[HN Gopher] Hamilton teen embroiled in FBI probe, fingered in $4...
       ___________________________________________________________________
        
       Hamilton teen embroiled in FBI probe, fingered in $46M
       cryptocurrency theft
        
       Author : x1ph0z
       Score  : 86 points
       Date   : 2021-11-24 15:29 UTC (7 hours ago)
        
 (HTM) web link (www.thespec.com)
 (TXT) w3m dump (www.thespec.com)
        
       | Jerrrry wrote:
       | another bitcoin bandit bites the dust.
       | 
       | I bet he bought an xbox gamertag from the most recent exploit.
       | 
       | These kids really do think the 3 letter agencies arent watching,
       | no matter how many of their close friends get v&.
       | 
       | The blockchain is forever, and the statue of limitations no
       | longer applies.
       | 
       | That verizon/att employee from 2018 will get caught, he will give
       | up an alias, and the feds are interested, now that the coins have
       | value.
       | 
       | and assuming the feds arent dirty (they are), you have 5 years to
       | run. If the fed assigned to your case decides he wants the coin
       | personally, you have 5 monthes.
        
         | the_optimist wrote:
         | What's the likelihood that the other $39M is parked with the
         | prosecuting agents?
         | 
         | https://www.justice.gov/usao-ndca/pr/former-federal-agents-c...
        
           | Jerrrry wrote:
           | Not 0.
        
         | paulpauper wrote:
         | lol way too premature to say that. if he gets off easy by being
         | a youth, he can still walk away with tens of millions of
         | dollars. If the rest of the btc cannot be recovered, likely
         | when he is released from jail or custody, assuming he is even
         | convicted, he will still have it. If he is not extradited and
         | charged in the US, then he is pretty much guaranteed to exit
         | with his fortune intact. Canada has pretty lenient justice
         | system.
        
       | NicoJuicy wrote:
       | > "Just the fact that everyone on earth thinks that Bitcoin is
       | crazy, and no one is telling me why, doesn't matter,"
       | 
       | Says the biggest known victim of a crypto heist in a private
       | person.
       | 
       | Ain't this ironic.
       | 
       | I guess I should spell out that centralization is a feature?
        
       | vmoore wrote:
       | So some exchanges use TOTP 2FA (which is more secure than SMS).
       | And some people like to copy their 2FA 'seed' which is usually a
       | QR code that they store somewhere securely. Amazing how a simple
       | QR code (or even a recovery code) can be worth so much.
        
       | jaywalk wrote:
       | If you're going to steal a large amount of Bitcoin, you should
       | probably have a plan on what you're going to do with it that
       | doesn't include buying a gaming username that can be trivially
       | traced back to you once you use it.
        
       | 323 wrote:
       | It's easy to steal bitcoin (for some definition of easy).
       | 
       | The hard part is cashing it out. As Breaking Bad used to say,
       | what criminals want is to pay taxes on their criminal proceeds.
        
         | miohtama wrote:
         | Here is my guide for laundering Bitcoin
         | https://capitalgram.com/posts/how-to-money-launder-bitcoin/ -
         | it should give some useful tips.
        
           | 323 wrote:
           | Anyone using your guide will be caught if the FBI goes after
           | them.
           | 
           | Your guide basically says use Binance/OTC, a fake ID and this
           | bank.
           | 
           | And you have zero stuff about actual money laundering - ie,
           | justifying $46 mil suddenly appearing in your name.
        
             | miohtama wrote:
             | > And you have zero stuff about actual money laundering -
             | ie, justifying $46 mil suddenly appearing in your name.
             | 
             | In China and Russia they give you a party membership if you
             | manage to steal such an amount from a Western individual or
             | a company.
             | 
             | In Dubai, that is an US ally, they just do not care. You
             | can march to a shop with $2M cash or Bitcoin and buy a
             | lambo. Just move to Dubai. They have financial regulator
             | compliance, but it is just on the paper and in real life
             | you get away with anything. Dubai is for crooks and shady
             | money. These is no extraction treaty. The lifestyle is
             | bling bling, good for crooks that want to flash their
             | rolexes.
             | 
             | You need to be really really stupid getting caught in
             | Dubai, but it may happen if you are too outrageous:
             | 
             | https://www.bbc.com/news/world-africa-53361490
        
             | paulpauper wrote:
             | pro tip: you don't have to launder $46 million at once. you
             | can treat it like a lottery annuity and just skim off a
             | little here and there.
        
