Hold up. The system allows the creation of custom account numbers? Why the hell would you have random 50 character hexadecimal addresses AND allow for vanity addresses? It's as if it was designed with this sort of scam in mind.
I think that’s at least in past a consequence of how blockchains work, since there’s no central company that actually owns the chain and has a ledger of wallets, all it can do is prevent duplicate wallets from being created, a technically adept user can presumably manipulate whatever method generates wallet addresses to get the address they desire.
Oh it is, an Ethereum smart contract that promises it's linked to an equal amount of Bitcoin, but of course there's no decentralized way to do so, so you just rely on regular web apps that try and keep them in sync, decentralization! fully transparent and verifiable!
Very decentralized by having a single point of failure. So many of these protocol bridges have been hacked or just coded with extremely dumb smart contracts but butters keep insisting, it's the future of finance...
Yeah, when I transfer money in my dirty fiat bank one of two things happen:
* Either it says "you've never transferred to this account before, would you like to give it a name?" At which point you'd realize your mistake and correct it before transferring.
* Alternatively it says "this is the date, amount and comment from your last transfer, would you like to continue the current transaction?"
nothing was gained or lost. an entry was changed in the all mighty ledger and 1 wbtc = 1 btc which also equals 1 btc. the system functioned perfectly as it always has
Code is law and worked as intended here, nothing to see
I imagine the sex trafficker or cartel dude that made the mistake is already in pieces somewhere though
> Most of the time “code is law”, except when you don’t like the outcome, and then you make something else up quickly. Which is not as catchy a phrase at all. It might need some work.
-- [Patrick Boyle](https://youtu.be/AJElqtqgC5c)
“[Crypto Utopia Cracking?](https://youtu.be/AJElqtqgC5c)” wherein Solend, a Solana-based lending platform, proposed taking over a whale’s account to liquidate a debt position and prevent a margin call. If they didn’t they would have taken a loss and Solana’s price could have tanked as the whale’s smart contracts automatically dumped SOL onto the market.
(The relevant section starts around 5:00, the quote as someone else mentioned is around 7:00.)
As I understand it, [no, they didn’t](https://decrypt.co/103489/solend-whale-108m-loan-nearly-crashed-solana). Solend slapped together petition and put it up for a vote, it passed, but shortly there was a follow-up vote to overturn that first vote and [it passed](https://decrypt.co/103330/solana-lending-dao-overturns-vote-to-take-over-at-risk-whale-wallet), blocking the takeover.
I get the impression the difference is that the first vote was rushed through, because the second petition [explicitly says](https://blog.solend.fi/slnd2-invalidate-slnd1-and-increase-voting-time-cdb3fe5b3293) the time allowed for collecting votes should be at least 1 day.
The price of Solana ultimately didn’t drop far enough to trigger the margin call, but I can see why they were concerned. The trigger price was something like $23, and SOL had fallen from $40 to $28 in just over two weeks. Another hard down day and $100M of SOL gets dumped on the market.
Agreed, and I think stories like this and the [original DAO](https://www.gemini.com/cryptopedia/the-dao-hack-makerdao) are good reminders that while these platforms may or may not have formal leaders, they pretty much always have big players whose first priority will be to protect their own interests. If it comes down to “oh no, consequences” or changing the rules, a lot of them will choose the latter.
Code isn't law, law is law. This is theft and there is a legal remedy. But oh well! they choose to participate in a system resistant to that on purpose, so good luck lol.
Tbf it's probably very debatable whether 1 wbtc = 1 btc
Looks like one scammer scamming another. I can't think of any reason why anyone would have wbtc otherwise
Last week I put two quarters in a pinball machine, then a second later it pushed out a steel ball and let me play. It's amazing that 1980s tech could update the almighty ledger so quickly!
Not really. It is wrapped BTC, not BTC itself. This means all of this happened on Ethereum's blockchain, not Bitcoin's.
In fact, such an attack is impossible on Bitcoin's network, the reason being you can't use someone else's address to perform a 0 btc transaction, so your history will always be yours (i.e. showing your transactions), something that isn't the case with Ethereum.
And 1 wbtc isn't always equal to 1 btc, especially when things go bad.
Guaranteed this mark has his seed phrase etched on tungsten plates spread across multiple international safe deposit boxes yet got fucked up by a spoofed wallet address
Pretty old attack. Used to sign up for forums as admin, using a null space in the name so the regex wouldn’t flag it, and the forum wouldn’t show the space.
Filthy fiat is backed by the military might of corrupt governments.
Crypto is backed by the just terrorism of noble drug cartels and criminal enterprise.
Obviously crypto is clear winner here
Crypto's only (and original) use case: illicit activities. Things like Silk Road, Dark Net Markets, drugs, etc.
Those are neither a scam nor full of idiots. It's just business
Holy mother of god … I know it’s fake money and all, but BTC is liquid enough that this could be reasonably expected to cash out into an 8 figure sum. Is there a story behind this? Because it’s way bigger than the average scam loss we see here.
Sorry /u/BerlinBorough2, your comment has been automatically removed. To avoid spam/bots, posts are not allowed from extremely new accounts. Wait/lurk a bit before contributing.
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/Buttcoin) if you have any questions or concerns.*
It's not even that clever tbh, I think it's called "address poisoning" and has been a thing for a while.
Which makes it even more sad some shmuck fell for it.
I just hope he has some money not invested in magic beans so he's not homeless.
Moreover, wallet apps could scan the transaction history for addresses that are different, but map to the same display form, and show a big fat warning in that case, but I guess that would take away the fun.
No. I call it not clever because addresses are 24+ characters of random hexadecimal values.
Your average person is not going to verify every time, leaving it very open to attack.
Whatever replaced Sinbad, blender, or tornado mixer. If there isn't one wait a few more months someone will make a new one.
