REvil Ransom Arrest, $6M Seizure, and $10M Reward | Hacker News Reader

REvil Ransom Arrest, $6M Seizure, and $10M Reward

krebsonsecurity.com

180 pointstodsacerdoti189 comments

It should be pointed out these are affiliates, not actual members. Later down article mentions the bounty for actual REvil leadership members.

This is what makes Ransomware as a Service so dangerous. It's basically franchising. The actual REvil gang gets to outsource the arrest risk to a third party and still gets paid billions.

Lots of organized crime operates in some way like this, it's a pretty successful system!

Including inner city drug gangs. The kingpins basically just hand out a franchise "package" to a corner, selling the equipment and method, training and often even fashion statements.

Can you please cite a reference for this concept? I'm interested in learning more and I'd like to read some verified information about how they operate

The TED tak “ The freakonomics of crack dealing” might interest you.

> What I'm going to tell you today is that, in fact, based on 10 years of research, a unique opportunity to go inside a gang -- to see the actual books, the financial records of the gang -- that the answer turns out not to be that being in the gang was a glamorous life. But I think, more realistically, that being in a gang -- selling drugs for a gang -- is perhaps the worst job in all of America. And that's what I'd like to convince you of today.

https://www.ted.com/talks/steven_levitt_the_freakonomics_of_...

https://en.wikipedia.org/wiki/Gang_Leader_for_a_Day

Also: a McDonalds job is better than being a street corner dealer

Narconomics. Enjoy.

https://www.econtalk.org/tom-wainwright-on-narconomics/

Watch the wire

Fiction isn’t evidence

It's the opposite, it might be hyperreal. More real than reality.

And the real leadership likely sees the affiliates as a threat. Someone that can never learn any damning details about the leadership identities.

I'm pretty sure they pretty much know who the top brass are by now. Just not much they can do about it

This is somewhat analogous to how regular corporations operate: the majority of the risk lies not with the people making most of the money, probably even more so when white collar crime is involved.

The thing I like about corporate law is that, unlike how organized crime usually works with the lowest members of the hierarchy getting charged and dealing the consequences of their actions that their bosses forced them to take, it's the shareholders taking responsibility (corporate fines) for the lowest members' actions. Corporate law forces shareholders to optimize their system and corporate hierarchy to disincentivize doing illegal things. As opposed to organized crime, which does the opposite; the mob bosses organize their system and hierarchy to incentivize doing illegal things because this gets the mob bosses money. Man, I could rant for hours about how much I viscerally despise the unintelligent internet commentators that talk down on corporate law. Without corporate law (the only thing holding shareholders responsible for the actions of their employees), all we get is unaccountability and organized crime!

How is the REvil gang outsourcing the risk? Aren't the things they're doing just as high-risk as the things the affiliates are doing?

Your affiliate might be able to make a deal with a judge in exchange for you. How confident are the ringleaders in their anonymity?

Yep. And the affiliates might be government agents. Both ringleaders and affiliates need to take anonymity measures, so they seem equally vulnerable to me.

Problem is this isn't exactly like a street meeting between mafia thugs in New York in the 60's. There's no face to face contact for cops to monitor. There's no wires to record voices and tie into identities. Sure, there's meetings, but they're online and can be anonymized. Of course, it's not 100%, but it's a higher chance of success than say, wiretapping a phone.

All of those apply to both the affiliates and the ringleaders.

Also, wiretapping a phone only captures future calls. A warrant against a website, or the website's hosting provider can provide message history, assuming it's not E2E encrypted. And it could even get the message history of every single user in one go if the site is e.g. hacked, or if there's a broad warrant against a crime website's hosting provider.

We can see from this article that tons of these criminal websites get hacked, and then people like Brian Krebs can investigate the leaked databases to see info about the criminals' accounts.

The gang themselves aren't doing the actual customer engagement (breaking in, phishing, etc.). The affiliates are. The affiliates are the ones themselves potentially exposing their IP address. REvil just provides the tools, training, and guidance.

The ringleaders also risk their IP when they access any website, such as some crime forum to sell their malware. Crime forums regularly get hacked, and sometimes the databases have last logged in IP in them.

Also, I'm not sure about crime forums, but other forums sometimes allow image embedding, either by a profile picture hotlink, or bbcode, or html, which can get the IP of everyone who views the page.

Also, just by sending someone a link you can get that person's IP. Maybe DNS prefetching can get some info about the person even if the person doesn't click the link.

Also whatever hosting provider they use to distribute the malware to the affiliates could end up leaking their IP.

customer engagement

Is this a euphemism for victim engagement, or is there some other party playing the customer role that I'm not thinking of?

REvil makes the malware, they sell it to criminals, and the criminals infect systems and take the payments for themselves.

IIRC REvil does not sell the malware to criminals, they give the malware to criminals but hold some control over the decryption keys needed for the ransom to ensure that they get a share of it.

I.e. it's truly an affiliate / revenue sharing system, not a sale of tools.

Ah, interesting. I guess that'd be the way to do it, though I wonder if they hold the payment keys themselves too, or if they get paid after the fact.

Russian hacking gangs are putting silicon valley entrepeneurs to shame. They've made every element of ransomware something that can be specialized in and outsourced. Initial access? Ransomware? C2 infrastructure? Negotiation? Customer service? It can all be outsourced to a Russian company that specializes in their niche.

Everyone is scrambling to build a cyber army. Looks like Putin is letting the invisible hand build it for him.

"Silicon valley entrepreneurs" are doing business in a war zone.

The general security situation is fraught because multiple nation states are at least sheltering and sometimes sponsoring attackers who damage the economy of the opponent.

Despite what narcissistic Zero-to-Oners would tell you, their startups aren't important in the grand scheme of things. Nation states are hacking intelligence agencies, governments, established IT vendors (not startups), power grids, and hospitals in that rough order. Ransomware gangs are hacking companies that have real money right now, not lottery tickets pre-IPO. These companies can afford good cybersecurity but don't want to spend more money than the damages they would incur from a successful attack.

> Ransomware gangs are hacking companies that have real money right now, not lottery tickets pre-IPO

Funded startups have a lot of money. Milking money out of startups is a highly profitable market segment. Why would ransom gangs not want to get in on that? They don’t tend to ask for the ransom to be paid in ISOs…

Most startups don't have a ton of data you can encrypt and chokehold them with. If hospitals don't have their medical records then people die. If your startup has to reimage all its laptops and redeploy its application code from github then it's a lost weekend.

