SIM swapper abducted, beaten, held for ransom | Hacker News Reader

SIM swapper abducted, beaten, held for ransom

krebsonsecurity.com

173 pointstodsacerdoti124 comments

I am currently in the middle of an identity theft attack. It all started with someone trying this SIM swapping attack on me. Luckily Verizon prevented it.

After failing to get my number they still were able to access my debit card. Since they didn’t have my number they initiated a text bomb attack where I received hundreds of signup and 2FA texts. Buried in the middle of those was a withdraw alert from my bank.

Luckily I spotted it.

All in all this has been a very bad experience for me. While I do feel bad for the violence inflicted on this guy I wish there was something more we could do as a society to prevent people from following in his footsteps.

What steps do you think you'll be taking to never have to deal with this again?

First I “locked” my phone number disabling transfers (although I suspect this is vulnerable to social engineering attacks).

I have also frozen my credit with the three credit bureaus (the attacker also opened a new line of credit in my name)

I am also closing the bank account that was compromised. They aren’t giving me any info but I suspect the attacker got my debit card via social engineering. It was a new account and I hadn’t even received my debit card yet.

I have a subscription to a credit monitoring service as well which has proven its worth in this situation.

Otherwise honestly I am not sure what to do. It sucks to know this person has my name, social, phone, and other info. I basically plan to keep my credit frozen indefinitely. I am also disabling text based 2FA for me and my wife wherever possible.

You need to give your ssn to so many people over your lifetime and you’re essentially trusting that all of them will be trustworthy and secure with it.

This could be easily solved with public key cryptography, but it would also confuse so many people it would be hard to implement.

If there’s an upside to the crypto craze, maybe it’s teaching people about cryptography basics.

We will literally never teach the whole world to use current crypto tech safely. It needs better UI.

At the root of the problem, people will forget passwords and lose physical tokens and will need some other way to restore access.

If this were being used for SSNs, you'd have a central authority to restore access. If you lose your passport, they can issue you another one and mark the old one as lost/stolen. You can do the same thing for key pairs.

The main problem it solves is giving a sketchy client your SSN on your I9 without allowing them to use it/leak it to scam groups to spin up a credit card on your behalf.

The main problem with the “key escrow” scenario is that the government can access your private key, so this solution is still not meaningfully secure. What do you think is more likely: that this new institution will be magically invulnerable? Or perhaps you will have just created an irresistibly valuable target for social engineers and hackers that inevitably will fall?

Not magically invulnerable, just a lot less vulnerable than a plain text 9 digit number that you hand out to hundreds of people over your lifetime.

Good news. A good chunk of the world already uses crypto for identification. My eID card is just that, i can auth with a chip and pin. This is normal in a lot of the EU.

I don’t want my identity to be linked to many of those accounts. So I’ll take a yubikey. Second, I’m glad I don’t live in a country where I’m required to carry id.

Just because a country has IDs doesn't mean you have to carry it all the time. Where I'm from (Germany) you don't have to.

You don’t have to but in situations where you are unable or unwilling to show your ID and a peace officer wants to check your identity, they’re entitled to take you to the precinct.

Freeze your credit at all three of the companies. It's free. It's not that painful to open it when you need it. Everyone should do this ASAP.

Ideally, Verizon should be able to give an “in person only” option for a SIM swap. And that’s the default.

I have this setup with my carrier (not Verizon) and it didn’t stop me from being victim of a sim swap attack twice thereafter.

Wouldn't a 'plug' working in a store work around that?

I’ve “locked” my number and it requires a transfer PIN. I hope Verizon’s systems won’t allow a transfer without that pin even with a malicious employee, however I wouldn’t be surprised if they are able to override it.

Apparently my attacker had a fake ID with my name and their photo. It’s possible a store employee could override the transfer lock if they are sufficiently convinced it’s really me.

I've heard many cases of transfer locks being broken. From what I understand, it is even possible to simjack at a higher level than the individual telco.

Thus, I don't even bother with stuff like this, the only solution in my eyes is to not rely on SMS 2FA and if you absolutely have to, at least use a GV number. While GV isn't totally secure either, at least it is disconnected a tiny bit from my cell number and doesn't have humans backing it (we all know that Google never answers the support phone).

There's also a "run in, punch a guy in the face and steal the tablet" method. Can't get around that either.

In one of Sid Myers games he has a quote that always stuck with me "Human behavior is economic behavior. The particulars may vary, but competition for limited resources remains a constant. " and you can watch that play out here.

