Monero Project admits thieves stole 6-figure sum from a wallet in mystery breach
Monero Project admits thieves stole 6-figure sum from a wallet in mystery breach
It's the latest in a string of unusual wallet-draining attacks that began in April
You're viewing a single thread.
The linked article (and so AutoTL;DR) is not very accurate. If you’re interested in this incident, read the original post, which is short and compact. General media articles are only quoting or re-quoting this thread, typically with some misunderstanding.
Specifically (about this post): Among other things, multisig is only suggested; nothing has been decided yet.
Generally (in many similar articles): Probably a specific local machine was hacked, though no one really knows yet what happened. It’s unlikely that the Monero network itself was hacked.
Since I’m a Monero supporter, obviously I tend to say good things about it, but frankly, the ironical fact here is, Monero is so privacy-focused that when something like this happens, it’s difficult to identify the attacker—i.e. by design Monero also protects the identity of the attacker. Some Monero users are having this weird, paradoxical feeling: it would be nice if we could catch this evil attacker, but being able to catch the attacker would be in a way very bad news for Monero (if you know what I mean) 😕
I used to be an old school supporter of cryptocurrency too, until that is when the scammers got their mitts into it and it went from a funny little technical hobby worth nothing to an overinflated shitfight that's robbed many people of their life savings.
Honestly, the entire cryptocurrency ecosystem is a parody of its former self and nothing the original inventors of it wanted it to become.
Exactly, except not “the entire”, but “almost entire”?
Monero has been largely detached from CEXes, no companies, no middle men… Many users still have that idealism, a cypherpunk philosophy, that which Bitcoin tried to achieve originally. It’s community-based and crowd-funded… Some of that fund was stolen, so we’ve got to admit that the Monero community was not so smart after all… Yeah, a bit embarrassing tbh. To err is human, I guess.
For example, we do have a zero-fee donation site kuno.anne.media and recently help some girl buy a laptop or doing things like that. Some of Monero users are idealists by nature, maybe silly dreamers or naive philosophers, but definitely not greedy HODLERs. Weird people, either way, haha 😅
I actually used to think crypto is a "weird fad and some thing people use to try getting rich". But then sanctions happened, and now I ADORE Monero. It allows me to easily pay for things I would've otherwise had to jump through hoops for. I am so happy that we at least somewhat have a payment system that can't be controlled)
Originally Bitcoin had nothing to do with “get rich quick”. It felt vaguely like Freenet. It was experimental, philosophical, mathematical, cypherpunk… Almost no one had imagined that investors were going to be interested in it and something like that fad would happen.
Unfortunately it’s not easy to get Monero. In several countries, CEXes don’t support it (delisted). Besides, getting Monero from CEX is not ideal privacy-wise. So, a typical Monero user gets it no-KYC, without using CEX. Which is legal, but rather complicated. That’s why I wouldn’t recommend Monero to regular people.
As you said, Monero is such a great way for payment in a practical sense. Very low fees (~1 cent, no matter how much you send), private (only you can authorize transaction, no need to get a permission from someone else). The community is relatively small (monero.town on Lemmy), but generally nice and cozy. We seldom, if ever, talk about investment… It’s so different from what people think when they hear “crypto”. It’s understandable that some people assume it’s just one of those alt sh*tcoins.
I would not use CEX under any circumstances - they require submitting ID, and I would not trust a random company to keep such data safe. But yea, discovery of sellers is a problem. Was going to go with a Localmonero one before finding someone IRL who sells for cash.
https://monero.town/post/894750 So you did f2f… Glad it works, though. But how to buy it is irrelevant to the OP and is off-topic, so we shouldn’t be talking about that here.
Basically I’d never recommend anyone to buy a significant amount of crypto hoping that you can get rich quick with that. Yes, it might go up, but it may go down. Encouraging such sketchy gambling would be crazy and irresponsible, and more importantly that’s not the original purpose of this technology. Yet you already even know localmonero, so yeah, you’re simply one of us. If you’d like to you can join monero.town or subscribe it from your instance :)
Nah, I don't have much in the wallet - just for the actual expenses)
What would be some examples of things you pay for with monero that you'd usually have to jump through hoops for?
VPS and domain, primarily.