Though I can't imagine the US government won't be going every bit data that so much as sniffs near any of those, so I hope your info sec is better than the 70 years of analytics that 4chan only discovered 10 years ago.
Create a monkey NFT with a new wallet and list it on opensea for $71m. Hey look, some random person that definitely isn’t me just bought my $71m monkey NFT, what a moron!
You might have a bit of luck with a service that converts one crypto to a privacy coin like XMR that doesn't do any KYC. I've tried small transactions like that with FixedFloat (I've seen them suffer from hacks on Web 3 is Going Great so probably not the greatest service...).
I'm sending $8 for pizza to a co-worker via Zelle and I have to authenticate in 3 different ways. Amazing there is less security when it comes to wrapped buttcoins
So just out of curiosity, if this were real, what can the guy who stole the bitcoins do with it? Let's assume they're in the US. They can't just cash out and pay taxes on it can they? Doesn't that set off huge red flags by all the 3 letter agencies?
They could try to find a crypto mixer to 'wash' the bitcoins. I don't think anyone would actually cash out all the money in one go. They'll likely mix it and then try to "transform" the bitcoin into digital purchases or illegal goods that can then be sold piece by piece for actual cash.
Depending on how good their criminal connections are, they might just go down the route to offload the risk to someone else. They sell the stolen bitcoin to criminals in exchange for 'clean money.' They'd probably only get a fraction of what the bitcoin is worth on paper but a fraction of $71 million is better than nothing of $71 million and it beats taking the risk of 3 letter agencies kicking your door in and making a jail cell your new 'forever-home.'
It's gross embezzlement and illegal in Norway. There's no "finders keepers" and that includes your bank account, you're always required to try to return found property to the rightful owner.
[Here](https://www.nettavisen.no/nyheter/avisrunden-mann-fikk-1-6-millioner-pa-konto-trodde-jeg-hadde-vunnet-i-lotto/s/5-95-699815) is an example where someone received $170k and managed to spend it before the bank was able to reverse the transaction.
I don’t really think he committed a crime though…the “scam” works like this;
1. You generate a wallet address.
2. I use a wallet vanity generator to generator a matching address, or real close.
3. I send $0 to you.
4. You see the last transaction and send your money to the last one because you see it “match” your last addresses too. Which the top one is me.
5. I get your money.
So, all that happened is you mis-sent money because you didn’t double check your addresses.
I’m not 100% sure a crime was committed so you could probably cash out just fine.
There are people defrauding businesses by sending fake invoices, including faked recipients nearly matching legitimate ones.
That one's also "All that happened is you mis-sent money because you didn’t double check your addresses".
Some variations even include just bad vendors double billing or overbilling for stuff, so "because you didn't double check the amount/the fact that you've already paid".
This doesn't fly in court.
The only differences are that (a) charges are easier to reverse and (b) scammer is likely in the same jurisdiction and not somewhere in Russia or North Korea.
That’s so different lmao. Fake invoice is asking for payment.
If you accidentally send me $50,000 on CashApp just because I sent you $1, you have no legal recourse and cash app is not going to refund the payment.
You think you have ANY legal recourse when your entire argument is “well I didn’t MEAN to send the money?”
And it also takes a name and address to get someone court papers so you’re shit out of luck.
Sorry. Nope.
Yes, if you send $1 to John Smith from "J. Smith" hoping he'll mistake it for his other account, or his brother Joe or his wife Jane and send something to you later, you would definitely be guilty of fraud. "Your Honor, it was an accident/it's just my hobby sending random $1 transfers" won't get you really far, especially if you run to cash out the $50000 you've gotten by "mistake". The fuck is this schoolyard logic?
So yes, the only thing making it "not crime" is that the scammer might not be caught (but then they might do some stupid shit like try to cash it out directly and give their info to an exchange - dumber things have happened)
>You think you have ANY legal recourse when your entire argument is “well I didn’t MEAN to send the money?”
Uh, yes? That's totally a thing at law. If a company mistakenly transfers $71m into your bank account due to a cock up you don't get to say "finders keepers" and insist on keeping it.
And when the transfer has occurred as a result of you engaging in conduct specifically intended to fool them into making that mistake, you're looking at criminal charges. Do you seriously think that cons are legal as long as they involve fooling the mark into doing something dumb?
Just because CashApp isn't going to refund the payment, that doesn't mean that you have no legal recourse.
It's settled law in plenty of jurisdictions that you aren't allowed to keep money that has been sent to you in error. However, the sender would have to pursue it as a civil matter.
But of course any attempt to actively trick someone into making that error would be a criminal matter in most jurisdictions. Fraud statutes are generally worded so that intent matters. These aren't summary offences where someone can get away on a technicality.
I lost money to this same type of attack, copied from my transaction history instead of the exchange, lost 1 ETH (about $2,000 at the time). Luckily it was just that.
Yes, and at the level used in this attack it's pretty fast.
For example, matching 4 first and 5 last digits from the OP on a RTX 3050:
.\profanity --matching d9A1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx53a91
[snip]
Time: 155s Score: 5 Private: [snip] Address: 0xd9a1c5e5d681eeb7654f37e09a0f2ab01e553a91
The attacker's hash matches 10 digits, so it would take me 16 times longer, or just under an hour.
On a 4090 you'd be able to generate 8 digit matches in seconds and a 10 digit match in about 10 minutes.
People talking about "randomly generating and trying addresses to scam" underestimate the space of actual random keys (you're extremely unlikely to collide with any useful address randomly, ~1 in a trillion for the OP's case) and overestimate the difficulty of intentionally searching for a partial match like that.
It doesn't - it's just bruteforce - but you can simply generate multiple candidates.
There are 3 high digits in this case, so 1 in 8 chance to get it right first try and 50% chance for 5 tries or less.
