3 ms·

> as sourced back to a product it calls “cauldrons” Then, the magician said "Abracadabra!" and poof! the money is gone. > The company also offered a bug bount

by rdtsc 2y ago

> as sourced back to a product it calls “cauldrons” Then, the magician said "Abracadabra!" and poof! the money is gone. > The company also offered a bug bounty to the hacker of 20% of the stolen funds. Would that give them immunity from prosecution if they ever catch him. If not, what's the upside for the hacker to return anything back?

pavel_lishin 2y ago
Is immunity from prosecution something a private company can even offer? They can certainly offer to not call the police, but if a serious crime were committed, the police don't need to have the victim cooperate.
- rdtsc 2y ago
  > if a serious crime were committed, the police don't need to have the victim cooperate. That's what I remember as well, but thought maybe it's different in different countries, or there is some other kind of cleverness behind the offer. Otherwise, it makes them look kind of silly.
- some_random 2y ago
  The police in general are so far behind on their ability to prosecute crypto/cyber crimes for so many reasons that in practice they would basically never be interested in prosecuting without victim cooperation. Not to mention that in theory this would retroactively make the crime totally definitely above board ethical hacking which is not a crime in any jurisdiction as far as I know.
- glitchc 2y ago
  Depends on what serious means here. In financial/wire fraud, the police often need support from the victim to collect sufficient evidence. If the victim does not cooperate, the case could be dropped due to lack of evidence. Murder is typically more serious.
  - toast0 2y ago
    The investigating agency could get subpoenas to compel the victim to provide evidence. But it's usually not done when the victim doesn't want to cooperate.
some_random 2y ago
It would give them immunity and more importantly make it far easier to liquidate the now totally legal and above board funds.
- rdtsc 2y ago
  Hmm, maybe but it would have to be come from the prosecutor's office, of whatever country has the best chance of catching the hacker, and the hacker has to be believe it.
  - some_random 2y ago
    Nope, because it's not like a normal immunity deal it's the company retroactively granting "authorization for third party testing" which makes the hack no longer a crime.
    - seanhunter 2y ago
      Nope. Financial crime absolutely does not work like that. Just the part of this where they supposedly manipulated the price of some asset used as collateral could well be market abuse.
      - some_random 2y ago
        Until law enforcement brings a case to court and secures a win, this is in fact exactly how it works. I'm not saying that it's right or good, but bullshit "bug bounty" payouts are pretty well established in the crypto ecosystem at this point and to the best of my knowledge the only case of anything like it resulting in a conviction is Joe Sullivan being convicted for covering up a data breach at Uber with such a scheme.
        seanhunter 2y ago
        Well Avraham Eisenberg was convicted of manipulation in the Mango Markets case[1] spite of such a deal. I believe his sentencing is tomorrow so we'll know then whether or not the deal[2] affected his sentence but it didn't affect his conviction. There is a general belief among a lot of crypto folks that "if it's on chain, it's fair game" and you can make these kind of deals etc but as far as I can see, there's absolutely no basis for that in law. If law enforcement/regulators start to take actions they can do so for any case they suspect of being market abuse irrespective of whether the parties agreed some kind of deal. That is certainly my read of both the US and UK/EU regulations, which are the two cases I'm aware of. Neither of them have any sort of carve out to allow participants to make a bilateral arrangement to give someone a post-hoc waiver for some act that would otherwise be considered abuse. [1] https://www.justice.gov/archives/opa/pr/man-convicted-110m-cryptocurrency-scheme https://www.justice.gov/archives/opa/pr/man-convicted-110m-c... [2] This has info about the money he returned in what him and Mango thought was a bounty/settlement type thing https://blocktribune.com/avraham-eisenberg-seeks-leniency-in-crypto-fraud-case-sentencing/ https://blocktribune.com/avraham-eisenberg-seeks-leniency-in...
metalman 2y ago
ok lets lay this out, somebody claims that some big complicated numbers that they had and claimed to be valuable, got removed by somebody else, useing a lot more smaller less complicated numbers worth essentialy nothing, and now are seeking the help of someone else with presumably, slightly more, uncomplcated numbers to retrieve the big complicated numbers,from the whoever it is that has them now, in return for a smaller share of said large and complicated numbers.
wmf 2y ago
Avi Eisenberg returned most of the money he manipulated from Mango Markets and he was still prosecuted and convicted.

