$477M FTX ‘hack’ was a Bahamian government asset seizure
marketwatch.com
marketwatch.com
The other address that recieved substantial funds is a contract based multisig wallet, and it recieved everything that is truely a shitcoin. And that wallet hasn't sold or moved anything beyond the initial movement. On the night of the hack there was speculation that this was a whitehat rescue of the remaining tokens.
To me this sounds more like there was both a hack, and a seizure to preserve what was left.
> the U.S.-based bankruptcy administrators […] had “credible evidence” that officials in the Bahamas had directed FTX founder Sam Bankman-Fried to access FTX’s systems after the Chapter 11 filing, “for the purpose of obtaining digital assets of the debtors.”
Insiders can be press ganged with threats of violence, which the state has a monopoly on.
"Mr Zhong pleaded guilty on 4 November to hacking the website and has forfeited his Bitcoin and assets to police as he awaits sentencing." https://news.yahoo.com/stolen-3bn-bitcoin-mystery-ends-17073...
if such an event happens in a more or less civilized country, you might eventually get some third party to confirm that you're unable to disclose the key
If he's in a different jurisdiction, they get the other country to cooperate and share the seized funds.
Yeah.
Like they refused to show up for a man stalking his ex and trying to break in, during daylight and in full view of everyone in the complex, and they continued to not show until after he murdered her.
There is no crypto scheme, no algorithm, no possible arrangement of private keys and Merkle trees that can escape the reality of men with guns.
It's a solved problem, and has been since the first bitcoin paper. That no one read that and just heard "magic internet gold I can get rich from" is their problem and not mine.
You don't get rich quick off the bitcoin protocol however so we have people run places like FTX: centralize and get the big bucks because they provide convenience. Then act surprised when it goes tits up like every other centralized system.
Same thing with people not encrypting their emails or not using tor as a bridge to the internet. In short: if you're the type of person who doesn't have their own key, yeah, prepare to get wrenched. The rest of us can manage our exposure quite easily.
I never said that, all I said was that this is not the BGP problem, it's the $5 wrench problem.
And it's not a solved problem, governments seize crypto all the time and people get tortured for their keys regularly. Just a few days ago the US picked up 50,000BTC.
All of crypto is a get rich quick scheme, but people want their winnings denominated in fiat which is why exchanges exist. It's hard to reconcile "best performing asset in history!!" with "you can't get rich off bitcoin."
> In short: if you're the type of person who doesn't have their own key, yeah, prepare to get wrenched. The rest of us can manage our exposure quite easily.
You have this completely reversed. If you're the type of person who does have their own keys prepare to get wrenched.
Sure thing bud.
OP is likely the same kind of person who calls taxes "theft" for rhetorical purposes.
You mean violence. Physical force. In that context, the means is irrelevant and pedantic.
Especially when they're so rarely used in situations like this.
Or are you saying cops don’t have real pistols in their holsters, and agents just pretend to be armed on those raids?
Of course, violence isn't the only sort of coercion... but it's part of it.
I mean: unless the attacker knows exactly how much coins you have, he has zero way to way if you're unlocking a decoy wallet or the real one.
That sounds so complicated, that even someone with a physics degree from MIT will not be able to make it work.
Say you give the attacker all of your bitcoins/data, they're now incentivized to continue punishing you in perpetuity regardless, since you could have provided a decoy.
They don't need to know the exact number. They need to have a rough idea of the number. In the most likely scenario, where a state wants access, they tend to have a pretty good idea, because they get that information from investors, state agencies, banks and seized records.
On the contrary. It's the only case where maths can defend vs men with guns.
Multi sig schemes spread over different people over several continents make the "men with guns" thing very difficult. Or multisig but m-out-of-n, with a dead beat: if after x weeks you don't hear of person A, person B and C move the coins to a new sig where person A isn't involved anymore.
There are also a shitloads of things you can do with smart contracts. For example you can have a smart contract where if person A's private key doesn't sign anything for more than x weeks ("blocks"), the funds are destroyed.
There also the whole plausible deniability thing: where it's impossible to know where a hardware unlocked with a hardware wallet is the real thing or not.
$5 wrench attack, here's my real password: take the 50 millions. Oops. Decoy. On the other password there's $2bn.
Didn't work in this case.
Ten years ago when my crypto was worth barely anything I had an airgapped, full disk encrypted, RasPi which required a Shamir's Secret Sharing key arrangement to unlock as my cold storage... just because it was something fun to setup.
Here a multi-billion dollar enterprise has less sophisticated OpSec. Just... wow.
A dude who plays LoL badly. Embarrassingly badly for his number of games.
But in GPs defense, I don’t believe these were multisig wallets with geographically distributed individuals in control. It was 1/1.
Nonetheless, a metal pipe is a good counter to crypto.
