MIT students stole $25M in seconds by exploiting ETH blockchain bug, DOJ says | Hacker News Reader

MIT students stole $25M in seconds by exploiting ETH blockchain bug, DOJ says

arstechnica.com

59 pointsem3rgent0rdr26 comments

IMO the title is a bit misleading since the bug was in the mev-boost library which isn't part of the ethereum protocol nor is it needed to validate blocks. As I understand, the "victims" were arbitrage bots that one could argue simply had their risk realized. I wonder if the brothers could have gotten away with it by just paying taxes.

Here is an in-depth post-mortem on the incident: https://collective.flashbots.net/t/post-mortem-april-3rd-202...

Earlier threads about this:

https://news.ycombinator.com/item?id=40369522

https://news.ycombinator.com/item?id=40371371

https://news.ycombinator.com/item?id=40372018

> In particular, the malicious proposer constructed their own block that broke the sandwich bots’ sandwiches up and effectively stole their money.

Deep cognitive disonnance or do these people really think they have enshrined privilege already? Because I don't think they mean to imply that their own sandwhich bots are "effectively stealing" from traders and other bots as part of normal operations...

So they front ran the front runners. Made the front runner buy shitcoins. Crime? Not an ETH bug though.

Misleading headline — are they really MIT "students"? The accused brothers are 24 and 28 years old respectively; the DOJ press release says they "studied" at "one of the most prestigious universities in the world" (the indictment says "in the country"). But that doesn't mean the brothers are currently students at MIT.

Wow, what happened to the "screw the government" position? As soon as there is a problem with "free money", its adepts run to the police for help ))))) It's hilarious, frankly. tbh after ETH modified their "unmutable" blockchain in DAO attack, they are just full of BS "innovators" and "investors".

You're talking about an opinion of a bunch of early hackers as if it was a common world view of everyone in the crypto/blockchain space. It's not (sadly, IMHO). There are many who are exploring merging government regulation and crypto currency.

Not sure what you mean by modifying unmutable blockchain, that never happened. What happened is that people stopped using that blockchain and switched to another one.

They switched to another blockchain… that has the same exact name and is maintained by the same people. So in my opinion, Ethereum broke the “unmutable” promise after the DAO debacle. You could argue that as Ethereum Classic kept the original blockchain, the promise was kept. But even so, it was the spirit of that promise was broken, and ETC is not maintained by Ethereum. I lost trust on Ethereum because of that and never touched it again since 2016.

Yeah, sure, I agree. But the blockchain technology itself is still sound - its about the users who accepted this change and the social capital of the organization that pushed it.

> its about the users who accepted this change and the social capital of the organization that pushed it

In other words, fiat

What would you rather they do? Let themselves be stolen from? Personally hunt down the people that wronged them? That's what happened when certain gangs lost money on crypto. This is a lame "gotcha" whether you like crypto or not.

If we talk about "stealing" - there was a huge effort to make people believe crypto is worth of investing as some "new money super technology that makes everyone rich", right? Were the risks higlighted? Not really. The richest person in the world (E.Musk) shills an inflationary unlimited bitcoin clone as something valuable (DOGECOIN) - this is fraud on a giant scale. I would love to see him calling out the BS in crypto "industry" - he didn't and instead did dogecoin thing. I frankly don't believe he is some kind of tech genius after this. And this is ok, right?

Do simple people know that they put their money into useless "technologies" that are fundamentally fragile and they are at risk of losing everything as soon as there are advances in computing (breaking sha/ecc, doing 51% attack)? They don't. So, that's really stealing, on a grand scale. This 21 million should be an award for the hackers, really. Unless ETH wants to change the "immutable blockchain" once again ))) noone cares these days anyways

Well. I'd say the anti-government¹ type generally has 3 options here:

1. Realize their stance is flawed, change it and go to the police

2. Stick to their stance and not go to the police

3. Ignore the cognitive dissonance and pretend going to the police is coherent with their political ideas. Rationalize about why in this narrow case it would be okay.

Now you can guess which one it will be yourself. As this is purely hypothetical talk about an stereotypical archetype of person, things may differ in the single case.

Personally I think just because you are stupid doesn't mean you forfeit your right to call the police. It just makes you a fucking hypocrite if you aren't consequential enough to adjust your stance to the choices you made (or adjust the choices you make to your stance).

¹: there are many flavours of anti-government, but we are talking about views, if fully realized would leave our victim with no police they could go to. Maybe they could beg in front of a local war lord?

If I lived in a town run by the mafia and had a problem I'd probably go talk to the local Godfather and ask for his help. I'd do this despite not being in favour of organised crime in principle. I'm not sure this is hypocrisy, just recognising the local reality.

Your scenario leaves out the fact that before this went down, you loudly announced to all and sundry that you don't need the Godfather or his fuckin' rules, so you were gonna start your own town with blackjack and hookers. Then you went back to him asking for help once you got ripped off exactly like how everyone said you would.

If you don't acknowledge the flaws in your ideas, that's not really hypocrisy, but it is very dishonest.

Could you point to where Flashbots representatives said similar things in the past?

You are aware of what a "hypothetical" is?

I can spell it out more abstractly:

1. Crypto bros are known for their "crypto is great because we can get rid of the role of the state within currency"-stance

2. Something bad happens to their crypto

3. They run to the authority of the state to resolve the issue

I don't see anybody who got stolen from here. I see idiots who wilfully opted out of the benefits of the blockchain and then hoisted themselves on their own petard in a bad trade. I see the government as essentially trying to legally enshrine the idea that the public should bankroll the protection of people who neglect the security features provided by the blockchain with public funds.

Adepts? That is genuinely hilarious.

> Wow, what happened to the "screw the government" position?

It was always just a meme.

John Perry Barlow was deeply, deeply, wrong.

It's your type of black/white thinking, and making the association that everyone in support of a specific idea shares an identical set of ALL values with everyone else interested in that idea, that enables fascism to rise to power.

Someone is interested in privacy? They must be a criminal, better watch closely and prosecute on whatever we can before they get too dangerous.

Someone is interested in crypto? They must be fully anarchist. Better lump them in with the anti-government crowd and make sure they are denied police protection.

These were multimillion dollar trades being done by white collar investors with the trading bots, I don't think they mind the police help one bit, and I think you'd be hard-pressed to find anti-state messages from any of them. They are just rich people taking advantage of a system to get richer. Nothing more nothing less. It is not possible to extrapolate political views based solely on participation in part of a capitalistic system.

So nothing of value was actually stolen.

[dupe]

Some more on official Justice post:

https://news.ycombinator.com/item?id=40371371

https://news.ycombinator.com/item?id=40369522

Another reminder that crypto is simply an ever growing bug bounty.

Pretty careless almost idiotic to just search with history and sync? about the crimes you are going to commit.

It shows that those guys aren’t really technical, exploiting a blockchain bug sounds like they hacked the system but instead they misused a feature.

They haven’t been even smart enough to understand that the blockchain is for tracing.

> sounds like they hacked the system but instead they misused a feature.

Isn't that quite often the definition of hacking though ?

If they were based on a different country they would've never been caught. And they do seem pretty technical to me, just not entirely thoughtful.

This was a pretty sophisticated attack and deeply technical execution.

Reply on news.ycombinator.com