               | 323 wrote:
               | Some years ago a Dutch teen bought a house with $100k
               | money from stolen bitcoin. He was caught and arrested
               | because he couldn't justify the money.
               | 
               | You also need to worry about algos that 10 years from now
               | will analyze bank transfers, purchases ...
        
               | miohtama wrote:
               | Just move to a place where they do not worry about
               | justifying the money
               | 
               | https://news.ycombinator.com/threads?id=miohtama#29331616
        
             | Matheus28 wrote:
             | Bitcoin makes this trivially easy... "I mined it a long
             | time ago and forgot about it until now"
        
               | akozak wrote:
               | Isn't that easily verifiable?
               | 
               |  _One expert told us that the chance of catching illicit
               | actors is "magnitudes greater" using blockchain than in
               | the traditional banking sector. Another went so far as to
               | say that "if all criminals used blockchain, we could wipe
               | out illicit financial activity."_ https://cryptoforinnova
               | tion.org/resources/Analysis_of_Bitcoi...
        
               | [deleted]
        
               | paulpauper wrote:
               | except that everything is time stamped
        
       | jrootabega wrote:
       | If you own a lot of crypto and it's still protected by SMS auth,
       | you need to disable that (edit: in favor of OTP). If you can't,
       | you need to buy a dozen prepaid sim cards and use them randomly.
       | Or pay someone to do it for you. Very cheap in comparison to a
       | theft.
        
         | raverbashing wrote:
         | Or maybe anyone that claims to be a security person worth their
         | salt (on the companies doing 2fa) need to sunset SMS 2fa and
         | use OTP instead, at least
        
           | jrootabega wrote:
           | True, and coinbase appears to do that (I say "appears to"
           | because I don't know what they would do if I actually tried
           | to reset my password and cajoled them into using my phone
           | number to do it.)
           | 
           | Unfortunately, some orgs, and even more unfortunately, some
           | banks, still require/force SMS mfa.
        
         | sombremesa wrote:
         | > you need to disable that
         | 
         | Might need a bit more elaboration there. You want people to
         | turn off 2fa?
        
           | jrootabega wrote:
           | In favor of offline OTP I meant. Although there's a case to
           | be made that having no mfa might be more secure than SMS mfa,
           | if that can be used to recover access to your account (at
           | which point it is no longer Mfa, but just a)
        
         | throwvirtever wrote:
         | Wouldn't a dozen prepaid SIM cards mean 12 times as many things
         | to defend? Also wouldn't anyone you paid to "do it for you"
         | need to be trusted, undermining the no-trust principle of
         | cryptocurrencies?
        
           | jrootabega wrote:
           | Yeah, it would require some thought. If you randomly rotated
           | through the different sims it might help. I was thinking that
           | someone else might be a good idea so that it would be harder
           | for an attacker to figure out your number. I'm assuming that
           | if you buy any phone service, prepaid or postpaid, that
           | someone would be able to find it on those people search
           | sites. But maybe all you really need is to have a number
           | strictly dedicated to each value store, never used for
           | communications.
        
       | glofish wrote:
       | When random teen can easily steal $46M from a "Bitcoin pioneer"
       | what hope is that for regular folks could make safe use of said
       | value store?
        
         | DennisP wrote:
         | The bitcoins were stored on a centralized exchange using a
         | phone number as 2FA. Banks and brokerage accounts can be hacked
         | the same way, though at least they'll make you whole if you
         | catch it soon enough.
         | 
         | To really secure bitcoins, a hardware wallet or a passphrase in
         | a safe deposit box are both pretty simple options that
         | nontechnical people use all the time. Neither is expensive and
         | both are widely known.
        
           | adventured wrote:
           | > Neither is expensive and both are widely known.
           | 
           | I'd say that ~97%-99% of the people in the US and Europe have
           | no idea how to use a hardware wallet. The vast majority have
           | no idea what a hardware wallet is. You're very far off the
           | mark in your estimate.
           | 
           | Bitcoin is at the adoption stage where the general public is
           | only beginning to use services like Coinbase. They do not
           | know how to use a hardware wallet, most of them do not know
           | that such a thing exists.
        
             | darkwater wrote:
             | > Bitcoin is at the adoption stage where the general public
             | is only beginning to use services like Coinbase. They do
             | not know how to use a hardware wallet, most of them do not
             | know that such a thing exists.
             | 
             | You are creating a persona tailored to back up your
             | argument. It is not that strange that a good chunk of
             | "common people" buying _right now_ bitcoins know what an
             | hardware wallet is, at least as a concept (not the tech
             | implementation obviously).
        
