All: I know it's a bit hard but if you're going to comment on this, please review your comment to make sure it isn't shallow, lurid, or gloating. Most posts so far in this thread have been below that line. On HN we want thoughtful, substantive, and above all curious comments—where by curious is meant intellectually curious, not gawking.
The hacker has spent the last 11 hours slowky and incrementally converting all the various tokens they got to ETH. They've been using a variety of different defi exchange and have eaten large slippage fees, at least once over 5M lost in slippage.
We're not seeing any else, e.g. laundering through another exchange, splitting into different accounts, automating the liquidation of tokens to ETH, off loading ETH into a cold wallet etc.
The on chain activity makes this look like an individual who did not prepare extensively before doing this or doesn't have the skills to use automation/operational best practices
EDIT: first outflows from 0x59abf3837fa962d6853b4cc0a19513aa031fd32b have started, they still haven't liquidated all their PAXG, a stable coin pegged to gold, unclear if it's freezable.
They were able to liquidate all of their USDT except 4M on avalanche, and all of their usdc both of which can be frozen. Dai is a usd pegged stable coin that can't be frozen, they have nearly 1% of it. Note that Dai is heavily exposed to USDC so authorities could pressure USDC to destroy Dai
> The on chain activity makes this look like an individual who did not prepare extensively before doing this or doesn't have the skills to use automation/operational best practices
This may be an understatement of their skill level. It seems the individual(s) also used a Kraken account to transfer funds and have been identified per their CSO.
> The on chain activity makes this look like an individual who did not prepare extensively before doing this or doesn't have the skills to use automation/operational best practices
How common is the knowledge of these best practices?
> Investigating abnormalities with wallet movements related to consolidation of ftx balances across exchanges - unclear facts as other movements not clear. Will share more info as soon as we have it.
From FTX's general counsel[1], retweeted by FTX_Official. So that indicates it's not being sold off legitimately under some sort of liquidation proceedings. It could be insiders or it could be hackers.
Rumors on Twitter[2] are there was also an update just pushed to the FTX app. Concerns are the update may contain malware. It makes sense to uninstall the FTX app if you have it.
It’s unfortunate that what started out with altruistic motives, a method for decentralized anonymous asset exchange, is being derailed by opportunists. There was a time where a 51% attack was the biggest concern.
All that said, I’m not surprised at where we are today.
> Reports on crypto Twitter are that this is a hack
It's really unfortunate to get "hacked" with such bad timing. You steal customer money and file for bankruptcy but now the bad hackers, probably from the Bahamas as well, take whatever is left and cash out. Oh no! /s
Yeah and I’m sure the Apple App Store review process won’t catch the steal_private_keys_and_upload_to_china() method they inserted. Not that iPhone apps can’t do this in the first place. A lot of FUD right now to create even more chaos.
Patrick Boyle breaks down the situation with his usual eloquence and dry humor. Video is worth watching just for the chart of the corporate structure.
https://youtu.be/zTFhnpf-IE0
It gets worse: somebody has pushed what appears to be a malicious update to the FTX app, and the official FTX telegram channel is warning people not to even browse to the website!
This last week has been a rollercoaster. I've been in crypto since a long time ago and have seen quite a bit, but this FTX implosion takes the crown. And to be honest, I don't think its over.
It's been stated that FTX can access the wallets of their customers [1], I wonder if employees or other bad actors knowing the ship is sinking have decided to - forgive me for the quip - plunder any remaining assets.
A cousin of mine, just a week ago proudly showed me his balance on FTX. He had earned close to 1 BTC through the various crypto consulting jobs he’d done this month. This was a huge deal for him as he’d been unemployed/underemployed for many years. And now this crap takes place. I’ve been unable to reach him since leading me to suspect that he has probably lost his money. I sincerely hope that is not the case but this entire fiasco breaks my heart. I hope SBF and his accomplices suffer and rot.
Regardless of whether you are pro- or anti- crypto, the collapse of FTX, SBF's bubble bursting in a rather extreme fashion, and now this hack are more nails in the coffin for mainstream support.
I am no fan of crypto myself, but it's interesting to think what would have to happen for crypto to burnish its image.
Would key people have to voluntarily form some sort of coordinating council and self-regulate? Would they have to invite governments to regulate them better? Whatever the solution is, I'd be highly surprised if it could be done algorithmically and reassure anyone.
This is additionally a reminder that crypto currently holds a fairly irreconcilable catch-22.
"Freezeable" tokens completely defeat the purpose of a decentralized currency. Why create nodes/verifiers etc if a wallet can be unilaterally frozen, either under pressure from gov't, community, or another entity.
However NOT allowing freezeability allows for massive hacks, either by insiders, poor security, or sloppiness.
Seems the solve is somewhere in the middle, a pool of trusted intermediaries.
Surely it's not a coincidence that on the day FTX announces bankruptcy, this gigantic hack occurs?
Some folks in this thread are speculating this might've been an inside job.
I suspect, it's likelier that hackers had been aware of a vulnerability for some time, had a plan to drain these funds, but decided to hasten the timeline on the basis of the news FTX was going under.
