible actions also extend the attack surface for fraud. Even the brightest minds can be lazy (some might even say it's a feature, not a bug) and one should never rely upon the opposite. We consequently face a design choice, for all irreversible (or hard-to-reverse) actions, the most common options being: a) allow a grace period; b) redesign, if possible, to make it user-reversible; c) build a forcing function for diligence[1]; or d) expect support tickets about that feature. The default is (d), and the helpdesk won't thank us, since the workload generally scales linearly with growth at a high opportunity cost. [1] e.g. https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule
secondcoming 5y ago
Incomprehensible gobbledygook. But I'm not worth $100m so I guess the joke's on me.
bryans 5y ago
> scammers are getting more creative and advanced in technique including standing up professional front end websites to give the appearance of legitimacy It seems like this is becoming the minimum standard for scam operations. For example, there is currently a BTC phishing scam going around that tries to convince the user they've accidentally received an email meant for someone else, which just happens to include a link to a million dollars worth of BTC. The website looks legitimate, albeit amateurish, to the point that it could even be convincing to another web developer. The rest of it is much like the OP's scam. It starts with an email from the hacked account of a real bank manager in an Italian town, and is addressed to a real self-proclaimed stock market "guru" from the UK, now living in the US. The email states that 19 BTC has been deposited into an account that was created for them on a site called Coinlux, and they provide the username and password for the account. The Coinlux name was even used by an actual company at one point, so searching for any of the names or details surrounding the scam generates very real and convincing results. Upon visiting the page, you're presented with a moderately professional-ish looking site that asks which fiat currency you want to use and lets you login. You're then prompted to enter a phone number to "secure the account" which, surprisingly, initiates an actual phone call from a number in the UK using a Twilio-like service. After confirming the verification number, you're allowed to view the account, which has some realistic dummy transactions in the history and other features that make the site somewhat believable (it even has a fake chat system and working account recovery). After initiating a withdrawal of any amount, it provides a warning that you should make a small test transaction first (of 0.0001/$4), to ensure that you're sending to the correct BTC address -- after all, you wouldn't want to send 19 BTC to the wrong place and lose it all. It takes much longer than a normal transaction (likely because the scammers are manually initiating them), but it does eventually go through, and they've now succeeded in convincing the user that there is real BTC in the account and you can actually withdraw it. However, if you try to make a larger withdrawal (or a second one at all), you're now presented with an error stating that you're not withdrawing enough, because of a "minimum withdrawal amount" defined when the account was created. This minimum amount happens to be 19.01 BTC, or 0.01 more than is in the actual account currently. So you've successfully withdrawn ~$4, but you have to deposit ~$400 if you want to access the entire 19 BTC. As if it weren't obvious enough at this point, checking the address[1] which sent the 0.0001 makes the entire scam plain as day. This means that anyone with any amount of tech knowledge is probably not susceptible to the scam, though I do think that certain personality types could get caught up in the excitement of potentially "stealing" a million dollars. On the other side, non-techies will likely fall for this in droves, and the transaction history on that address does show there have already been successful victims -- though this particular person's scam has been massively unsuccessful so far, and they may actually be in the red overall. [1] https://www.blockchain.com/btc/address/bc1qt80xra3r2df8gvzr0pu8vce98ltk6zxlr3fx9z https://www.blockchain.com/btc/address/bc1qt80xra3r2df8gvzr0...
dimgl 5y ago
I'm surprised anyone reading this story wouldn't conclude that the real takeaway is to just not engage with cryptocurrency at all. This ecosystem is so convoluted it just turns me off at every level.
- de_nied 5y ago
  I think there is value in being able to write up an online contract (code) that is able to manage money for two parties without needing to go to a bank or some third party to act as the middleman. It's the same thing as reading the terms and conditions.
  - lostcolony 5y ago
    Human transactions can 'easily' be undone in a court of law, and yet are still so painful to undo as to necessitate a trusted escrow agent in many of them. This is making it so there is no "undo", and no escrow agent. There's value, for those looking to take advantage of others.
    - aaaaaaaaata 5y ago
      This is the fulcrum point of the argument, and until you've been on the wrong side of, bluntly, legal bullshit, you just won't get it.
- donkarma 5y ago
  cryptocurrency is fine. NFT, smart contract, web3, tokens, and pretty much anything related to Ethereum isn't
- sunir 5y ago
  I woke up this week to dozens of comments on a video from a speaker at SaaS Connect 2017 (previously known as The Small Business Web Summit) to learn she was arrested and charged by the DOJ this week for laundering $4.5 billion in crypto. https://www.justice.gov/opa/pr/two-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency https://www.justice.gov/opa/pr/two-arrested-alleged-conspira... Billion! Since this is an allegation, we must presume innocence. However I still cannot imagine what planet would entrust 10 figures to her control. Witness her rap. https://www.youtube.com/watch?v=7jlSHGAem6g https://www.youtube.com/watch?v=7jlSHGAem6g But I also realize reading this Twitter thread I do not understand the world of crypto at all.
djakaitis 5y ago
The real takeaway is that decentralized financial accounts are at extreme risk of deception with little reciprocity.
waffle_maniac 5y ago
I don’t see a bio on his website. Is he anonymous?
mynameisash 5y ago
> when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them. However, what wasn't normal is that the approval was actually for Aave ETH. I'm a reasonably technical dude (senior data engineer at GAMMA/FAANG/whatever we're deciding to use nowadays), yet I don't have a damn clue what this means. And that's not an indictment of your communication. How on earth could I expect my wife, my brother, my parents, my kids, any of my friends, etc., to understand this? On the other hand, all these people understand the concepts of bank accounts, credit cards, fiat currency, etc. I'm open to learning more and having my views changed, but I'm so far convinced that there's absolutely nothing about crypto that is a simple, reliable, demonstrably real solution to a problem that isn't already handled by our current financial instruments.
- Stevvo 5y ago
  It is a specific technical detail of how ERC-20 tokens work. Your wife/brother/kids etc make transfers online from their bank account without knowing the technical details of how that transfer works. Ideally wallets would have better UX where concepts like this could be handled safely and in an accessible manner. I think crypto isn't really ready for general consumption yet.
  - rnk 5y ago
    This discussion tells me once again that crypto today is similar to you have access to the backend systems of the bank and you can write database commands in sql that change things in your account records. It's insane low level access system. Transferring ownership of money via a webpage that has a source and destination on your bank webpage is understandable at a certain level. Is that the right source, is that the right destination. But you can put in 100,000 instead of 1k or 10k by accident. That's very different than if you click the 'ok' button it runs say random javascript like commands that the destination of the money wrote up. You can't ever expose that level to end users without it being an endless fraud source for people.
zby 5y ago
"The catch was that when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them." - this is a bit surprising - I thought the way to let a contract move tokens was just to send them to it? Approving a contract to move everything from a wallet works like sending everything from the wallet to the contract - it omits the step where you choose the amount that you trust the contract with, why is this the 'normal' way?
SZJX 5y ago
Thomas also mentioned in the thread that it seems "Space Falcon" is a real NFT project. The actual domain ends in .io though, and somehow the scammers managed to acquire the .com domain and I'd imagine they'd then only need to replicate the frontend UI instead of coming up with an all-new one. Still very sophisticated for sure.

