5 ms·

MIT students stole $25M in seconds by exploiting ETH blockchain bug, DOJ says

59 points by em3rgent0rdr 2y ago

sharpshadow 2y ago
Pretty careless almost idiotic to just search with history and sync? about the crimes you are going to commit. It shows that those guys aren’t really technical, exploiting a blockchain bug sounds like they hacked the system but instead they misused a feature. They haven’t been even smart enough to understand that the blockchain is for tracing.
- 4gotunameagain 2y ago
  > sounds like they hacked the system but instead they misused a feature. Isn't that quite often the definition of hacking though ? If they were based on a different country they would've never been caught. And they do seem pretty technical to me, just not entirely thoughtful.
- metachris 2y ago
  This was a pretty sophisticated attack and deeply technical execution.
democracy 2y ago
Wow, what happened to the "screw the government" position? As soon as there is a problem with "free money", its adepts run to the police for help ))))) It's hilarious, frankly. tbh after ETH modified their "unmutable" blockchain in DAO attack, they are just full of BS "innovators" and "investors".
- throwaway11460 2y ago
  You're talking about an opinion of a bunch of early hackers as if it was a common world view of everyone in the crypto/blockchain space. It's not (sadly, IMHO). There are many who are exploring merging government regulation and crypto currency. Not sure what you mean by modifying unmutable blockchain, that never happened. What happened is that people stopped using that blockchain and switched to another one.
  - nohup2 2y ago
    They switched to another blockchain… that has the same exact name and is maintained by the same people. So in my opinion, Ethereum broke the “unmutable” promise after the DAO debacle. You could argue that as Ethereum Classic kept the original blockchain, the promise was kept. But even so, it was the spirit of that promise was broken, and ETC is not maintained by Ethereum. I lost trust on Ethereum because of that and never touched it again since 2016.
    - throwaway11460 2y ago
      Yeah, sure, I agree. But the blockchain technology itself is still sound - its about the users who accepted this change and the social capital of the organization that pushed it.
      - RcouF1uZ4gsC 2y ago
        > its about the users who accepted this change and the social capital of the organization that pushed it In other words, fiat
- vsuperpower2020 2y ago
  What would you rather they do? Let themselves be stolen from? Personally hunt down the people that wronged them? That's what happened when certain gangs lost money on crypto. This is a lame "gotcha" whether you like crypto or not.
  - democracy 2y ago
    If we talk about "stealing" - there was a huge effort to make people believe crypto is worth of investing as some "new money super technology that makes everyone rich", right? Were the risks higlighted? Not really. The richest person in the world (E.Musk) shills an inflationary unlimited bitcoin clone as something valuable (DOGECOIN) - this is fraud on a giant scale. I would love to see him calling out the BS in crypto "industry" - he didn't and instead did dogecoin thing. I frankly don't believe he is some kind of tech genius after this. And this is ok, right? Do simple people know that they put their money into useless "technologies" that are fundamentally fragile and they are at risk of losing everything as soon as there are advances in computing (breaking sha/ecc, doing 51% attack)? They don't. So, that's really stealing, on a grand scale. This 21 million should be an award for the hackers, really. Unless ETH wants to change the "immutable blockchain" once again ))) noone cares these days anyways
  - atoav 2y ago