Crypto prices are falling and violence around that community goes up. Corporations see the economy going into a recession and start layoffs. I wonder if more fraud, wage theft and illegal tax avoidance happens during economic down turns as well?

Pravin Lal's speech stuck with me even more, it seemed prescient and relevant for how the mid/late-2000s and early 2010s played out.

"As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with freedom and vitality, but the free nation gradually constructing its grip on public discourse has begun its rapid slide into despotism. Beware of he who would deny you access to information, for in his heart he dreams himself your master."

Adverse issues (e.g., fraud) tend to get noticed more in downturns, because, generally, everyone cares more about the details in those times. In times of plenty, they also occur (perhaps even as much), but people are more willing to let the same behavior pass because everything is going well.

At the risk of stepping too much into the meta, I wouldn't be surprised if there are some innate behaviors from evolution for responding to downturns (e.g., caring more about fairness).

The innate behavior idea makes some sense. One example: Unemployed married men are something like twice as likely to be divorced as men who are employed. People typically don't say "I divorced him beacuse he doesn't make any money" but suddenly behaviors that were tolerable previously become deal breakers once a man loses his job.

Or you know the gravy train is over and you can get 50% before it drains down to nothing + 20% of his imputed former income drained from the 50% he has remaining + a new man with a job.

> "Human behavior is economic behavior. The particulars may vary, but competition for limited resources remains a constant. "

That quote is discussed a length on this wonderful blog (like others said, it's from SMAC): https://paeantosmac.wordpress.com/2015/07/07/first-impressio...

It's never as simple as simple economic models suggest :)

Some studies indicate poor people are more altruistic:

https://greatergood.berkeley.edu/article/item/the_poor_give_...

I won't express an opinion on who is more altruistic, [edit] because I don't think I have sufficient data to draw a broad conclusion. Studies on college campus like these always seem pretty weak to draw societal wide conclusions from. These tiny experiments are usually conducted on college students and often are not reproduce-able.

"In one of these experiments, the researchers, led by doctoral student Paul Piff, gave participants the opportunity to share $10 with an anonymous stranger. A few days earlier, the participants had all filled out a questionnaire in which they reported their socioeconomic status. The results showed that people who had placed themselves lower on the social scale were actually more generous than upper class participants were."

This strikes me as a pretty weak study to extrapolate to any society wide conclusions.

Having spent my childhood in one of the poorer corners of the globe, it tracks with what I experienced, for what it's worth. When folks don't have much, group sharing any bounty received, and being the recipient of others', is how people survive.

It may also be the case that a community more inclined towards socialism ('sharing any bounty') doesn't fair as well, and is disproportionately likely to be poor. Not saying that's the case, but it's one possible explanation of why poor communities would disproportionately exhibit that behavior.

I honestly think you have it in reverse. If you and your community are poor, the only way to survive is through cooperation. The folks that didn't participate? You don't see them because they didn't survive.

So yes, you see cooperative behaviors in the poorest of communities. Because other behaviors at that income level are incompatible with life!

Chicken/egg. Populations that share poverty traits practice collectivism to survive. But collectivism is a local maximum that prevents stronger traits from capturing benefit, and thus inhibits them from taking hold.

In the long run, non-collectivist populations develop an advantage through hard times and environments. Collectivist populations subsist, and nothing more.

I noticed you countered by using 'cooperation', a word found nowhere in my above comment. I do not think this is an accident, and calling me to have it 'in the reverse' of a word I never said is no doubt a deliberate and misleading framing on your part, although I admit it is rather clever

? I used cooperation as a synonym for sharing the bounty, which is think is perfectly reasonable. Please assume good faith in discussions here. HN is run differently than most internet fora.

A better study on US Army officers, though focused more on empathy and narcissism rather than altruism

https://journals.aom.org/doi/abs/10.5465/amj.2015.0680

I’ve been to over 40 countries and I can tell you this is true. The people that have the least are some of the most caring people, who will insist on feeding you even when they don’t have much food to give.

It is economic disparity that creates violence. Only when villas are in reach of a small poor town do you start to get petty muggings, scams and murders.

Can attest to this, numerous times I have been invited to dinner, helped tremendously for no reward and met with just pure humility from dalits (untouchables) when backpacking in India.

