Hackers nab $500k as Enigma is compromised weeks before its ICO
techcrunch.com
techcrunch.com
1. Dump the leftovers of your bi-weekly software engineering paycheck into buying ETH, BTC, or whichever altcoin is popular this week. It went up 5000% in the past, it's got to keep growing right?
2. Participate in an ICO and stock up on whatever platform token they're hawking. It's more profitable if you get in early due to some presale mechanism (hopefully here you aren't sending your hard-earned digital currency to a hacker's wallet). Sell these tokens about 4-5 days after the sale closes, before the hype dies down and the bagholders realize they're holding sand.
3. Even more profitable is kicking off your own ICO. Go through the checklist - fancy HTML5 theme that you can buy off of Themeforest and edit the HTML a bit for the landing page, create a Slack channel/Twitter account/subreddit, write a "whitepaper" that is easy enough for the shmucks you're targeting to understand, yet replete with enough pseudo-academic crypto jargon and irrelevant/unnecessary mathematical symbols to get the shmucks nodding their heads and pretending to understand how this particular algorithm/equation based on the "turing-complete ethereum blockchain" will "change the world" or "bank the unbanked" or, more importantly to them, appreciate 500x in value. Don't forget listing the members of your team and advisors, ideally with as much credential signalling as you can - "MIT," "Stanford," "Comp Sci Phd," "McKinsey," all work here, fake it till you make it and make sure you list Vitalik Buterin on your list of advisors just for that extra bit of technical legitimacy. Use centuries-old sales tactics to pitch your ICO - butter up your target audience's sense of superiority by emphasizing exclusivity - they're the only clever ones, they're the genius computer nerds who understand the 1000x potential of your algorithm, they're the ones that are breaking free of the shackles of regulated securities. Create a sense of urgency with a ticking timer on your landing page, a 24-hour window to buy your monopoly money, a subtle/not-so-subtle hint that the earlier you get in, the more you'll make.
4. You could always just put on your black hat and rob these extremely soft targets blind. The simpler the method, it seems, the better. Plus, there's absolutely no risk of ever being held accountable - that's the beauty of anonymous cryptocurrency!
The ICO will be raising money to bring on new material and for marketing of the courses. We expect 100,000 students in the first quarter, at which point the coin value on the open market is expected to skyrocket beyond all other blockchain coins.
Send your donation or investment money to coursecoin@gmail.com (seriously, please don't.). We will handle the rest.
If you'd like to see our white paper, check it out. https://futureoflife.org/data/documents/research_survey.pdf
I assume that's a typo, and you mean before lunch on the day it was announced. :)
> Send your donation or investment money to coursecoin@gmail.com (seriously, please don't.)
On many of those same forums, I expect people would be sending money anyway, and justifying it by saying that "they have to say the seriously please don't part to avoid the SEC, but they don't mean it".
Caveat being you've done the work to be able to add authentic value to the people you're selling too. (which is where most ico's break down)
I'd advise them to incorporate their PDF, and perhaps lesson taker's info, into a blockchain.
1) Have the bot build the currency here: http://build-a-co.in
2) Generate HTML5 pages
3) Submit to twitter (focus on new york area) / make tshirts
Oh snap I just had the craziest business idea. Get this. I make tshirts... then I sell them. I'm gonna go tell the folks at /r/entrepreneur!
But hey, I'm sure it's "different" this time, right? You're right and everyone in the crypto space is wrong.
But they weren't wrong. Geocities and Pets.com died without making very much money.
The giants of the Internet were Search Engines, Online Shopping, Video Sharing, and Social Networks. The giants of "Blockchain" probably either in awful, primodial form (ie: Pets.com was online shopping, but a terrible experience. Geocities was also a social network... albeit a bad one by today's standards).
So today's coins probably will fail to some new coin made 3 or 4 years from now which really figures out the "killer app" of Blockchain.
------------
I think its fair to say that "Blockchain" as a technology will exist in the future. Back in the 90s, one could reasonably expect that "Jerry and David's Guide to the World Wide Web" was going to be the primary methodology of looking for new websites... before the Search Engine was perfected.
So many people lost their life savings chasing after fad technologies of the 90s, Webvan being one of the most notable. Billions of dollars invested and lost into just... awful ideas that no one understood.
