15 ms·

“Crypto drainer” template facilitates theft

187 points by eliya_confiant 4y ago

walrus01 4y ago
am I a bad person if I think that people buying the latest hyped NFT deserve to have their 'crypto' drained? NFTs of art images are such an absurdity.
- aleksiy123 4y ago
  Yes, people who spend their money on things you don't approve of deserve to lose their money.
  - rvnx 4y ago
    Please disapprove real estate, buying a house is really too expensive and it makes it difficult to find decent housing.
    - walrus01 4y ago
      patiently waiting for a "vancouver real estate market drainer" phishing service that can cause a real world market crash.
      - rvnx 4y ago
        Thank you anon. You are my hero.
      - bombcar 4y ago
        There we go, a use case for NFTs! If Vancouver real estate was all on the block chain then people could steal it and so people wouldn't want to own it because it'd get stolen, and prices would drop!
    - onesafari 4y ago
      Seriously tho, how are people affording these mortgages? Is everyone living paycheck to paycheck or what?
      - walrus01 4y ago
        the percentage of american wage earners who are living paycheck-to-paycheck is probably a lot higher than you think it is. even couples with dual six figure salaries.
        efitz 4y ago
        Lifestyle often expands to consume available income. And sometimes more.
        walrus01 4y ago
        hey let's buy a $60,000 pontoon boat on a 60-month loan, and a jetski, what could possibly go wrong
  - woodruffw 4y ago
    It's clear the GP isn't making a categorical claim about disapproval. It's more likely they think that the victims here had every available opportunity to exercise basic diligence. I'm not sure I actually agree with that (I think a lot of the people getting scammed here are being predated on by a market that thrives on misinformation), but that's a far cry from how you've interpreted the comment.
    - aleksiy123 4y ago
      To be honest I'm more concerned with the "deserve to be scammed" part. The "because I don't like it" is cherry on top. My point is if you read that comment it takes a second of introspection to come to an answer.
- willcipriano 4y ago
- xwdv 4y ago
  Crypto is a net negative for the world, so anyone should feel free to pillage crypto assets and redistribute them to other more noble causes. People must learn to avoid crypto. We can teach them why.
  - politician 4y ago
    What other things do you disapprove of that absolve people of the crime of theft? PS: Read your HN profile: Submitting stories is by far the best way to earn karma. Comments are small potatoes.
    - Gigachad 4y ago
      Not strictly theft, but I approve of people criminally obstructing actions which are bad for the environment. Destruction or obstruction of coal power mining/generation or smaller movements like deflating the tires of luxury SUVs. If the law doesn't take environmental action seriously then individuals have to take control. Destroying the entire crypto market, even criminally, would be a benefit to the world.
- hourago 4y ago
  Not necessarily a bad person. But to think that people that may not have the education to understand NFTs deserve to be robbed seems to justify to prey on people. NFTs are an absurdity, but millions are spend on advertising them to an unprotected public. That are the real culprits. Scammers do not deserve to get any money, that's for sure.
  - uoaei 4y ago
    You don't need to have the education to understand NFTs to have the knowledge not to put bets down on things you don't understand.
    - pcthrowaway 4y ago
      Most people don't understand things they invest in/buy. Most people buying stocks don't understand the company as well as someone who works in the sector. Most casual art appreciators don't know how to tell if a painting they're buying is a forgery. Most people buying a house don't know how to assess the foundation, and even if they get a professional assessment, they don't have the same knowledge of the housing market as professionals. Maybe that neighbourhood is slated for rezoning in 5 years that would devalue the property. Heck, even people buying gold/diamonds get ripped off on fakes/synthetics. Outside of investments, most people here have probably bought a car. Do people who buy a car deserve to get ripped off if they don't understand how every component works well enough to inspect it themselves?
      - uoaei 4y ago
        It appears crypto bros are on the verge of re-inventing market regulation!
    - drc500free 4y ago
      If every transaction required perfect understanding by both parties, there would be no markets. We have regulations to reduce the amount of understanding needed to participate in markets without getting fleeced, which makes the markets function.
- nathias 4y ago
  yes
- nkrisc 4y ago
  I don’t know if they “deserve” it but I sure hoped they learned a valuable lesson about cryptocurrencies.
- jdtang13 4y ago
  People don't deserve to be scammed. Imagine if your own grandma or teenage cousin fell victim to this.
  - kareemsabri 4y ago
    lol who's grandma is buying NFTs? my teenage cousin doesn't have any money so better they get scammed now and learn.
  - mbreese 4y ago
    Teenagers have been getting scammed for years. Not that they deserve it, but advertising the impossible to the gullible has a long history. https://en.m.wikipedia.org/wiki/X-ray_specs https://en.m.wikipedia.org/wiki/X-ray_specs
- deleted 4y ago
  [deleted]
- TacticalCoder 4y ago