I am not claiming that people from other castes behaved badly, in contrary, but when you see how little those people have (ie 3 generations, or 10 members of family sleeping in 1 room 3x3m and that was their whole 'house' - just 4 super basic walls with no roof, nothing else). Coming back to my relatively crappy eastern european country where people constantly complain how poor they are compared to ie germany made me feel sad, ashamed and badly out of touch with my folks...

>It is economic disparity that creates violence. Only when villas are in reach of a small poor town do you start to get petty muggings, scams and murders.

I remember hearing about this in a Jordan Peterson video. The correlation between economic inequality and young make violence is apparently one of the strongest in all of sociology, and still applies regardless of the size of the geographical boundary you draw.

Historic studies on altruism often failed to account for all costs or benefits of certain actions. This led to results showing a great deal of altruism that later research overturned when scenarios were better crafted to control costs and benefits. It has been a while since I read the specifics but one example involved sales people who appeared to act altruistic and not take advantage of a seemingly oblivious shopper. Once the study was changed so that the specific sales person who took advantage of the shopper wasn't known to the researchers, only how often it happened, the altruism disappeared. There was a social currency of "appearing to be ethical" that was worth more than taking advantage of the shopper. Once that social currency was removed, the sales people reevaluated which options were most optimal.

This is all to say that any studies on altruism need to be scrutinized to see if some benefit or cost was missed in the experiment design.

That makes perfect rational sense to me. You would expect people who may come to rely on charity or who have relied on it in the past to be more charitable now.

If you're poor because predators (like police, the courts, a vindictive ex, whatever) take whatever wealth you have, then it might also make sense to be extremely benevolent with whatever you have before you get stolen. Then you'll get the social capital and when your neighbor has a good day you'll get some of that too. Almost like a method of decentralized banking.

> Crypto prices are falling and violence around that community goes up

Claims like that need a source to back them up

Not to speak for them, but there are things to cite in the article:

> Prosecutors say the defendant fired a handgun into a Pennsylvania home, and helped to torch another residence in the state with a Molotov Cocktail — all allegedly in service of a beef over stolen cryptocurrency.

> Earlier this month, three men in the United Kingdom were arrested for attempting to assault a local man and steal his virtual currencies.

It's not particularly strong evidence that this violence is caused by a falling value but it's also not entirely unreasonable to be left with that perspective.

Mainly this bit: "Foreshadow’s experience is the latest example of a rapidly escalating cycle of physical violence that is taking hold of criminal SIM-swapping communities online. Earlier this month, KrebsOnSecurity detailed how multiple SIM-swapping Telegram channels are now replete with “violence-as-a-service” offerings, wherein denizens of the underground hire themselves out to perform various forms of physical violence — from slashing tires and throwing a brick through someone’s window, to conducting drive-by shootings, firebombings and home invasions."

Alpha Centauri? I have a faint memory of Nwabudike Morgan saying a line like that in one of the early game "milestone" cutscenes.

-Nwabudike Morgan, diamond tycoon

CEO Nwabudike Morgan, "The Centauri Monopoly"

I've started reading a book about systems theory and and that's what the quote made me think of. One flow is restricted and so another increases. I wish I had read the book a long time ago because I've barely started it and I'm already looking at things in a new way.

What book? Sounds interesting.

Thinking in Systems by Meadows.

The book isn’t terribly long and so far it’s pretty easy to read.

I know it's a game, but this quote is plain old competition for resources viewed with Ferengi lenses. If there's want and scarcity, there will be competition, no matter how fair.

Wow—I didn’t know this stuff was being done. While this has been shouted from rooftops for a while now, BANKS and related are still using SMS to verify things—this is yet another shout as to why SMS should not be used for 2FA.

There's reasons to be optimistic that the solution to preventing this type of attack (which is so troubling precisely because the difficulty of patching it is utterly colossal) might yet be around the corner. Band-aid mitigations, like programmable eSIMs and tethering one's phone to an online identity (as Google Fi does) have existed for a while now, neither of which is an ideal solution. I was surprised recently though by what sounds like credible speculation that Apple's next iPhone release may drop the SIM card slot completely. If true, I'm guessing that could be the Zugzwang that will force mainstream wireless carriers, notoriously allergic to investing in their own infrastructure, to finally make the needed upgrades to achieve a post-SIM card future — much in the same way, I'm hoping, that the elimination of the audio jack forced the adoption of Bluetooth on even the most viscerally reluctant consumer.

https://news.ycombinator.com/item?id=29701887

It's not speculation. The iPhone 14/pro dropped the sim card for models sold in the US.