> These companies can afford good cybersecurity but don't want to spend more money than the damages they would incur from a successful attack.

A bit off your "real" point: No company should ever spend more mitigating a risk than the potential cost they could incur from the risk. That is just good business, but the reality is that companies generally won't spend more on cybersecurity than their peers (either as a percentage of revenue or percentage of IT spend). Whether that is the proper balance for a risk/spend calculation is the real topic.

The problem is that we can't accurately calculate the probability of a cyber event and the cost impact of that event. So the company is stuck waiting for an attack on themselves or one of their cohorts so they can adjust.

> No company should ever spend more mitigating a risk than the potential cost they could incur from the risk

Funny, after the fact they are usually out a lot of money and they decide that they now do want to mitigate that risk.

It’s genuinely interesting how poorly companies perform when you gauge their ability to cost out a successful attack. Pre-attack, many seem to make an economic decision not to mitigate it. Post attack, the fifth CISO in four years gets fired, the CEO vows to do better and the cycle repeats all over…

>No company should ever spend more mitigating a risk than the potential cost they could incur from the risk.

I've heard hospital administrators make this argument after I've warned them about their security infrastructure being vulnerable to ransomware. I'm not convinced.

>No company should ever spend more mitigating a risk than the potential cost they could incur from the risk.

basically you summed up the opening scene from the FightClub. The human life cost H millions, so until it is going to kill N such that N * H >= cost of the fix ...

Mostly true, although the ceiling at which you become interesting is dropping for multiple reasons.

Given the time cost of retrofitting effective security, waiting until you become a worthwhile target doesn't work. But hiring secops and spending time on security engineering instead of your product is also deadly to startups. It is another knife-edge for startups to walk.

Modern-day privateers?

Could you expand on that? Any high-profile cases?

Edit: found this comment in this same thread https://news.ycombinator.com/item?id=29158450

Except normal entrepreneurs can sleep easy at night and not worry about going to jail for life. Or at least right now, political situations can change and even conducting legal business can be dicey.

The Mafia was a hierarchical franchise system. There would be gunfights when one mafia franchisee would encroach on another franchisees turf.

so what can the actual members be charged with? conspiracy or RICO?

Conspiracy is very probably a viable charge.

RICO is quite dicey--the main charges in these indictments are 18 USC §1030 charges, which do not qualify as predicate acts for RICO charges. But the 18 USC §1956 charge (i.e., money laundering) does qualify, although the fact that there's only one count in these indictments means it's going to be harder to describe the necessary pattern for RICO. If it does, then I believe the other elements of 18 USC §1962(c) could be straightforwardly shown. (In particular, the defendant and the enterprise are clearly different).

But IANAL, and the details here can be incredibly convoluted, so make of that what you will.

What i learned from this: if you piss off the USA, you can't travel freely and brave your invulnerability. You should be sitting quiet in Russia, which won't extradite you, and not flash your stolen money. Because if you do, your local bandits will find you, and if you don't, the USA will find you.

Inside russia you can flex as much as you want. Case in point "Maksim Yakubets" of Evil Corp. Who drives a camo'd lamborghini with the plate "Thief"..

https://www.thetimes.co.uk/article/moscow-cyberthief-wanted-...

https://www.youtube.com/watch?v=hHY6VEurPA4

The probably he has connections with the corrupt police or criminals. A nobody can't really drive a custom lambo and not get noticed.

This is shocking. God, what a corrupt state.

Yes, contrary to the US which isn't corrupt, right.

I am neither american nor russian by the way. And although my own country is officially not really corrupt, we also have our fair share of lobbies and non-prosecuted crimes when someone higher up fucks something up.

EDIT: Looking at the downvotes I guess people think I hate the US while defending Russia or whatever. Actually I think every country or rather it's government has flaws with intransparency or legal corruption, just in different areas. US has shady financial things, Russia is apparently in the hacking space, my country has it's shady areas as well etc. Don't take my comment as an attack towards the US as a whole or as a way to say Russia does nothing wrong.

Finally, pure whataboutism.

Not really in my opinion.

The poster was expressing that they're shocked, saying what a corrput state Russia was. And I don't quite understand why they're shocked and presumed that they're from the US.

I didn't try to deflect by saying "Russia isn't a dangerously corrput state because look at the US", I tried to say "Why are you shocked about Russia when your own country has it's problems with corruption too."

Hope that makes sense and that I'm now not registered as a russian astro-turfer.

When attacking Russia for a specific thing, bringing up the misdeeds of the US are a distraction, and "whataboutism".

When comparing the morality of the two nations (or criticising the "world police" status of the US as hypocritical) recalling American misdeeds is appropriate.

In the case the post was "what a corrupt state", attacking character of Russia generally, hence it's appropriate. It's worth pointing out that OJ Simpson published a book "If I did it", which could be seen as morally unacceptable too - but then there would be a difference between "that's terrible" and "America is terrible".

For some reason everyone on this site sees the term “whataboutism” as an immediate way to invalidate a statement they disagree with.

I believe OPs point was that in fact, Russia is as corrupt as other world powers…so you shouldn’t be shocked by their tolerance of cyber criminals.

How is this particular instance "corruption". The guy violated US laws which Russia do not "harmonize". This is similar to a US-based person who is attacking Putin in the media. It's illegal in Russia, but would that make the US extradite him?

Thievery is illegal in Russia too.

But the theft is happening outside of Russia, so a Russian court could not pursue.

What would happen if you stole $1bn in Russia and escaped to the US?

You'd make a federated, censorship-resilient sometimes-encrypted chat app.

US specifically negotiated with Russia to get help with this case: https://www.nytimes.com/2021/10/31/world/europe/biden-putin-...

Besides, in Russia you're not safe for a bunch of other reasons.

>Besides, in Russia you're not safe for a bunch of other reasons.

It all depends how cozy/useful you are with/to the state apparatus.

it also helps not having a VK account tied to your "business" e-mail

Never fight a strong state I guess...

I would not recommend attacking infrastructure in China or Russia either if you want to sleep easy at night

I'd be requesting hotel rooms on the ground floor for life personally.

