16 ms·
Canadian math prodigy allegedly stole $65M in crypto
- nikhizzle 2y agoSo which one is it? Code is contract and he should get to keep the money. Or crypto is governed by laws outside of crypto and so he violated the “spirit” of the code and hence is a criminal? It seems like right now the crypto industry makes the decision to their convenience on a daily basis.
- intrasight 2y agoPurity goes out the window when there's real money involved. And means that in cryptocurrency, you only own what the government grants that you own. It'll be interesting how this gets resolved by Canadian courts. And this is rich: “A bad actor not brought to justice and held to account for one act of fraud will surely commit another”
- deleted 2y ago[deleted]
- jiveturkey 2y ago> It'll be interesting how this gets resolved by Canadian courts. He's being prosecuted by the US DOJ, EDNY. Not Canada.
- Obscurity4340 2y ago[flagged]
- notyourwork 2y agoThis comment adds no value to the discussion and tries to politicize the conversation.
- criddell 2y agoCode is contract and disputes are handled by the courts. There's no such thing as a purely extrajudicial contract, is there?
- deleted 2y ago[deleted]
- Spivak 2y agoI think the name smart contract is misleading because if you believe that the code is law then there is no actual contract in the smart contract. There is no meeting of the minds, no agreement on what the contract means or what is considered customary. Just a machine floating in the ETHer you can interact with. You owe the machine nothing and it owes you nothing.
- jxjnskkzxxhx 2y agoWe have laws, yes.
- eadmund 2y agoYes, we have laws. When should the law intrude on the private transaction of two parties? Typically, the law holds both parties to their contractual agreement. If those two parties have contracted to abide by the output of an algorithm, can the law distinguish good faith manipulation of algorithmic inputs to benefit oneself from bad faith manipulation of algorithmic inputs to benefit oneself? Given that the whole point of a smart contract is to encode the terms of the agreement as code, when is it appropriate to step in and alter that agreement?
- hinkley 2y agoIn the real world locks are meant to keep honest people honest and slow down the dishonest people until someone notices and stops them. There’s a world where crypto could be sold the same way, but the sycophants drowned that out for long enough that we aren’t in the Trough Disillusionment now so much as the Trough of Open Mockery.
- Gunax 2y agoThere definitely some hypocrisy, but it might work differently in the law. As devs, we might claim that 'code is the law' but my guess is that the law does not care. That is, one cannot overwrite property laws by a few lines of code. Consider how disclaimers work--we are increasingly putting limitations on what rights you can contractually forfeit. This will be interting to watch.
- gosub100 2y agoSee also: tether.
- programjames 2y agoIt seems absolutely bonkers to me that someone would write a smart contract that lets them bleed $50m without automatically stopping after they lose the first $1/10/100k.
- poochkoishi728 2y agoThat seems hard to implement. Presumably the move was all based on regular transactions. You can't just say, "If we're losing money, stop it", you have to concretely specify the conditions.
- hiAndrewQuinn 2y agoThere is a third way: Private adjudication. I see no reason why the crypto community couldn't run its own private court system, similar to what e.g. Randy Barnett describes in chapter 5 of Anarchy and the Law. (Obligatory, I don't work in crypto or have any special connection to it, I just think people forget this third option even exists when it's really the most common way most private industries actually resolve disputes most of the time.)
- notnullorvoid 2y agoIt already does run its own private court system, it's the consensus process that is used to upgrade the protocol. If there was enough consensus there could be a fork that returned the funds, but that will never happen.
- hiAndrewQuinn 2y agoSure, but suppose people decide that's not good enough.
- dkarras 2y agoPrivate court system? How does it work? Regular court system works because the government has the threat of violence, has the muscle and rights to hunt, capture and detain. if "private court" rules against me and I refuse to obey, how will they make me obey? There is no "or else" embedded in it so it will be useless.