Thanks for the reply. Isn't obtaining Monero more difficult then paying for those things on your card? Or are you doing it for the anonymity?
I personally did it because sanctions made my card not work. So it was either paying with Monero directly, or finding a middleman and hoping he wouldn't scam you, not to mention that the latter would probably have higher fees than a Monero seller. But once sanctions are gone, I would probably continue doing so, just because I prefer not to use my bank card at all)
Very fair point.
I know exactly what Monaro is and you're not looking at it objectively but as a holder and fan. But that's okay I guess, as long as you're not involved in the scams and just like it for what it is. However, you sound a lot like someone preaching about some religion to others and you should be aware of that.
Sorry if I sounded unpleasant. I’m not holding Monero, I actually use it (just like one may use Paypal), is all. Still, as you can see I’m from Monero.town, so obviously I’m a fan. Guilty as charged!
I’ve actually been “preaching” about privacy to my friends, but they’re typically like “Google is fine. I have nothing to hide.” Or about PGP (in vain). But I wouldn’t preach about (recommend) the privacy coin to regular people. Like you pointed out, it’s controversial and risky. As a long time user, I know too well about both sides of this.
The nice thing about the unregulated cryptocurrencies is that everyone loose exactly how much they deserve to loose. No more.
loooooose
There are words that I always spell out wrong unless I do a double check before posting.
However, I've heard somewhere, that this is not necessarily a mistake. Just a language evolving. So I'm not fixing it. /s
edit: Jesus, I did it twice. I wouldn't be so mad if it wasn't a post in which I try to act so smug.
So you were into “let’s invent a fake money so we can get other people’s money” as a thing?
I was into "cool techy nerd thing before it was used to fleece people" thing. When scammers started ripping people off with it we referred to them as shitcoins and a Bitcoin was worth basically nothing.
You have to be quite stupid to support crypto in 2023, after Luna, Ftx, NFTs, all the rugpulls and explicit pump and dumps, you morons just keep coming back for more. That last paragraph is pure comedy gold - you're so close to self-awareness it's hilarious.
- All stablecoins are not stable and a scam, algorithmic ones can't work, since they mimic death spiral financing, and the other ones just gamble their clients money
- Every non-stable coin is just a bigger fool scam, since there is no use case for crypto, so no way to derive a non-speculative value (beyond selling illegal drugs, 419 scams, and couple of enthusiasts trading it personally as donations and the like)
- Crypto destroys customer protections, to do a rollback a few bad transactions you have to convince the entire chain to back you and force a fork, creating an alternative, competing version of the economy
- All consensus mechanisms are geared to allow the wealthy to control the crypto economy, whether it's proof of stake, work or storage, since you can buy all those things with money. They also waste inordinate amounts of energy which translates to an exorbitant transaction cost compared to payment processors like Visa or MasterCard
- Crypto gives great privacy protections to anonymous criminals and scammers and destroys privacy for anyone using the system as a honest user. If you used your crypto wallet as a bank account, anyone with whom you interacted on the blockchain in a non-anonymous capacity (like, idk, your boss at work, sending you your salary) knows your wallet address, and can figure out where your money is going. You can't hide your dildo purchases or campaign contributions from your employer, no matter how many intermediate accounts you create, there will always be a trace. How fun
- Crypto aims to prevent man-in-the-middle attacks, when most attacks nowadays are done through social engineering, which crypto makes trivial, due to it's write-only nature. 419 "Nigerian prince" scammers love crypto - because just like their other favorites money transfer through Western Union or MoneyGram and gift cards it's an irreversible payment method. If you pay with your bank account or PayPal, you can dispute transactions or get a chargeback, aside from forking the whole chain there ain't no way you're doing that with crypto. This also makes it perfect for retail scams.
If you're going to use Luna, FTX, and NFTs as arguments about something like Monero, and I don't want this to sound to mean (hard to convey tone through text), but you probably don't really understand any of them.
I have been both a long time supporter of crypto and the ideas behind it, and I was quick to make fun of the NFTs and have always warned against both keeping large sums money in exchanges and warning against trusting stable coins. I certainly can't garuntee crypto's future, but your argument sounds a lot like somebody saying "a trading card site and two unlicensed online banks went broke so you're stupid for buying Cisco stock" right after the dot com crash.