             | hanniabu wrote:
             | The vast majority of people _in crypto_ know what a
             | hardware wallet is
        
               | spiderice wrote:
               | Not really sure how this is relevant, seeing how the
               | original comment said
               | 
               | > what hope is that for regular folks could make safe use
               | of said value store
        
               | DennisP wrote:
               | I just googled "how to safely store bitcoin" and a bunch
               | of articles with good, simple advice came up.
        
           | 1024core wrote:
           | > a passphrase in a safe deposit box are both pretty simple
           | options
           | 
           | _If_ you can get a safe deposit box in your bank, that is. My
           | local bank (Chase) is always sold out of boxes. Sure, you'll
           | next say: change your bank. But the other one (BoA) is also
           | out.
           | 
           | My point is, it's not such an easy option as you're making it
           | out to be.
        
             | diveanon wrote:
             | Maybe stop going to big corporate banks?
             | 
             | I got one last week without any issue.
        
             | [deleted]
        
             | neilv wrote:
             | When I shopped for a local bank branch that had safe
             | deposit boxes (maybe decade ago), one of the bankers told
             | me a lot of banks and branches were trying to get rid of
             | their boxes, and not wanting to include boxes in new
             | branches.
             | 
             | I managed to get a box in the basement of the BofA in
             | Harvard Square back then, and kinda wish I'd kept it, since
             | I doubt I could get one today.
        
             | sombremesa wrote:
             | Funnily enough my bank very recently made me sign an
             | agreement which precluded me from subleasing my safe
             | deposit box. Maybe this is the next arbitrage opportunity.
        
           | TuringNYC wrote:
           | This explanation doesnt make total sense to me, so 2FA, by
           | definition is two-factor. This explains how one factor was
           | compromised. How was the other factor compromised?
        
             | jrootabega wrote:
             | You may be right. A lot of orgs will happily let you use
             | SMS for 2FA at login, but let you recover your account with
             | that same SMS, making it 1FA x 2 (or 0FA, to line up with
             | RAID 0)
        
             | np_tedious wrote:
             | Probably password reuse, then leaked. Like you'd see on
             | https://haveibeenpwned.com/
        
           | Blackstone4 wrote:
           | The difference is that often the institutions (i.e. banks and
           | brokerage firms) are often repay lost funds or can reverse
           | the transactions where as here it is a lot harder.
        
           | breakfastduck wrote:
           | So back to shoving cash under the bed, essentially.
        
           | viro wrote:
           | This shows a fundamental misunderstanding of how
           | cryptocurrency works. Bitcoins aren't stored anywhere. You
           | don't need to get hacked; to have your bitcoins stolen.
        
             | DennisP wrote:
             | If you want to be pedantic about it, you have to store your
             | private key securely.
        
           | tobyjsullivan wrote:
           | Holding the coins is one thing, transferring is another. I
           | just transferred my bitcoin out of my paper wallets. I can
           | promise you there is absolutely no way for a non-technical
           | person to do this safely. What are they going to do? Visit
           | some random website to sweep their wallets and hope their
           | private keys are not stolen (which they will be)?
           | 
           | I haven't used a hardware wallet - I suspect they solve the
           | transferring problem. But what's the risk my hardware wallet
           | still works a year from now? 10 years from now?
           | 
           | I decided trusting Coinbase in 2021 is the most reasonable
           | option for the amount I have. (Different calculus back in
           | 2016). I admit I don't know what I'd do with 8-figure
           | balances though.
        
             | DennisP wrote:
             | Hardware wallets do solve that problem. Keep your 24-word
             | passphrase somewhere safe, and you can use that to restore
             | your keys into any hardware wallet, without plugging it in
             | to a computer. The passphrase algorithm is a public
             | standard, so if your hardware breaks, you can restore onto
             | another one.
             | 
             | After that, plug the hardware wallet into a computer and
             | you can transfer without the computer ever seeing your
             | private key. The hardware wallet displays the destination
             | address, which you should check.
             | 
             | I do agree that Coinbase is reasonably safe, as long as you
             | use a strong password and 2FA, and don't give them your
             | phone number.
        
         | tigereyeTO wrote:
         | People steal USD from companies and people all the time.
         | 
         | "What hope is that for regular folks could make safe use of
         | said USD?"
        