- 2y ago
- amit9gupta 2y agoHe did not steal anything. He beat the fund (Indexed Finance) at their own game. He has not stolen anybody's password, has not modified DeFI code - simply executed a set of financial transactions according to the rules (expressed as DeFI smart contracts) and profited from it. Indexed Finance is an unlicensed investment firm. The promoters knew the risk ( decentralized finance) and now they want to blame someone who outsmarted them at their own game.
- Cthulhu_ 2y agoThe company and its customers knew what they were getting into; to get protections from the law and guarantees, financial institutions need to get licensed and comply with all the rules, regulations and law. Of course, this includes providing transaction data to the relevant parties to help them detect tax evasion and money laundering.
- Aurornis 2y ago> to get protections from the law and guarantees, financial institutions need to get licensed and comply with all the rules, regulations and law. That’s not how the law works. If someone breaks the law or doesn’t comply with regulations, that’s a separate issue. It doesn’t entitle a third party to steal their funds. If you were to rob a drug dealer, you couldn’t argue that they weren’t complying with the law and therefore you were free to take it. You would both have broken laws.
- archontes 2y agoDefine theft. If you write a contract and give it to a lawyer with the instruction, "Anyone who satisfies this contract gets this money." And someone satisfies the contract to the lawyer's -but not your- satisfaction, and the lawyer sends the money, did the third party steal from you?
- danielvf 2y agoThere's a very relevant XKCD on this, where someone discovers a clever "bug" in an insurance contract, and is then disappointed. https://xkcd.com/1494/ https://xkcd.com/1494/
- cherryteastain 2y agoMy personal belief is that this was not fraud and "Code is Law" works. Yet, this guy is a perfect example of how intelligence and wisdom are not the same. He was clearly smart and dedicated enough to pull off this sort of trade successfully multiple times in a row, and probably all he had to do to get away with it was keeping his mouth shut. Or at the very least not get convicted by default on contempt of court charges by ignoring a court summons.
- neuroelectron 2y agoCourt was outside its jurisdiction here. The fact that the case went forward shows that he was about to be railroaded by corrupt authorities.
- cherryteastain 2y agoAgree, but the wisdom here is in recognising that once you made $65m in seconds at someone else's expense they will try to recoup that amount by any means necessary.
- neuroelectron 2y agoHe isn't working completely alone. He was able to borrow some "wisdom" and skedaddle.
- steve_adams_86 2y agoIt is a good example. Unfortunately most 18 year olds don’t possess a whole lot of wisdom yet. This guy was basically a kid when he did this.
- hinkley 2y agoThat German general who talked about keeping stupid industrious people away from your armed forces never met a clever enough fool. Clever fools are how you get Jurassic Park.
- neuroelectron 2y ago"The house always wins," is the law he broke.
- perihelions 2y agoPrevious thread, https://news.ycombinator.com/item?id=31478795 https://news.ycombinator.com/item?id=31478795 ("The math prodigy whose hack upended DeFi won’t return funds" (2022) — 399 comments)
- tlogan 2y agoCode is not law. Law is law.
- pixelpoet 2y agolaw : code :: word problem : mathematical notation
- freejazz 2y agoHas that been your experience interacting with the law?
- Calwestjobs 2y agowell judge said something like indictment do not age like fine wine, but judge forgot that crypto does ;)
- freejazz 2y ago[flagged]
- tomrod 2y ago:::goedel's incompleteness theorem
- deleted 2y ago[deleted]
- m101 2y agoHow this works in traditional finance is that the big funds would screw the small guy that beats them (especially if they're from a foreign country). They claim that they use unfair or illegal practices, but the reality is that they're not that different to their own. Ultimately the rules are written by people who look legitimate, and/or those who capture regulators.
- perdomon 2y agoBased on this article, it doesn't sound like he did anything illegal (initially). He saw an opportunity and took advantage of it not unlike high frequency trading in the late 90s/early 2000s. Decentralized markets operate in a space that's inherently risky -- if they don't want to get exploited, hire better engineers or get out of the game. Begging the government for help when you got bested isn't how decentralization works.