I reccomend looking into it just a bit more. Even if it's just to be a better anti-crypto advocate.
Ah yes, Monero, from the WannaCry incident, the premier currency for criminals. Also I've made a detailed list of points and most of them (except 1, which is about stablecoins and 5, which only half-applies) apply to Monero. It's still proof of work, so it wastes energy, it still destroys consumer protections, is perfect for scams and makes it even harder for authorities to pursue criminals. And it is still a bigger fool scam, despite being useful for criminals.
“a trading card site and two unlicensed online banks went broke so you’re stupid for buying Cisco stock” right after the dot com crash.
Ftx was one of the largest exchanges for the whole of the crypto market. This is like Goldman Sachs, Wells Fargo and Deutsche Bank all going bankrupt and their execs sentenced to prison at the same time.
(There are no major licensed crypto banks btw)
Addendum: Cisco is a company that offers products and services. Crypto is used by criminals and speculators.
Proof of work does not waste energy. It burns exactly how much it needs to.
it still destroys consumer protections, is perfect for scams and makes it even harder for authorities to pursue criminals.
The very same things that allow these things can allow the people in power to spy on all your digital transactions, as well as deny service to people they don't like (which they would more eagerly do to opposition rather than real scammers)
Oh, and not to mention that even with protections like this, most scams and crime still happen in the "traditional" payment systems anyway.
You don't have to repeat hundred times Monero is used by criminals, and many of us glad for Monero used by criminals.
Before explaining to me "why criminals are bad!!!!": Criminality ≠ morality
Ideally you would want laws to reflect morality. If drugs became legal, monero would no longer be useful for buying them, if that's what you're talking about.
I don't see reason to publicly make financial transactions. So no, if possible i would like to spend Monero for my grocery shopping.
My point on the comparison wasn't that that they're 1:1, but more so when a market does crazy stuff in a speculative frenzy there's things that potentially have legitimate value and things that don't. Comparing potentially good projects to obvious BS isn't really a a good way to debate the value or lack of.
As for unlicensed banks, yeah probably an imperfect comparison, but not entirely irrelevant IMO. Something like Coinbase (that does have licenses BTW) is probably a lot less likely to go bust than some shady exchange based in the Bahamas. Now, as a counter point ftx probably had the appropriate licenses for their US based front, but then just funneled that elsewhere right.
And sure, they were one of the biggest, but back to my original point: in a crazy speculative bubble the scams and legitimate projects all have to be evaluated individually.
Speaking of banks though, its kinda hilarious you brought up Goldman Sachs, Wells Fargo and Deutsche Bank. Last I checked two of the three were kinda involved in a pretty big thing known as the 2008 financial crises and would have collapsed had they not been bailed out. Their executives aren't in prison, but many people believed they should be.
Finally criminal useage is valid criticism, but Monero is not the first thing to be used to transfer illicit funds. Cartels, hitmen, and people who kidnap children for ransom all seem to like cash (well, that and the banks, some of which have a horrendously bad record of transferring illicit funds). If you were to convince me that Monero is making the world a way worse off place then maybe you'd change myind, but right now as it stands it appears a small percentage of criminals find Monero slightly easier than cash and are using it because it's the path of least resistance. Last I checked, the drug trade, computer hacking, and any other active criminal enterprise existed before the use of Monero.
My point is there isn't any other usage to it. People won't use Monero for buying their groceries or online shopping, but its nature lends itself to being used to commit crimes. Cash at the very least has serial numbers - you could possibly track that.
The reasons why it isn't suitable to be used as a currency are exactly what I listed, and you failed to interrogate: volatility, lack of consumer protections, anonymity for wrongdoers, extremely high transaction fees and energy usage, consensus protocols favoring big money and the inability to perform even a basic rollback without splitting the entire economy of your chain in twain.
With e-commerce, you could have someone send you some coins and then not deliver the product. What are they gonna do, get a non-existent chargeback?
As a person who has been buying my groceries with Monero for almost a year, I must dispute that. Is Monero less stable than the US dollar, sure. However, compared to a lot of crypto Monero is quite stable because it has real world use and extremely low transaction fees. monero is also quite stable when compared to (admittidly bad) fiat currencies such as the argentenian peso.