So, let’s assume that this hack is not meant to preserve money, but to destroy evidence. If you spread a lot of s** around and overwrite all this stuff with malware, does it create plausible deniability?
"I was initially a crypto skeptic, but after studying some of the more interesting crypto projects, I have come to believe that crypto can enable the formation of useful businesses and technologies that heretofore could not be created."
The telephone, the internet, and crypto share one thing in common. Each technology improves on the next in terms of its ability to facilitate fraud.
As such, I was initially a crypto skeptic, but after studying some of the more interesting crypto projects, I have come to
- Bill Ackman (@BillAckman) November 20,
This is absolutely wild and unprecedented. Imagine being a victim of Madoff's ponzi and - after already being traumatized by the unveiling of the fraud - discovering that the rest of the money had been stolen.
Madoff's ponzi was larger, but the recovery rate was 88%. It looks like customers who didn't withdraw in time will end up with 0%.
Can confirm. Lost 100% of my mtgox holdings in 2013. Theoretically my account balance is 7.73 BTC. I can still log in and see it. Maybe by the time I retire I’ll have recovered like 0.7 BTC. Which amusingly would be the sum of my original $11k investment.
A lot of this is just gambling. People need to go into it with the mindset that the money will be gone tomorrow, and then be pleasantly surprised if it doesn’t.
There's no way this is a coincidence. This is undoubtedly people who work(ed) at the company and were trusted with private keys trying to get away with some money while they can.
What I don't get (well I do, lobbying and inside deals), is why these guys have run so long (especially Tether). Just because crypto is a 'decentralised' wild west opposed to government shouldn't mean they sit outside of the laws around fraud, laundering and deception, especially if they're registered companies.
The lack of legal focus, given the obvious illegitimacy of it all is disgraceful and I can't even imagine the size of the wealth transfer happening through all this.
FTX was able to fleece Wall Street investors specifically because of their deep Wall Street connections. This is a corrupt Wall Street story. The only reason they were exposed is because they left evidence on-chain, and people started asking questions. There are very few people who have been in the cryptocurrency space for more than 5 years that had any sort of trust in FTX.
> Just because crypto is a 'decentralised' wild west opposed to government shouldn't mean they sit outside of the laws around fraud, laundering and deception, especially if they're registered companies.
Entirely speculation, but something fun I've heard repeated occasionally:
If this was "just tech", it could find itself regulated easily. (Though this isn't necessarily the case.)
If it's a geopolitical weapon or spy tool of any consequence, then there may be other stakeholders pushing back against weakening it.
Plausible, borderline conspiratorial, but fun to think about.
Scientology, herbalife, and other obvious scams have persisted. I think crypto people love getting defrauded, and as long as they enjoy it there won't be much pressure to prosecute.
[+] [-] dang|3 years ago|reply
https://news.ycombinator.com/newsguidelines.html
[+] [-] X6S1x6Okd1st|3 years ago|reply
We're not seeing any else, e.g. laundering through another exchange, splitting into different accounts, automating the liquidation of tokens to ETH, off loading ETH into a cold wallet etc.
The on chain activity makes this look like an individual who did not prepare extensively before doing this or doesn't have the skills to use automation/operational best practices
EDIT: first outflows from 0x59abf3837fa962d6853b4cc0a19513aa031fd32b have started, they still haven't liquidated all their PAXG, a stable coin pegged to gold, unclear if it's freezable.
They were able to liquidate all of their USDT except 4M on avalanche, and all of their usdc both of which can be frozen. Dai is a usd pegged stable coin that can't be frozen, they have nearly 1% of it. Note that Dai is heavily exposed to USDC so authorities could pressure USDC to destroy Dai
[+] [-] biztos|3 years ago|reply
https://etherscan.io/address/0x59abf3837fa962d6853b4cc0a1951...
[Edit: and also the Heist label is very useful!]
[+] [-] bonestamp2|3 years ago|reply
[+] [-] haldujai|3 years ago|reply
This may be an understatement of their skill level. It seems the individual(s) also used a Kraken account to transfer funds and have been identified per their CSO.
https://twitter.com/c7five/status/1591434844760076290?s=61&t...
[+] [-] wklm|3 years ago|reply
[+] [-] drexlspivey|3 years ago|reply
[+] [-] zen21|3 years ago|reply
How common is the knowledge of these best practices?
[+] [-] matheusmoreira|3 years ago|reply
[+] [-] unknown|3 years ago|reply
[deleted]
[+] [-] api|3 years ago|reply
Of course one would assume he or his conspirators would do a better job, but maybe not if this busting out was initiated under time pressure.
Once again almost everything in cryptocurrency proves to be a scam.
[+] [-] AirStreamer27|3 years ago|reply
[+] [-] VagueMag|3 years ago|reply
[+] [-] unknown|3 years ago|reply
[deleted]
[+] [-] unknown|3 years ago|reply
[deleted]
[+] [-] FollowingTheDao|3 years ago|reply
[+] [-] unknown|3 years ago|reply
[deleted]
[+] [-] zeven7|3 years ago|reply
From FTX's general counsel[1], retweeted by FTX_Official. So that indicates it's not being sold off legitimately under some sort of liquidation proceedings. It could be insiders or it could be hackers.