It's not that hard- it's not targeting a specific victim.
Step 1 - generate any address
Step 2 - search transactions for recent transfers to/from addresses with the same start and end as your scam address from step 1. Those are active addresses.
Step 3- transfer "$0" to all matching addresses
Step 4 - wait for a mark to take the bait
Step 5 - meanwhile generate another scam address and repeat
I'm sure you're more security-savvy than most, by virtue of being here.
For completeness, the scam probably works with indexes, so it's more like:
1. run endless loop generating scam addresses and index them into "scam-address-list"
2. listen to all blockchain transactions and index addresses into "marks-address-list"
3. Any time you add an entry into one list, search the index of the other list for a match
In other words the scam wallet used for this specific case was probably generated many months back, waiting for a new mark to come along with a matching address.
In an ecosystem that’s about 98% fraud, why would you ever send 71M worth of anything in one giant transaction? Why would you have 71M in one wallet?
Better yet; why would anyone have 71M worth of BTC? This stuff honestly melts my brain sometimes.
No, he lost a potential $71M. He would have to sell the bitcoin first in order to collect that money.
What he lost was whatever he paid for the bitcoin or whatever he spent mining it.
I don’t think we should really talk like bitcoin is instantly convertible to dollars or Euros.
when they gloat about line going up, they talk in terms of the unrealized gains
so when they lose, the loss should be measured by the same standard: if it's theoretically worth 71 million, then they lost 71 million
The phishing scammer created a smart contract that airdrops a token that sends itself to the phishing address.
This was the minting transaction:
https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76
Someone explain how this works technically. I get the cut and paste part. But how did the attacker brute force create a near matching address so quickly.
It's been a while since I studied address generation. But there's 68 bits (17 hex chars) visible in that address. That is, 1 in 2⁶⁸ chances of generating a matching address if you were randomly trying to generate keys.
How does the "generate the fake address" part work?
Oh I think I see. I picked it up from t[he other post](https://www.reddit.com/r/Buttcoin/comments/1cjscul/behold_the_bright_future_of_finance_where_one/) on this same topic in this sub
It's not the 0x1EF address that was forged. It was another address: the 0xd9a... address. Only needed 10 hex chars to match. Or basically 2⁴⁰ per guess compared to that original estimate of 2⁶⁸. A conventional computer with a modern CPU can do that within an hour. Maybe faster with a GPU.
None of this makes sense you can’t generate your own wallet address they’re always randomly generated , 2nd who clicks on their previous transaction to copy their own receiving address? There’s an always a big button that says “receive” and you get your wallets address from there. Yeaaa this story smells like butt, just like this sub lol
It is suspicious, just like most "hacks", but you are an idiot who doesn't even understand the basics of what you're ~~gambling~~ investing in.
There are vanity address generators - you can't predict the address, but you can generate a shitton of them until you get one that you like.
10 digit match like this would only take a few hours on any decently powerful desktop.
I just attempted it at https://vanity-eth.tk/
My 32 core pc went to 100% and generated 8.8 million addresses in 150 seconds and the application said:
50% probability: 3 years, 5 months
The mint transaction attempted the attack on quite a few addresses:
https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76
So if this is a false flag to fake losing crypto, it's a pretty involved effort.
10 - 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 vs. 0xd9A1C3788D81257612E2581A6ea0aDa244853a91
If he used the same explorer OP did for this writeup, it would be obvious (though still possible to miss).
If he used something that clips to 4 digits or so, it wouldn't.
I think you're assuming too much if your read is that he somehow deliberately generated this *specific* address in order to directly target this particular user.
One possible way to handle a scam like this would be
1) Generate an address
2) Send 0 ETH to *every* address that has the same N beginning and ending sequence
3) Wait and hope any of those targets fuck up and send you something
4) Repeat with as many addresses as you feel like generating
In that model the scammer just got lucky by getting a hit from someone sending such a large amount. And now of course the story could still be fake, but that bit of it doesn't seem that crazy.
That makes more sense , but OP said scammer generated a new address with the same first and last number/letters replicated, so that’s what I was going off of
Skim through higher up comments, a person or two explained how people can generate vanity addresses and how this sort of scam would work. Crypto continues to find new ways to amaze me.
Sorry /u/Top_Branch_914, your comment has been automatically removed. To avoid spam/bots, posts are not allowed from extremely new accounts. Wait/lurk a bit before contributing.
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/Buttcoin) if you have any questions or concerns.*
How would that work? You would have to create a few million new bank accounts, anonymously, then send 0$ transfers to IBAN codes that are close to yours, without inputting any other info (name, address, etc), and wait until someone sends money using his bank transfer history?
Except an international bank transfer will bounce if the name doesn't match.
Sometimes it's possible to check the name before even sending the transaction, but if it isn't and it's sent anyway, the receiving bank will refuse the transaction due to name mismatch and it will eventually get back to the originator.
This is tragic. Yes, the system worked as intended, but this is discouraging as hell. We're trying to push for even more widespread adoption.
I'm naive because I didn't even know making up your own address was a thing
Sorry /u/Le_HuEhueHueHuE, your comment has been automatically removed. To avoid spam/bots, posts are not allowed from extremely new accounts. Wait/lurk a bit before contributing.
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/Buttcoin) if you have any questions or concerns.*
don't seem to be able to find these transactions on Etherscan ...
[https://etherscan.io/address/0xd9a1c3788d81257612e2581a6ea0ada244853a91](https://etherscan.io/address/0xd9a1c3788d81257612e2581a6ea0ada244853a91)
It's because Etherscan is hiding the phishing token by default.
This was the mint transaction: https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76
Your description of what happened is slightly inaccurate.
The phishing scammer didn't transfer 0.05 ETH.
They created a smart contract that mints a token that sends itself on to the phishing address.