    Well. I'd say the anti-government¹ type generally has 3 options here: 1. Realize their stance is flawed, change it and go to the police 2. Stick to their stance and not go to the police 3. Ignore the cognitive dissonance and pretend going to the police is coherent with their political ideas. Rationalize about why in this narrow case it would be okay. Now you can guess which one it will be yourself. As this is purely hypothetical talk about an stereotypical archetype of person, things may differ in the single case. Personally I think just because you are stupid doesn't mean you forfeit your right to call the police. It just makes you a fucking hypocrite if you aren't consequential enough to adjust your stance to the choices you made (or adjust the choices you make to your stance). ¹: there are many flavours of anti-government, but we are talking about views, if fully realized would leave our victim with no police they could go to. Maybe they could beg in front of a local war lord?
- vagrantJin 2y ago
  Adepts? That is genuinely hilarious.
- BLanen 2y ago
  > Wow, what happened to the "screw the government" position? It was always just a meme. John Perry Barlow was deeply, deeply, wrong.
- CommitSyn 2y ago
  It's your type of black/white thinking, and making the association that everyone in support of a specific idea shares an identical set of ALL values with everyone else interested in that idea, that enables fascism to rise to power. Someone is interested in privacy? They must be a criminal, better watch closely and prosecute on whatever we can before they get too dangerous. Someone is interested in crypto? They must be fully anarchist. Better lump them in with the anti-government crowd and make sure they are denied police protection. These were multimillion dollar trades being done by white collar investors with the trading bots, I don't think they mind the police help one bit, and I think you'd be hard-pressed to find anti-state messages from any of them. They are just rich people taking advantage of a system to get richer. Nothing more nothing less. It is not possible to extrapolate political views based solely on participation in part of a capitalistic system.
yashg 2y ago
So nothing of value was actually stolen.
stuffoverflow 2y ago
IMO the title is a bit misleading since the bug was in the mev-boost library which isn't part of the ethereum protocol nor is it needed to validate blocks. As I understand, the "victims" were arbitrage bots that one could argue simply had their risk realized. I wonder if the brothers could have gotten away with it by just paying taxes. Here is an in-depth post-mortem on the incident: https://collective.flashbots.net/t/post-mortem-april-3rd-2023-mev-boost-relay-incident-and-related-timing-issue/1540 https://collective.flashbots.net/t/post-mortem-april-3rd-202... Earlier threads about this: https://news.ycombinator.com/item?id=40369522 https://news.ycombinator.com/item?id=40369522 https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40372018 https://news.ycombinator.com/item?id=40372018
- baobun 2y ago
  > In particular, the malicious proposer constructed their own block that broke the sandwich bots’ sandwiches up and effectively stole their money. Deep cognitive disonnance or do these people really think they have enshrined privilege already? Because I don't think they mean to imply that their own sandwhich bots are "effectively stealing" from traders and other bots as part of normal operations...
netcruiser 2y ago
So they front ran the front runners. Made the front runner buy shitcoins. Crime? Not an ETH bug though.
deleted 2y ago
[deleted]
dctoedt 2y ago
Misleading headline — are they really MIT "students"? The accused brothers are 24 and 28 years old respectively; the DOJ press release says they "studied" at "one of the most prestigious universities in the world" (the indictment says "in the country"). But that doesn't mean the brothers are currently students at MIT.
mensetmanusman 2y ago
Another reminder that crypto is simply an ever growing bug bounty.
ChrisArchitect 2y ago
[dupe] Some more on official Justice post: https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40369522 https://news.ycombinator.com/item?id=40369522
DylanSebastian 2y ago
[flagged]
gregemma 2y ago
[flagged]