Frankly, the neckbeards of the 80s were right. The vast majority of 90s webpages were utter crap without a business model.
For example, how many would have predicted the rise of small, fairly low-tech, text search ads as the multi-billion dollar revenue linchpin for all global search.
Similarly, whatever the core long-term value of crypto-currencies will be, it probably hasn't been truly understood yet.
Most of these ICOs are similar to the period before the dotcom crash when simply adding .com to the name of a failing business was enough to lift it's stock value. Anyone else remember that or can give an example?
Whatever rises from the rubble of this cryptocurrency bubble bursting is what will no doubt be most interesting and what will no doubt end up being truly world changing.
Looking forward to the middle/end-game.
1. Usenet is garbage: CORRECT although it was better in the early days. This seems to be a general trend with all comment/message board systems, they rapidly lose value when they breach a certain size, although some including our dear HN have survived for quite some time.
2. Downloading books won't happen: WRONG. Paper isn't going anywhere but ebooks are an unqualified success at this point, largely because (unlike at the time) we can carry our computers anywhere now.
3. The Internet is a wasteland of unfiltered data: CORRECT for now. Interestingly, there was a golden age of Google and Wikipedia that would have made this statement look false but now we've regressed back to fake news, social feeds, and personalized search results.
4. The internet will not be useful for governing: CORRECT for the most part.
5. Computers won't help schools: CORRECT for the most part.
6. "Cyberbusiness" will fail because the world needs salespeople: LOLZ.
I'm not going to try to break down the final paragraph. I think some of these will still improve in the longer run but 22 years later, I'm still giving him 4 out of 6 here.
Granted, this doesn't readily translate to the classroom nor does it fit everyone's learning style.
P.S. there was a story on reddit (can't find it now unfortunately) about how the attackers tried to deposit the money to Bittrex but luckily someone alerted them and the exchange froze the account. So there is still some hope that funds will be returned.
... that is controlled by the founders and could presumably be used for whatever they'd like. The usual approach is to create two companies. One a shell to own the ICO itself, and the second a tech services company that does development for the shell corp.
So it ends up something like:
"We definitely need the expertise of ICO founder Mr. X. Let's hire his consulting company to update the CSS on our web page at $1,000/hour..."
They do get paid salaries, but undergo audits... To make sure that the 10 million dollar round didn't go straight to the CTO's Bahaman yaht fund. These audits are typically not done by the founders.
With an ICO, all bets are off. There's no reporting requirements, the founders hire their own bookkeepers, and the equity holders have no rights with respect to the governance of the firm.
It's certainly possible to structure an ICO in such a way that token holders will get board seats, proper auditing, etc, but I've yet to see one that is.
I've never heard of Enigma before today, hell I still don't have a clue what they are going to actually do besides an ICO, but I know they have just implemented best practices security and it's a safe bet to make money. I think PG calls this a submarine.
This is very clever. When the theft loss is dismal compared to the money raised, it only gets more press and more people buying the coin!
Never attribute to malice what can be explained by stupidity, and never underestimate just how stupid a person can be.
> "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."
It wouldn't take more than a couple hours of skimming to completely recalibrate your expectations.
futures traders didn't want a tulip, nobody accepted delivery of a tulip.
no tulips in the spot market were being traded anywhere near the futures month prices.
with that in mind, doesn't this make it one of the worst poster childs of irrational exuberance to cite?
Other sources give great detail of the tulip purchasing craze. For example, read the tulip chapter in 'Extraordinary Popular Delusions and The Madness of Crowds', by Charles Mackay. It cites many sources that detail the crazy high prices people did actually pay for tulips.
Between the contract categorization changes, actual shortages, and the bubonic plague, I think there are a lot of things that are unclear. Without the plague abruptly killing all the speculators would we have called it a bubble, or just an uptrend?
It's unfortunate that the greed and FOMO are dragging the technology through the dirt. If you plan on investing in any ICO please do your due diligence and avoid the hype trains.
Which is fine if you have the money to spend (waste). But people are getting sold on it like a penny-stock scheme straight out of Wolf of Wall Street.
But I agree that there is a small group of people making big bucks from this (people behind ICOs plus a tight group of early bitcoin adopters).