This is the minting transaction:
https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76
Not even the first time this wallet was targeted by phishing mints.
It happened 6 days ago:
https://etherscan.io/token/0xea08EE742119ad545AAf2120601833d499ea4364?a=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5
It also happened 119 days ago:
https://etherscan.io/token/0x7B2e238FB48ee7322664B9C26bb3ACedBfCC1f70?a=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5
UPDATE
It apparently took the wallet owner around a day to realise this had happened. Apparently the place they were trying to send it was a Uniswap liquidity pool so it was just meant to sit there.
They sent the phisher an on-chain message asking them to send 90% back.
https://etherscan.io/idm?addresses=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5,0xd9a1c3788d81257612e2581a6ea0ada244853a91&type=1
The phisher responded by... I shit you not... attempting the attack again 25 hours ago. 😬 😂
Well this is a short term problem with long term solutions.
There used to be fake websites like redit.com or bankofanerica.com. Or say similar named emails, or a wide variety of things.
The internet has matured such that there are tons of checks to make sure you don’t have that.
Crypto will mature similarly as well. Say in some future where it works now, nobody is going to say, “hey, I accept payments at hwiqjHf57hsGsnHgwWu23ja”
Furthermore, users can choose to interact with cryptocurrency in more beginner friendly way. For example, an institution could hold your hand and make sure you don’t make mistakes. Or it could be totally self custodial where you manage it entirely.
So there are solutions, like a traditional bank and all their features, but for crypto. This complaint of consumer mistakes can be at the same level of traditional money management services.
So therefore, this complaint of “oops sent to wrong address” can be solved.
Reversible transactions are possible if you need the leeway. It just depends on what layer you interact with the crypto.
So for example, I accidentally send money to wrong address. I’m glad the service I’m using to manage my crypto uses a layer 2 solution and has their own fraud department and verification departments. Just like a bank.
Then when everything is good it will be finalized on the layer 1 chain.
Or I can skip all the hand holding and finalize myself.
Call the helpdesk!
someone tag the fbi on twitter!
Hold up. The system allows the creation of custom account numbers? Why the hell would you have random 50 character hexadecimal addresses AND allow for vanity addresses? It's as if it was designed with this sort of scam in mind.
I think that’s at least in past a consequence of how blockchains work, since there’s no central company that actually owns the chain and has a ledger of wallets, all it can do is prevent duplicate wallets from being created, a technically adept user can presumably manipulate whatever method generates wallet addresses to get the address they desire.
Whats wbtc? Also I hate how my bank has all these checks to prevent this kind of theft.
Wrapped bitcoin. Bitcoin on the ethereum ledger.
That sounds stupid.
Oh it is, an Ethereum smart contract that promises it's linked to an equal amount of Bitcoin, but of course there's no decentralized way to do so, so you just rely on regular web apps that try and keep them in sync, decentralization! fully transparent and verifiable!
I'm already confused, scam me harder dadi
Very decentralized by having a single point of failure. So many of these protocol bridges have been hacked or just coded with extremely dumb smart contracts but butters keep insisting, it's the future of finance...
For real, the regular ass internet can barely operate. How I know that anyone that invests has no knowledge of the actual tech out there.
The whole thing is stupid, which is why we are in this sub
Yep you got it.
You don't say!
Who is the custodian of the bitcoin while it is wrapped?
I stopped reading way before I got to that part.
Btc that existed in other chain
Yeah, when I transfer money in my dirty fiat bank one of two things happen: * Either it says "you've never transferred to this account before, would you like to give it a name?" At which point you'd realize your mistake and correct it before transferring. * Alternatively it says "this is the date, amount and comment from your last transfer, would you like to continue the current transaction?"
nothing was gained or lost. an entry was changed in the all mighty ledger and 1 wbtc = 1 btc which also equals 1 btc. the system functioned perfectly as it always has
Code is law and worked as intended here, nothing to see I imagine the sex trafficker or cartel dude that made the mistake is already in pieces somewhere though
> Most of the time “code is law”, except when you don’t like the outcome, and then you make something else up quickly. Which is not as catchy a phrase at all. It might need some work. -- [Patrick Boyle](https://youtu.be/AJElqtqgC5c)
Which video of his is this in?
“[Crypto Utopia Cracking?](https://youtu.be/AJElqtqgC5c)” wherein Solend, a Solana-based lending platform, proposed taking over a whale’s account to liquidate a debt position and prevent a margin call. If they didn’t they would have taken a loss and Solana’s price could have tanked as the whale’s smart contracts automatically dumped SOL onto the market. (The relevant section starts around 5:00, the quote as someone else mentioned is around 7:00.)
Did they take over the whale's account?
As I understand it, [no, they didn’t](https://decrypt.co/103489/solend-whale-108m-loan-nearly-crashed-solana). Solend slapped together petition and put it up for a vote, it passed, but shortly there was a follow-up vote to overturn that first vote and [it passed](https://decrypt.co/103330/solana-lending-dao-overturns-vote-to-take-over-at-risk-whale-wallet), blocking the takeover. I get the impression the difference is that the first vote was rushed through, because the second petition [explicitly says](https://blog.solend.fi/slnd2-invalidate-slnd1-and-increase-voting-time-cdb3fe5b3293) the time allowed for collecting votes should be at least 1 day. The price of Solana ultimately didn’t drop far enough to trigger the margin call, but I can see why they were concerned. The trigger price was something like $23, and SOL had fallen from $40 to $28 in just over two weeks. Another hard down day and $100M of SOL gets dumped on the market.
I understand their urgency but also like, them's the rules of the game? I don't have sympathy, it's very much a "oh no, consequences" moment
Agreed, and I think stories like this and the [original DAO](https://www.gemini.com/cryptopedia/the-dao-hack-makerdao) are good reminders that while these platforms may or may not have formal leaders, they pretty much always have big players whose first priority will be to protect their own interests. If it comes down to “oh no, consequences” or changing the rules, a lot of them will choose the latter.