Where are you buying your groceries in Monero? If it's available where I am, I'd like to get in on that.
For now Instacart via Coinsbee
The reasons why it isn't suitable to be used as a currency are exactly what I listed, and you failed to interrogate ...
My original point I meant to make was just that your first argument, XMR = bad because NFTs/FTX/Luna was either that you didn't understand the differences of them, or that you did and were presenting a disingenuous argument.
The other points are more of a come to your own conclusions type of deal. But, if we're on the topic:
Volatility? I'd point out that, yes, it's volital like every other thing that's new. It'll figure out a stable price (what price that'll be, or if it'll be 0, I can't say). New tech and volital speculative markets and all that, churning out crap and jems alike.
Anonymity, consumer protections, & no transaction reverses? Again, cash, see what my take on it is above. + If tracking serial numbers stopped crime they'd be doing that already.
Energy useage? Yup, there's a lot, and that's a good criticism. But as these things grow there's work towards more efficient models. Also, it's not like everything else (from mining gold to making a PlayStation) uses energy in an often inefficient way.
No use as a currency? There's already a growing amount of using it as a currency. A lot of people are talking about the "Monero circular economy" with the idea being a community both earning and spending Monero amongst themselves. There's also a surprisingly large amount of merchants accepting Monero compared to a few years ago, and a large number of crypto services (including Monero) that offer a middleman type service to allow you to spend XMR and have a business get fiat.
Addendum: to elaborate on eccommerce a bit more, last I checked it's a good idea to buy from trusted platforms. What's to stop food I buy from being contaminated with lead? Buying that 80 cent box of pankake mix from wish is just probably a bad idea. So is entering your credit card details and social security number on totallynotascam(dot)legit that you got spam emails about.
Beyond that, though, it's not like Monero existing makes credit cards not exist. Any danger to the user isn't really an argument against something existing if the user chooses to use it.
umber of crypto services (including Monero) that offer a middleman type service to allow you to spend XMR and have a business get fiat.
So you buy Monero with fiat, just to convert that Monero to fiat again, so the vendor can receive fiat? What for?
Political statement? Ease of use? Social experiment? Ideological preference? Spending crypto you were paid in? A stand in until more merchants accept Monero directly? For no reason, but it's not hurting anybody and it's not illegal so why not?
Pick any of the above.
Tell me you don't understand what you're talking about without saying you don't understand what you're talking about. It really sounds like you only get your info about crypto from headlines.
To go through each of your points:
-
There are plenty of stable coins that are stable, such as USDC. Many of them exist for a multitude of different purposes.
-
Non stable coins also can have different uses. Reddit, for example, had its own coin for a while, and Ethereum exists to allow for programmatic transactions (ie: you pay a program to do something, and it'll get done)
-
While it is true that laws around crypto are nowhere near as mature, as they are very new, crypto offers its own consumer protection advantages over fiat. For example, as an attacker it's a metric fuck ton harder to get into a crypto wallet than it is to get into a bank account.
-
What makes you think fiat currencies aren't controlled in the same way?
-
Pick one. Both cannot be true at the same time. While it is true most crypto uses a publicly available ledger, you can only start tracing purchases when you know the identities of the ones holding the accounts. This is muuuuch easier said than done, especially given how easy it is to simply make new accounts with zero identifying info attached to them.
-
If you're the kind to fall for Nigerian Prince scams, you're fucked regardless if you used fiat or crypto. Banks will not refund you over payments you yourself sent.
There are plenty of stable coins that are stable, such as USDC.
For now. All the stable coins that failed were stable until they weren't. What incentive is there to actually providing that kinda service, if you won't make money with it?
Ethereum exists to allow for programmatic transactions (ie: you pay a program to do something, and it'll get done)
NFTs. SAY THEIR NAME
And remember what a resounding success Wolf Game was? As a hobbyst programmer I can tell you there isn't an idea dumber that putting code into something immutable, that you have to destroy, create anew, rename the new thing you made to the old one, while paying for each step of the process, just so that you can fix a bug is a terrible idea.
It's pretty natural that what ended up being contained in those smart contracts was links to jpegs - it's much harder to mess that up than an actual interactive program.