Last year, the price of one Ether was ca. $10. Now it's 30x as much. That's quite a multiplier.
If you bought some ETH last year, just by the price increase, you have lots of spare cash to throw at stuff that promises to make you even richer.
Edit: title is better now
Especially when the aim is to get press attention.
It's cleverly machiavellian. It accomplishes so much for the ICO founders with little to no recourse.
So much said that explains so little.
If the concept of cryptocurrency is going to survive I think there needs to be one or two clear winners to eventually bring some stability to their value.
Of course, not issuing your own coin doesn't leave as much opportunity to get rich quick off a bit of hype.
The team cannot finance itself without selling a new token
These projects don't use equity and there is nothing that will make the equity more valuable as there.
There are lots of things that will make their token be more valuable as it is a new commodity.
the team and organization gets funded, the buyers are liquid, nobody makes ridiculous decisions counter to their dreams hoping for "an exit", because everyone already has one.
we don't have consumer or investor protections here yet so sure it is ripe for abuse, so far people are content with that, and we also haven't needed it
Can you expand on this? What do you mean by "everyone already has one" in this scenario?
There is no legal way to sell the shares (hyperbole, but very many hurdles). And exchanging additional shares for cash investments only serves to make your non-sellable stake in the company smaller while increasing your tax burdens in many scenarios. These new investors are typically VCs and they push for changes in the company completely unrelated to the founders vision, and good exits never come, because of the many ways VCs can get their much of their money back before founders or even employees get anything.
In token sales, there may be a corporation for liability purposes but the equity in that corporation is not being sold at all. A product from the corporation is sold, a product with the unique characteristics of having easily formable secondary markets.
Tokens are initially created and sold in exchange for US dollars, or Ethereum or another liquid token. This is used to grow the company, just like any presale on kickstarter is used to grow a company. Yet, the equities regulator is sticking their nose in it (for good reason), but a more applicable regulator could be formed to help grow the market and still obtain the consumer/investor protections they desire. I digress:
Everyone that buys can immediately sell to other people, if the demand is there.
Everyone that earned tokens by helping the corporation, including the founders, or large purchasers who also wanted to see the project develop, can also sell to other people. Immediately.
If there is demand, then existing holders that helped fund the company (buy buying early), can sell to other people at a higher price.
This is only "controversial" and "confusing" because it is more advantageous than the promises people sell to 20 year olds spending decades of their life for useless sweat equity, and it undermines the existing VC industry. It is potentially as revolutionary as "the share company" was in the year 1600.
The most obvious way to abuse this would be to join or create a startup, go through the ICO process, then sell off your shares, and, well, exit. Leave the company. You're rich, now - why keep working to build the product you (or your boss) promised to deliver?
Well thats not what I said, so I don't know where you got that from. Strawman much?
I said there are legal problems for selling stocks... of the privately held company variety if that wasn't clear. Those legal problems aren't stipulated by the VCs, well, at least one of them is, but it applies to them as well. The others are from the federal government. I'm not going to bother writing a dissertation on that.
VCs have many ways of getting their money back, and many of those ways are at the expense of employees even if they bought their options.
> The most obvious way to abuse this would be to join or create a startup, go through the ICO process, then sell off your shares, and, well, exit
What? Just to clarify, are you conflating ICO tokens with equity shares? Or saying something like "your share of the ICO"?
> You're rich, now - why keep working to build the product you (or your boss) promised to deliver?
This is where the consumer and investor protection concerns come from right now from various regulator perspectives. ICOs are much like Kickstarter, the answer is you don't have to deliver. Reality is also much like Kickstarter, people have a dream and want to deliver. People do deliver. People that have never touched millions of dollars in their life, go out and play business person until the money runs out.
Many technical dreams that wouldn't fit into a VCs portfolio are able to get funded now. Thats really all it comes down to.
People put their reputation on the line. That doesn't mean much to all people, and they have bad reputations now.
There are several advantages in the ways to mitigate these risks. First, these communities come with a big open source culture. If the team starts messing up, there are still ways to contribute or even carry on the project, a lot of the times. Most of the projects have a big decentralized component to them, which does enable others to carry the baton.