- kazinator 2y agoYou can't "steal" crypto; it's all just a scam that operates outside of the law. I mean, sure, we can use the language of theft and crime figuratively, just like when we talk about animals. For instance, "the wolf stole a chicken from the coop".
- tim333 2y agoThe case of SBF suggests you can and it's not outside the law enough to prevent 25 years of jail.
- bigyabai 2y agoIf SBF had merely stolen cryptocurrency, then the FTX exchange wouldn't have collapsed entirely. SBF stole customer funds on a line of infinite credit and infinite liquidity, basically lying to customers that he owned the asset they wanted when in reality he defrauded them for speculative gain.
- Sonnigeszeug 2y agoContract is code, you don't need anything anymore. It solves all the problem. Something happens We need to use the system which we want to replace...
- TrackerFF 2y agoOne universal law is that if you steal from people with more money than you, you're screwed. And the more money they have, the worse off you are. But on a serious note, whenever you read about some people that have either managed to outright steal crypto, or find some vulnerability which hasn't been legality tested...and they just pack their bags, hoping to live life free, forever after. It just seems so naive, too naive with how smart these individuals otherwise tend to be. I think it is fair to say that once you'll cross a threshold, could be a million. could be 10 million. could be 50 million. All depends on who you've taken it from, you'll realistically be hunted for life. The people that do get away with these things, are state sponsored operators - but they don't walk away with tens of millions in loot, either. EDIT: Reading the article, this guy sounds like a real piece of work.
- dandanua 2y ago> One universal law is that if you steal from people with more money than you, you're screwed. And the more money they have, the worse off you are. If someone has more money than you, you're screwed. Period. This is how it works in the fascists world order, which is increasingly dominating these days.
- throwway120385 2y agoIf you want to know the future of humanity, just imagine a bot stamping on a human face forever.
- tempfile 2y ago"Code is Law" is a profoundly immature idea, and I am surprised anyone other than children take it seriously. The law is not, and never has been, something that is read literally and taken at face value. This is the entire reason that judges and lawyers exist. Saying "The code let me do it, so it should be legal" is a bit like if I leave a "free to a good home" sign on a plant pot outside my home, and it leans on my car. It does not mean you are permitted to take my car, no matter how "obvious" it seems to you that it should.
- Dumblydorr 2y agoSomeone who disagrees with you is a profoundly immature child? Your analogy is confusing, you’re comparing a free plant on the roadside to 63 million dollars on a crypto exploit?
- tempfile 2y agoNot always, just in this case :-) What's actually confusing in the analogy? Are you actually confused or just pretending? The point is that just because a sign says something under a literal reading, it doesn't mean that it's what was intended, or what's binding. If there's a piece of paper on my car saying "free to a good home", I probably didn't intend that you can take my car (or my house, or whatever). It's not very different to the fact that a 0-day exploit on your bank's web server does not entitle the thief to your money.
- jxjnskkzxxhx 2y agoA lot of people who disagree with me also happen to be profoundly immature child. I didn't say that one follows from the other, you added that.
- deleted 2y ago[deleted]
- throwway120385 2y agojust in case though, I usually hang the sign on signposts in the public right of way in case someone tries to steal my car.
- prvc 2y agoThe entire space of smart contracts falls within the intended functionality of the systems that implement them, which make this particular use of them conceptually unlike things like buffer overflows. Calling it a "hack" or an "attack" as this article does (while strawmanning the opposite case) is a deliberate attempt to muddy the waters, and is a failure of journalism.
- neuroelectron 2y agoIt reminds me of the Sam Bankman-fried case, but it also quite different. SBF thought the abstractions would protect him from the law when he clearly was misleading investors and using code to abstract away his fraud. However, in this case, the code/fraud was presented and used as intended. While I believe SBF was innocent of defrauding his early investors who were foolish to trust such a system, he was guilty for other reasons. Andean Medjedovic's case shouldn't have even made it to court and he had no obligation to leave his crypto or cashed out legal tender with some "custodian" and spend the next several years of his life as a beta tester for establishing case law. This wasn't just "code is law," more accurately, "under the stipulations of the contract, code is law."
