Bitcoin phishing attempt | Hacker News Reader

Bitcoin phishing attempt

pastebin.com

44 pointsaaronpk40 comments

I'm invincible to these schemes, I play Eve Online. Go into a random trade hub and you get people shouting SEND ME E-MONEY AND I'LL DOUBLE IT!

They link to a 'public' API showing that player's financial transactions over time, giving 'proof' that what he claims is legit. And for low quantities, it works too - to build trust, of course. But when the scammed sends over a large quantity of money, the scammer will add that to the 'API page' and claim the user's trying to scam him or there's supposedly a technical problem, or something.

In this case, the scammer could improve by linking to a 'transaction log' online, and by offering to double someone's small amounts of bitcoin. With the current rates, that'd have to be like 0.01 BTC ($7). Those would be used to lure people in, going OMG IT WORKS, until they transfer, say, 10 BTC, after which the scammer simply doesn't return the money.

Can someone elaborate on how this could even work? If someone asked me to give them a dollar and I'd get 3 dollars back in one hour, I'd want to know what they are doing with my dollar. I assume the subtext is "we have some guaranteed way to arbitrage bit coins at a 300% return - send us your money and we'll give you at least that much back". I realize it's a scam. I just don't understand how the scam could work.

It could very well be money laundering.

Send a legit bitcoin and they send you back 3 stolen bitcoins from one of the mt.gox hacks.

At the current exchange rate, they would be losing ~$1400 USD to 'clean' $700. Nobody launders money at such a drastic loss.

Given that they say their minimum 'deposit' is 1 BTC, even finding a handful of extremely gullible marks will be quite lucrative for them. That's all the motive necessary. It goes without saying that no one who sends BTC to this address is going to see anything back.

>At the current exchange rate, they would be losing ~$1400 USD to 'clean' $700.

This is valid at any exchange rate, not just the current one.

BTW, does it mean that bitcoin users should verify every bitcoin they receive to make sure it hasn't been stolen?

> I just don't understand how the scam could work.

You send the money, the scammer pockets and laughs

Yes, but how does anyone with the ability to navigate the fairly pain-in-the-ass process of getting Bitcoins fall for something so transparently stupid?

How does anyone with the ability to navigate the fairly pain-in-the-ass process of getting [any large amount of any currency] fall for something so transparently stupid?

And yet they do, all the time.

I'd say it's just as transparently stupid to give your Bitcoins to someone else. And yet tons of people use web wallets, which are often hacked (or "hacked").

Dealing with the pain of getting bitcoins doesn't make you smart, and it certainly doesn't make you invulnerable to greed.

I think you don't need to be a rocket scientist to use coinbase.com, for example.

Greed.

Why do people send their banking credentials to some random guy in Nigeria?

Same reason.

The folks sending banking credentials to Nigeria tend to not be computer savvy. The same is not true for Bitcoin.

> I just don't understand how the scam could work

Because greed.

I think someone mentioned here that they would actually send you 3 BTC if you transferred in one, to lure you in. Then when you send more, they make off with it.

(This was probably at a time where 1 BTC wasn't worth all that much, and gullible people might have thought "it could just work")

Ponzi schemes sometimes work by giving early/influential customers the advertised returns as taken from the newer customers' subscriptions. This creates a viral effect, but the customers suckered in by the viral effect will get nothing.

Based on the offered rate, I suspect this scheme doesn't plan to be that sophisticated.

If the advertised rate is high but not extraordinary, customers don't typically care exactly what is happening to their money (for example: what is your bank doing with your money right now?).

I think the only way it might have a chance of working is the fact that the (well-known, "legit", and large) gambling site SatoshiDice works almost the same way - you send it bitcoin and it sends you back either your winnings or an extremely small amount if you lose. This is a similar concept, just with bad grammar and for the 0.1% completely gullible idiots.

I'd say 50% greed, 50% stupidity.

Congrats, you are not in the target group..

Technically, there are black markets with high margins like that. But even in that case, why would they want to give these margins away to somebody else instead of giving a dollar to themselves.

Because they need capital to invest in the first place?

My bet is that it is some kind of viral Ponzi scheme where some early adopters (or very gullible but lucky people) get a good return and talk about it until it reaches some target, then the guy running it shuts down.

I'm pretty sure I saw a few of these running over on SilkRoad about a year ago - you sent the seller some coin and got it back + 25%, 50% etc the next week. Lots of good reviews, very likely some people made quite a bit of money when SR was shut down by the feds.

How can any bitcoin miner be that naive?

As you can see for now none fell for that (assuming they have one address for all "investments"): https://blockchain.info/address/18PyfH1AqV2DbEweh6USf1HYg7D9...

Yes, the intersection of the 'able to send bitcoin somewhere' and 'dumb enough to fall for this' populations is probably zero.

"Someone reminded me I once said «Greed is good». Now it seems it's legal. Because everyone is drinking the same Kool Aid."

The people involved with bitcoin are (mostly) tech-savvy, I don't think they are going to have much success.

Excuse me for being pedantic but how is this a "phishing" attempt?

I thought phishing meant fishing for usernames and passwords. This just seems like a run of the mill stupid scam attempt that happens to say Bitcoin instead of dollars.

This happens all the time, it's nothing special. Normally targeting known btc users, using emails from leaked DBs (eg. gox)

Bitcoin needs to make it much further into the non-techie markets before this yields enough to make it worthwhile. Of course if this con is run by a pro, they'll actually profile each mark and return the amount promised during the first round, hoping for a much bigger score on the second round.

Heh: https://blockchain.info/address/18PyfH1AqV2DbEweh6USf1HYg7D9...

No transactions found for this address, it has probably not been used on the network yet.

I also got this email and noticed it's from a bogus mail server:

Received-SPF: softfail (google.com: domain of transitioning noreply@bitcoin.org does not designate 62.149.157.234 as permitted sender)

Wonder why Google's spam filtering didn't catch it...

Because bitcoin.org's SPF record's failure mode is set to "softfail" rather than "fail" [1]. According to Wikipedia, "Typically, messages that return a SOFTFAIL are accepted but tagged".

[1] http://mxtoolbox.com/SuperTool.aspx?action=mx%3abitcoin.org&...

Did the email you got contain the same "investment address"?

Yes

1 BTC is a really high minimum investment. Maybe they'd have a better chance of scamming people if they started a bit lower.

They might be A/B testing it.

I'm curious if the emails other people got have the same bitcoin address or if they used unique addresses per email.

Judging by the blockchain info [0] they are either using unique addresses or the scam isn't very successful.

[0] https://blockchain.info/address/18PyfH1AqV2DbEweh6USf1HYg7D9...

I got it as well, I wonder how they chose their targets?

Did they use the same Bitcoin address as in the pastebin?

It seems like no one paid them anything yet [1], but they might be using a unique address per email.

[1] http://blockchain.info/address/18PyfH1AqV2DbEweh6USf1HYg7D9H...

Reply on news.ycombinator.com