I have too many people hammering me with comments to respond to all your points. I spend like an hour writing responses to you goobers, unless I see something really stupid I'm not responding any further.
So a quick round: 3&6 social engineering is far more common than simply hacking your account. So no, it's the opposite. Also, 6- completely false, why do you think they avoid using bank accounts?
5- I gave you an example where someone would know your identity - if you're using it in a non-anonymous context, like getting paid. It could also be the case when buying something, with your name/delivery address. Unless you go off chain, there is no point of setting up new accounts, as transactions can be traced and connected to the intermediate accounts.
4- Financial policy is decided by elected representatives. Corruption is an issue, but in crypto it's built-in.
For now. All the stable coins that failed were stable until they weren’t. What incentive is there to actually providing that kinda service, if you won’t make money with it?
This is the nature of all emerging technologies. The internet itself went through a similar phase in the late 80s up until the early 2000s. Remember Gopher? NetBeanz?
NFTs. SAY THEIR NAME
I didn't say NFTs because I wasn't talking about NFTs. I was talking about smart contracts. They are two very seperate things.
This is why I say you don't understand what you're talking about and only get your info from headlines.
And remember what a resounding success Wolf Game was?
A shitty flash-style game who's only defining feature is having a blockchain. What of it?
It's not like the regular videogame industry started with Super Mario Bros either.
As a hobbyst programmer I can tell you there isn’t an idea dumber that putting code into something immutable, that you have to destroy, create anew, rename the new thing you made to the old one, while paying for each step of the process, just so that you can fix a bug is a terrible idea
And yet people wrote immutable code all the time in the 80s and 90s. Many people didn't have internet back then, so the only ways to get patches out reliably would be extremely expensive.
Also: it's not like bug fixing traditional apps is free either.
So a quick round: 3&6 social engineering is far more common than simply hacking your account. So no, it’s the opposite.
Again, if someone socially engineers you into sending money, you're shit out of luck when dealing with fiat currencies too.
If you're worried about someone divulging a password and hoping 2FA could catch them, there are hosted exchanges like Coinbase for that. If your person is the kind to give 2FA codes too, again, you're just as fucked in fiat environments; banks do not cover that shit.
Banks will only cover fraud incidences that you can't reasonably be blamed for, like your card details being exposed because a website got hacked. They leave you high and dry when it comes to social engineering.
5- I gave you an example where someone would know your identity - if you’re using it in a non-anonymous context, like getting paid.
If you're that worried, just make another crypto wallet, send the money to that and then make your purchase. Your employer doesn't know who owns that other account. If you're really worried about traceability, use BitTornado, and any would-be hobbyist investigator is fucked.
4- Financial policy is decided by elected representatives. Corruption is an issue, but in crypto it’s built-in.
Cute that you think corruption in fiat isn't part of the design. You do know how, for example, the federal reserve in US works, right?
As a hobbyst programmer I can tell you there isn't an idea dumber that putting code into something immutable
Wut. Immutable OSs are super hip right now
You have no idea what that phrase means.
The "immutable" I'm talking about here is not in the sense of "immutable OS", but rather immutable like punched cards. You literally needed to punch another set of cards if your program contained a bug. You need to create another smart contract to replace your buggy program. Paying gas fees for it.
-
I do agree most cryptocurrencies are scammy, or traded speculatively. It’s a free country, so one can do whatever they want to with their own money, but I personally think they’re like greedy gamblers.
I’m a Monero user, not a trader, not an investor. I have Monero because I use it. I support it because I’m a privacy advocate. I’ve never even once used a CEX, totally unrelated to investment. Your points may be valid for those investor people, though.
You're partially correct with some of these points.
Theatge amount of energy you mention is really only relevant to proof of work. You've mentioned proof of stake etc - so you should know that. The energy requirements for "proof" techniques such as PoS is negligible
Reversing transactions are 'hard'/infesable - and so in a way they do help scammers - but I think it's a false equivalence. It helps everyone. In my mind it's like says "encryption helps terrorists", that may be true, but it helps us all.
Regarding on chain transaction transparency, there are some chains that are like this (bitcoin), and there are some chains that are not (monero). There's also ways to anonymise transactions through mixers etc if you do care about that. Although, I don't know of anyone that gets their salary into their crypto wallet.