- pcthrowaway 2y agoThis is completely different from the SBF case. SBF was lying about things, it was more like a Bernie Madoff type scheme. As a CEO he had fiduciary duties he neglected. This guy won a game of poker against the house, and now the house is mad.
- neuroelectron 2y agoThe connection is crypto and exploitation
- BlackFly 2y agoHe should have accepted their offer of 10% as a bug bounty. Certainly crypto folk love to act like unregulated markets but this smells like market manipulation to my armchair education and even if the market tries to play both ways, the courts won't. I do hope that the Ontario court fights the extradition, because the American laws leveled at him seem bogus by Canadian standards (wire fraud, extortion and money laundering) but that tort case might be legit.
- Calwestjobs 2y agothing is, if you get rid of 90% of money, what money will you use for lawyers services if those .... sue you anyway?
- garfield_light 2y ago>He should have accepted their offer of 10% as a bug bounty. If I was in his shoes I wouldn't trust them. They can just try to put me on jail anyways.
- danielvf 2y agoMy favorite is one of the text files on the attacker's computer: A file labeled "Decisions and Mistakes," in which he wrote, "Going On the run / Yes / Chance of getting caught<Payoff for not getting caught / (NA) / Risk is typically underpriced in modern world.
- 0cf8612b2e1e 2y agoThat is just terrible opsec. The millisecond the money has moved, you need to destroy all of that equipment.
- danielvf 2y agoDon't worry, he also had a ""POST-EXPLOITATION" plan. Which included, among other things, "KEEP the configs Burn the evidence, including the histfile Book flight to: Pack Bags"
- rozap 2y agoWait, I thought cryptocurrencies aren't securities? Why are our tax dollars being spent investigating this? If they're not securities (like coinbase etc would like us to believe), then he didn't do anything wrong and there are no other rules - code is law. If they are securities, then why are there so many illegal exchanges operating in plain sight? Once again, crypto folks are all about decentralization until someone outsmarts them, then they go crying to daddy government to bail them out.
- wmf 2y agoThis doesn't change the big picture but some are securities, some are commodities, and some are collectibles.
- Barrin92 2y agoI'm not entirely sure what makes you think there's no financial regulation or laws you can break outside of securities trade, because there is and which is why he's charged with wire and commodities fraud, Hobbs Act extortion and money laundering. Code is not law, the law is the law.
- commandersaki 2y agoSimilar situation with two brothers that gained millions on Ethereum by coercing bots: https://www.arnoldporter.com/en/perspectives/blogs/enforcement-edge/2024/05/when-crypto-bots-lose-at-their-own-game https://www.arnoldporter.com/en/perspectives/blogs/enforceme...
- moktonar 2y agoPlacing trust on software is the root of all evil..
- waltfieger89 2y ago[dead]
- netvarun 2y agohttps://archive.is/kVsvc https://archive.is/kVsvc
- stainablesteel 2y agothe movie about this guy is going to be awesome
- baq 2y agoJust another day of crypto bros speedrunning finance.
- glass1122 2y ago[dead]
- ForHackernews 2y ago> Not everyone agrees. “Code is not law. Law is law,” Mr. Gottlieb wrote in a lengthy thread to Mr. Medjedovic on X in late October, 2021. “And what you did was not a ‘clever trade.’ It was market manipulation. It’s illegal. And people go to prison for it. Boy the crypto industry better pray that market manipulation isn't illegal in DeFi-world or they're all going to prison.