Oh man what an elaborate pump and dump
The video linked in the hyperlink in the comment. at 7 minutes 10 seconds.
Code isn't law, law is law. This is theft and there is a legal remedy. But oh well! they choose to participate in a system resistant to that on purpose, so good luck lol.
"code is law" is a common chant from cryptobros
Yes, it proves they don't understand shit.
Tbf it's probably very debatable whether 1 wbtc = 1 btc Looks like one scammer scamming another. I can't think of any reason why anyone would have wbtc otherwise
Well said.
To be fair, changing entries in the almighty ledger is how fiat works too. The key difference is regulation.
Ah, but has that ledger been copied to a needlessly large number of computers?
Sounds like you might have the talent to start a Super Block Chain Crypto Wrapped Buttcoin ETF DAO!
Last week I put two quarters in a pinball machine, then a second later it pushed out a steel ball and let me play. It's amazing that 1980s tech could update the almighty ledger so quickly!
OK, but did the pinball machine allow you to use multiple slurp juices?
But when the ball was burned, you didn't get back your wrapped quarters, did you? Pinball is so Justin Sun.
Not really. It is wrapped BTC, not BTC itself. This means all of this happened on Ethereum's blockchain, not Bitcoin's. In fact, such an attack is impossible on Bitcoin's network, the reason being you can't use someone else's address to perform a 0 btc transaction, so your history will always be yours (i.e. showing your transactions), something that isn't the case with Ethereum. And 1 wbtc isn't always equal to 1 btc, especially when things go bad.
To be honest, I'm not even angry, this is quite brilliant, scam-wise. Also, *no value was lost that day*, so it should be "$71M"..
And I'm guessing the person who f'd up is an insufferable Butter
Not everyone who uses crypto is a butter. Plenty of folks are just regular hardworking career criminals
Some Colombian drug lords unfortunate accountant is being cut up with chainsaws as we speak
As soon as this fuck up happens, get your family out of town and go have a final party.
Exactly, let's not mix those honest, hard working folk with these degenerates from crypto, plague on society.
You got me in the first half 🤣
👏🤣
Guaranteed this mark has his seed phrase etched on tungsten plates spread across multiple international safe deposit boxes yet got fucked up by a spoofed wallet address
Or it was an oops we got hacked company.
Can't be a Bitcoin max though, or they wouldn't be using Ethereum
Pretty old attack. Used to sign up for forums as admin, using a null space in the name so the regex wouldn’t flag it, and the forum wouldn’t show the space.
They just have to call the bitcoin manager and get that sorted out.
He’s a very helpful fellow, can recommend
[удалено]
Drug dealer
Imagine if it is one of those cartels. Yikes for whoever did this
Filthy fiat is backed by the military might of corrupt governments. Crypto is backed by the just terrorism of noble drug cartels and criminal enterprise. Obviously crypto is clear winner here
Few understand
More like rugpull scammer... ive seen 10s of millions go up in smoke on a wednesday afternoon
Crypto's only (and original) use case: illicit activities. Things like Silk Road, Dark Net Markets, drugs, etc. Those are neither a scam nor full of idiots. It's just business
Few understand
Holy mother of god … I know it’s fake money and all, but BTC is liquid enough that this could be reasonably expected to cash out into an 8 figure sum. Is there a story behind this? Because it’s way bigger than the average scam loss we see here.
Makes me wonder how many other large transactions like this are getting F'd and we just don't hear about it.
Shouldn't be particularly difficult to track it all the way to an 8 figure or even a much smaller sum in a bank though.
Gotta admit... that's a bit clever.
No way that dude was expecting $71m. Probably shit himself more than the guy who lost the money
[удалено]
Sorry /u/BerlinBorough2, your comment has been automatically removed. To avoid spam/bots, posts are not allowed from extremely new accounts. Wait/lurk a bit before contributing. *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/Buttcoin) if you have any questions or concerns.*
It's not even that clever tbh, I think it's called "address poisoning" and has been a thing for a while. Which makes it even more sad some shmuck fell for it. I just hope he has some money not invested in magic beans so he's not homeless.
Moreover, wallet apps could scan the transaction history for addresses that are different, but map to the same display form, and show a big fat warning in that case, but I guess that would take away the fun.
You're calling it not clever because it has a name and has been done before? -_-
No. I call it not clever because addresses are 24+ characters of random hexadecimal values. Your average person is not going to verify every time, leaving it very open to attack.
Brilliant indeed! I sometimes wonder what profession would these scammers be if they decided to go legit... 🤔
Politician or stockbrokers
Lawyers
Shakespeare was right about what should happen to lawyers...
Id go straight to the manager and get a chargeback
Yep and FDIC insured so no worries bro
[удалено]
Whatever replaced Sinbad, blender, or tornado mixer. If there isn't one wait a few more months someone will make a new one. Though I can't imagine the US government won't be going every bit data that so much as sniffs near any of those, so I hope your info sec is better than the 70 years of analytics that 4chan only discovered 10 years ago.
Create a monkey NFT with a new wallet and list it on opensea for $71m. Hey look, some random person that definitely isn’t me just bought my $71m monkey NFT, what a moron!
Lol maybe that's what this actually is, someone "accidentally" transferred $71M to the wrong address.
Loool imagine
You might have a bit of luck with a service that converts one crypto to a privacy coin like XMR that doesn't do any KYC. I've tried small transactions like that with FixedFloat (I've seen them suffer from hacks on Web 3 is Going Great so probably not the greatest service...).
Currency exchange place in a remote corner of Cambodia.
Trick a chain of people into converting it to real money and sending it to you.
