Hacker News Reader

Hacker News

Comment by nemothekid | Hacker News Reader

Parent Full thread

nemothekid

As far as I can understand

1. The user had 1,400 BTC in an old wallet using this software

2. An old version of the software was vulnerable to phishing

3. The user attempted to use the software, and was phished

4. Massive payday for the scammers

Really unfortunate - and goes to show with software you manage yourself you need to be diligent about making sure it's updated. For all the shit coinbase gets, it's difficult to lose your coins in this manner.

View on HN

Also, I think it's just the reason that crypto-currency will fail.

If you trick me into an ACH transfer of 16 million, there will

a) Trigger some random human based audits at my bank before the money can leave (likely involve some phone calls)

b) Have actual recourse, like court orders to hold the funds at the other bank

c) Take some amount of time to happen, to allow for A & B

It's not perfect, and it has bugs.. but I would never store actual money of value in crypto anything.

If you trick me into an ACH transfer of 16 million, there will

Fun recent case - Citibank claims they fatfingered $900 million over:

https://www.bloomberg.com/opinion/articles/2020-08-25/citigr...

And they're having some trouble getting all of it back although the commentaries suggest that they (eventually) will.

Yah, and this case is a lot different than someone hacked it. If it has been "hacked" it would have been a different story. More like a complex legal case + fatfinger.

Naysayers consistently say that "It will fail," without realizing the chain continues to work regardless of your faith or mainstream uses. It works, it will continue to work. It works via satellite and radio. It's unstoppable like BitTorrent. It is decentralized. Faith or not, Bitcoin is not going to fail and it works perfectly as intended.

This is exactly the reason why I don’t use crypto currencies.

unless a bank wouldnt serve you, like for sizable parts of the economy.

Good reason to pull all crypto into fiat ASAP, store it in a real bank (or really, diversify it - user said that was the "vast vast majority" of their savings, that should never be all in one asset), and report it as other income on your taxes.

Sizable, like 2%?

I looked it up. 6% of Americans don’t have a bank account. Doesn’t say whether they could go ahead and get one, or they choose not to.

Sizable?

Correct me please if I'm wrong, but I'd say most of those folks not served by a bank wouldn't have the skills to manage bitcoins either.

The 6% of people without bank accounts are often the least wealthy, more sick part of our population (basically, the people that need protected).

They do NOT have the technical skill to manage a bitcoin wallet. If anything it points even MORE to why we should not use crypto.

Is this 6% of all USA-ians, or 6% of adults?

I don't expect most 10 year olds to have chequing accounts, and if we're talking about about all Americans I'm honestly surprised it's not higher, taking into account da yout, those who are mentally/physically infirm, and those folks who just don't trust banking.

It was my understanding that the user had installed a version of the Electrum wallet that was not from the official source at electrum.org. (But agree - it was really difficult to identify the core issue from this string of GitHub comments.)

They were running an old official version which has a serious issue allowing the full node servers it connects to to pop up a message. e.g. "You need to upgrade - click here" - that led to the malware.

And there is no way to track down the node server that popped up this malicious message? Take it offline?

Yes, electrum.org maintains a blacklist. That won't stop a phisher that just made 16 million dollars though. Spawning a new server costs cents.

> For all the shit coinbase gets, it's difficult to lose your coins in this manner.

Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are vulnerable to phishing. So no, Coinbase is not immune to losing coins in this manner. If Coinbase wanted to prevent being vulnerable to phishing they would i) only allow U2F 2FA, and ii) make U2F mandatory for all accounts.

1. AFACT the user was phished in a manner that was specific to this platform. It's not really comparable to clicking a nasty link in an email. Whether you chose to use U2F or TOTP, the risks is upfront. The user in this case was running official software - there was no URL to check.

2. The vector of the attack isn't important. The user ultimately lost his coins because he wasn't running the latest version of the software. He could have have easily lost his shirt from an RCE. That is much more difficult on a managed SaaS platform.

How do we confirm this actually happened? Perhaps I am being cynical, but people have been know to embellish and lie on the internet before? Shouldn't we be able to follow these funds on the ledger?

https://news.ycombinator.com/item?id=24334393

Ah I remember when my bank app had a bug and someone stole $15 million dollars from me then when I asked for help they said not your keys not your dollars. Such is life!

Reply on news.ycombinator.com