I think part of the challenge is increasing tech literacy in America. Most of my friends and family have trouble understanding password managers or hardware 2fa.

I think you're overestimating the problem. Here in the UK, banks send out physical 2FA devices (card readers, little calculator style devices, etc) for those who don't want something eg linked a smart phone app. They're easy enough to use for anyone who can use online banking, and those who don't need or want online banking don't need them.

Which banks still send these? Former HSBC USA sent me one before they shut down their consumer products but it was very poorly implemented in their web interface

I think you're overestimating Americans

We got credit cards with chips way after Europe. We don't have anything close to GDPR because enough voters don't understand data privacy (and ofc regulatory capture).

> We got credit cards with chips way after Europe.

That was largely due to POS terminals in gas pumps — we have LOTS of gas pumps and the POS devices in them aren't uniform or inexpensive. When I worked on payment systems the resistance was from the merchants, not the consumers.

Where research (and experience) has shown some degree of consumer dissatisfaction is with entering PINs, which is why chip-and-PIN credit cards aren't commonly seen in the US. Even in countries where it's commonly used, you generally only require the PIN over a merchant-set amount.

Also: sending a check by mail is still a thing.

Or phone numbers should be treated as infrastructure and given legal protections above simply being at the whim of T-Mobile/ATT/Verizon employees.

As a victim of these gangs, I’m sorry but I feel no sympathy. They swapped my sim and called in a SWAT raid on my house while they attempted to take over all my digital accounts. I’m lucky it didn’t end worse for me or my family.

I see a lot of commenters here talking about how they have no sympathy for the kid. I think it's important to remember that it's hard out there these days. A life of crime may not be the only option available, but it becomes more and more appealing as access to education or training gets more difficult to afford, inflation increase outpaces wage increases, workers rights aren't expanded.

Dehumanizing criminals is a very privileged way of approaching the world.

What we have here is a child who was failed by society.

> I think it's important to remember that it's hard out there these days. A life of crime may not be the only option available, but it becomes more and more appealing as access to education or training gets more difficult to afford

No, no. It is a very discriminatory view. Many very rich people are criminals. I'm from a very poor neighborhood, from a third world country. Many of my friends got into crime and died. Many more are hardworking, in my experience it is easier to find a criminal who was born rich than a criminal who was born poor . I don't have much formal education. But using books that was going to waste, I learned programming, etc. And Today it is much easier to learn ANYTHING.

> Dehumanizing criminals is a very privileged way of approaching the world. What we have here is a child who was failed by society.

It's not Dehumanization. Someone works hard, buys something after years of work and gets robbed overnight. When someone defends the criminal in the first place, he is ignoring the guy who suffered without doing absolutely anything to deserve it. It's normal to hate the criminal.

And the poor hate criminals. Defending criminals is a very privileged way of approaching the world.

I am not a favor to kill criminals, etc. But sometimes when you get what you're looking for. And defending very bad behavior is not good for anyone, neither the boy nor society.

Flip that around. In a very real sense the criminal either chose to dehumanize his victims, or ignore the suffering he was causing (arguably worse). "Do unto others as you would have them do unto you".

Also, some people are just shitheads, and I don't think we can say with any degree of certainty where Foreshadow sits.

There's a lot of shitheads out there for sure and when one commits crimes in which there are victims one makes a moral decision to inflict some kind of harm. Even with that, you can never truly know another person and categorizing who committed crime out of necessity and who is morally devoid is near impossible. I think we tend to judge our peers harsher than we judge our corporate overlords.

Imo this type of crime is a symptom of our broken society more than a symptom of a broken person.

Copaganda and western hero-villain stories teach us from a young age that there has to be a bad guy who needs to suffer for their actions.

The net is that a criminal like this is someone who makes a conscious decision that other person's life or property (which is also in most cases life via time spent working) don't matter, the only thing that matters is that they want something, be it money in this case, or sex/power/... in case of violent crime. In this case the only possible excuse is that it's a kid whose brain maybe sorta is not fully formed. On the other hand, while for some crimes you could argue about making bad snap judgments, etc., and for other cases you could argue that your victims are far removed and abstract so you don't grok the above decision as well (shoplifting from a chain store is a good example for both); for something like SIM swapping, with extreme level of planning and foresight, aimed at a specific individual, I personally accord a person continuously making this decision zero moral value.