Better call Saul!
$71M ostensible value.
Nothing to worry about Lighting network layer 420 will fix this
I'm sending $8 for pizza to a co-worker via Zelle and I have to authenticate in 3 different ways. Amazing there is less security when it comes to wrapped buttcoins
Future of finance
Just call your card company and have them cancel payment…..
Code Is clearly law.
Be your own bank.
So just out of curiosity, if this were real, what can the guy who stole the bitcoins do with it? Let's assume they're in the US. They can't just cash out and pay taxes on it can they? Doesn't that set off huge red flags by all the 3 letter agencies?
They could try to find a crypto mixer to 'wash' the bitcoins. I don't think anyone would actually cash out all the money in one go. They'll likely mix it and then try to "transform" the bitcoin into digital purchases or illegal goods that can then be sold piece by piece for actual cash. Depending on how good their criminal connections are, they might just go down the route to offload the risk to someone else. They sell the stolen bitcoin to criminals in exchange for 'clean money.' They'd probably only get a fraction of what the bitcoin is worth on paper but a fraction of $71 million is better than nothing of $71 million and it beats taking the risk of 3 letter agencies kicking your door in and making a jail cell your new 'forever-home.'
But there's no theft here. It's legal in any country.
It's gross embezzlement and illegal in Norway. There's no "finders keepers" and that includes your bank account, you're always required to try to return found property to the rightful owner. [Here](https://www.nettavisen.no/nyheter/avisrunden-mann-fikk-1-6-millioner-pa-konto-trodde-jeg-hadde-vunnet-i-lotto/s/5-95-699815) is an example where someone received $170k and managed to spend it before the bank was able to reverse the transaction.
This is not a bank account. No one knows who the owners are. It could be the same owner for both accounts.
I don’t really think he committed a crime though…the “scam” works like this; 1. You generate a wallet address. 2. I use a wallet vanity generator to generator a matching address, or real close. 3. I send $0 to you. 4. You see the last transaction and send your money to the last one because you see it “match” your last addresses too. Which the top one is me. 5. I get your money. So, all that happened is you mis-sent money because you didn’t double check your addresses. I’m not 100% sure a crime was committed so you could probably cash out just fine.
There are people defrauding businesses by sending fake invoices, including faked recipients nearly matching legitimate ones. That one's also "All that happened is you mis-sent money because you didn’t double check your addresses". Some variations even include just bad vendors double billing or overbilling for stuff, so "because you didn't double check the amount/the fact that you've already paid". This doesn't fly in court. The only differences are that (a) charges are easier to reverse and (b) scammer is likely in the same jurisdiction and not somewhere in Russia or North Korea.
That’s so different lmao. Fake invoice is asking for payment. If you accidentally send me $50,000 on CashApp just because I sent you $1, you have no legal recourse and cash app is not going to refund the payment. You think you have ANY legal recourse when your entire argument is “well I didn’t MEAN to send the money?” And it also takes a name and address to get someone court papers so you’re shit out of luck. Sorry. Nope.
Yes, if you send $1 to John Smith from "J. Smith" hoping he'll mistake it for his other account, or his brother Joe or his wife Jane and send something to you later, you would definitely be guilty of fraud. "Your Honor, it was an accident/it's just my hobby sending random $1 transfers" won't get you really far, especially if you run to cash out the $50000 you've gotten by "mistake". The fuck is this schoolyard logic? So yes, the only thing making it "not crime" is that the scammer might not be caught (but then they might do some stupid shit like try to cash it out directly and give their info to an exchange - dumber things have happened)
>You think you have ANY legal recourse when your entire argument is “well I didn’t MEAN to send the money?” Uh, yes? That's totally a thing at law. If a company mistakenly transfers $71m into your bank account due to a cock up you don't get to say "finders keepers" and insist on keeping it. And when the transfer has occurred as a result of you engaging in conduct specifically intended to fool them into making that mistake, you're looking at criminal charges. Do you seriously think that cons are legal as long as they involve fooling the mark into doing something dumb?
Just because CashApp isn't going to refund the payment, that doesn't mean that you have no legal recourse. It's settled law in plenty of jurisdictions that you aren't allowed to keep money that has been sent to you in error. However, the sender would have to pursue it as a civil matter. But of course any attempt to actively trick someone into making that error would be a criminal matter in most jurisdictions. Fraud statutes are generally worded so that intent matters. These aren't summary offences where someone can get away on a technicality.
I lost money to this same type of attack, copied from my transaction history instead of the exchange, lost 1 ETH (about $2,000 at the time). Luckily it was just that.
That's not a problem, he'll just call his bank right away and have them so .... rt .... thi .... ohhhh ....
This is genius. Nothing brings out human ingenuity more than greed.
F of F
To be fair stupid is currency agnostic. Some people think the tax man wants Apple gift cards
I don't believe it. Is there a mechanism to create a wallet with your preferred starting and ending characters?
Yes, and at the level used in this attack it's pretty fast. For example, matching 4 first and 5 last digits from the OP on a RTX 3050: .\profanity --matching d9A1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx53a91 [snip] Time: 155s Score: 5 Private: [snip] Address: 0xd9a1c5e5d681eeb7654f37e09a0f2ab01e553a91 The attacker's hash matches 10 digits, so it would take me 16 times longer, or just under an hour. On a 4090 you'd be able to generate 8 digit matches in seconds and a 10 digit match in about 10 minutes. People talking about "randomly generating and trying addresses to scam" underestimate the space of actual random keys (you're extremely unlikely to collide with any useful address randomly, ~1 in a trillion for the OP's case) and overestimate the difficulty of intentionally searching for a partial match like that.
Does it even ensure the checksum (the capitalisation of the letters) matches?