         | azth wrote:
         | It will take some time for the infrastructure to mature.
        
           | cactus2093 wrote:
           | It's been 10 years, meanwhile everyone is hyping up how
           | awesome and fast-moving the "web3" space is and how all the
           | best developers have left their day jobs and are building for
           | it. What's taking so long?
        
             | hanniabu wrote:
             | They're literally building all the foundational
             | infrastructure from scratch. It took the web a long time to
             | mature as well.
        
               | astoor wrote:
               | web3.js has been around for at least 5 years. Think how
               | much the WWW evolved in that amount of time.
        
           | danielvaughn wrote:
           | I might be wrong, but my concern is that attackers will
           | mature as well. At the end of the day, putting your security
           | entirely in your own hands is a level of liability that most
           | people aren't willing to take on. I like some of the ideas in
           | the cryptocurrency space, but I really wish they would openly
           | contend with the fact that centralization has its benefits.
        
           | djbusby wrote:
           | And until then? We just say "oh, fraud, oh well"?
        
             | VWWHFSfQ wrote:
             | This is what banks and credit card companies do already.
             | It's the cost of doing the business. If someone steals your
             | credit card and uses it then you're not responsible, the
             | bank is. And you get your money back. But there's no such
             | recourse or security for individuals in this new system.
        
             | azth wrote:
             | Straw man argument.
        
         | Jerrrry wrote:
         | The issue is that most communication is centralized between two
         | companies, Verizon and ATT, and those companies have employees
         | that are very, very fallible.
         | 
         | We need to decentralize our communication infrastructure.
        
           | mindslight wrote:
           | That's a problem for sure, but it's not the problem here. The
           | problem here is cryptocurrency trustees implementing snake
           | oil "2FA" using the PSTN, which was never intended to provide
           | the needed security properties.
        
           | mym1990 wrote:
           | No real reason to point the finger at people at Verizon and
           | ATT are more fallible than others. Almost anyone can fall for
           | social engineering if done right/often enough. I know you
           | probably think you're too smart to be fooled like that, but
           | that's exactly how you'll fall to a scam.
        
             | Jerrrry wrote:
             | The people Verizon/ATT are more fallible, because of the
             | implicit risk/threat model that is imposed on us by
             | duopolistic infrastructure.
             | 
             | They have vastly more power without the required training.
             | 
             | This asymmetry makes them larger targets, and therefore,
             | more fallible.
             | 
             | ATT/Verizon employees are the weakest link in almost all
             | threat models, including our national one.
             | 
             | I don't think I am personally infallible; and I am/used to
             | be the reason you have to take cyber, social engineer, and
             | spear attack trainings every year.
             | 
             | It is because I know the true weakest links (humans with
             | unrelegated access) that compel me to remind others:
             | 
             | do not use SMS for 2FA.
             | 
             | There are other ways of getting the nonce/temporal secret
             | to the end-user without pitting the security to a
             | overworked 27 year old druggy CSR in upstate new york.
        
         | lvass wrote:
         | The stolen sum was taken from a centralized, bank-like account.
         | Not your keys, not your coins.
         | 
         | Given how incredibly likely people are to trust these
         | untrustworthy organizations, not much hope regular folks can be
         | safe.
        
       | WFHRenaissance wrote:
       | Does his name happen to be Freddy?
        
       | walrus01 wrote:
       | This is a fine example why nobody should rely on SMS "2FA" for
       | anything.
       | 
       | SMS "2FA" is not actual 2FA
       | 
       | SS7/PSTN are horribly broken. People need to stop using them
       | entirely, whenever possible, and stick to that as a firm
       | principle. For the same reason why scam calls and fake caller ID
       | are epidemic. Just disregard the _existence_ of the PSTN, even if
       | your phone has a DID, never give it to anyone or use it for
       | anything. I say this as someone who 's worked in telecom for 20
       | years.
       | 
       | Social engineering mobile phone operator customer service
       | departments to execute a SIM swap attack is trivially easy if you
       | already possess some basic personal info about the target.
       | 
       | You should never rely on having something important that's only
       | protected behind a SMS-based password reset/login authentication
       | module.
        