sillysaurusx 5y ago

Does Thomas actually have $100M of assets in a single wallet? Or is it spread out over, say, ten wallets? I’m interested to know whether the con artists could have realistically nabbed $100M, or if there was effectively never any chance of that due to other precautions. I would hope it’s the latter, but crypto’s strangeness stopped surprising me. Fabulous comment, by the way. Easily one of the top ten in the last month. Thank you for the breakdown.

negamax 5y ago
Yes, he has $100M+ in Aave Eth in one wallet. You can see this on etherscan
randomhodler84 5y ago
There is over $160M in his address. https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01e717c2f6c76 https://etherscan.io/address/0xb1e9d641249a2033c37cf1c241a01... He could have approved a malicious contract to drain the lot.
- sillysaurusx 5y ago
  I see. But.. why? Isn’t that a remarkably bad idea? Or is there some crypto advantage to keeping every last coin in the same basket? Other than it being a flex.
  - vmception 5y ago
    people have always used wallets in a way very different from the best practices described 10 years ago no address reuse is almost impossible as the wallets make it very hard as well people don't really seem to know that Metamask gives you unlimited addresses, fwiw it is expensive to do approvals in each address
  - randomhodler84 5y ago
    It’s got an ENS address associated which is only used by flexers. It’s a giant flex.
  - PretzelPirate 5y ago
    There’s no advantage, just laziness. A wallet like that shouldn’t be easy to access and should never be used for for anything other than funding their other hot wallets.
    - nootropicat 5y ago
      Concentration of funds is a great advantage for borrowing.