59 points by em3rgent0rdr 2y ago

Pretty careless almost idiotic to just search with history and sync? about the crimes you are going to commit. It shows that those guys aren’t really technical, exploiting a blockchain bug sounds like they hacked the system but instead they misused a feature. They haven’t been even smart enough to understand that the blockchain is for tracing.

4gotunameagain 2y ago
> sounds like they hacked the system but instead they misused a feature. Isn't that quite often the definition of hacking though ? If they were based on a different country they would've never been caught. And they do seem pretty technical to me, just not entirely thoughtful.
metachris 2y ago
This was a pretty sophisticated attack and deeply technical execution.

democracy 2y ago

Wow, what happened to the "screw the government" position? As soon as there is a problem with "free money", its adepts run to the police for help ))))) It's hilarious, frankly. tbh after ETH modified their "unmutable" blockchain in DAO attack, they are just full of BS "innovators" and "investors".

throwaway11460 2y ago
You're talking about an opinion of a bunch of early hackers as if it was a common world view of everyone in the crypto/blockchain space. It's not (sadly, IMHO). There are many who are exploring merging government regulation and crypto currency. Not sure what you mean by modifying unmutable blockchain, that never happened. What happened is that people stopped using that blockchain and switched to another one.
- nohup2 2y ago
  They switched to another blockchain… that has the same exact name and is maintained by the same people. So in my opinion, Ethereum broke the “unmutable” promise after the DAO debacle. You could argue that as Ethereum Classic kept the original blockchain, the promise was kept. But even so, it was the spirit of that promise was broken, and ETC is not maintained by Ethereum. I lost trust on Ethereum because of that and never touched it again since 2016.
  - throwaway11460 2y ago
    Yeah, sure, I agree. But the blockchain technology itself is still sound - its about the users who accepted this change and the social capital of the organization that pushed it.
    - RcouF1uZ4gsC 2y ago
      > its about the users who accepted this change and the social capital of the organization that pushed it In other words, fiat
vsuperpower2020 2y ago
What would you rather they do? Let themselves be stolen from? Personally hunt down the people that wronged them? That's what happened when certain gangs lost money on crypto. This is a lame "gotcha" whether you like crypto or not.
- democracy 2y ago
  If we talk about "stealing" - there was a huge effort to make people believe crypto is worth of investing as some "new money super technology that makes everyone rich", right? Were the risks higlighted? Not really. The richest person in the world (E.Musk) shills an inflationary unlimited bitcoin clone as something valuable (DOGECOIN) - this is fraud on a giant scale. I would love to see him calling out the BS in crypto "industry" - he didn't and instead did dogecoin thing. I frankly don't believe he is some kind of tech genius after this. And this is ok, right? Do simple people know that they put their money into useless "technologies" that are fundamentally fragile and they are at risk of losing everything as soon as there are advances in computing (breaking sha/ecc, doing 51% attack)? They don't. So, that's really stealing, on a grand scale. This 21 million should be an award for the hackers, really. Unless ETH wants to change the "immutable blockchain" once again ))) noone cares these days anyways
- atoav 2y ago
  Well. I'd say the anti-government¹ type generally has 3 options here: 1. Realize their stance is flawed, change it and go to the police 2. Stick to their stance and not go to the police 3. Ignore the cognitive dissonance and pretend going to the police is coherent with their political ideas. Rationalize about why in this narrow case it would be okay. Now you can guess which one it will be yourself. As this is purely hypothetical talk about an stereotypical archetype of person, things may differ in the single case. Personally I think just because you are stupid doesn't mean you forfeit your right to call the police. It just makes you a fucking hypocrite if you aren't consequential enough to adjust your stance to the choices you made (or adjust the choices you make to your stance). ¹: there are many flavours of anti-government, but we are talking about views, if fully realized would leave our victim with no police they could go to. Maybe they could beg in front of a local war lord?
vagrantJin 2y ago
Adepts? That is genuinely hilarious.
BLanen 2y ago
> Wow, what happened to the "screw the government" position? It was always just a meme. John Perry Barlow was deeply, deeply, wrong.
CommitSyn 2y ago
It's your type of black/white thinking, and making the association that everyone in support of a specific idea shares an identical set of ALL values with everyone else interested in that idea, that enables fascism to rise to power. Someone is interested in privacy? They must be a criminal, better watch closely and prosecute on whatever we can before they get too dangerous. Someone is interested in crypto? They must be fully anarchist. Better lump them in with the anti-government crowd and make sure they are denied police protection. These were multimillion dollar trades being done by white collar investors with the trading bots, I don't think they mind the police help one bit, and I think you'd be hard-pressed to find anti-state messages from any of them. They are just rich people taking advantage of a system to get richer. Nothing more nothing less. It is not possible to extrapolate political views based solely on participation in part of a capitalistic system.

yashg 2y ago

So nothing of value was actually stolen.

stuffoverflow 2y ago

IMO the title is a bit misleading since the bug was in the mev-boost library which isn't part of the ethereum protocol nor is it needed to validate blocks. As I understand, the "victims" were arbitrage bots that one could argue simply had their risk realized. I wonder if the brothers could have gotten away with it by just paying taxes. Here is an in-depth post-mortem on the incident: https://collective.flashbots.net/t/post-mortem-april-3rd-2023-mev-boost-relay-incident-and-related-timing-issue/1540 https://collective.flashbots.net/t/post-mortem-april-3rd-202... Earlier threads about this: https://news.ycombinator.com/item?id=40369522 https://news.ycombinator.com/item?id=40369522 https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40372018 https://news.ycombinator.com/item?id=40372018

baobun 2y ago
> In particular, the malicious proposer constructed their own block that broke the sandwich bots’ sandwiches up and effectively stole their money. Deep cognitive disonnance or do these people really think they have enshrined privilege already? Because I don't think they mean to imply that their own sandwhich bots are "effectively stealing" from traders and other bots as part of normal operations...

netcruiser 2y ago

So they front ran the front runners. Made the front runner buy shitcoins. Crime? Not an ETH bug though.

deleted 2y ago

[deleted]

dctoedt 2y ago

Misleading headline — are they really MIT "students"? The accused brothers are 24 and 28 years old respectively; the DOJ press release says they "studied" at "one of the most prestigious universities in the world" (the indictment says "in the country"). But that doesn't mean the brothers are currently students at MIT.

mensetmanusman 2y ago

Another reminder that crypto is simply an ever growing bug bounty.

ChrisArchitect 2y ago

[dupe] Some more on official Justice post: https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40371371 https://news.ycombinator.com/item?id=40369522 https://news.ycombinator.com/item?id=40369522

DylanSebastian 2y ago

[flagged]

gregemma 2y ago

[flagged]