Overall, regulation is slow! But it's getting there. I don't think crpyto will solve all of.humans problems, but I might just help with some. It's going to be interesting seeing how it all plays out - people thought it was going to be here and gone in a year, but it's been over a decade now.
Theatge amount of energy you mention is really only relevant to proof of work. You've mentioned proof of stake etc - so you should know that. The energy requirements for "proof" techniques such as PoS is negligible
It can't compete with payment processors. Proof of stake is also basically just oligarchy, while proof of storage is a waste of hardware. All of them center their validation process on big money investors, who either have a lot of hardware or a lot of money to stake.
Although, I don't know of anyone that gets their salary into their crypto wallet.
So it would be useless for things normal money is useful for? Where's the revolution in banking that I heard about? Banking the unbanked?
Regarding on chain transaction transparency, there are some chains that are like this (bitcoin), and there are some chains that are not (monero).
Here you provided users privacy at the cost of making criminals completely untraceable. Bravo.
How about a bank account, where people who know you won't know your transaction history but police can catch people participating in organized crime?
I don't think crpyto will solve all of.humans problems, but I might just help with some
Which ones? I have not heard of one use case, only excuses from you guys.
TradFi has a few wealthy individuals that control banking
You say PoS is an oligarchy, but it still offers anyone to participate in markets they previously were unable to. For example, providing liquidity and getting a cut of transaction fees - this is something TradFi has a monopoly on, but now everyday people can get a cut. You're right that people with more money will have a bigger cut - but it's still more equal than TradFi
In the first sentence reiterated insults, in the second just saying it's a scam, and in the third repeating that it's a scam and (absurdly) denying there's a use case.
I'm not even going to read anymore, I'm interested in the arguments against crypto, but not to see some asshole ranting bullshit.
In the first sentence reiterated insults
Nope. Just pointing out how the feature Monero boasts about (transaction obfuscation) made it a great pick for the conversion target for the ransom bitcoins obtained from the WannaCry cyber attack.
Edit: Are you refering to my first or second comment? In my inbox I assumed the second, since you said "reiterated", but now I see you responded to my first one. Also, all the insults here are warranted. The future cryptobros want for finance is a dystopian one.
cryptobro mad!
As you yourself out it, the issue with monero is that it is designed to protect attackers.
I think I know what you’re trying to say, and that’s actually a difficult point. Privacy is double-edged.
By that logic, you’d have to support chat control, e2e backdoor, eIDAS 45, etc. and ban Tor, Tails, VPN, BitTorrent, or encrypted communication in general because sometimes criminals can (and do) abuse such technology too. While such logic is understandable, I’m a privacy advocate and can’t agree with that. Most libre people, EFF, FSF, etc. have been fighting against that very logic for more than 20 years. I’m one of them.
It's designed to protect anyone using it - even attackers.
That's the price to pay for having privacy.
The alternative is an Orwellian dystopia.Really?
Please show me in which of Orwell's writings he suggested that economies should be based off allowing financial criminals to commi their crimes against citizens, unimpeded.
The thesis of 1984 is that when totalitarianism takes hold, we will turn on those we love to protect ourselves. Which specific portion of that novel do you believe told you that true freedom is getting your money stolen with no recourse?
This is primarily the issue with libertarians. You guys are constantly applying a book you haven't read to every situation you don't like. It's weird and I think people see through it.
Please show me in which of Orwell's writings he suggested that economies should be based off allowing financial criminals to commi their crimes against citizens, unimpeded.
I don't need to and I won't, because I never said so.
Please don't put words in my mouth.The thesis of 1984 is that when totalitarianism takes hold, we will turn on those we love to protect ourselves.
I was thinking of 1984, too; obviously.
I see it in a more abstract way though.
The consequences of mass surveillance, which are the basis of repressive regimentation of people are what makes lack of privacy dangerous and in my book not desirable - even if it has certain drawbacks, because abandoning privacy just has way more and more severe drawbacks.This is primarily the issue with libertarians. You guys are constantly applying a book you haven't read to every situation you don't like. It's weird and I think people see through it.
This is primarily the issue with people who think they know others because they've read one comment.
It's weird and I think people see through it.edit: typos
It's designed to protect "users".