It's actually easy to tell the monsters apart from the desperate.

Once you can afford to stop causing harm, do you continue doing it?

A person who boldly states their lack of sympathy is acting with a fair degree of certainty in regards to what kind of person they're talking about.

> What we have here is a child who was failed by society.

I really embrace your faith in humanity and trying to understand and explain what might have led to this.

But in the end, he chose organized crime. That's where really terrible stuff happens, you know that, if you choose it.

Yeah there's obvious reasons why organized crime is dangerous, but it's designed to lure people in with quick money/protection/sense of identity and then trap them.

The same goes for any behavior where one knows adverse consequences beforehand. I remember I bummed my first cigarette from a stranger one day when I was stressed out as a teenager. When I got hooked on the addictive properties and irreversibility damaged my lungs should there have been no room for empathy?

I'm not saying choosing to view this kid as a victim solves anything or that people should share my view. I want more voices spreading it so people can see there's another way to see the world.

And fwiw like most people my attitude flips 180 when I'm the victim of a crime. I am after all, only human.

> When I got hooked on the addictive properties and irreversibility damaged my lungs should there have been no room for empathy?

The only person hurt in that scenario was yourself.

I feel bad for the kid, but he's talking to the FBI, so at least he learned his lesson relatively easily (he's still alive).

I agree. People who are born wealthy routinely choose crime, if sometimes for no reason other than adrenaline rush or pure greed.

Judging from the photo, the kid has fetal alcohol syndrome. He likely came into the world with few choices.

You seem to be asserting all this as fact when I think it's mostly conjecture or opinion. I find it far more dehumanizing to think of people just as the product of society.

How many criminals do you know well?

Sure, some criminals are people who make “mistakes”. It was an error in judgement, they feel remorse and won’t do it again.

But many criminals know what they are doing is hurting others, their attitude is “who cares”? It’s a risk they take, if they get caught it’s just “the cost of doing business”. These are people who take your sympathy and use it against you.

Especially, when you do something that hurts people, there are ways to rationalize it. "If I didn't do it, someone else would", "they'll get it back from insurance or something, it won't inconvenience them too much", or just plain trying not to think about them at all.

But none of those options really work for the kind of identity theft where you take up loans in someone else's name, try to extort them with private information etc. The people who do that know perfectly well what kind of Kafkaesque hellhole they're sending their victims into. About the only thing they can do to justify themselves to themselves, is pick a victim they already hate for some reason.

Gangster attacks gangster. Comes with the territory. Maybe he'll be of some benefit in scaring others out of doing such things.

Sometimes I wonder what the world would be like if criminals had access to a court-like dispute resolution system. Obviously the details are too complicated to ever work out, but there would probably a lot less assault and murder.

This is basically the premise of The Godfather.

https://www.youtube.com/watch?v=eZHsmb4ezEk

criminals have a code of behavior, and a hierarchy. if you look at 1% motorcycle clubs they have a code of behavior among each other.

messing with someones deal[competition] is against that code.

there is a murmuring of the commons that roughly equivocates some sort of due process, mostly pronounciations of a persons character, and qualifying an alibi.

when it comes to prison time there is hierarchy, depending on the nature of the crime, and who "co-workers" are, and unfortunately race often figures in it as well.

Just wanted to remind everyone that insisting on using SMS for 2FA and for notifications instead of push notifications is a deliberate inaction on the part of service providers that creates vulnerabilities and whole sprawling crime underworld.

This is the criminal cyberpunk future we've been reading about since the 80s...

The criminal world is dangerous. When large sums of money are involved it becomes even more dangerous.

Seems like a kid who had no idea what he was getting into suddenly found out how dangerous things can become. It's hard to feel bad for the "victim". Not only were they a "plug" for a crime that gains complete control of someone's life, they're also a criminal.

> "No1 cared about that nigga anyway, he snaked targs [targets] and flaunted it everywhere,” Gus said of Foreshadow. “I’ve been fucked over so many times I’ve lost millions. I am just a guy trying to make more money.”

No matter how evil a person is, they always see themselves as the victim. Every person I have ever met sees themselves as a victim. I am pretty sure Hitler saw himself as a victim as well.

Here the kidnapper, thief and potential murderer sees himself as a victim because he couldn't steal as many millions of dollars as he wished he could. I shouldn't be surprised by this behavior, but it still makes you laugh.