  > am I a bad person if I think that people buying the latest hyped NFT deserve to have their 'crypto' drained? I'll tell you this: the scummy thieves who drain these deserve it even less.
- deleted 4y ago
  [deleted]
- googlryas 4y ago
  If you truly believe that? Then yes.
renewiltord 4y ago
So let me get this straight. You just connect your Wallet to a random website and let them run arbitrary smart contracts? That's wild, man. Surely there's gotta be some concern here that someone could take your shit. I'm just surprised there isn't a privacy.com equivalent for this, like a limited-view wallet that lets you create sub-wallets for interaction with various services. Or if there is, perhaps it's not famous yet. Worthwhile product, I think, but hard to build because you'll be the target of everything. I think it would be easy for me to make a mistake somewhere while building it.
- bombcar 4y ago
  You can create a different wallet for each transaction, and do all sorts of complicated things, but nobody does. Just like you could pay your phone bill with a prepaid Visa each month just in case they overcharged you.
  - gowld 4y ago
    But why isn't it fully automated, like Apple Pay or privacy.com?
    - bombcar 4y ago
      Because the main purpose of crypto has been number go up. I suspect monero (which I think is the privacy one?) has something more in that area.
    - brutusborn 4y ago
      The same reason anything isn't automated: the developer estimates the cost of developing the system is higher than the potential upside. At some point, someone will add this functionality to their coin / platform because they think the potential upside will be worth it.
- technion 4y ago
  Nothing stops a person making a new wallet with limited assets for interaction with less reputable websites. Web3 culture has made this quite difficult in practice. For example, it's quite normalised to say "new exciting nft project, only available to existing owners of expensive nfts". This sort of thing is considered an ownership perk. And it's why those discord hacks were so damaging, a statement like that was made and it did not sound out of character. So in order to use this service, you must be using the wallet with your expensive nfts, so ownership can be verified, but also because it's a phishing site. Edit: and if you wanted to routinely transfer small funds to a hot wallet, gas fees will put a stop to the idea.
scoofy 4y ago
Regulation can be bad, but it can also be good. People think of history like it was wonderful, but it was full of cons and scams. Reputation matters, and people with reputations charge a premium for it. Some of the best aspects of regulations is exactly to remove the reputation tax by mandating everyone follow the same practices as the trusted institution. The real sad aspect is that the crypto-libertarians of today are repeating some of the exact same clear scams from the wildcatting era, and when it's brought up, it's just mocked because, honestly, who is going to read a book about 19th century finance when you can just watch the new star wars show instead.
- rory 4y ago
  How exactly would regulation help in this case? Most countries already regulate pretty strongly against theft.
  - scoofy 4y ago
    Again, the purpose of blockchain-as-capital is exactly to escape regulatory requirements. One of the main reasons why we are able to use the banking systems like we do, is the ability, generally, to unwind translations that were fraudulent. There are also disclosure forms that must be presented as a double-check, to transactions that cannot be unwound. With most blockchains, this is entirely not feasible. The irony is that many of the brokers will likely be swamped by regulation going forward exactly because people will be unhappy with the lack of these types of disclosures.
    - rory 4y ago
      No need to condescend-- the gap isn't that I didn't read what you wrote, or even that I disagree. Your point is just unrelated to the situation we're talking about. A wallet is not like a bank. It's like.. well, a wallet. If you hand a wallet full of cash to a thief, no banking regulation will protect you. The tradition digital equivalent is a Visa gift card or Western Union.
  - deleted 4y ago
    [deleted]
mjcohen 4y ago
Best way to make money from crypto.
astoor 4y ago
This sort of thing is as old as crypto itself - see e.g. "How to steal Bitcoins" with some excellent HN comments (including from one of the thieves referenced in the original article) from 8 years ago: https://news.ycombinator.com/item?id=7365663 https://news.ycombinator.com/item?id=7365663
cvccvroomvroom 4y ago
My next billion dollar apps will be disposable crypto wallets and currently obscure website accreditation.
- bogwog 4y ago
  My next billion dollar app will be a service that unlocks anyone's doors and gives you directions to their valuables (with augmented reality ofc). That way, you can directly steal from people without the complexity and carbon footprint of traditional cryptocurrency and NFT projects.
  - cvccvroomvroom 4y ago
    Tell August, Ring, and Nest you have a new auditing API designed exclusively for them coupled with a value-add homeowners asset inventory management app. ;)
    - 8note 4y ago
      Allows for thefts without the related property damage. Who wants to replace your TV and have to fix the window they broke to steal it
      - cvccvroomvroom 4y ago