by rdtsc 2y ago

pavel_lishin 2y ago

Is immunity from prosecution something a private company can even offer? They can certainly offer to not call the police, but if a serious crime were committed, the police don't need to have the victim cooperate.

rdtsc 2y ago
> if a serious crime were committed, the police don't need to have the victim cooperate. That's what I remember as well, but thought maybe it's different in different countries, or there is some other kind of cleverness behind the offer. Otherwise, it makes them look kind of silly.
some_random 2y ago
The police in general are so far behind on their ability to prosecute crypto/cyber crimes for so many reasons that in practice they would basically never be interested in prosecuting without victim cooperation. Not to mention that in theory this would retroactively make the crime totally definitely above board ethical hacking which is not a crime in any jurisdiction as far as I know.
glitchc 2y ago
Depends on what serious means here. In financial/wire fraud, the police often need support from the victim to collect sufficient evidence. If the victim does not cooperate, the case could be dropped due to lack of evidence. Murder is typically more serious.
- toast0 2y ago
  The investigating agency could get subpoenas to compel the victim to provide evidence. But it's usually not done when the victim doesn't want to cooperate.

some_random 2y ago

It would give them immunity and more importantly make it far easier to liquidate the now totally legal and above board funds.

rdtsc 2y ago
Hmm, maybe but it would have to be come from the prosecutor's office, of whatever country has the best chance of catching the hacker, and the hacker has to be believe it.
- some_random 2y ago
  Nope, because it's not like a normal immunity deal it's the company retroactively granting "authorization for third party testing" which makes the hack no longer a crime.
  - seanhunter 2y ago
    Nope. Financial crime absolutely does not work like that. Just the part of this where they supposedly manipulated the price of some asset used as collateral could well be market abuse.
    - some_random 2y ago
      Until law enforcement brings a case to court and secures a win, this is in fact exactly how it works. I'm not saying that it's right or good, but bullshit "bug bounty" payouts are pretty well established in the crypto ecosystem at this point and to the best of my knowledge the only case of anything like it resulting in a conviction is Joe Sullivan being convicted for covering up a data breach at Uber with such a scheme.
      - seanhunter 2y ago
        Well Avraham Eisenberg was convicted of manipulation in the Mango Markets case[1] spite of such a deal. I believe his sentencing is tomorrow so we'll know then whether or not the deal[2] affected his sentence but it didn't affect his conviction. There is a general belief among a lot of crypto folks that "if it's on chain, it's fair game" and you can make these kind of deals etc but as far as I can see, there's absolutely no basis for that in law. If law enforcement/regulators start to take actions they can do so for any case they suspect of being market abuse irrespective of whether the parties agreed some kind of deal. That is certainly my read of both the US and UK/EU regulations, which are the two cases I'm aware of. Neither of them have any sort of carve out to allow participants to make a bilateral arrangement to give someone a post-hoc waiver for some act that would otherwise be considered abuse. [1] https://www.justice.gov/archives/opa/pr/man-convicted-110m-cryptocurrency-scheme https://www.justice.gov/archives/opa/pr/man-convicted-110m-c... [2] This has info about the money he returned in what him and Mango thought was a bounty/settlement type thing https://blocktribune.com/avraham-eisenberg-seeks-leniency-in-crypto-fraud-case-sentencing/ https://blocktribune.com/avraham-eisenberg-seeks-leniency-in...

metalman 2y ago

ok lets lay this out, somebody claims that some big complicated numbers that they had and claimed to be valuable, got removed by somebody else, useing a lot more smaller less complicated numbers worth essentialy nothing, and now are seeking the help of someone else with presumably, slightly more, uncomplcated numbers to retrieve the big complicated numbers,from the whoever it is that has them now, in return for a smaller share of said large and complicated numbers.

wmf 2y ago

Avi Eisenberg returned most of the money he manipulated from Mango Markets and he was still prosecuted and convicted.