Watch out for people with umbrellas, or offering cups of tea.

Having grown up in Wiltshire we're already we'll versed in 123 m spire techniques comrade.

Ah, with winter coming around, even crosswalks can be slippery and you could fall and break your neck.

I think that's.. what's the opposite of survivorship bias?

I'm pretty sure that's still survivorship bias.

Perhaps an availability heuristic: the ones we know about are the ones that have been caught.

SB/AH are fairly tightly coupled. Also Texas Sharpshooter.

These two people are respectively 22 and 28 years old. They have spent their time in cyber-crime environments since their teenage years.

Respectively, a third of his life for the first one, and half of his life for the second one. And that is a lower bound.

The first one had an account on a cybercrime forum 8 years ago, so he was 14!

> These last two nicknames correspond to accounts on several top cybercrime forums way back in 2013.

The second one had an account 13 years ago, so he was 15. Wow!

> [T]hat forum’s database says a user by the name “Damnating” registered with the forum in 2008.

I have a SQL Injection tutorial on Youtube with ~150,000 views, that I recorded when I was 13 or so I think.

Had been doing code-stuff and hanging out on hackforums.net for a few years at that point.

My voice is prepubescent in the video hahaha:

  "(Tutorial) - Hack a Website With SQL Injection"
  147,745 views, Jun 26, 2010

https://www.youtube.com/watch?v=0z1rt9Y-ON0

I come back every few years to check on it, I found this comment particularly wild:

  rispettoPrograms: 2 years ago
  "this helped me to pass a Certified Secure test!"

Thought I wanted to do Cybersecurity stuff when I was young, but as it turns out, when you're a young teenager "Cybersecurity" just sounds cool.

Nowadays I build CRUD apps, and CRUD app accessories ;^)

This is great. Wish I had started programming earlier in my life (started when I was 23).

I also used to have accounts on plently of cheating forums back in the days, most have gone offline now.

Those places were the starting point to have a deep interest in IT, memory editing, and more broadly cracking.

It’s becoming harder to believe crypto currencies are a good thing when you see how it allows criminal to move money anonymously.

Anybody actually uses crypto for legal goods and services? I’m genuinely curious about it, I do want to be proven wrong, that crypto currency can be used for legal things.

PS: just to be clear, not asking how crypto works, I’m quite familiar with it.

An argument could be made that the ability to move money shouldn't be restricted to the "law abiding".

Governments not only have the power to restrict the movement of money but tax records and transaction details let them know 90% of the most important details about everyone.

Additionally, sure without crypto there wouldn't wouldn't be these kinds of ransoms but the same attack could be used for terrorism/warfare. These ransoms just provide the incentive to develop solutions. A terrorist attack that had no option to decrypt the data could completely shut down entire countries.

> Anybody actually uses crypto for legal goods and services?

I regularly use my crypto-backed (ie balance is in cryptocurrencies) Binance Visa card to make purchases. I have some money in cryptocurrency exchanges because their lending (used to lend to margin traders) systems have better interest rates than my banks savings accounts do and when I want to use the money I use my crypto-backed Visa card.

I suppose you can argue this is only possible because of the margin traders, but for me it acts as a higher interest savings account that’s a good place to keep some money that I don’t need immediately accessible (I need to move it to the card to use it) but is still accessible if I need to make a purchase with it.

In the past I’ve also used cryptocurrencies to transfer money between myself (I’m in Europe) and family in Australia, as a cheaper faster means of transfer than international bank transfer or western union.

So there are at least some legitimate uses, even if the criminal uses outnumber them.

Those cards use euro/usd under the hood, so you don't actually send crypto to whoever you buy things from. They get euro/usd.

I mentioned that in another comment: https://news.ycombinator.com/item?id=29158328

To the user, this is transparent (for some cards anyway, eg Binance), so its effectively the same thing. Yes, I'm not actually sending the merchant crypto, but what does it matter? I am using my crypto balance to buy things, the fact that the merchant isn't receiving crypto is an implementation detail. Conceptually, it could be a choice left up to them.

The question was if anyone is using cryptocurrencies for legitimate purposes and I was saying that I am using cryptocurrencies to buy things, I didn't say that the people I'm buying things from are receiving the cryptocurrencies and to me it makes little difference if they are or aren't, I have a crypto balance that I use to buy things.

> Yes, I'm not actually sending the merchant crypto, but what does it matter?

In the context of the question, it matters a lot. You're not using it as tendered currency.

The question was who is buying things legitimately with crypto, and your Binance card isn't that. You're buying things legitimately with that card... ...with real currency.

Why merchants prefer real currency to crypto is left as an exercise for the reader.

You're nitpicking.

The question was: "Anybody actually uses crypto for legal goods and services?"

I am using crypto to buy suff, how it is facilitated under the hood is an implementation detail and none of my concern. I am using and spending cryptocurrencies to buy things. My balance on the card is currently primarily USDT (and some ETH). Not dollars, not pounds, not euro: a cryptocurrency. The fact that technically they sell that USDT to fiat when I make a purchase is transparent to me and not something I have to care about.

If I'm nitpicking, then you're hairsplitting.

You could just as easily be exchanging black tar heroin for real currency and using that to make your purchases.

Are you then using heroin to acquire goods and services?

The question was if anybody was using cryptocurrencies to buy stuff. Well, I am. When I buy stuff, my crypto balance goes down and I get the purchased item. What happens outside that is invisible to me. From what I see on my end, I am spending crypto.

If I used a US credit card to buy something from a European store with prices in euro, am I spending USD from my USD balance or am I spending euro? From my perspective, I would say that I’m spending USD, even though the bank is exchanging it to euro under the hood and sending the merchant euro. How is it any different with crypto in my case?

Again, you're not buying stuff with cryptocurrencies, anymore than the heroin dealer is buying things with heroin. You're both converting your asset to a fiat currency, and then buying things with that.

It's a simple distinction.

Okay, less emotive comparison - you hold gold as a store of value. You liquidate some for US dollars, and then use those to purchase goods and services.

Again, did you buy those goods and services with gold, or with US dollars?

It's even worse than this, because they don't even have gold (or bitcoins in this case), what they have is an IOU for bitcoins on a bank account (at Binance): this is fiat bitcoin and it has even lower guarantee than fiat dollar, since Binance is far more regulated than a regular bank.