        The house equivalent of leaving car doors rolled down and doors unlocked for SF, PDX, and ATX. We'll call it OpenHouse. Come by and steal our shit in an organized way because our police won't do a damn thing to stop you. The app even turns a light on and leaves milk and cookies to make you, dear crook, feel right at home while you're pilfering our valuables to sell for crack.
Animats 4y ago
"Connecting a wallet" makes it vulnerable to Javascript from a web site? Who designed that?
- sumeno 4y ago
  Have you seen the rest of crypto? It's not very surprising
- mNovak 4y ago
  Unless I'm misunderstanding something, I don't think it can. Your ownership of NFTs and ETH balance is public info on chain, and the site can construct a malicious transaction giving them away, but it ultimately has to trick the user into signing it. Not really sure what leeway they have to manipulate how the wallet UI presents the tx to the user though.
  - rattlesnakedave 4y ago
    Metamask presents a big red warning when it requests a signature for a hex ETH transaction. But most people don’t read. Or they request token approvals users don’t bother to modify.
    - Gigachad 4y ago
      "requests a signature for a hex ETH transaction." What an earth does that even mean? It's no wonder people keep messing this up. You need to spend half your life keeping up with the tech just to not get scammed.
      - cowtools 4y ago
        You don't know what a digital signature is? This is the equivalent of being mad at banks because you don't understand what a bank routing number is. >It's no wonder people keep messing this up. The type of user that doesn't understand this should not even be using cryptocurrency in the first place.
PragmaticPulp 4y ago
Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas fees to transfer the money) and then, presumably pay even more gas fees to transfer everything back out of the wallet if it turns out to not be a scam. It's incredible that crypto has reached a point where some people seem to think this is all totally reasonable and natural to expect the average user to know.
- joshgroban 4y ago
  You don't know what you're talking about.
- nubb 4y ago
  you’re right. the unreasonable complexity of crypto is why people fall for phishing scams. thanks.
  - mushbino 4y ago
    Right? It's a good thing our monetary system and financial instruments aren't complex, phew!
    - giaour 4y ago
      It's one thing to have complex payment instruments where innocent mistakes are reversible. Having them in a world where everything is permanent is another situation entirely.
      - mitchdoogle 4y ago
        Tell that to everyone who has had their identity stolen through no action of their own
- 4y ago
Barrera 4y ago
> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. They don't understand at all how public key cryptography works, or worse, they bring truly bad mental models from their experience with their online bank or Facebook. Then they get burned. Nothing new here. It's for this reason that central bank digital currencies are one the the worst ideas ever to come out of central banks. The average person is in no position to even think about managing cryptographic material let alone securing life-changing amounts of money with it. Idiot-proofing CBDC will mean that the central bank just becomes an actual, central, bank. No crypto required. A real one where people actually keep their money. So long to private banks.
- rattlesnakedave 4y ago
  No it doesn’t suggest 2. Google “token approvals.” Or just look at metamask for like 30 seconds.
  - Barrera 4y ago
    I looked at it for 30 seconds and am deeply skeptical of the scheme.
- dcolkitt 4y ago
  All connecting a wallet does is allow the app to see your public keys. Private keys are not directly exposed. The app can then request the user sign transactions, but they must be explicitly approved by the user. Where fraud typically happens is when a user thinks they're signing an innocuous transaction, when in fact they're signing a malicious one. This is generally a hard problem, but it's very clear from the wallet the address of the smart contract your transaction interacts with.
  - Barrera 4y ago
cvccvroomvroom 4y ago
When a scam is nearly indistinguishable from another scam, something else is inherently wrong.
- walrus01 4y ago
  it's like a turducken of scams: crypto, NFT, NFT-drainer-siphon
  - cvccvroomvroom 4y ago
    Perhaps the next inception is the NFT-drainer-siphon-drainer that spoofs the collection and botnet sites to trick the scammers into relocating funds into the wrong place. At some point, fencing these worthless NFTs will be needed. Hmm.. create a botnet to sell NFTs on Insta.
  - mellavora 4y ago
    "turtles all the way down" in other words.
koprulusector 4y ago
I am honestly mind blown that a scam tool like this isn’t minified and uglified to obfuscate reverse engineering. The process also strips comments, which I imagine would’ve been a preference of the perpetrator. I assume the example from the author [of the blog post] must’ve been a deployment by someone without much experience with the javascript ecosystem or extremely lazy. Pretending this assumption is correct, what does it tell us? Is it a reflection of the environment’s lack of regulation (even industry/market led, like PCI) and a deluge of unsophisticated (ignorant) users/consumers?
- eliya_confiant 4y ago