[1] https://twitter.com/_Ryne_Miller/status/1591281729125613570
Rumors on Twitter[2] are there was also an update just pushed to the FTX app. Concerns are the update may contain malware. It makes sense to uninstall the FTX app if you have it.
[2] https://twitter.com/zachxbt/status/1591295039946493952
[+] [-] DavidSJ|3 years ago|reply
Is that based on some evidence, or is it speculation?
[+] [-] unknown|3 years ago|reply
[deleted]
[+] [-] iblaine|3 years ago|reply
All that said, I’m not surprised at where we are today.
[+] [-] mudrockbestgirl|3 years ago|reply
It's really unfortunate to get "hacked" with such bad timing. You steal customer money and file for bankruptcy but now the bad hackers, probably from the Bahamas as well, take whatever is left and cash out. Oh no! /s
But it's alright, SBF said he's sorry.
[+] [-] flylib|3 years ago|reply
[+] [-] ForHackernews|3 years ago|reply
[deleted]
[+] [-] dna_polymerase|3 years ago|reply
[+] [-] 0xbadc0de5|3 years ago|reply
[+] [-] rippercushions|3 years ago|reply
https://twitter.com/zachxbt/status/1591293813519253504
[+] [-] crypt1d|3 years ago|reply
[+] [-] tfsh|3 years ago|reply
1: https://www.coindesk.com/policy/2022/11/10/ftx-violated-its-...
[+] [-] mudrockbestgirl|3 years ago|reply
https://debank.com/profile/0x59abf3837fa962d6853b4cc0a19513a...
Currently at ~$390M. It looks like they're trying to swap most of the tokens they received into ETH on-chain.
[+] [-] unknown|3 years ago|reply
[deleted]
[+] [-] Gasp0de|3 years ago|reply
[+] [-] fellellor|3 years ago|reply
[+] [-] YossarianFrPrez|3 years ago|reply
I am no fan of crypto myself, but it's interesting to think what would have to happen for crypto to burnish its image.
Would key people have to voluntarily form some sort of coordinating council and self-regulate? Would they have to invite governments to regulate them better? Whatever the solution is, I'd be highly surprised if it could be done algorithmically and reassure anyone.
[+] [-] tevon|3 years ago|reply
"Freezeable" tokens completely defeat the purpose of a decentralized currency. Why create nodes/verifiers etc if a wallet can be unilaterally frozen, either under pressure from gov't, community, or another entity.
However NOT allowing freezeability allows for massive hacks, either by insiders, poor security, or sloppiness.
Seems the solve is somewhere in the middle, a pool of trusted intermediaries.
[+] [-] fumblebee|3 years ago|reply
Some folks in this thread are speculating this might've been an inside job.
I suspect, it's likelier that hackers had been aware of a vulnerability for some time, had a plan to drain these funds, but decided to hasten the timeline on the basis of the news FTX was going under.
[+] [-] abakker|3 years ago|reply
[+] [-] przeor|3 years ago|reply
The telephone, the internet, and crypto share one thing in common. Each technology improves on the next in terms of its ability to facilitate fraud.
As such, I was initially a crypto skeptic, but after studying some of the more interesting crypto projects, I have come to - Bill Ackman (@BillAckman) November 20,
[+] [-] genmud|3 years ago|reply
[+] [-] infrawhispers|3 years ago|reply
[+] [-] AndreLock|3 years ago|reply
Madoff's ponzi was larger, but the recovery rate was 88%. It looks like customers who didn't withdraw in time will end up with 0%.
[+] [-] sillysaurusx|3 years ago|reply
A lot of this is just gambling. People need to go into it with the mindset that the money will be gone tomorrow, and then be pleasantly surprised if it doesn’t.
See this millionaire who is now worth $10k due to FTX: https://www.tiktok.com/t/ZTRxWq77B/
[+] [-] jl2718|3 years ago|reply
[+] [-] unknown|3 years ago|reply
[deleted]
[+] [-] smt88|3 years ago|reply
[+] [-] headsoup|3 years ago|reply
The lack of legal focus, given the obvious illegitimacy of it all is disgraceful and I can't even imagine the size of the wealth transfer happening through all this.
[+] [-] px43|3 years ago|reply
https://twitter.com/concodanomics/status/1591232063906217984
[+] [-] echelon|3 years ago|reply
Entirely speculation, but something fun I've heard repeated occasionally:
If this was "just tech", it could find itself regulated easily. (Though this isn't necessarily the case.)
If it's a geopolitical weapon or spy tool of any consequence, then there may be other stakeholders pushing back against weakening it.
Plausible, borderline conspiratorial, but fun to think about.
[+] [-] 1270018080|3 years ago|reply
[+] [-] throwawaysleep|3 years ago|reply
All sorts of scams, from dietary supplements to homeopathy pyramid schemes are permitted to carry on because fighting them is too unpopular.
Edit: take a look at Twitter. Crypto folks are busy worried that the Us gov will overreact and regulate crypto over this.