I can at least easily/cheaply convert and withdraw it as one of many cryptocurrencies. Of course, if Binance went away or otherwise restricted withdrawals, then I wouldn't have access to it, but that's the price you pay for the convenience and features of a centralized exchange.

Some of the newfangled DeFi cryptocurrencies try to get around this, but of course they can't offer a visa card.

As with all things, its a trade-off. For me, Binance is a better trade-off than my bank, for the things I use Binance for. I also don't exclusively use Binance and I do keep some of my crypto in my own wallets, separately from the centralized exchanges.

Go back to my scenario: when you use a US credit card, denominated in USD, to buy something from a European merchant, whose prices are in Euro and who receives Euro from the purchase made, are you buying the goods in USD (the currency that your account contains) or in Euro (the currency the merchant receives)?

From the perspective of the customer, you only ever see the dollars: that's what your account contains and that's what the number that goes down in exchange for the goods. Yes, behind the scenes, your bank turns that into Euro (liquidates the gold for you, in your example) and sends the Euro to the merchant, so as far as the merchant is concerned, the transaction is in Euro, but from the customers perspective, everything happened in USD.

I'm not arguing that you're not correct, that you are technically buying goods in Euro, what I'm saying is that from the customers perspective it may as well be in USD.

For the cryptocurrencies, of course I'm technically buying in USD, on-demand liquidating the cryptocurrencies to USD in the process, but from the customer experience, I may as well be transacting cryptocurrencies and I am spending my cryptocurrencies (via a transparent exchange behind the scenes) to make the purchase, just like a USD card holder spends their USD (via a transparent exchange behind the scenes) to make their Euro purchase and just how you would liquidate your gold (assuming there was a "gold" visa card where the bank handled the liquidation for you transparently behind the scenes) to make a USD purchase.

From my perspective, when I use the Binance card, I am using my crypto to buy something. How that works isn't relevant to me. I don't see the USD[1], I see my crypto balance go down and I get the purchased item. For all intents and purposes, I am using crypto to buy things. If I didn't have the crypto, I wouldn't be able to buy things with that card.

What the customer sees matters, since the money in a non-gold-backed account is just a number anyway, you're not really "spending" anything. But from the customers perspective, the number represents the USD (or whatever) that's in their account. When they make that number go down, that's what they're spending. If the bank decides that for some reason its more efficient to convert the money to GBP first, then to Euro and then back to USD, good for them, it doesn't affect the customer. Its an "implementation detail".

Or another scenario: What if I use a USD card to make a Euro purchase, but the merchants account is in GBP? (A UK-based business with an EU-localized store, perhaps) I am buying in USD, the actual purchase transaction happened in Euro and the merchant only ever sees GBP. You seem to be arguing that only the middle bit, the Euro transaction, matters. I'm saying which part matters depends on the observer: for me, the USD part is what matters, for the bank the Euro part might be the most important and for the merchant its the GBP part. For all intents and purposes, I spent USD, the merchant received GBP, but the bank processed Euro. The dictionary says "spend" means "to use up" or to "pay out" (and pay is to give), I'm using up the USD in this example.

[1] I mean, technically I do: the merchant quotes their price in USD and Binance does of course let you see the USD equivalent balance of your cryptocurrencies

The difference is that a US merchant must accept US dollar for your purchase but must not, and in fact does not, accept cryptocurrency.

That wasn’t the scenario though, I picked the scenario because it’s similar to my use of cryptocurrencies: where your credit card is in a different currency to your purchase, while the card issuer does the conversion behind the scenes. Just like is happening when I buy something with a Binance card. So what currency a seller must accept is unrelated.

Dude, enough. Things were okay, but now you really are splitting hairs. This is a legal (for now) use case for cryptocurrency.

Edit - “For now” is critical. Who knows what the next five years will bring??

I believe this is a whole other debate (that I’m not willing to get into)… Still my question remains, this type of currency seems to be mostly benefiting criminals activities.

Attackers are being shielded by and adversarial nation states and taking advantage of currency exfiltration via crypto currencies. So, arguably ransomware attacks should be treated as terrorism and, in some cases, acts of war. Whatever 'war' means in this context.

> An argument could be made that the ability to move money shouldn't be restricted to the "law abiding".

Which, of course, would not be a very convincing argument to the vast majority of the population who aren't libertarians, including me.

Remember when I a certain notorious government from the 20th century made being born a Jew illegal? I remember that.

Governments do stupid things all the time, and Crypto currencies is a great technology to keep governments honest. Even if most activity remained illegal (It won't) it would STILL be a beneficent technology. This illegal business is done with or without crypto, regardless.

> Remember when I a certain notorious government from the 20th century made being born a Jew illegal?

A government once made being a Jew illegal and that was bad.

Therefore any government making anything illegal is bad.

That appears to be your logic, or am I missing something?

Yes, you are missing the part where a small group of person making things illegal based on very limited information instead of relying on the total computational system of the human organism is a bad things.

Why are drugs illegal? In a large part because black people used them. Also in part, because it threatened the traditional American way of life people were attached to.

I'd recommend stop using nazi analogies for the most part.

Other than that, you need internet for your transactions. Guess who has the power to control the grid? Crypto does not make you independent in absolut terms. There might always be a way to access the internet, but only for those capable - and this won't be the one you're buying food from.

>Guess who has the power to control the grid?

For now. Top level domain registration has already moved to crypto. Elon is working on Starlink. Wireless data transfer technologies are coming for a peer based internet infrastructure.

Can someone defend cryptocurrency to me, a person who emphatically does not believe that the government of the United States is comparable to Nazi Germany?

It kinda sucks in its current state, but theoretically it has a lot of promise as a cheap and open source alternative to PayPal and a lot of banks’ services

At this rate, I don’t know if that’s ever going to come about.. looks like it’s just gotten bogged down in ways to increase its value at the cost of its utility..

> but theoretically it has a lot of promise as a cheap and open source alternative to PayPal and a lot of banks’ services

Even theoretically, how can they do this? I don't see it happening, even setting aside the much rehashed mining electricity consumption issue.