I may have to file this one under, "everyone wants to be a gangster until it's time to do gangster things"
No relation to crypto or even who you are anymore.
>No relation to crypto or even who you are anymore.
The relation with crypto is that crypto doesn't solve this problem either.
Nothing can solve the problem of protecting you from "bad men" who want to hurt you and don’t care about anything else.
"Ho ho! Good luck, gentlemen! For, you see, I've implemented a multi-signature scheme spread over different people across several continents which requires-"
"Understood. Off to jail with you, then."
I don't understand how this defeats the wrench attack.
Presumably you aren't released until the actual tokens are in hand, so decoys just make the attacker angrier.
Someone might be quite happy to engage squads in lots of countries to kidnap and beat everyone if the payout is billions of dollars, but it's a very different problem and e.g. the Bahamas government or some local thug won't be able to do it. I have no idea how large a cartel would need to be to have reliable operatives on the ground in lots of countries, and I'd assume if you're part of a group holding the keys to those amounts of cash, you're going into lockdown when two of your associates suddenly vanish.
Perhaps one or two if the multisig holders are already on board and will "reassure" the others that everything is fine.
Or one government (like the US) coordinates with others to get it done.
For criminals, it'll also be a huge operation, and it'll come with insane publicity which criminals typically don't like. Who's powerful enough and willing to potentially burn their existence in entire countries for such a payout, when they make billions a year?
Unless there are street fights, people will not care that much.
Or perhaps political opponents in unstable countries.
On the government side the USs reach is far and criminals are not always willing (or able) to go beyond it. Maybe coordinating with China won't happen, but let's say Japan, mexico and 2 EU countries is not out of the ordinary.
There are busts happening almost every year on that scale
Somehow I don't see state actors falling for that, especially when they have a rough idea of the actual numbers involved, based on the shitton of angry people, some of which are very rich and very well connected, clamouring about it.
If you’re part of a multi signature scheme and you’re hiding from US authorities in, I dunno, China or Russia or Pakistan or Afghanistan or Iran, there’s (a) not much stopping Uncle Sam’s boys from sneaking up on you anyway if they’re sufficiently motivated and (b) some local men with guns whom you might need to deal with as well.
In reality it’s probably not worth it for the US to track you down to the ends of the earth and/or get the CIA involved if you’re just trying to sneak some ill-gotten money out of the country, and it’s a lot easier for one of your multi-signature holders not to get caught than for the authorities to simultaneously catch up with a quorum. And maybe your group includes some people who really don’t mind living the rest of their lives in these types of places.
But for those of you who live within the greater American empire, the price you pay for keeping that money out of Uncle Sam’s hands is going to include keeping it out of your hands and also you go to prison if you ever get caught. Which is probably a bad deal unless you’re a drug cartel or some other group that’s already sort of priced in that outcome.
Side note: its interesting how "men" has gone from sometimes being gender neutral to being almost exclusively male and how "man" has gone most of the way down the same path.
In the Vox interview he says he’s trying to win a jurisdictional battle with Delaware, this just part of that fight.
He had an "out" which was the companies business model was to purchase regulations from politicians intended to put all his competitors out of business, that process seemed to be going VERY well, and if he could have held out another half year, maybe two years... he likely would have been very successful. So he is legally obligated as an officer of his company to lie on twitter to keep the charade running long enough to pay off for the investors.
Certainly his investors would have made more money if he hadn't gotten caught than how it turned out, and being a criminal organization he can't be honest about that on Twitter.
Please point me to this law.
[1] second paragraph here: https://www.wired.com/story/ftx-hack-theft-crypto-tracing/
https://www.vox.com/future-perfect/23462333/sam-bankman-frie...
I have to say I find the idea of a "Bahamian regulator" amusing, or at least ironic. People don't put their wealth and companies in the Bahamas because of their reputation for excellent regulation.
Ultimately, if you foul things up enough in whatever jurisdiction you happen to be physically located in, men with guns will come to compell you to do something.
We often ignore the physical realities when thinking through security scenarios
I've lost count how many times I've seen self-professed crypto fundamentalists say they'd never, ever give out their keys during duress - that they'd rather die than hand over anything. (Usually in the context of some person getting kidnapped and giving their keys to their captors, has happened quite a few times around the world)
Not your keys, not your crypto.
how quickly should the bahamas have announced about the asset seizure? is it common in other countries to not comment about (seizures in) ongoing investigations?
The government has the right to do this because FTX agreed to this.
Certainly, I would feel more confident getting my money back from a reasonable government than SBF.
SBF chose to operate out of the Bahamas because of their lax legal structure. The fact that he claimed for days this was a hack makes this look like a failed attempt at buying his freedom. I have much more faith in the integrity of the US bankruptcy process than whatever nonsense is going to happen in the Bahamas...