Secondly, the token obtained in the ICO has an exchange rate. You, the buyer, are able to exit your position while a market still exists. Most coins, even "dead" ones, have a market, or CAN have a market. Even if they have their own blockchain, they can be revived with the participation of just a few computers, and exchanges will list them.
Are they? It's hard to imagine there being enough buyers to match sellers if/when a coin hits a high peak, let alone if there is a collapse of confidence in the coin or product or its promoters
I've held positions in tokens upwards of 10% of the entire issuance and have been able to move in and out within a few minutes, I usually aim for ~5% of the last spot price.
This is true of any market, just assume there is at least 1 rational actor in the market, what are they seeing that makes them so excited? Warren Buffet - before pivoting to the conservative investment baby boomer guru - bought illiquid discarded companies usually up to 51% of the equity and sold them on the public stock markets at mass profits. In 2017, the international crypto markets are way more liquid than the US equity markets were in the 1970s.
There are obvious downsides to that, but it's a tradeoff for ease of development. You can create your own "coin" -- really just a (set of) smart contract(s) -- with simple tooling provided by the ethereum ecosystem. This is the real genius of ethereum; there is no "one use case" for it, but rather many, limited only by imagination. As more contracts are added to the ethereum ecosystem, ICOs funnel money into ETH, and ETH as a whole benefits from the ever increasing number of derivative services.
Fraud in legacy payment networks is hundreds of millions per year, with an occasional outlier of 80 billion, the only difference is that it isn't international news every single time. $500,000 thefts are happening every single day in fiat currencies, in person, banks, over electronic networks like ACH/checks, Wire, SWIFT, IBAN etc.
Square Inc's annual report cites a couple huge thefts they have had to deal with which have and could materially affect their business of creating merchant tools. They lost like $5 million in one swipe and its just buried in a boring annual report. $500k in one crypto OPSEC issue and you question the entire concept? Cmon thats mentally disingenuous
You'll just have to keep that in mind if you want to have any kind of objective view of this reality containing cryptocurrencies
I found this : http://kv-journal.su/content/vor-u-vora-ukral
"the thief stole from the thief"
I can't find anything hat related, though I wish I could
However later is more popular what the grandparent wrote: Вор у вора шапку украл
Sincerely,
Las Vegas Gaming Commission Marketing Manager
People get phished and get tricked into handing out bank account and credit card details all the time. It's not even newsworthy unless it happens on a large scale. This is only newsworthy because of the fact that it's crypto so people equate this with some sort of deficiency with the technology and/or ecosystem. That's not the case.
I do understand you're being sarcastic, though.
a bold prediction, not backed up by what you are saying because:
> to actually legally use it as a money is a huge pain tax-wise
Is not true.
Yes, that is true and nobody was arguing that with you. Thats not controversial or interesting to anybody but you.
It simply makes other considerations necessary to use it practically. And software already exists to alleviate how it is used, when used as payment network rails.
In your attempt to imagine next week's death knell for bitcoin, in the US, you missed all the tax advantages the IRS has created for bitcoin by classifying it as property, such as the ability to like-kind exchange forever and never have a tax event (unless you buy something).
I think it's interesting that cryptocurrency has achieved its current level of success despite those things being widely known and publicized. Users accept the risk to gain the benefits of the platform.
Fiat currencies work this way. Gold and cryptocurrencies do not, but they still work all the same, though gold is not very convenient in the modern world.
> failure, fraud and speculation.
These ICO hacks are separate from the fact that cryptocurrencies do work and are working right now. Preventing fraud is not a feature of any currency. Speculation is something that happens with any investment, I'm not sure why you think that there is or should be efforts to prevent it.
That's a bold claim to throw out there with nothing to back it up. Gold has been used as a currency for thousands of years. Crypto-currencies are out there working whether you like it or not. To say that they can't work is pretty silly when they are literally working right now.
> they would require taxes be paid in the _coin of the realm
First, you should source this since it sounds like you are talking about a specific country at a specific time in history.
Those were usually made of gold and silver. Why do you think coins have cleated edges? It's so people can shave them off without someone knowing.