xwdv 5y ago

To be honest, if they got this close, it’s only a matter of time before they take it all. He should strongly consider cashing out and leaving only an amount he is willing to lose in ETH. Hell, given my distaste for crypto, if I were more unethical I may even attempt such scams, but I’d balance it out by donating the stolen money to environmental initiatives to combat global warming (after giving myself some fair compensation, I don’t have the skills to get away with hiding $100+ million).

randomhodler84 5y ago
It’s like the televangelist. Money affinity scamming. You need to conspicuously show your wealth on chain so people think God (vitalik) made them rich. Unless you flex with your $100M in aave on your main with an ENS name, how will your victims know you are rich and worthy?
- xwdv 5y ago
  If I had $100M, I find it hard that I’d care that much about things. I barely give a fuck now and my net worth is only 1/58th of that. I’d probably just build a passive income stream and chill the rest of my life.
  - paulluuk 5y ago
    Couldn't you already do that right now? If you put your wealth into S&P 500 you should be able to live from roughly 170K USD per year.
    - xwdv 5y ago
      Ah yes, a world where taxes don’t exist and the S&P always returns 10%-20% a year and everything you really want in life is dirt cheap. Nah, I want cars, some homes, a yacht and a hot ass babe to pleasure me and raise nice children as we travel the world and dress fancy.
      - 5y ago

MereInterest 5y ago

I like the takeaways, though I'd also add an additional one, that you should use systems that have reversible transactions. That way, when you fall victim to fraud, you can use the court system to recover your losses.

hashimotonomora 5y ago
randomhodler84 5y ago
This is just saying “that’s what you get for playing with crypto you degenerate”. The fact is wires can also be irreversible and you cannot use the court system as a blunt instrument outside your jurisdiction. The value transmission medium isn’t the problem here.
- amptorn 5y ago
  Can a smart contract make a wire transfer with your knowledge?
- gonehome 5y ago
  Yeah the op comment wasn’t made in good faith. Try getting your money back when getting scammed via venmo or PayPal - rarely any better, and if you’re selling you’re more likely to get scammed with those services than crypto.
  - woodruffw 5y ago
    I have done multiple clawbacks via payment processors. In each case, I escalated (vendor -> processor -> my bank -> CFPB) until the dispute was resolved to my satisfaction. In nearly all cases, no separate restitution was required: the processor or my bank was able to reverse or halt the ACH transaction before the money settled. In the handful of cases where settlement had already happened, they were able to countermand the transaction.
    - 5y ago

dom96 5y ago

For somebody with $100M+ I find it strange how excited Thomas got about the prospect of some strangers setting up a meeting with some random founders. With that much money would it be that difficult for Thomas to set up a meeting with them on his own?

verve_rat 5y ago
He might have the wealth, but he is nouveau riche. He probably doesn't have the connections and hasn't experienced enough of the rich people world to see what those connections look like. He probably (subconsciously) thought this was a start of that sort of thing.
djur 5y ago
Yes, isn't it interesting how people who own crypto valued at hundreds of thousands or millions of dollars rarely act like people with that much money, get involved in the kind of business deals or social engagements that people with that much money do, etc.? It's also interesting how many of the assets they tend to purchase are themselves part of the crypto ecosystem. How many people, given $300k, would go and buy exclusive access to an online monkey avatar?
AlexCoventry 5y ago
Yes, and I think he just set himself up as an even bigger target, because he's revealed that he has personal, immediate custody over $100m. His next attackers are likely to get much more personal and direct.

ricardobeat 5y ago

I’m curious, does anyone know Thomas, or how did they amass 100M in ETH? The websites provide absolutely no identity of anyone involved (as is very common for crypto). The Twitter account is 4 months old. No mention of the person or the Arrow company on the internet previous to this episode seems to exist. Other than looking at the chain records, how should we believe that any of these stories are true?