  Hi, author here. I liked this comment a lot and I can help to shed some light: We do see phishing pages like this increasingly popping up with obfuscation. I think at this time less than a third are obfuscated, but this is gradually increasing. The thing is, most of the folks running these sites are likely not very technical. They buy the template from a vendor and plug in the config settings and just focus on driving traffic to the site - this happens through Discord & Twitter spam. The thing with fraudsters and threat actors that play in this space is that at the end of the day it's a business and they want maximum reward for minimal effort. I think right now there's not a very aggressive takedown feedback loop with these phishing sites, but we are working to accelerate this and as this happens the perpetrators WILL need to rely more on obfuscation to try and thwart on the fly static detection. My guess is that eventually most of the logic will be server-side and cloaked as has happened with many other categories of phishing and fraud (particularly malvertising campaigns). Sooner or later the more amateur scam operators in this space will likely get shaken out by this acceleration of the cat and mouse game and only highly technical operators will be left. With regards to the sites that we see obfuscated today, we are still able to do accurate attribution, as we've been specializing in the detection and blocking malicious client-side code for some time now. Thanks again for your comment.
caylus 4y ago
Others in the thread have mentioned that the MetaMask wallet provides a warning prior to allowing a site like this to access the wallet. For reference, this appears to be an example of that warning: https://github.com/MetaMask/metamask-extension/issues/11337 https://github.com/MetaMask/metamask-extension/issues/11337 Transcript: "Signing this message can have dangerous side effects. Only sign messages from sites you fully trust with your entire account. This dangerous method will be removed in a future version." Presumably part of the issue is that a legitimate "NFT mint" transaction might also carry the same warning.
- darcys22 4y ago
  There is a difference between signing a transaction and signing a string. The warning you have linked pops up when a signing of a string occurs and warns that if the person embeds a transaction in that string you are signing whatever transaction they have made. There is a new method they have for signing strings that does not allow a transaction to be signed so its safer. The crypto drainer seems to directly be sending the NFTs and assuming that the user cant understand the transaction and what its actually doing.
charlie0 4y ago
Soon to be millions, and then hundreds of thousands if the crypto market continues to spiral.
DonHopkins 4y ago
I absolutely despise crypto scammers, but looking at those asinine graphics they use to lure in their suckers, it make it VERY VERY VERY difficult to have any empathy for their victims. If that whole "Amazing Pandaverse" theme template appeals to your aesthetic sensibilities and primal urge to get rich quick and screw everyone else and the environment while wearing kewl sunglasses and dollar sign bitcoin logo bling jewelry, you're probably a huge narcissistic douchebag who actually deserves to get the fuck scammed out of you, not a poor innocent senior citizen living on a pension. It kind of makes me nostalgic for the good old fashioned robot insurance scams targeting seniors, when you could actually feel sorry for the victims. https://www.youtube.com/watch?v=g4Gh_IcK8UM https://www.youtube.com/watch?v=g4Gh_IcK8UM
- Rastonbury 4y ago
  Lol come on, not everyone who falls for these are douchebags. Many is min wage jobs just trying to get out of it and 'make it', I bet they think its childish looking too but hey I can make double my meager savings
  - DonHopkins 4y ago
    I totally agree, it's victim blaming, but the incredible level of self sabotage and tolerance for douchbaggery the victims exhibit is a huge drain on my limited supply of empathy, after so many years of trying to deprogram and empathize with gullible racist fuckhead suckers who got scammed by Trump, and have been programmed to view empathy as a weakness, so don't deserve it themselves. And there's probably a huge overlap between people who admire golden toilets and bored ape jpegs. At any rate, they'll probably reskin these templates to feature Hummel figurines, then I can feel sorry for the victims again. https://www.youtube.com/watch?v=57nge8q8CKk https://www.youtube.com/watch?v=57nge8q8CKk
ackbar03 4y ago
I sometimes wonder what people behind these actually do (or used to do) and how they got into it. It takes real work to build these things, deploy, sell, and maintain these things, doesn't seem to be the sort of thing that grew from a weekend side-project in my opinion. They could spend that time working on something more legal.
- NullPrefix 4y ago
  Legit and legal work is usually region limited. Even on internet. Especially hired, not contracted work. Scams are free to operate globally
Hunter223 4y ago
Thanks to MATT DUNHAM. i was able to recover all my lost bitcoin from forex trading guys, when it comes to recovery of funds either from binary options, crypto, forex and Ponzi schemes. ( MATTDUNHAM928 at gmail dot com ) His the best recovery expert i have ever seen all my life. He recovered my funds and also funds of my friends, colleagues who were in similar situation as i was.
Hunter223 4y ago
Thanks to MATT DUNHAM. i was able to recover all my lost bitcoin from forex trading guys, when it comes to recovery of funds either from binary options, crypto, forex and Ponzi schemes. ( MATTDUNHAM928 at gmail dot com ) His the best recovery expert i have ever seen all my life. He recovered my funds and also funds of my friends, colleagues who were in similar situation as i was...