When eth was dirt cheap, you could send $5,000 overseas in 10 minutes for $2, with just a half percent of slippage on the trades to and from fiat currency and ~1% price movement up or down

Yeah, theoretically it just used $2 worth of electricity somewhere in the world, but I’m pretty sure PayPal is going to do something nefarious with the $100+ you’d have to give them for the same service

You build a second layer.

All the hype benefits of pretending to use blockchain, without ever actually using it.

For any newbies reading THIS IS FUD.

The tldr is thst Lightning is as safe as bitcoin because it uses bitcoin under the hood.

https://endthefud.org/

Calling things you don't like FUD doesn't make them less true.

The website you linked is just a collection of random (and often contradictory, just read a few of the “energy” topic) opinions posted on medium.

“FUD” is “Fear, Uncertainty, Doubt”.

The person you’re replying to was (sarcastically? I would’ve been) suggesting a solution, which isn’t any of those things.

Lightning depends on and USES the blockchain, grandparent said it doesn't which is patently untrue, thus fud.

What’s important is they’re not engaging in fear, uncertainty, or doubt. I’m not going to accuse bananas of being unsuitable for vegetarians just because they’re shaped like sausages.

As there are different ways to use a thing, and everything I’ve seen of Lightning (network not cable) is using the Blockchain in roughly the same sense as a USD denominated bank that happens to not ban accounts from trading Bitcoin uses the Blockchain — i.e. it does, but it’s very much also pretending — this seems reasonable, if not literal.

There are chains where mining costs a fraction of BTC or ETH, both in terms of money and electricity use. Cardano, Polygon.

As of today this is my belief too. It’s reached billions of $ of values,I can’t think of a place to use it and all (absolutely all) the persons I know who owns some look at it as an investment not as a currency

There used to be a cryptocurrency called Freicoin, which charged its holders X% per annum, deducting the proceeds directly from user savings and funneling the proceeds into charity “for the greater good”.

Freicoin failed to gain any appreciable adoption on the open market. Despite what people claim — e.g. “currency is supposed to be inflationary, cuz greater good” — when it’s their money on the line, they never choose inflationary money if they can easily opt out of it.

The failure of Freicoin underscores the reality that inflation is an anti-feature of money. No one actually wants inflation — if they have better options, they avoid it every time.

When the US government went off the gold standard, they doomed themselves to a Bitcoin future, because suddenly everyone could see the government’s money was backed by nothing. And if US dollars are backed by nothing, what stops a software developer from launching a competing money which is also backed by nothing? They removed all barriers to entry.

Now that everyone knows government money is backed by nothing, every available currency in this world has become an embarassingly hollow confidence racket. It’s merely a matter of whether you believe private sector confidence games made by competent engineers deliver superior technical/economic qualities compared to government confidence games.

Really, why would you want to hold a money in which a tiny group of people fully control the extent to which your money is debased year after year, when you could instead rely on an apolitical computer algorithm not controlled by anyone with a supply schedule known fully in advance which is auditable in real time using freely available open source software? Doesn’t that sound like a better form of money to you?

Visit “WTF Happened in 1971” [1] for another look at the impact of inflationary economics and currency debasement on middle and lower class people.

[1]: https://wtfhappenedin1971.com/

I would prefer to phrase that dynamic as, no one would knowingly opt into a money that can do that to them, so these kinds of schemes require first lulling/locking a population into that currency on a different promise, and only then debasing it, which is argued to solve certain public goods problems related to economies.

That is, people only accepted dollars in the understanding that convertibility wouldn't be suspended, just like they accepted the historical money that Freicoin was modeled after before knowing they'd do the Silvio Gesell scheme. It's an open question whether we've accurately modeled the full knock-on effects of reneging on the promise that got the currency off the ground (though personally I agree with you).

> No one actually wants inflation — if they have better options, they avoid it every time.

I don't like taxes either, but I also like living in a developed country. Inflation is a kind of tax, so nobody likes it, but at the same time pretty much everyone likes having what this tax provides (in the case of growing money supply, it's the ability to have money at all in circulation in the economy for the layperson).

Visit “WTF Happened in 1971” [1]. That argument doesn’t hold water for middle and lower class persons.

[1]: https://wtfhappenedin1971.com/

For the past 50 years the lower and middle class person where robbed, not by inflation (which was way higher before 71 than between 1981 and today) but by neoliberal policies (Thanks Raegan, thank you Bill Clinton, and all the others, really).

Interestingly enough those policies where grounded in the same ideological background as today's crypto enthusiasm: Austrian economics.

In the 70's, Keynesian's political influence died (because of inflation haters), and so died the golden age of America, and the lower-income families spiralled to straight poverty. Now, after the 2008 crisis, Keynesianism is in charge again, and some people are really bullish with crypto for ideological reasons (because they've drank too much of the 80-90's propaganda comparing Keynesianism with Communism, really). But using lower and middle class persons as an argument reveals either poor historical knowledge or bad faith. It's pretty ironic anyway.

I'm not interested in being sold libertarian ideology. I want someone to defend cryptocurrency on its nonpolitical merits. What can it do for me?

Year 0, you have $X dollars in your bank account with $Y purchasing power.

Year 1, you have $X dollars with $Y - 1 purchasing power.

Etc.

$Y > $Y - 1

Inflation is an anti-feature.

> What can it do for me?

It really sounds like you’ve never held Bitcoin. HN can change that for you really quickly if you’re open to it.

Currencies compete, and ones with inflation which punish holding the currency over the long term are fundamentally less user-friendly.

You talked about bank account, but people usually have much less money in their bank account than what they earn in salary. And with a deflationary currency, the value of your work declines year after year in that currency, meaning that your employer will be willing to pay you less and less every year!

As long as inflation is low enough, people don't really care about it in general because there salary increases as much (and given than the average American has much more debt than saving, the inflation is actually a gift to them).

So I talked about workers, but how about investors and entrepreneurs? Say I have $10 million today sitting in a bank account. I can either let it sit idle, losing value to inflation every year, or invest it somewhere where it can create value. Now if the value of my $10 million increases in real terms (meaning that my purchasing power will naturally increase when time passes) the most rational thing to do is not to invest that money. It's actually unlikely that my investment will pay off anyway, because the amount of money spent by people will decrease year after year (because that's what deflation means).