- egypturnash 2y agoThey are part of the team representing Cicada 137 LLC I wonder if this is any relation to Cicada 3301. https://en.wikipedia.org/wiki/Cicada_3301 https://en.wikipedia.org/wiki/Cicada_3301
- msvcredist2022 2y agoalmost definitely a relation in name only
- Calwestjobs 2y agoyes it is and biggest surprise is? he is suing himself ! XD
- TrapLord_Rhodo 2y ago“The silver lining to all of this is that Trump promised to stop the persecution of crypto people,” Mr. Medjedovic wrote on Signal. “Like, half of the people involved in this resigned/stepped down recently.” Very interesting that he gives praise to trump after all this hassle from the US government. Why is the US even involved in this? It's a canadian dude and a canadian exchange.
- lamadruga 2y agoHow do these people get caught? Isn't crypto supposed to be anonymous or something?
- ycombinatrix 2y agoSome coins are designed to provide a degree of anonymity. Bitcoin & Ethereum do not.
- ryao 2y agoThe article says "he took credit for it on the social media platform X".
- sn9 2y agoI'd love to hear Matt Levine's take on this.
- turbocon 2y agoOooo entirely agree, I do suspect he'd come down on the "law is law" side however it's not clear to me a law was actually broken.
- Calwestjobs 2y agohe is in france territory which is not french Guiana.
- deleted 2y ago[deleted]
- Validark 2y agoHow dare some peasant actually win at a game they were meant to lose? That's illegal!
- AlexanderTheGr8 2y agoI followed this case when it happened. It was $16M at the time, not sure how it became $65M now. I suppose it doesn't matter - any number above $100k probably grants the same punishment* Interesting side-note : the people he took/stole from - they offered him 10% if he returned the rest. He said no in a tweet trolling them. Contrary to the opinions in this thread, I think he was smart to run away. Remember that he did this from Canada, not the US. Countries don't have the same extradition treaties with Canada that they do with US. If he had stayed, he would almost certainly be convicted. No court can possibly understand "code is law". Courts' job is only to interpret the law, not make the law. And the law was not written for crypto. You cannot fit a square in a circle without distortion. What I think would have happened is the courts, rather than introducing novel precedent, would have preferred to just rely on existing case law and declare him a criminal. Another interesting side-note : the judge presiding the case made a public comment asking the guy to come back to Canada promising him a fair trial. The guy didn't show up - maybe he didn't receive the message. Overall, even with the benefit of hindsight, we still can't be sure if he was smart to exploit this or not. Forced to live in a few countries but with a lot of money. * It's because (1) laws were designed when numbers were lower (no one had $16M to steal); (2) humans can't visualize big numbers (individually, $16M is just as big as $65M in my head)
- dgs_sgd 2y agoIt went from $16M to $65M because he did more hacks after the initial one.
- poochkoishi728 2y agoDoesn't seem worth it. Live as a fugitive, with your face publicly known, so you always have to watch your back from criminals who'd jump at the chance to extort you once they found out who you are.
- RandomBacon 2y ago"extort" is a pretty benign word for torture. I'm pretty sure there are criminals that will kidnap him and then cut off fingers one by one and do worse things until he gives up the money.
- djeastm 2y agoHe made the mistake of not already being wealthy before he manipulated the currencies. It's truly funny reading this when the US stock market is manipulated at will. I'm not trying to be political, just remarking on the absurdity of it all.
- bogota 2y agoO look another amazing and riveting discussion on emerging technology with real world implications… o wait it’s just a bunch of cranky people complaining about crypto.
- hoppp 2y agoClever lad but horrible opsec. Sounds to me like Indexed Finance had bad business logic and they had it coming. There was no break in or exploiting, it was a trade using flash loans, fair enough if you ask me. A platform trading hundreds of millions should invest in proper security audits What's the lesson? Maybe tornado cash the gas tokens before doing stuff like this and definitely never post it on social media or acknowledge that you did anything. Be smart and have good opsec
- Jean-Papoulos 2y agoThere's a reason the guy is on the run ; it's because what he did is market manipulation and that's illegal. However, cryptocurrencies are unregulated so you can easily argue that the laws usually governing the markets don't apply. Unfortunately for him, I don't think the judge will want to set that precedent...