chrisco255 5y ago
I know of Thomas through the Rocketpool community Discord (a decentralized Ethereum staking pool). He's a regular on there. And I'm one of 90ish members in the Arrow Discord. It's a super early stage startup that's still in the conceptualization phase. I don't know how he got his capital, I don't know his background. But he's been an engaged member of the RPL community and seems genuine in his interest for drone transportation. A lot of this is still available in the Discord chat history.
- floodyberry- 5y ago
  when he invites you to get in on the ground floor of an amazing opportunity, I suggest you take him up on it. He's rich so it definitely won't be a scam!
  - chrisco255 5y ago
    My impression of him is that he's a decent guy who got targeted by scammers who knew he was rich. I've participated in the ground floor of plenty of opportunities. Some of them work out, some of them don't. But the ones that do more than make up for the ones that don't.
    - floodyberry- 5y ago
      Your reading comprehension is stellar!

inopinatus 5y ago

There's a more general takeaway, and it's one every developer discovers for themselves, sooner or later: - People don't read what's in front of them. I've seen this emerge in a vast array of fields. No matter how much we highlight specific details, for all our efforts in red-flagging irreversible actions, folks will often blitz past a confirmation dialog, nag screen, or notification message, without internalising the details or the risks. For those in financial technology, as in this specific example, irreversible actions also extend the attack surface for fraud. Even the brightest minds can be lazy (some might even say it's a feature, not a bug) and one should never rely upon the opposite. We consequently face a design choice, for all irreversible (or hard-to-reverse) actions, the most common options being: a) allow a grace period; b) redesign, if possible, to make it user-reversible; c) build a forcing function for diligence[1]; or d) expect support tickets about that feature. The default is (d), and the helpdesk won't thank us, since the workload generally scales linearly with growth at a high opportunity cost. [1] e.g. https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule

secondcoming 5y ago

Incomprehensible gobbledygook. But I'm not worth $100m so I guess the joke's on me.

bryans 5y ago

> scammers are getting more creative and advanced in technique including standing up professional front end websites to give the appearance of legitimacy It seems like this is becoming the minimum standard for scam operations. For example, there is currently a BTC phishing scam going around that tries to convince the user they've accidentally received an email meant for someone else, which just happens to include a link to a million dollars worth of BTC. The website looks legitimate, albeit amateurish, to the point that it could even be convincing to another web developer. The rest of it is much like the OP's scam. It starts with an email from the hacked account of a real bank manager in an Italian town, and is addressed to a real self-proclaimed stock market "guru" from the UK, now living in the US. The email states that 19 BTC has been deposited into an account that was created for them on a site called Coinlux, and they provide the username and password for the account. The Coinlux name was even used by an actual company at one point, so searching for any of the names or details surrounding the scam generates very real and convincing results. Upon visiting the page, you're presented with a moderately professional-ish looking site that asks which fiat currency you want to use and lets you login. You're then prompted to enter a phone number to "secure the account" which, surprisingly, initiates an actual phone call from a number in the UK using a Twilio-like service. After confirming the verification number, you're allowed to view the account, which has some realistic dummy transactions in the history and other features that make the site somewhat believable (it even has a fake chat system and working account recovery). After initiating a withdrawal of any amount, it provides a warning that you should make a small test transaction first (of 0.0001/$4), to ensure that you're sending to the correct BTC address -- after all, you wouldn't want to send 19 BTC to the wrong place and lose it all. It takes much longer than a normal transaction (likely because the scammers are manually initiating them), but it does eventually go through, and they've now succeeded in convincing the user that there is real BTC in the account and you can actually withdraw it. However, if you try to make a larger withdrawal (or a second one at all), you're now presented with an error stating that you're not withdrawing enough, because of a "minimum withdrawal amount" defined when the account was created. This minimum amount happens to be 19.01 BTC, or 0.01 more than is in the actual account currently. So you've successfully withdrawn ~$4, but you have to deposit ~$400 if you want to access the entire 19 BTC. As if it weren't obvious enough at this point, checking the address[1] which sent the 0.0001 makes the entire scam plain as day. This means that anyone with any amount of tech knowledge is probably not susceptible to the scam, though I do think that certain personality types could get caught up in the excitement of potentially "stealing" a million dollars. On the other side, non-techies will likely fall for this in droves, and the transaction history on that address does show there have already been successful victims -- though this particular person's scam has been massively unsuccessful so far, and they may actually be in the red overall. [1] https://www.blockchain.com/btc/address/bc1qt80xra3r2df8gvzr0pu8vce98ltk6zxlr3fx9z https://www.blockchain.com/btc/address/bc1qt80xra3r2df8gvzr0...