Very true, Dale Carnegie makes the exact same point in his book "How to win friends and influence people". Apparently people like Al Capone, "Two Gun" Crowley, and Albert Fall (the guy behind the Teapot Dome oil scandal) felt themselves victims as well, according to his book.

I just had to go through a lot of hoops to switch from a physical sim to a new esim on a new phone. My brother had a sim swap attack occur a couple of weeks ago in an attempt we think to get to the small bit of crypto he had. Apparently a sim swap attack was attempted and thwarted again earlier this year but they did not give me any details to me about the attack.

I'm glad our account has this extra protection on it but I'm still going to be going through and removing SMS 2FA on anything remotely important.

Note that SMS for 2FA is very different to SMS for account recovery. E.g., remove your phone number as a recovery method from Gmail.

Opening a private phone number and email solely for the purpose of banking and identity, would be one solution

trigger warning, there's a very violent photo near the top of the page

It's been removed from the page so here's the link:

https://krebsonsecurity.com/wp-content/uploads/2022/09/fores...

Dude on the right has his finger on the trigger of that polymer80 glock clone, so hopefully it isn't loaded...

I noticed this immediately as well. Hit a bump in the road and they get a nice Pulp Fiction reenactment.

What does this mean “trigger warning?” Seems to have some political backlash but I never understood the original reference.

The term “trigger” in this context was initially used by mental health professionals in the context of setting off post-traumatic stress. I believe this here is an example of this primary (non-problematic) usage. It then got politicized and associated with “snowflakes”, and endlessly mocked and memed. Actually may be that more people know the word now from right-wing trash talk than from mental health concerns.

IC, thank you.

That's strawberry jelly in that photo if I've ever seen it.

I'm with you on that. I did kickboxing and other things for some years, so I've seen some blood from blunt force.

Blood dries quite fast and/or gets absorbed by the fibers of the clothing and will then turn into a darker shade of red.

Blood has a rather low viscosity. If you beat somebody properly up, there will be lots of little splashes of blood, this looks very "drippy", almost like paint that dropped down. If he's bleeding like that from the mouth, he'd most likely have swallowed some blood coughed it up and all over him. The sweatshirt would look very different at least.

If you beat someone up, you'll also have bruises all over his face. Normally you'd see green and blue eyes and bruises on his face, especially his cheeks. Some slightly missed hits always happen, especially when the opponent tries to duck or move away. This looks too "precise" and accurate for some random beat up.

Yeah, dried blood on clothing looks brown... not that I'd know that. I heard from a friend, yeah.

Jam maybe? Looks like seeds in there. If someone got beat up you’d at least expect them to lick their lips instead of drooling it all over the place.

Yeah, it doesn't look like real blood.

As Mike Erhmentraut would say, he's part of the game.

This is a very.. odd question but does anyone know where I can find the video? I'm curious about the details

I believe it's posted in the article's comments, someone posted two Discord CDN links but I haven't personally watched them.

> a lackey for a cybercriminal group that specializes in cryptocurrency thefts was beaten and kidnapped last week by a rival cybercrime gang.

Play that game, and a person is fortunate to survive it.

In other news: Water is wet. Crime groups have rivals. The federal government taxes individuals, corporations, and other governments.

I read the headline and laughed. SIM swappers will get no pity from me. If you play with fire long enough, you'll get burned.

Note the picture in the post is very graphic FYI.

Fucked around and found out.

your encription might use sha256, but is it resilient to a baseball bat?

SHA256 is a hash algorithm, not encryption.

Is this kind of nitpicking really necessary especially when the point GP was making is completely unrelated to the exact nature of the algorithm (it applies to both)?

Well hashing algorithms are resilient against baseball attacks, I am not able to reverse SHA256 even if you beat me to death.

I think it is important distinction for criminals to know, killing someone because one doesn't understand difference between AES256 and SHA256 is bad outcome for everyone involved.

Well, you usually know your password without the need to crack the hash, so...

Yes, otherwise others might learn something that's wrong.

The heart veritably breaks.

This type of result is unavoidable with anonymous cryptocurrency, and it will only get worse if we continue to accept anonymous transfers as a legitimate source of income. The new European MiCA regulation goes a long way into establishing traceability in crypto-transactions, but is still short of what's required.

Essentially, the whole current lot of cryptocurrencies should be detached from financial markets because they operate, by design, like a large money laundry service.

Reply on news.ycombinator.com