3 ms·
> people entered their seed phrases into the app, then discovered their wallets were immediately drained. Why did they cash out immediately? Wouldn't it be muc
by basilikum 6mo ago
> people entered their seed phrases into the app, then discovered their wallets were immediately drained.
Why did they cash out immediately? Wouldn't it be much smarter to send the seed phrase to a server and stay undetected for longer just collecting seed phrases until you sweep them all at once?
- alasano 6mo agomaybe they had a check to determine total value of all collected seeds and then triggered auto sweeps from a certain threshold to guarantee a minimum. Not sure what the game theory optimal way of stealing is!
- basilikum 6mo agoGame theory of cybercrime is way too interesting.
- basilikum 6mo agoThat would make sense. But perhaps they just made a transaction directly from the app to a hardcoded address. Not making any additional network requests might decrease the chance of being flagged by automated systems in the Appstore review process. Then again you could just disguise these requests as ordinary block chain connections. I'm probably over thinking this and it was just a quick and dumb money grab.
- cank 6mo agoa bird in the hand is worth much more than ten in the bush. The 'collect and sweep' strategy is extremely risky because seeds are perishable. You're racing against the app getting nuked and the users rotating keys.
- basilikum 6mo agoBut would people actually know and rotate keys? The moment the app gets nuked you could grab all the money.