In an ideal world, an IOU from FTX for the amount of 100 ETH would be worth 100 ETH. Unfortunately, FTX is insolvent and bankrupt. The only thing the bankruptcy court can do is divide up FTX’s assets and distribute whatever FTX does have to their creditors. That is naturally going to entail taking possession of those assets.
This used to be a risk even with banks, and a lot of people during the Great Depression lost the money they had in the bank due to bank insolvency. The solution to this problem was the FDIC. If you have an American bank account, not only do you have an IOU from the bank for the number of dollars you have in that account, you also have an insurance policy from the FDIC that will pay you the value of the account (up to a specific limit) if the bank is unable to do so. And if the FDIC isn’t good for the money, that would mean the US government has defaulted on their debt, which probably means it’s the end of days, your dollars would have been worthless anyway, and you’re just going to have to get by on whatever canned food, water purification tablets, and ammunition you’ve managed to stockpile in your house until the world re-stabilizes into whatever cyberpunk dystopia comes after the collapse of the United States.
Historically that limit has always been waived during bank collapses, although my inability to remember a specific historical counterexample does not disprove its existence.
edited to add the limit still exists on the books for marketing purposes, in a weird turn of events unregulated non-banks liked to market that they're "as trustworthy as a bank" because they bought a bond policy for the FDIC limit so feel free to write them a check for less than the FDIC limit because they're bonded. The unregulated industries would get REALLY mad if the FDIC limit were doubled legally because then they'd have to pay about twice as much to get their bond. Then the FTC got real mad and I don't recall the outcome of that story although I don't see many references to the FDIC anymore in marketing material from unregulated companies, so that must not have gone well. This all went down in, like, the 80s not like last week or whatever.
Who would you rather have keeping your money? SBF with a warrant on his head and cash to disappear forever, or a national govermebt you can eventually sue if needed?
Who is "they":
Under Part V Section 41. Co-operative Power paragraph 2, as what boils down to "the SEC for the Bahamas" they will cooperate with other nations equivalent of the SEC "other domestic regulatory authority". So if the US SEC or US bankruptcy court asked them nicely, they can at their discretion (see paragraph 4) cooperate. My point above is the "they" deciding to do this is kind of unclear. Certainly gaining control of assets would kind of be the job of the bankruptcy court so if they asked the Bahamas Commission to help out, could, and in my opinion, probably did.
Based on my opinion of what I've read about what happened, SBF violated the entirety, not just one or two paragraphs, but the entire section, of Part III section 17 "Adequate systems and controls for digital token exchanges", subs a thru e inclusive, so they could be operating entirely on their own.
They could be doing all of this on their own or as a favor to the USA SEC, I donno. But no one seems to have considered Sec 41 in their rush to decide to "they" are whom are deciding things.
Anyway, regardless who decided to act:
Under Part II Section 5 paragraph 2 sub h, "do all things, and take all action, which may be necessary or expedient or are incidental to the discharge of any function or power given to the Commission".
The power they're probably invoking is Part II Section 4 paragraph 2 sub b, for the purposes of ensuring the "... development and maintenance of investor protection standards with respect to digital asset business..." So their legal purpose is to stop crooks from embezzling investors money. Combined with the paragraph above they likely think the leaving the investor assets in the control of SBF would be a little unwise as everyone seems to think he's already stolen billions of dollars worth of them, so what little is left should be preserved or at least removed from his opportunity to continue to pilfer.
Under Part III section 19 para 1 sub e, when they declared bankruptcy the registration to operate is auto-revoked and then para 4 hits "Where the Commission has suspended the registration of a digital asset business, the Commission may impose such conditions upon or give such directions to the registrant, including timeline for compliance, with which conditions or directions the registrant must comply."
So I have not seen the paperwork served on SBF in a leak or whatever, but it probably resembles the above.
That makes no sense. They are incorporated under Bahamianan law, so that law takes precedence over any contractual agreement. I.e., FTX cannot enter into a contract that declares implicitly or explicitly that they won't follow said law.
Maybe it's better that these assets are in the hands of Bahamian authorities, but it is highly questionable that the transfer happened after the Delaware filing, and that it was made in such a sloppy way that destroyed so much value.
My albeit very basic understanding is that once the bankruptcy filing was made in Delaware, the Bahamas had some obligation to defer to the Delaware courts. It makes one wonder if this was actually an official action to begin with, and was not instead given a post hoc imprimatur only when it became obvious that the transfers could not be hidden.
Apparently, there is a court hearing scheduled for monday about that motion. I imagine the status of the seized funds will be one of the main topics of that hearing.