The idea that deflation is better than inflation (or, more broadly, that inflation is undesirable for the consumer) is libertarian ideology that I reject.

I don't think anyone is arguing that the US government is comparable to Nazi Germany. I think the implication is that the Weimar Republic rapidly devolved into Nazi Germany and the Roman Republic rapidly devolved into the Roman Empire. I'm sure I'm missing a few other good examples of authoritarian/totalitarian regimes arising surprisingly quickly from relatively liberal democracies. (In particular, I'm not familiar with how stable or liberal Italy, Spain, or Greece were before their mid-20th century dictatorships.) History has shown that liberal democracies are metastable forms of government, capable of self-correcting moderate pressures toward authoritarianism, but not immune to larger swings.

I don't think the US is close to spiraling into authoritarianism within my lifetime or my children's lifetimes, but I would caution against rounding the tail risk to zero. Political change is glacially slow, except when it isn't.

> Roman Republic rapidly devolved into the Roman Empire

Well, after 500 years...

It was pretty stable for hundreds of years. My understanding is that the collapse of the republic was pretty rapid.

It can allow some pretty cool things. For instance, a end-to-end open source VPN. The nodes are hosted on an open source 'decentralized cloud', that is made possible by crypto, which allows users to know exactly what the server providers are doing with their information and ensures fair play. This is something which you can use right now, and is cheaper (for my use case) than buying a VPN.

Here is another notion. If you want to be anonymous you have to use anonymous protocols. If you explicit want to be able to track the movement of the tokens you are providing, like if you are a government who wants to ensure money is not moving to incorrect places, this is enabled easily and openly through crypto protocols.

I didn't meant the Nazi Germany thing to be a strawman, I was trying to be humorous while also bringing a historical example of the failings of government that is un-doubtable.

I believe the principle of paying taxes on transactions (aka traceability and accountability) is a way to finance the infrastructure allowing you to safely operate your business (cops, army, schools, roads…). Total anonymity seems like you might try to outsmart society which might not payoff in the long run (not saying all societies are perfect)

If you are interested in how game theory might solve the tragedy of the commons, see Vitalik's article: https://vitalik.ca/general/2019/12/07/quadratic.html

You should keep in mind. Public traceability is the default mode of Crypto. Public ledgering is the foundation of crypto protocols, after all. Only Monero has emerged as a viable anonymous product, and the one most traded on the dark net.

Remember when someone made a stupid Nazi analogy when the situations are completely different??

It’s incredibly hard to take anything you said after that seriously. Heck, you just made the exact same logical leap that anti-vaxxers are using to oppose vaccine mandates in Canada. That’s not good…either for dialogue or humanity.

I don't think the situation is so different from pre-World War 1 Germany that we shouldn't be vigilant. You have to consider that, in the 1930s, we thought WW1 was so horrific that there would never be war again. There are concentration camps in China (A developed nation!) right now, for the Uighurs, yet you still don't see the horrors of WW2 as a possibility?

>Heck, you just made the exact same logical leap that anti-vaxxers are using to oppose vaccine mandates in Canada.

At least I'm consistent then. Can you point out where my logical leap is?

Sure, it's simple. The Nazi party tried to systematically exterminate Jewish, Roma, gay and disabled people. They stole all their possessions, used them as slave labour and then murdered them in death camps.

You're comparing that to the possibility of banning a currency? There are no parallels between this and the Holocaust. You're consistent, but you're still wrong.

It was not my intention to compare the magnitudes, you silly head

Really?? If that’s the case, you’re unbelievably bad at writing. And the silly head thing makes you seem unbelievably immature. Good for you - you’re bad at communicating and lash out like a child when you’re called out. You’re basically the stereotype of the average cryptocurrency user, and frankly dude, cats like you are why there’s no adoption.

You can’t just default to offensive and think people will trust your silly financial ideas. It’s usually the opposite. Good job promoting your ideas.

> when you see how it allows criminal to move money anonymously.

Pseudonymously. Cash in a bag is anonymous and very widely used by criminals.

The other big difference is with the public ledger currencies the whole transaction history is visible, including to the authorities. Which is considerably more transparent than the current financial system with shell companies, tax havens etc etc.

If you're familiar with this, why reiterate the old canard?

Just use Monero or another crypto that also uses a ZKP algo to anonymize who sends what to whom.

IIRC most of these stories are about bitcoin payments. If they switch to monero, sure that's different.

But then we need to conduct the debate on the basis of different cryptos requiring different policy. Rather than saying crypto->criminal.

Encrypted chat also allows them to communicate securely. Is it hard to see why encryption is a good thing?

Personally, I'd rather give a bit more work to the police than have everyone give up on privacy.

I guess a society would have to make financial exchanges a part of your private life but it opens up a whole other can of worms (how do you finance the institutions enabling your business to thrive if you can easily circumvent financial accountability ?)

I make litecoin money transfers from my Spanish account to my Argentinian account. In Argentina the exchange is manipulated by the government, and currency exchange between individuals is illegal. Since cryptocoins are not considered currency, they are in a grey area. If I were to do an international transfer it would be like 2/3 more expensive, not considering even fees.

Cryptocurrencies are not anonymous, and fiat currency is no shining star.

HSBC and other major banks launder money for the drug cartels at billion dollar scale. Rather than white collar crime like ransomware, drug cartels actually kill and mutilate people.

Nobody has gone to jail at those banks for enabling it, even when they violate laws in the process of facilitating those transactions.

Sorry, is there any real argument here?

> Cryptocurrencies are not anonymous

A lot of them are certainly hard to trace, and are specifically trying to be.

> and fiat currency is no shining star

Indeed, but we go to great lengths to make it hard to launder money,

> HSBC and other major banks launder money for the drug cartels at billion dollar scale

Some people go to great lengths to break the law. But why make it easy and enable even more people to do bad things?

> Rather than white collar crime like ransomware, drug cartels actually kill and mutilate people.

You think drug cartels won't use crypto? Ransomware gangs are likely just pioneers.

If you want to make the case for crypto, argue its benefits (which I can certainly see). Or propose some means to keep its problems in check. But don't just deflect and point to problems elsewhere.

Anti-money laundering efforts cost society orders of magnitude more overhead than it yields in preventions. https://twitter.com/hyc_symas/status/1432349042592395270

Drug cartels are the result of draconian drug policy. If it weren't for these policies you wouldn't have people turning up dismembered in barrels of acid.