am I a bad person if I think that people buying the latest hyped NFT deserve to have their 'crypto' drained? NFTs of art images are such an absurdity.

aleksiy123 4y ago
Yes, people who spend their money on things you don't approve of deserve to lose their money.
- rvnx 4y ago
  Please disapprove real estate, buying a house is really too expensive and it makes it difficult to find decent housing.
  - walrus01 4y ago
    patiently waiting for a "vancouver real estate market drainer" phishing service that can cause a real world market crash.
    - rvnx 4y ago
      Thank you anon. You are my hero.
    - bombcar 4y ago
      There we go, a use case for NFTs! If Vancouver real estate was all on the block chain then people could steal it and so people wouldn't want to own it because it'd get stolen, and prices would drop!
  - onesafari 4y ago
    Seriously tho, how are people affording these mortgages? Is everyone living paycheck to paycheck or what?
    - walrus01 4y ago
      the percentage of american wage earners who are living paycheck-to-paycheck is probably a lot higher than you think it is. even couples with dual six figure salaries.
      - efitz 4y ago
        Lifestyle often expands to consume available income. And sometimes more.
        walrus01 4y ago
        hey let's buy a $60,000 pontoon boat on a 60-month loan, and a jetski, what could possibly go wrong
- woodruffw 4y ago
  It's clear the GP isn't making a categorical claim about disapproval. It's more likely they think that the victims here had every available opportunity to exercise basic diligence. I'm not sure I actually agree with that (I think a lot of the people getting scammed here are being predated on by a market that thrives on misinformation), but that's a far cry from how you've interpreted the comment.
  - aleksiy123 4y ago
    To be honest I'm more concerned with the "deserve to be scammed" part. The "because I don't like it" is cherry on top. My point is if you read that comment it takes a second of introspection to come to an answer.
willcipriano 4y ago
xwdv 4y ago
Crypto is a net negative for the world, so anyone should feel free to pillage crypto assets and redistribute them to other more noble causes. People must learn to avoid crypto. We can teach them why.
- politician 4y ago
  What other things do you disapprove of that absolve people of the crime of theft? PS: Read your HN profile: Submitting stories is by far the best way to earn karma. Comments are small potatoes.
  - Gigachad 4y ago
    Not strictly theft, but I approve of people criminally obstructing actions which are bad for the environment. Destruction or obstruction of coal power mining/generation or smaller movements like deflating the tires of luxury SUVs. If the law doesn't take environmental action seriously then individuals have to take control. Destroying the entire crypto market, even criminally, would be a benefit to the world.
hourago 4y ago
Not necessarily a bad person. But to think that people that may not have the education to understand NFTs deserve to be robbed seems to justify to prey on people. NFTs are an absurdity, but millions are spend on advertising them to an unprotected public. That are the real culprits. Scammers do not deserve to get any money, that's for sure.
- uoaei 4y ago
  You don't need to have the education to understand NFTs to have the knowledge not to put bets down on things you don't understand.
  - pcthrowaway 4y ago
    Most people don't understand things they invest in/buy. Most people buying stocks don't understand the company as well as someone who works in the sector. Most casual art appreciators don't know how to tell if a painting they're buying is a forgery. Most people buying a house don't know how to assess the foundation, and even if they get a professional assessment, they don't have the same knowledge of the housing market as professionals. Maybe that neighbourhood is slated for rezoning in 5 years that would devalue the property. Heck, even people buying gold/diamonds get ripped off on fakes/synthetics. Outside of investments, most people here have probably bought a car. Do people who buy a car deserve to get ripped off if they don't understand how every component works well enough to inspect it themselves?
    - uoaei 4y ago
      It appears crypto bros are on the verge of re-inventing market regulation!
  - drc500free 4y ago
    If every transaction required perfect understanding by both parties, there would be no markets. We have regulations to reduce the amount of understanding needed to participate in markets without getting fleeced, which makes the markets function.
nathias 4y ago
yes
nkrisc 4y ago
I don’t know if they “deserve” it but I sure hoped they learned a valuable lesson about cryptocurrencies.
jdtang13 4y ago
People don't deserve to be scammed. Imagine if your own grandma or teenage cousin fell victim to this.
- kareemsabri 4y ago
  lol who's grandma is buying NFTs? my teenage cousin doesn't have any money so better they get scammed now and learn.
- mbreese 4y ago
  Teenagers have been getting scammed for years. Not that they deserve it, but advertising the impossible to the gullible has a long history. https://en.m.wikipedia.org/wiki/X-ray_specs https://en.m.wikipedia.org/wiki/X-ray_specs
deleted 4y ago
[deleted]
TacticalCoder 4y ago
> am I a bad person if I think that people buying the latest hyped NFT deserve to have their 'crypto' drained? I'll tell you this: the scummy thieves who drain these deserve it even less.
deleted 4y ago
[deleted]
googlryas 4y ago
If you truly believe that? Then yes.