- concats 2y agoA lot of people seem to argue that the original intent was for disputes to be handled by the courts. That is, governed by laws outside of the crypto's smart contract implementation. And thus the company is right to seek judicial help and label this act as theft. Alright, sure, on its surface that doesn't seem like an unreasonable position. After all, we all trust the courts right? But, if this really was agreed upon by most of the parties involved, shouldn't the smart contract have include giving the courts a master-key that allows them to override the blockchain when necessary? Undoing fraudulent transactions and such. Can we really argue that everyone expected disputes to be handled by the courts if this wasn't implemented? There is no technical reason why it couldn't have been done, as far as I can tell. It would not be great for PR perhaps, since it sort of goes against what a lot of the original crypto enthusiasts believed in: decentralization and protection from future hypothetical tyrannical governments. But at least it wouldn't be half as hypocritical as what we have today. Of course, if you designed your crypto like this, with a court controlled backdoor, you'd unfortunately have to stop calling the whole thing decentralized. But if that's the intent, and everyone agrees to it, what's the issue? I'm trying not to pass any value judgement on the "Canadian math prodigy" in this scenario, on the whole I don't care much about the isolated incident, but rather on whoever wrote the smart contract trying to both have their cake and eat it too. I find crypto really fascinating from a technical and philosophical standpoint, but I'm not too fond of how it's been adapted by society as mostly a sort of get-rich-quick scheme.
- ur-whale 2y agohttps://archive.is/kVsvc https://archive.is/kVsvc
- ThatsAllForNow 2y agoIs there a technical write up of exactly what he did?
- avodonosov 2y ago> a U.S. company named Cicada 137 LLC sued Mr. Medjedovic in Ontario. The identity of the person or people behind the company is unknown, but Cicada said it lost US$9.69-million worth of digital tokens to the exploit. (It’s common for significant investors in cryptocurrency to shield their identities.) > Mr. Medjedovic left home after receiving death threats So, crypto-dealers hiding their identiyty and issuing death threats now appeal to law.
- rimbo789 2y agoIsn’t all crypto theft?
- yapyap 2y ago> They are part of the team representing Cicada 137 LLC That’s a reference I haven’t heard in a bit
- Pxtl 2y agoI've been following this story because he's a local boy, I actually met him very briefly once, back when he was just a kid. The article is skimming over some of the darker sides of his side of the story - like how allegedly his code and conversations are generally peppered with racist rants (I haven't seen any examples of such). The boy seems like a horrible case of internet poisoning - like, a brilliant mathematician child completely mangled in the head by 4chan/gamer discourse. One part of his first heist that isn't mentioned often is that Indexed Finance says he was actually working with them and contributing to their codebase before he pulled his exploit.
- NiloCK 2y agoSome info on the attacks themselves: https://rekt.news/indexed-finance-rekt https://rekt.news/indexed-finance-rekt https://rekt.news/mango-markets-rekt https://rekt.news/mango-markets-rekt
- Xmd5a 2y agoin-depth twitter thread: https://x.com/cryppinfluence/status/1889268223528538113 https://x.com/cryppinfluence/status/1889268223528538113 This in particular: https://x.com/cryppinfluence/status/1889268417108332733 https://x.com/cryppinfluence/status/1889268417108332733 This is the stuff of legend.
- arp242 2y agoCrypto people want a banking system free from government control where no-one has any checks on anything. And they also want government to act if someone does something they don't like. The https://indexed.finance https://indexed.finance page has a big fat "This project is in beta. Use it at your own risk." warning. I guess "use at your own risk" doesn't apply to themselves. Unserious people.
- deleted 2y ago[deleted]
- aaroninsf 2y agotHe FuTurE oF fInAnCe, entry no. 61,384
- casinoplayer0 2y agoFor crypto industry it's not a lot, but still... Happening regularly.
- tyreu 2y ago[dead]