For the past 5 years or so I pay moderators, community managers, designers, marketers, and many other personnel in crypto. Usually stablecoins. I've also deployed vesting agreements for closer personnel. Software developers have basically always accepted crypto for services over the last decade, or ones that do have been easy to find.

I've accepted capital in crypto for non-crypto hedge/PE funds, more and more fund administrators are very well adept in taking in-kind investments for subscriptions of new limited partners.

Its more like having cell phone service in an underground subway station. When its not there you debate about it, when its there you just use it.

One aspect that may be overlooked which is a high volume use case, is that international wires are being circumvented at unlimited amounts, converted to domestic wire transfers. The unlimited amounts aspect is something that Wise/Revolut/Paypal/Western Union cannot compete with in either capability, company policy, company interpretation of compliance, actual regulatory compliance, speed, or fees. For example, in the payment for services use case, instead of an international wire transfer taking multiple business days and being error prone by user error along with multiple banks and a random compliance officer, the recipient (me, or them) just does a domestic wire transfer if they want fiat currency, after the payment was received in crypto. The bank just has a locally KYC'd person receiving domestic funds from the same person's KYC'd account at the domestic crypto exchange, which has the capability of being a same-day transfers within the local monetary union. Its just a matter of convenience. The international wire system (SWIFT) is not an authority to defer to, if their circumvention makes you feel like something bad is happening. They're just there, and antiquated, and inconvenient. Despite what you may have heard about how amazing the Eurozone's SEPA system is, turns out that not that many people actually send between nations, where the reality is that instant or even same-day SEPA is heavily dependent upon the two banks involved, the two countries, and more. Infinite, unreliable, permutations. With crypto, people receive it all very fast, and they can decide what they want to do with it. Since they can also acquire goods and services and invest with crypto often times they don't want fiat money. Whether they do or don't, they all also have the choice of stable value, or merely a few minutes of exposure to volatile value. This reality amongst people that actually use it has simply trumped all conjecture.

I’m curious regarding your employees: how do you deal with taxes and payrolls? Or is more like an “under the table” kinda situation?

For US employees 5 years ago we built a price oracle to automatically withhold vested sums from the smart contract, and consider other conditions like if the employee did an 83(b) election and would not be subject to income tax upon vesting.

Everyone else paid in crypto were contractors. Just normal tax deductions on our end, based on value sent at time of transaction.

How do you convert crypto to your currency on your tax forms and accounting if you don’t mind me asking?

It follows the same rules as uncategorized property:

USD value at time of receipt for income taxes, USD value at time of disposition and the delta for capital taxes.

The nature of the transaction’s purpose determines where/how it is accounted for. Just like with usd its up to you to determine if a transaction was a deductible expense, capital gains/loss, charitable contribution, a non-tax event like an in-kind investment, bond/credit/borrowing, income, vesting… its not different enough to really be having this conversation to be honest, but I’ve heard it all over the past decade so fire away.

I just make notes of the usd value transferred at the time, to simplify things when filing taxes. But the block explorers often show usd dollar values at time of transaction and time now so its easy to have a record to look at as well.

Some exchanges are beginning to attempt doing this for people, making tax forms like stock brokerages make tax forms, but they all assume people are buying and selling crypto on their platform instead of earning it directly off platform. Swing and a miss there, but lets check back in 5 years.

This finally seems like a legitimate use of crypto, thanks for the patience. What’s the main benefit for your case of using crypto over wiring fiat currencies?

I/We have large inventory of crypto balances more frequently than fiat.

So I think you have to switch your frame of reference here. I’m not doing cumbersome things to get crypto and then send it to someone. I do cumbersome things to get and send fiat where having permission to transfer it is even a factor.

Fiat users are pretty interesting in that they typically have never been in a circumstance to accept a large payment or a volume of payments. Even though when I use fiat I am able to send to only the banked population within a banking walled garden, most of them dont even know how to accept payment. “Wire?ABA?Ach?IBAN?SWIFT? Why is my Zelle/Venmo/Paypal frozen the one time I did something important to me?” Native crypto users are exempted from this. Even brokerage accounts for stock investing are walled gardens.

Per institution, per account type, there are varying degrees of online wire transfer convenience, many times with an unclear daily or monthly wire limit. As people can acquire goods, services, and invest with their crypto, many people just choose that path available to them and don’t swap back to fiat. If they are also paid in fiat then they use that to pay for the things that require payment in fiat, but people are willing to build balances in this parallel borderless ecosystem as well.

Hammers are the most common murder weapon, will you ban those?

Crypto has its uses, I use it often and expect it will be used much more as the dollar collapses in the near future.

Are they? Looking at the homicide data from the FBI [1] handguns are by far the most common weapon.

1 - https://ucr.fbi.gov/crime-in-the-u.s/2019/crime-in-the-u.s.-...

I was going to assume the OP lived somewhere with meaningful gun regulations, so hammers.

But sadly "the dollar will collapse soon" means well regulated militia member instead.

"It’s becoming harder to believe fiat cash is a good thing when you see how it allows criminal to move money anonymously."

Fixed that for you.

It’s surprisingly difficult to move around large amounts of fiat money without being caught. Large scale gangs get good at it by necessity, but many people have gotten caught. More importantly the effort to launder money is a major disincentive for criminal activity as it shifts the risk vs reward ratio.

Not really if the penalty of money laundering is far smaller than the profit. Just look at HSBC. Penalty for it is just the cost of doing business.

HSBC was fined $1.9 billion for processing (not profiting) $881 million + $660 million. Their profit was probably only a few percent of that. But even if they simply took all $1.5b as profit, they still were fined more than that.

You might say they probably laundered more money than that. You're probably right. But it ain't what you know, it's what you can prove.

Assuming the bank profits a few percent, a $1.9 billion fine wipes out the profit from 10s, maybe 100s of billions of laundered money.

And nobody went to jail. Which is the point of the argument. HSBC are STILL trading and moving money today.

This was also not the first time HSBC was caught doing this.

Nothing has changed. They made the losses back. I know execs calculate fines as operational expenses because I've helped them do it (granted not HSBC but people aren't too disimilar from each other)

That is the very different problem of willingness to punish "system-critical" money launderers, versus the ability to detect rogue money launderers. Failure on one problem does not invalidate efforts on the other.