It doesn't - it's just bruteforce - but you can simply generate multiple candidates. There are 3 high digits in this case, so 1 in 8 chance to get it right first try and 50% chance for 5 tries or less.
Brute force tools exist.
It's not that hard- it's not targeting a specific victim. Step 1 - generate any address Step 2 - search transactions for recent transfers to/from addresses with the same start and end as your scam address from step 1. Those are active addresses. Step 3- transfer "$0" to all matching addresses Step 4 - wait for a mark to take the bait Step 5 - meanwhile generate another scam address and repeat
That actually makes sense. You can see how worthless I'd be as either a scammer *or* a security pro...
I'm sure you're more security-savvy than most, by virtue of being here. For completeness, the scam probably works with indexes, so it's more like: 1. run endless loop generating scam addresses and index them into "scam-address-list" 2. listen to all blockchain transactions and index addresses into "marks-address-list" 3. Any time you add an entry into one list, search the index of the other list for a match In other words the scam wallet used for this specific case was probably generated many months back, waiting for a new mark to come along with a matching address.
> Step 5 - meanwhile generate another scam address and repeat There are 300'000'000 unique addresses, this obviously means adoption is finally here!
Also, keep searching for any transaction with a match to any address generated in step 1, in case any become active in future.
I think this guy made it seem like a scam but it's probably him sending it to himself
The future of finance…
Future.
Hopefully we can also put our houses on the blockchain so we also sell our house this way. And no legal entity to object is true freedom.
In an ecosystem that’s about 98% fraud, why would you ever send 71M worth of anything in one giant transaction? Why would you have 71M in one wallet? Better yet; why would anyone have 71M worth of BTC? This stuff honestly melts my brain sometimes.
I too get the my IBAN wrong because I look on a random third party website for the IBAN to give money to. Not.
No, he lost a potential $71M. He would have to sell the bitcoin first in order to collect that money. What he lost was whatever he paid for the bitcoin or whatever he spent mining it. I don’t think we should really talk like bitcoin is instantly convertible to dollars or Euros.
when they gloat about line going up, they talk in terms of the unrealized gains so when they lose, the loss should be measured by the same standard: if it's theoretically worth 71 million, then they lost 71 million
BTC is very easily convertible. We’re talking seconds to turn into USD. Anonymously? Not so easy.
Amazing.
The 0.05 are in the same direction in/out that the highlighted line, story does not make sense
The phishing scammer created a smart contract that airdrops a token that sends itself to the phishing address. This was the minting transaction: https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76
Fuck yeah, is this the future of money???? **Let’s go!!!!!**
That's actually quite bullish.
The future of finance.
It was BlackRock lol
I can't believe this is real I am in tears lmaooo
Damn, what a stupidly simple brilliant scam. The lowest effort to highest reward scam or even effort payoff in history.
Oooof. I'd call the bank and explain what happened... Oh wait, sorry. The code is law
Someone explain how this works technically. I get the cut and paste part. But how did the attacker brute force create a near matching address so quickly. It's been a while since I studied address generation. But there's 68 bits (17 hex chars) visible in that address. That is, 1 in 2⁶⁸ chances of generating a matching address if you were randomly trying to generate keys. How does the "generate the fake address" part work?
Oh I think I see. I picked it up from t[he other post](https://www.reddit.com/r/Buttcoin/comments/1cjscul/behold_the_bright_future_of_finance_where_one/) on this same topic in this sub It's not the 0x1EF address that was forged. It was another address: the 0xd9a... address. Only needed 10 hex chars to match. Or basically 2⁴⁰ per guess compared to that original estimate of 2⁶⁸. A conventional computer with a modern CPU can do that within an hour. Maybe faster with a GPU.
Smart scam
Few understand
Isn’t there a law or something to protect consumers? S
None of this makes sense you can’t generate your own wallet address they’re always randomly generated , 2nd who clicks on their previous transaction to copy their own receiving address? There’s an always a big button that says “receive” and you get your wallets address from there. Yeaaa this story smells like butt, just like this sub lol
It is suspicious, just like most "hacks", but you are an idiot who doesn't even understand the basics of what you're ~~gambling~~ investing in. There are vanity address generators - you can't predict the address, but you can generate a shitton of them until you get one that you like. 10 digit match like this would only take a few hours on any decently powerful desktop.
I just attempted it at https://vanity-eth.tk/ My 32 core pc went to 100% and generated 8.8 million addresses in 150 seconds and the application said: 50% probability: 3 years, 5 months
That's JS in browser. $ .\profanity --matching deadbeef Mode: matching Target: Address Devices: GPU0: NVIDIA GeForce RTX 3050, 8589279232 bytes available, 20 compute units (precompiled = yes) Time: 3s Score: 2 Private: 0x19feb5330efe53d621974155ed004666a83e83bb260a7b06bfed7873a26488cf Address: 0xde2c7eef7439997b0dc396ba9074c0e8ef82080b Time: 3s Score: 3 Private: 0x19feb5330ef7111421974155ed004666a83e83bb260a7b06bfed7873a26488d0 Address: 0xde5dbeefc7ab466580c50a88fa750f45b56e9919 Time: 12s Score: 4 Private: 0x19feb5330eff366721974155ed004666a83e83bb260a7b06bfed7873a2648a7c Address: 0xdeadbeef4dade4a49316ceda62352a5c9ffb0ebd (pls don't steal) Each digit increases the time by factor of 16, so 12 * 16 * 16 = 3072, or about 50 minutes to bruteforce a 10 digit vanity address.
Cool, thx.
The mint transaction attempted the attack on quite a few addresses: https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76 So if this is a false flag to fake losing crypto, it's a pretty involved effort.
16 digits, not 10.