renewiltord 4y ago

So let me get this straight. You just connect your Wallet to a random website and let them run arbitrary smart contracts? That's wild, man. Surely there's gotta be some concern here that someone could take your shit. I'm just surprised there isn't a privacy.com equivalent for this, like a limited-view wallet that lets you create sub-wallets for interaction with various services. Or if there is, perhaps it's not famous yet. Worthwhile product, I think, but hard to build because you'll be the target of everything. I think it would be easy for me to make a mistake somewhere while building it.

bombcar 4y ago
You can create a different wallet for each transaction, and do all sorts of complicated things, but nobody does. Just like you could pay your phone bill with a prepaid Visa each month just in case they overcharged you.
- gowld 4y ago
  But why isn't it fully automated, like Apple Pay or privacy.com?
  - bombcar 4y ago
    Because the main purpose of crypto has been number go up. I suspect monero (which I think is the privacy one?) has something more in that area.
  - brutusborn 4y ago
    The same reason anything isn't automated: the developer estimates the cost of developing the system is higher than the potential upside. At some point, someone will add this functionality to their coin / platform because they think the potential upside will be worth it.
technion 4y ago
Nothing stops a person making a new wallet with limited assets for interaction with less reputable websites. Web3 culture has made this quite difficult in practice. For example, it's quite normalised to say "new exciting nft project, only available to existing owners of expensive nfts". This sort of thing is considered an ownership perk. And it's why those discord hacks were so damaging, a statement like that was made and it did not sound out of character. So in order to use this service, you must be using the wallet with your expensive nfts, so ownership can be verified, but also because it's a phishing site. Edit: and if you wanted to routinely transfer small funds to a hot wallet, gas fees will put a stop to the idea.

scoofy 4y ago

Regulation can be bad, but it can also be good. People think of history like it was wonderful, but it was full of cons and scams. Reputation matters, and people with reputations charge a premium for it. Some of the best aspects of regulations is exactly to remove the reputation tax by mandating everyone follow the same practices as the trusted institution. The real sad aspect is that the crypto-libertarians of today are repeating some of the exact same clear scams from the wildcatting era, and when it's brought up, it's just mocked because, honestly, who is going to read a book about 19th century finance when you can just watch the new star wars show instead.

rory 4y ago
How exactly would regulation help in this case? Most countries already regulate pretty strongly against theft.
- scoofy 4y ago
  Again, the purpose of blockchain-as-capital is exactly to escape regulatory requirements. One of the main reasons why we are able to use the banking systems like we do, is the ability, generally, to unwind translations that were fraudulent. There are also disclosure forms that must be presented as a double-check, to transactions that cannot be unwound. With most blockchains, this is entirely not feasible. The irony is that many of the brokers will likely be swamped by regulation going forward exactly because people will be unhappy with the lack of these types of disclosures.
  - rory 4y ago
    No need to condescend-- the gap isn't that I didn't read what you wrote, or even that I disagree. Your point is just unrelated to the situation we're talking about. A wallet is not like a bank. It's like.. well, a wallet. If you hand a wallet full of cash to a thief, no banking regulation will protect you. The tradition digital equivalent is a Visa gift card or Western Union.
- deleted 4y ago
  [deleted]

mjcohen 4y ago

Best way to make money from crypto.

astoor 4y ago

This sort of thing is as old as crypto itself - see e.g. "How to steal Bitcoins" with some excellent HN comments (including from one of the thieves referenced in the original article) from 8 years ago: https://news.ycombinator.com/item?id=7365663 https://news.ycombinator.com/item?id=7365663

cvccvroomvroom 4y ago

My next billion dollar apps will be disposable crypto wallets and currently obscure website accreditation.

bogwog 4y ago
My next billion dollar app will be a service that unlocks anyone's doors and gives you directions to their valuables (with augmented reality ofc). That way, you can directly steal from people without the complexity and carbon footprint of traditional cryptocurrency and NFT projects.
- cvccvroomvroom 4y ago
  Tell August, Ring, and Nest you have a new auditing API designed exclusively for them coupled with a value-add homeowners asset inventory management app. ;)
  - 8note 4y ago
    Allows for thefts without the related property damage. Who wants to replace your TV and have to fix the window they broke to steal it
    - cvccvroomvroom 4y ago
      The house equivalent of leaving car doors rolled down and doors unlocked for SF, PDX, and ATX. We'll call it OpenHouse. Come by and steal our shit in an organized way because our police won't do a damn thing to stop you. The app even turns a light on and leaves milk and cookies to make you, dear crook, feel right at home while you're pilfering our valuables to sell for crack.