Also countries used gold to transact between each other, no matter what they tried to press on their citizens. The longest any fiat currency has lasted is around 300 years, most don't last 50. Our current world wide currency system is only about 40 years old. The transition came after Charles DeGualle started to reclaim France's gold after the Vietnam war because he feared the US didn't have enough gold to redeem their dollars. Nixon was forced to take the US off the gold standard completely and our current system was born.
But not supporting a robust market economy until it (and other metals) were reduced primarily to accounting units for many transactions, so the real “currency” was, in substantial parts, debt instruments, not actual gold. I mean, this is true even in emergent pre-capitalist market economies, which were fueled by (and fueled, in a positive feedback loop) the development of banking.
There is a huge difference between a commodity currency like gold and a commodity-backed currency like gold-denominated debt instruments.
[0] http://www.conchsoc.org/interests/shell-money.php
People that keep saying a currency that doesn't have a central authority leeching off of it by printing more and using it however they want perplex me. If all else was equal, would you choose to put your money in a currency that continues to be worth less and less or a currency where that is designed to not be devalued?
You can say it won't work all you want, but when people have a choice of what currency to use, they aren't going to choose one that is meant to inflate. The only reason people use inflationary currencies is because they don't have a choice.
You need to connect the dots and explain yourself, which you don't seem to be doing.
Cryptocurrencies and ICO's as they stand today conceptually have a lot more in common with the old urban numbers rackets[0] than they do with the concept of currency.
Now, without a nation-state backing it, it's going to potentially have problems with stability, regulation, etc, but that doesn't mean it's not acting as money now.
With gold for example, stealing the physical assets takes effort, resources, time, equipment, etc.
With digital assets, that is not the case... and our current level of system security is not adequate in the slightest. It is a challenge we are still largely ignoring today, but crypto currencies will require it be fixed, or better-risk-managed at any rate.
(not advocating gold over digital, but people continue to hand wave the actual risks)
This type of issue could be solved in a lot of ways. I think a solution wherein:
1. ICOs use a standard 'escrow' contract wherein ether and coin get held by the contract for 7 days or so before either party can withdraw the opposite pair (where either can back out).
2. Building some standard 'ether address' widget that verifies the type of contract an address is. A user-wallet would usually be a warning sign.
Legitimate ICOs should take on use of these widgets and contracts, educating users in the process to only send to particular contracts. This requires a great deal of improved hygiene for ICO providers and education for consumers, but there’s no easy foot forward here.
So yeah, we definitely need improved hygiene that addresses the pain points of trying to do these funding events through a blockchain.
1: If you want more blockchainy tech, the dividends get paid into the smart contract owning the shares, automatically.
But you're right that such law would be used to go after us. That's why we're encouraging people to use Monero to invest and receive dividends and are open to other ideas as well.
For an investor, it's probably detached enough that general conspiracy/organized crime laws are more applicable than pimping/solicitation.
IANAL, this isn't legal advice, and even if I was and it was, you probably shouldn't take legal advice from pseudonymous accounts on internet discussion forums.
I'm not sure why this has to be corrected for every crypto thread on HN. We get it, someone has to comment on every crypto post "Ponzi scheme," "tulips," or the like (regardless on whether or not such a generic comment is especially relevant to the thread) but simply calling it a "scam" gets the unoriginal point across without making you seem so misinformed.
When people are planning on taking in millions of dollars of investment in an easily traded, easily stolen, digital currency, they've got to expect attention from relatively well funded/motivated attackers.
Unfortunately many of the founders of these ICOs don't seem to be that well setup in this regard as some of the disclosed hacks, including this one, aren't exactly advanced.
The term "investor" in relation to ICOs could be replaced with the term "mark", and the whole thing would be a lot more accurate.
Blockchains... Bring a secure, distributed ledger. That's nice, but this isn't Amazon replacing the Sears catalog.
Is there a way to do a public offering of tokens? Or does it necessitate all the same reporting that a publicly listed company has?
Could still be worth it! Because the investors control even less of your board than in Snapchat IPO.
There are the Howey test on the Federal level, and then there is also the Risk Capital Test in several states.
Precedent can very easily go towards the direction that people have a reasonable expectation of the tokens going up in value, making them securities in the eyes of at least the Risk Capital Test. In fact club memberships became securities under this test!
http://www.theselc.org/which_states_apply_the_risk_capital_t...