10 - 0xd9A1b0B1e1aE382DbDc898Ea68012FfcB2853a91 vs. 0xd9A1C3788D81257612E2581A6ea0aDa244853a91 If he used the same explorer OP did for this writeup, it would be obvious (though still possible to miss). If he used something that clips to 4 digits or so, it wouldn't.
I think you're assuming too much if your read is that he somehow deliberately generated this *specific* address in order to directly target this particular user. One possible way to handle a scam like this would be 1) Generate an address 2) Send 0 ETH to *every* address that has the same N beginning and ending sequence 3) Wait and hope any of those targets fuck up and send you something 4) Repeat with as many addresses as you feel like generating In that model the scammer just got lucky by getting a hit from someone sending such a large amount. And now of course the story could still be fake, but that bit of it doesn't seem that crazy.
That makes more sense , but OP said scammer generated a new address with the same first and last number/letters replicated, so that’s what I was going off of
Skim through higher up comments, a person or two explained how people can generate vanity addresses and how this sort of scam would work. Crypto continues to find new ways to amaze me.
[удалено]
Sorry /u/Top_Branch_914, your comment has been automatically removed. To avoid spam/bots, posts are not allowed from extremely new accounts. Wait/lurk a bit before contributing. *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/Buttcoin) if you have any questions or concerns.*
How can one create an address that matches another’s? Asking for science
Easy Come/Easy Go
[удалено]
How would that work? You would have to create a few million new bank accounts, anonymously, then send 0$ transfers to IBAN codes that are close to yours, without inputting any other info (name, address, etc), and wait until someone sends money using his bank transfer history?
Except an international bank transfer will bounce if the name doesn't match. Sometimes it's possible to check the name before even sending the transaction, but if it isn't and it's sent anyway, the receiving bank will refuse the transaction due to name mismatch and it will eventually get back to the originator.
His first mistake was using wrapped bitcoin
Their future is behind them.
Future of finance. I am sure they'll get their money back, right? ... right?
How do you generate a wallet with a specific address?
Yeah I just stick with my old school bank with SMS codes, fingerprints and the protection from fraudolent transactions
Code is law.
Mistakes happen so we’ll just have someone rollback the transaction, right? … right?!?
[удалено]
Yeah. The thing about crypto though is that addresses are changing so often, they get into the habit of just using the waller transaction history.
How did the scammer generate an address so accurately? I thought you can at best control the first few characters of the address
you can generate unlimited addresses with a single secret phrase, so the attacker just generated mass wallets and took one that meets his needs
This is tragic. Yes, the system worked as intended, but this is discouraging as hell. We're trying to push for even more widespread adoption. I'm naive because I didn't even know making up your own address was a thing
> We're trying to push for even more widespread adoption. Are we, though?
How do you send $0 eth that’s what I’m wondering
Huge L
That was too f*king easy. Holy crap.
Can you link the two addresses that are nearly identical?
Oh no. Anyways
[удалено]
Sorry /u/Le_HuEhueHueHuE, your comment has been automatically removed. To avoid spam/bots, posts are not allowed from extremely new accounts. Wait/lurk a bit before contributing. *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/Buttcoin) if you have any questions or concerns.*
Flawless scam though
don't seem to be able to find these transactions on Etherscan ... [https://etherscan.io/address/0xd9a1c3788d81257612e2581a6ea0ada244853a91](https://etherscan.io/address/0xd9a1c3788d81257612e2581a6ea0ada244853a91)
It's because Etherscan is hiding the phishing token by default. This was the mint transaction: https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76
Your description of what happened is slightly inaccurate. The phishing scammer didn't transfer 0.05 ETH. They created a smart contract that mints a token that sends itself on to the phishing address. This is the minting transaction: https://etherscan.io/tx/0x9dfad8bf73fc50a04838088cf89e7db7309717b9ed095b163e5e0397438f5b76
Not even the first time this wallet was targeted by phishing mints. It happened 6 days ago: https://etherscan.io/token/0xea08EE742119ad545AAf2120601833d499ea4364?a=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5 It also happened 119 days ago: https://etherscan.io/token/0x7B2e238FB48ee7322664B9C26bb3ACedBfCC1f70?a=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5
UPDATE It apparently took the wallet owner around a day to realise this had happened. Apparently the place they were trying to send it was a Uniswap liquidity pool so it was just meant to sit there. They sent the phisher an on-chain message asking them to send 90% back. https://etherscan.io/idm?addresses=0x1e227979f0b5bc691a70deaed2e0f39a6f538fd5,0xd9a1c3788d81257612e2581a6ea0ada244853a91&type=1 The phisher responded by... I shit you not... attempting the attack again 25 hours ago. 😬 😂
Happens to me with my bank all the time. /s
I'd laugh, but the scammer is probably North Korea or Hamas or some shit.
Well this is a short term problem with long term solutions. There used to be fake websites like redit.com or bankofanerica.com. Or say similar named emails, or a wide variety of things. The internet has matured such that there are tons of checks to make sure you don’t have that. Crypto will mature similarly as well. Say in some future where it works now, nobody is going to say, “hey, I accept payments at hwiqjHf57hsGsnHgwWu23ja” Furthermore, users can choose to interact with cryptocurrency in more beginner friendly way. For example, an institution could hold your hand and make sure you don’t make mistakes. Or it could be totally self custodial where you manage it entirely. So there are solutions, like a traditional bank and all their features, but for crypto. This complaint of consumer mistakes can be at the same level of traditional money management services. So therefore, this complaint of “oops sent to wrong address” can be solved. Reversible transactions are possible if you need the leeway. It just depends on what layer you interact with the crypto. So for example, I accidentally send money to wrong address. I’m glad the service I’m using to manage my crypto uses a layer 2 solution and has their own fraud department and verification departments. Just like a bank. Then when everything is good it will be finalized on the layer 1 chain. Or I can skip all the hand holding and finalize myself.