Animats 4y ago

"Connecting a wallet" makes it vulnerable to Javascript from a web site? Who designed that?

sumeno 4y ago
Have you seen the rest of crypto? It's not very surprising
mNovak 4y ago
Unless I'm misunderstanding something, I don't think it can. Your ownership of NFTs and ETH balance is public info on chain, and the site can construct a malicious transaction giving them away, but it ultimately has to trick the user into signing it. Not really sure what leeway they have to manipulate how the wallet UI presents the tx to the user though.
- rattlesnakedave 4y ago
  Metamask presents a big red warning when it requests a signature for a hex ETH transaction. But most people don’t read. Or they request token approvals users don’t bother to modify.
  - Gigachad 4y ago
    "requests a signature for a hex ETH transaction." What an earth does that even mean? It's no wonder people keep messing this up. You need to spend half your life keeping up with the tech just to not get scammed.
    - cowtools 4y ago
      You don't know what a digital signature is? This is the equivalent of being mad at banks because you don't understand what a bank routing number is. >It's no wonder people keep messing this up. The type of user that doesn't understand this should not even be using cryptocurrency in the first place.

PragmaticPulp 4y ago

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas fees to transfer the money) and then, presumably pay even more gas fees to transfer everything back out of the wallet if it turns out to not be a scam. It's incredible that crypto has reached a point where some people seem to think this is all totally reasonable and natural to expect the average user to know.

joshgroban 4y ago
You don't know what you're talking about.
nubb 4y ago
you’re right. the unreasonable complexity of crypto is why people fall for phishing scams. thanks.
- mushbino 4y ago
  Right? It's a good thing our monetary system and financial instruments aren't complex, phew!
  - giaour 4y ago
    It's one thing to have complex payment instruments where innocent mistakes are reversible. Having them in a world where everything is permanent is another situation entirely.
    - mitchdoogle 4y ago
      Tell that to everyone who has had their identity stolen through no action of their own
4y ago

Barrera 4y ago

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. They don't understand at all how public key cryptography works, or worse, they bring truly bad mental models from their experience with their online bank or Facebook. Then they get burned. Nothing new here. It's for this reason that central bank digital currencies are one the the worst ideas ever to come out of central banks. The average person is in no position to even think about managing cryptographic material let alone securing life-changing amounts of money with it. Idiot-proofing CBDC will mean that the central bank just becomes an actual, central, bank. No crypto required. A real one where people actually keep their money. So long to private banks.

rattlesnakedave 4y ago
No it doesn’t suggest 2. Google “token approvals.” Or just look at metamask for like 30 seconds.
- Barrera 4y ago
  I looked at it for 30 seconds and am deeply skeptical of the scheme.
dcolkitt 4y ago
All connecting a wallet does is allow the app to see your public keys. Private keys are not directly exposed. The app can then request the user sign transactions, but they must be explicitly approved by the user. Where fraud typically happens is when a user thinks they're signing an innocuous transaction, when in fact they're signing a malicious one. This is generally a hard problem, but it's very clear from the wallet the address of the smart contract your transaction interacts with.
- Barrera 4y ago

cvccvroomvroom 4y ago

When a scam is nearly indistinguishable from another scam, something else is inherently wrong.

walrus01 4y ago
it's like a turducken of scams: crypto, NFT, NFT-drainer-siphon
- cvccvroomvroom 4y ago
  Perhaps the next inception is the NFT-drainer-siphon-drainer that spoofs the collection and botnet sites to trick the scammers into relocating funds into the wrong place. At some point, fencing these worthless NFTs will be needed. Hmm.. create a botnet to sell NFTs on Insta.
- mellavora 4y ago
  "turtles all the way down" in other words.

koprulusector 4y ago

I am honestly mind blown that a scam tool like this isn’t minified and uglified to obfuscate reverse engineering. The process also strips comments, which I imagine would’ve been a preference of the perpetrator. I assume the example from the author [of the blog post] must’ve been a deployment by someone without much experience with the javascript ecosystem or extremely lazy. Pretending this assumption is correct, what does it tell us? Is it a reflection of the environment’s lack of regulation (even industry/market led, like PCI) and a deluge of unsophisticated (ignorant) users/consumers?