What is the difference between the two? Organized crime always goes through banking insiders, it just makes sense. That's how high level bankers get rich generally.

Most crime isn’t well organized. Which is why catching outsiders is still quite useful.

I’m not so sure about that. In my country (Hungary) actually all big crimes have to go through the prime minister, he’s working together with the national bank and lots of other politicians, bankers and lawyers to steal the EU money that the country gets. Otherwise it’s a peaceful country (that is getting less peaceful as the government steals more of the economy).

Big crimes make the news, small crimes are when people are getting mugged. Both types of crime are significant, but small crimes are vastly more common.

It’s reducing the reward not just increasing the risk.

> It’s surprisingly difficult to move around large amounts of fiat money without being caught

For the average Joe maybe.

For corporates? What a joke. I work in fintech systems for ForEx and credit lending. Gets abused by banks allllll the time. And I don't mean some sketchy african or asian bank. I mean HSBC. They still trade, despite the billions in fraudulent transactions they've knowingly moved.

And HSBC are just retarded, I promise you ALL the large banks have moved fraudulent transactions. Not always intentionally, but banks consist of people and people are easily swayed with the right pressure points.

Does crypto make this easier to do? Yes, but the problem isn't the medium of value transfer. That's as untrue of crypto as it is of fiat.

And if you want to launder crypto, just sell a few NFTs.

Even crypto needs to be converted to fiat at some point to actually spend it, either directly so you can move it to a bank account or turn it into cash, or indirectly by using a crypto-backed credit cards and if that money isn’t legit, you still have to launder it if you can’t prove to your tax authorities where it came from.

Apart from being a means of exchange, in what way are fiat currencies equivalent to crypto currencies in terms of moving money?

Fiat cash is similarly untraceable and decentralized as crypto currency.

That is because it has fungiblity and transactions that aren't censorable.

But good luck trying to carry a suitcase filled with cash over an international border.

Thought about that, then realized that we (as in most of us) hardly use cash anymore and cash would also require an in-person exchange. It seems that crypto (by accident, not design) fixes most problems faced by criminal activities

>It seems that crypto (by accident, not design) fixes most problems faced by criminal activities

Why do you assume it's by accident, especially given that it's so perfectly tailored for the use case?

One could wonder indeed

You'd think? Then why have the US authorities traced crypto to the second individual arrested if it somehow magically fixes criminals' problems?

>if it somehow magically fixes criminals' problems

No claims of magic, but crypto is undeniably well-suited for and utilized by criminals.

>why have the US authorities traced crypto to the second individual

BTC alone did $45B in transaction volume over the last 24 hours. That's a pace of $16.4T over a year.

These two arrests, while encouraging, are nothing in comparison.

> No claims of magic, but crypto is undeniably well-suited for and utilized by criminals.

All right, but not all crypto is used or crime, in fact most of this volume is used for speculation, hoarding and to circumvent capital controls (getting one's dough out of China).

The thing is that most of it is traceable. Me and my colleagues have witnessed the CEO of a company in a neighbouring office being arrested and extradited to the US on charges of money laudring and fraud using crypto assets (BTC and ETH specifically). So the arrest/indictment of these two doesn't come as a surprise, it was bound to happen as soon as they got caught or stepped out of Russia.

I presume because it is clear what community bitcoin came from (the cipherpunks). It is obvious that this community would want bitcoin, and it is not a criminal community.

Besides, bitcoin isn't tailored perfectly. And the coins that are tailored better mostly seem to have libertarians and people who enjoy the tech building them.

>it is clear what community bitcoin came from (the cipherpunks).

Is it really?

>Besides, bitcoin isn't tailored perfectly

Well, I said crypto. But BTC has obviously been a preferred currency.

Crypto, diamonds, rare goods, it's all relatively easy to move large amounts of value rather than physical currency.

I think the problem is the proportion.

It's really not clear that crypto is disproportionately used for criminal activity, in fact there's evidence it might be less commonly used for criminal activity

https://www.forbes.com/sites/haileylennon/2021/01/19/the-fal...

In proportion, I can’t see 2% of the transactions being done for goods and services (since I can’t think of a place accepting crypto for payment)

Binance, wirex, crypto.com and others offer credit cards backed by cryptocurrency balances. Sure, technically, they sell the crypto for fiat as you use it, but to the user it’s the same as spending the cryptocurrency directly.

And there are at least some online businesses that accept crypto, certainly security focused services like Mulvad and ProtonMail but I’ve occasionally seen it for other SaaS products too, although not too often.

On the contrary, nowadays you can buy several types of gift cards with crypto[0].

[0] https://www.bitrefill.com/buy/usa

Not really a fair comparison, as moving traditional money becomes harder and harder, to the point where law abiding citizens can get caught in a trap, should they move or handle too large sums incorrectly.

And it's going to get much harder. There's a reason for the push to cashless societies.

Answer to this question depends on your view of ethicality of different activities that are considered "crime". If you were a libertarian, then both drug trade and tax evasion, although crimes in a legal sense, would be completely ethical.

I wouldn't provide information for reward for the department of security, if I had any. Sounds very risky, being exposed to both sides in conflict.

This isn't a gang at work. This is a crime network.

For a foreigner there is much less guarantee of being paid. They should throw in a green card and witness protection (the person would be worth $5M, before taxes, so they wouldn't be importing a poor person)

>The apparent lack of any real operational security by either of the accused here is so common that it is hardly remarkable.

I'm always surprised how people who exploit IT systems weaknesses for a living seem to be themselves fairly weak on security and hiding their tracks.

DOJ press release https://www.justice.gov/opa/pr/ukrainian-arrested-and-charge...

> The DOJ also said it had seized $6.1 million in cryptocurrency

Is that before or after the surge (ASOF this comment btc is at an all time high)?

How much money until people decide that those Windows licenses aren't worth the trouble?

R. Evil, seriously? Feels like watching a poorly written Austin Powers sequel.

They just implement it in Rust.

Microsoft, Facebook and Netflix sure don’t sound like a cool “Mega corp Brand” name either.

The old saying, Russians are either evil, genius, or evil genius

Reply on news.ycombinator.com