Are Nike shoes therefore securities? It is an open ended question and yes where we are in this country a future court could rope something like that in too before Congress gets around to forcing regulatory clarity.
Tokens can be products. It is what you sell them for and how you sell them and how you interact with that market, and how others interact with that market, that determines if something is a security. But is isn't a single one of those factors in isolation that makes it a security.
Answer (if you don't need USA investors): http://cryptovalley.swiss/
I quite like using Google Authenticator for my 2FA.
I'm sure it's more complicated than that in reality, but if you have SMS access, you only need to find one weak link in the chain including iCloud/google, email provider, app provider, etc.
You sure can, but will you then have the requisite TOTP secrets?
Good news is according to apple [0], you can protect your icloud keychain with a six digit code required to move the keychain to a new device.
If instead of SMS the 2FA use only a software token generator, then highjacking the cell network would not be a successful attack vector.
I should also add that to just highlight problems with one specific method of 2FA without establishing that it is still more secure than a single factor password, let alone acknowledging that other methods of identification are available, somewhat misses the point of 2FA.
People have to deal with PKI all the time, why not just make it expected basic knowledge?
Case in point, Enigma was trying to raise $50,000,000 which they haven't even initiated yet. This was only going to result in 50% of the tokens in the hands of the public. So buyers would have new tokens and trade that amongst themselves and other people, Enigma would have $50m a lot of that for the founders, and Enigma would also have the other Enigma tokens which would also be valued at $50m which they could use for rewards or selling into the market in the future, all depends on how the market grows.
The hackers get their $500k bug bounty and would have to have equally as bad OPSEC to get caught.
The deterrents aren't really there right now, it isn't necessarily a problem, I don't really think the state is necessary here and I wouldn't want them to use my pooled resources on this given the cost of their investigations.
For one, my understanding is that the Enigma's "website, email lists and other property" was compromised, not it's "ICO". Second, the $500,000 was scammed out of users/investors rather than directly stolen in the "hack". I think for crypto-coins this is an important distinction.
Scammers do their best to associate themselves with our communities because positive discussion at a place like hackernews is seen as "well, all those smart techies trust it..."
this seems useless
/s
The data on the page on Etherscan:
https://etherscan.io/address/0x29d7d1dd5b6f9c864d9db560d72a2...
does provide some insight at a quick analysis.
The total sent is (at the 494,170.68/1492=331.214 rate) almost exactly 500,000 US$ (499,821.59) of which, in four operation of 373 Eth each 1492 Eth were withdrawn 494,170.68.
Of the 212 total operation 4 are withdrawals, 3 are 0, that makes 205 "IN" operations.
The distribution of the amounts of the single operations/deposits is interesting, I quickly put together a few "classes":
a. >30,000 2 Total 66,243 US$
b. 20-30,000 3 Total 70,840 US$
c. 10-20,000 6 Total 82,803 US$
d. 5-10,000 14 Total 102,576 US$
e. 2.5-5,000 23 Total 80,125 US$
f. 1-2,500 33 Total 54,225 US$
g. 0-1,000 124 Total 43,010 US$
If the "targeted audience" was around 9,000, roughly 200 or 2.2% fell for the phishing.
A handful of people (classes a., b., c., 11 in total, i.e. coincidentally roughly the 0.1%) contributed for almost half the amount 66,243+70,840+82,803=219,886 219,886/500,000=43,98%.
If we look at the Nigerian '419' scam, apparently the emails are written in bad English to filter out the smarter people that are unlikely to fall for the scam anyway. The reason is that handling the response on such an email is labor intensive and the people behind those scams prefer to only use labor when chance of success is high.
See: https://www.microsoft.com/en-us/research/publication/why-do-...
The crypto currency ecosystem has become toxic and irrational propped up by ignorance, desperation and blind greed
I wonder what arguments will be made to third world countries at the next climate change summit when a large number of our population seem to be squandering electricity without pause in the hope of riches.
The only way any crypto takes off in the world we live in is if some powerful vested interest sees some use for it, at which point all the speculators having spent the better part of the past decade pushing fantasy narratives about freedom etc will sell out every single tall claim made for a dime. Those who do not understand history and in this case economies are condemned to repeat it, and badly.