3 ms·

Nope, because it's not like a normal immunity deal it's the company retroactively granting "authorization for third party testing" which makes the hack no longe

Nope, because it's not like a normal immunity deal it's the company retroactively granting "authorization for third party testing" which makes the hack no longer a crime.

seanhunter 2y ago
Nope. Financial crime absolutely does not work like that. Just the part of this where they supposedly manipulated the price of some asset used as collateral could well be market abuse.
- some_random 2y ago
  Until law enforcement brings a case to court and secures a win, this is in fact exactly how it works. I'm not saying that it's right or good, but bullshit "bug bounty" payouts are pretty well established in the crypto ecosystem at this point and to the best of my knowledge the only case of anything like it resulting in a conviction is Joe Sullivan being convicted for covering up a data breach at Uber with such a scheme.
  - seanhunter 2y ago
    Well Avraham Eisenberg was convicted of manipulation in the Mango Markets case[1] spite of such a deal. I believe his sentencing is tomorrow so we'll know then whether or not the deal[2] affected his sentence but it didn't affect his conviction. There is a general belief among a lot of crypto folks that "if it's on chain, it's fair game" and you can make these kind of deals etc but as far as I can see, there's absolutely no basis for that in law. If law enforcement/regulators start to take actions they can do so for any case they suspect of being market abuse irrespective of whether the parties agreed some kind of deal. That is certainly my read of both the US and UK/EU regulations, which are the two cases I'm aware of. Neither of them have any sort of carve out to allow participants to make a bilateral arrangement to give someone a post-hoc waiver for some act that would otherwise be considered abuse. [1] https://www.justice.gov/archives/opa/pr/man-convicted-110m-cryptocurrency-scheme https://www.justice.gov/archives/opa/pr/man-convicted-110m-c... [2] This has info about the money he returned in what him and Mango thought was a bounty/settlement type thing https://blocktribune.com/avraham-eisenberg-seeks-leniency-in-crypto-fraud-case-sentencing/ https://blocktribune.com/avraham-eisenberg-seeks-leniency-in...
rdtsc 2y ago
Ah that's interesting. So it's like someone stealing from them, and them saying, ok bring part of it back and we'll retro-actively tell the police/customers that we gave your the money as payment for "testing our security". I guess that could work if no customers are affected. If customers want to get their money and it's all there for everyone, it's all good. But if it isn't, it would be awkward to tell them "we don't have your money, we bought this expensive security audit for $10M and now you only get 20% of your deposit back". Interestingly enough, they are sort of taking the side of the hacker then against the customer. Customers can go to the police and they'd laugh at them "you put your money in Abracadabra, and now you complain that, poof! your money is gone, as if by magic? Did we get that right?"
- some_random 2y ago
  Yup that's exactly it, but since it's all happening on the blockchain everyone knows exactly what's happening when companies offer these kinds of "bug bounty rewards".

Nope, because it's not like a normal immunity deal it's the company retroactively granting "authorization for third party testing" which makes the hack no longer a crime.

seanhunter 2y ago

Nope. Financial crime absolutely does not work like that. Just the part of this where they supposedly manipulated the price of some asset used as collateral could well be market abuse.

some_random 2y ago
Until law enforcement brings a case to court and secures a win, this is in fact exactly how it works. I'm not saying that it's right or good, but bullshit "bug bounty" payouts are pretty well established in the crypto ecosystem at this point and to the best of my knowledge the only case of anything like it resulting in a conviction is Joe Sullivan being convicted for covering up a data breach at Uber with such a scheme.
- seanhunter 2y ago
  Well Avraham Eisenberg was convicted of manipulation in the Mango Markets case[1] spite of such a deal. I believe his sentencing is tomorrow so we'll know then whether or not the deal[2] affected his sentence but it didn't affect his conviction. There is a general belief among a lot of crypto folks that "if it's on chain, it's fair game" and you can make these kind of deals etc but as far as I can see, there's absolutely no basis for that in law. If law enforcement/regulators start to take actions they can do so for any case they suspect of being market abuse irrespective of whether the parties agreed some kind of deal. That is certainly my read of both the US and UK/EU regulations, which are the two cases I'm aware of. Neither of them have any sort of carve out to allow participants to make a bilateral arrangement to give someone a post-hoc waiver for some act that would otherwise be considered abuse. [1] https://www.justice.gov/archives/opa/pr/man-convicted-110m-cryptocurrency-scheme https://www.justice.gov/archives/opa/pr/man-convicted-110m-c... [2] This has info about the money he returned in what him and Mango thought was a bounty/settlement type thing https://blocktribune.com/avraham-eisenberg-seeks-leniency-in-crypto-fraud-case-sentencing/ https://blocktribune.com/avraham-eisenberg-seeks-leniency-in...

rdtsc 2y ago

Ah that's interesting. So it's like someone stealing from them, and them saying, ok bring part of it back and we'll retro-actively tell the police/customers that we gave your the money as payment for "testing our security". I guess that could work if no customers are affected. If customers want to get their money and it's all there for everyone, it's all good. But if it isn't, it would be awkward to tell them "we don't have your money, we bought this expensive security audit for $10M and now you only get 20% of your deposit back". Interestingly enough, they are sort of taking the side of the hacker then against the customer. Customers can go to the police and they'd laugh at them "you put your money in Abracadabra, and now you complain that, poof! your money is gone, as if by magic? Did we get that right?"

some_random 2y ago
Yup that's exactly it, but since it's all happening on the blockchain everyone knows exactly what's happening when companies offer these kinds of "bug bounty rewards".