dimgl 5y ago

I'm surprised anyone reading this story wouldn't conclude that the real takeaway is to just not engage with cryptocurrency at all. This ecosystem is so convoluted it just turns me off at every level.

de_nied 5y ago
I think there is value in being able to write up an online contract (code) that is able to manage money for two parties without needing to go to a bank or some third party to act as the middleman. It's the same thing as reading the terms and conditions.
- lostcolony 5y ago
  Human transactions can 'easily' be undone in a court of law, and yet are still so painful to undo as to necessitate a trusted escrow agent in many of them. This is making it so there is no "undo", and no escrow agent. There's value, for those looking to take advantage of others.
  - aaaaaaaaata 5y ago
    This is the fulcrum point of the argument, and until you've been on the wrong side of, bluntly, legal bullshit, you just won't get it.
donkarma 5y ago
cryptocurrency is fine. NFT, smart contract, web3, tokens, and pretty much anything related to Ethereum isn't
sunir 5y ago
I woke up this week to dozens of comments on a video from a speaker at SaaS Connect 2017 (previously known as The Small Business Web Summit) to learn she was arrested and charged by the DOJ this week for laundering $4.5 billion in crypto. https://www.justice.gov/opa/pr/two-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency https://www.justice.gov/opa/pr/two-arrested-alleged-conspira... Billion! Since this is an allegation, we must presume innocence. However I still cannot imagine what planet would entrust 10 figures to her control. Witness her rap. https://www.youtube.com/watch?v=7jlSHGAem6g https://www.youtube.com/watch?v=7jlSHGAem6g But I also realize reading this Twitter thread I do not understand the world of crypto at all.

djakaitis 5y ago

The real takeaway is that decentralized financial accounts are at extreme risk of deception with little reciprocity.

waffle_maniac 5y ago

I don’t see a bio on his website. Is he anonymous?

mynameisash 5y ago

> when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them. However, what wasn't normal is that the approval was actually for Aave ETH. I'm a reasonably technical dude (senior data engineer at GAMMA/FAANG/whatever we're deciding to use nowadays), yet I don't have a damn clue what this means. And that's not an indictment of your communication. How on earth could I expect my wife, my brother, my parents, my kids, any of my friends, etc., to understand this? On the other hand, all these people understand the concepts of bank accounts, credit cards, fiat currency, etc. I'm open to learning more and having my views changed, but I'm so far convinced that there's absolutely nothing about crypto that is a simple, reliable, demonstrably real solution to a problem that isn't already handled by our current financial instruments.

Stevvo 5y ago
It is a specific technical detail of how ERC-20 tokens work. Your wife/brother/kids etc make transfers online from their bank account without knowing the technical details of how that transfer works. Ideally wallets would have better UX where concepts like this could be handled safely and in an accessible manner. I think crypto isn't really ready for general consumption yet.
- rnk 5y ago
  This discussion tells me once again that crypto today is similar to you have access to the backend systems of the bank and you can write database commands in sql that change things in your account records. It's insane low level access system. Transferring ownership of money via a webpage that has a source and destination on your bank webpage is understandable at a certain level. Is that the right source, is that the right destination. But you can put in 100,000 instead of 1k or 10k by accident. That's very different than if you click the 'ok' button it runs say random javascript like commands that the destination of the money wrote up. You can't ever expose that level to end users without it being an endless fraud source for people.

zby 5y ago

"The catch was that when he went to stake his NFT, they asked for an approval for spending aETH from his wallet. Approvals such as this are normal when interacting with smart contracts, since the contract has to be "delegated" responsibility over the tokens in order to move them." - this is a bit surprising - I thought the way to let a contract move tokens was just to send them to it? Approving a contract to move everything from a wallet works like sending everything from the wallet to the contract - it omits the step where you choose the amount that you trust the contract with, why is this the 'normal' way?

SZJX 5y ago

Thomas also mentioned in the thread that it seems "Space Falcon" is a real NFT project. The actual domain ends in .io though, and somehow the scammers managed to acquire the .com domain and I'd imagine they'd then only need to replicate the frontend UI instead of coming up with an all-new one. Still very sophisticated for sure.