eliya_confiant 4y ago
Hi, author here. I liked this comment a lot and I can help to shed some light: We do see phishing pages like this increasingly popping up with obfuscation. I think at this time less than a third are obfuscated, but this is gradually increasing. The thing is, most of the folks running these sites are likely not very technical. They buy the template from a vendor and plug in the config settings and just focus on driving traffic to the site - this happens through Discord & Twitter spam. The thing with fraudsters and threat actors that play in this space is that at the end of the day it's a business and they want maximum reward for minimal effort. I think right now there's not a very aggressive takedown feedback loop with these phishing sites, but we are working to accelerate this and as this happens the perpetrators WILL need to rely more on obfuscation to try and thwart on the fly static detection. My guess is that eventually most of the logic will be server-side and cloaked as has happened with many other categories of phishing and fraud (particularly malvertising campaigns). Sooner or later the more amateur scam operators in this space will likely get shaken out by this acceleration of the cat and mouse game and only highly technical operators will be left. With regards to the sites that we see obfuscated today, we are still able to do accurate attribution, as we've been specializing in the detection and blocking malicious client-side code for some time now. Thanks again for your comment.

caylus 4y ago

Others in the thread have mentioned that the MetaMask wallet provides a warning prior to allowing a site like this to access the wallet. For reference, this appears to be an example of that warning: https://github.com/MetaMask/metamask-extension/issues/11337 https://github.com/MetaMask/metamask-extension/issues/11337 Transcript: "Signing this message can have dangerous side effects. Only sign messages from sites you fully trust with your entire account. This dangerous method will be removed in a future version." Presumably part of the issue is that a legitimate "NFT mint" transaction might also carry the same warning.

darcys22 4y ago
There is a difference between signing a transaction and signing a string. The warning you have linked pops up when a signing of a string occurs and warns that if the person embeds a transaction in that string you are signing whatever transaction they have made. There is a new method they have for signing strings that does not allow a transaction to be signed so its safer. The crypto drainer seems to directly be sending the NFTs and assuming that the user cant understand the transaction and what its actually doing.

charlie0 4y ago

Soon to be millions, and then hundreds of thousands if the crypto market continues to spiral.

DonHopkins 4y ago

I absolutely despise crypto scammers, but looking at those asinine graphics they use to lure in their suckers, it make it VERY VERY VERY difficult to have any empathy for their victims. If that whole "Amazing Pandaverse" theme template appeals to your aesthetic sensibilities and primal urge to get rich quick and screw everyone else and the environment while wearing kewl sunglasses and dollar sign bitcoin logo bling jewelry, you're probably a huge narcissistic douchebag who actually deserves to get the fuck scammed out of you, not a poor innocent senior citizen living on a pension. It kind of makes me nostalgic for the good old fashioned robot insurance scams targeting seniors, when you could actually feel sorry for the victims. https://www.youtube.com/watch?v=g4Gh_IcK8UM https://www.youtube.com/watch?v=g4Gh_IcK8UM

Rastonbury 4y ago
Lol come on, not everyone who falls for these are douchebags. Many is min wage jobs just trying to get out of it and 'make it', I bet they think its childish looking too but hey I can make double my meager savings
- DonHopkins 4y ago
  I totally agree, it's victim blaming, but the incredible level of self sabotage and tolerance for douchbaggery the victims exhibit is a huge drain on my limited supply of empathy, after so many years of trying to deprogram and empathize with gullible racist fuckhead suckers who got scammed by Trump, and have been programmed to view empathy as a weakness, so don't deserve it themselves. And there's probably a huge overlap between people who admire golden toilets and bored ape jpegs. At any rate, they'll probably reskin these templates to feature Hummel figurines, then I can feel sorry for the victims again. https://www.youtube.com/watch?v=57nge8q8CKk https://www.youtube.com/watch?v=57nge8q8CKk

ackbar03 4y ago

I sometimes wonder what people behind these actually do (or used to do) and how they got into it. It takes real work to build these things, deploy, sell, and maintain these things, doesn't seem to be the sort of thing that grew from a weekend side-project in my opinion. They could spend that time working on something more legal.

NullPrefix 4y ago
Legit and legal work is usually region limited. Even on internet. Especially hired, not contracted work. Scams are free to operate globally

Hunter223 4y ago

Thanks to MATT DUNHAM. i was able to recover all my lost bitcoin from forex trading guys, when it comes to recovery of funds either from binary options, crypto, forex and Ponzi schemes. ( MATTDUNHAM928 at gmail dot com ) His the best recovery expert i have ever seen all my life. He recovered my funds and also funds of my friends, colleagues who were in similar situation as i was.

Hunter223 4y ago