That's not all: They also seized the funds with SBF's help after FTX had declared bankruptcy and SBF had stepped down as CEO. General counsel for FTX at the time indicated they were surprised by the fund movement and unaware of what was going on[1]. Shouldn't the Bahamas have been communicating with the people actually in charge of FTX at the time? Aren't those the people who would legally be in control of the funds?
[1] https://twitter.com/_Ryne_Miller/status/1591281729125613570
/tinfoil
All in all, nothing to see here. And in case the confiscated assets cannot be confiscated by the Bahamas a court will ultimately return them.
Can somebody please explain that second one? Because this makes no sense at all.
> The “dilutive ‘minting’ of approximately $300m in FTT tokens by an unauthorised source” after FTX filed for bankruptcy. That’s along with the $372m hack.
Guessing: post ftx collapse someone minted new ftt tokens. Which should be strange because only FTX should have been able to do so.
In any case there was no buyer in size, so if they had dumped all they could the meagre proceeds would have probably been enough for like an extra half hour worth of withdrawals.
Finally, new-FTX did not say they were "hacked", only that the transfers were not authorized by them.
I'm pretty sure when you give an on the record interview, and that gets published, it's not a "leak".
There's also no reason to believe articles written about SBF aren't politically motivated anymore.
In my view FTX chose to incorporate in the Bahama's for a reason, and that reason wasn't the transparency and integrity of the Bahamian legal system.
They incorporated in "Antigua and Barbuda", which is a very seperate country. The only relationship FTX has with Bahamas, is the location of their headcounters, and a single wholly-owned subsidiary that probably didn't hold much in the way of funds.
The Bahamas has the only relationship that actually mattered: apparently SBF was physically in their custody.
This is the entity (alongside the physical presence of SBF) by which the Bahamas are arguing they have jurisdiction over the FTX bankruptcy proceedings.
Why is Antigua and Barbuda in quotes here?
https://www.vox.com/future-perfect/23462333/sam-bankman-frie...
Maybe he just didn't want to have to explain some breaking news to her.
if that is true they might have very well had reason to lie until the bankruptcy proceedings in the Bahamas have started successfully/maybe some under the table agreements where completed.
I wouldn't be surprised if they have some deal with the Bahamian government giving them some benefit for allowing the government to size millions of crypto assets.
But there might very well have other reasons. Like them not knowing that the transaction was a asset seizure in context of the bankruptcy proceeding is a possibility as crazy as it might sound.
This would _also_ imply that whoever internal to FTX that authorized the asset transfer for siezure didn't tell anyone and covered their tracks well enough that SBF didn't know about it.
I mean, it's possible? But seems more straightforward that SBF was simply lying in the vox interview, he still seemed deluded enough to think he could fundraise his way out of the abyss, and this lie was part of his attempt to raise funds.
an internal person doing a bad transaction and then bring unreachable counts as being hacked
etc.
and this didn't even account for absurd degrees of internal miscommunication and misunderstand I have seen in some companies
so it doesn't imply what you are saying
and like I said likely he lied, but something being likely doesn't mean there aren't other options
Maybe the seizure didn’t happen until after the hack?
I find some of the takes on this sub really amazing. The real question you should ask yourself is why did Vox never disclose in previous hype pieces they did on this person that they received a grant from his "philanthropic" 'Building a Stronger Future' foundation. Only after the implosion of FTX and Alameda have they added a disclaimer to relevant articles.
How naive is HN?
SBF hands over the keys to the Bahamas govt. and tries to publicly claim it as a hack, and then the Bahamas government decides to become one of the largest holders in the world of Ethereum.
There are still a lot of questions to this story that will be interesting to see filled in.
[I'm uncomfortable referring to cryptographic tokens as "assets". I think of an asset as something with an intrinsic value, albeit floating. Cryptographic tokens have a price, but no value.]
>The Crown and the Police Force https://en.wikipedia.org/wiki/Monarchy_of_the_Bahamas#The_Cr...
The national police force of the Bahamas is known as "The Royal Bahamas Police Force".
>The St. Edward's Crown appears on the Bahamian Police's badges and rank insignia, which illustrates the monarchy as the locus of authority.
>Every member of the Royal Bahamas Police Force has to swear allegiance to the monarch of the Bahamas, on taking office.
("Monarch of the Bahamas" aka King Charles III of Great Britain.)
I can imagine many levels of royal induced pressure being applied here.
The royals give zero fucks about SBF and crypto.
From what I got, crypto exchanges spend a lot of effort to not be banks in a legal sense, so the special protections for customer deposits with traditional banking don't apply - the deposits are technically owned by FTX, not the customers.
On the other hand, customers do appear to have some claims in the bankruptcy proceedings, enough that the SEC seized the funds. So it's not just "you pay me, I make number go up" either.
Were the deposits just treated like loans to FTX?
When there's blood in those waters it's a lot more likely there's going to be a feeding frenzy.