         | hn_throwaway_99 wrote:
         | People love to say this, and while I agree with the general
         | gist, there are a couple problems with this statement:
         | 
         | 1. For large swaths of the population, hardware key-based 2FA
         | or TOTP-based 2FA are too difficult to use, and they can also
         | be more difficult to remediate if the user loses the hardware
         | key or TOTP secret.
         | 
         | 2. SMS 2FA _is_ much better than nothing for most people. The
         | bigger problem is when SMS can be used as just a _single_
         | factor in account recovery scenarios.
         | 
         | 3. There is a push to make telecoms more responsible for sim-
         | swapping fraud: https://krebsonsecurity.com/2021/10/fcc-
         | proposal-targets-sim...
        
         | croutonwagon wrote:
         | Surprisingly it's usually banking and investment company's that
         | require SMS based MFA. Including my main 401k brokerage.
         | 
         | In those cases I keep a google voice number. It's also the same
         | number I use to give to anyone/any company and it's just on do
         | not disturb 24/7. If I need to deal with a company on that
         | number I just turn off DND. This practice of never giving out
         | my actual number has drastically decreased the number of "car
         | warranty" trash calls to my actual phone. They all go to that
         | and generally a message is never left, and the phone doesn't
         | ring. Sometimes I get a voicemail of 3 seconds of dead air but
         | that's it.
         | 
         | I know a lot of people de-google but my thought is this isn't a
         | normal PSTN endpoint, and it's not nearly as easy to sim swap,
         | if not impossible but still works as a second factor. And I'm
         | not aware of another service that can do it better and like it
         | or not, google is a big target so I trust their auth over some
         | other fly by night competitor.
        
           | walrus01 wrote:
           | My strategy for people that need to reach me by voice
           | involves a one step IVR on my own asterisk system. This IVR
           | is linked to a DID that I give out for this purpose. It
           | answers and has a voice greeting prompt that says something
           | like "press five zero zero to be connected". If someone does
           | that, x500 initiates a new outbound call to my _actual_
           | number, preserving the calling party 's caller ID.
           | 
           | This cuts down on 99% of your car's extended warranty and IRS
           | scam calls.
        
       | ChrisArchitect wrote:
       | Is this Hamilton, Ontario, Canada?! Unclear
       | 
       | Also, Josh Jones, the founder of DreamHost? wow. heh
       | 
       |  _Edit_ : Sorry, because I read it on outline/archive I didn't
       | see the glaring Hamilton Spectator logo at top and related Canada
       | nav. Thanks
        
         | latchkey wrote:
         | Yes, the same Josh Jones.
         | 
         | He also created bitcoinbuilder.com, which among other things,
         | brokered the sale of people holding Mt. Gox bitcoin after it
         | collapsed. If you held bitcoin on Mt. Gox, you could sell it to
         | him and he then resold those rights.
         | 
         | Now that it looks like there is a settlement coming next year,
         | he is still sitting on a mountain of coin.
         | 
         | Pretty amazing that he got hacked. He is super technical. In
         | other words, it can happen to the best of us.
        
         | smnrchrds wrote:
         | It is in the text as well.
         | 
         | > Jones first reported the theft to the Los Angeles FBI, who
         | then brought in other U.S. and Canadian agencies as the
         | investigation grew.
        
       | n3dm wrote:
       | Ugh, paywall.
        
         | DennisP wrote:
         | https://archive.md/5oAva
        
       | ashconnor wrote:
       | https://archive.md/5oAva
        
       | hsnewman wrote:
       | This, along with the energy requirements of crypto is why I
       | don't/won't put any money in it.
        
         | hunterb123 wrote:
         | Under that reasoning you shouldn't interact with any humans or
         | technology at all.
         | 
         | There should be a rule against regurgitating talking points
         | without adding to the discussion, but I'll humor you.
         | 
         | I invest solely in crypto because the banks and federal reserve
         | have scammed the common people more than any sole individual.
         | 
         | The government prints money knowing full well the common person
         | will bear the burden of inflation.
        
       | ziddoap wrote:
       | For those without subscriptions. https://outline.com/3CRjpe
       | 
       | > _That post has since been taken down, but many comments
       | included criticism for leaving such a large amount of Bitcoin
       | accessible on a phone._
       | 
       | Not to victim blame, but it really is odd to me that someone
       | would leave any amount of BTC on their phone, let alone millions
       | of dollars worth.
       | 
       | > _The Hamilton teen faces charges of theft over $5,000 and
       | possession of property or proceeds of property obtained by crime_
       | 
       | I've always wondered why the line is drawn at $5,000. It's mildly
       | interesting that stealing $46M and stealing $5,000 result in
       | equivalent charges.
        
         | nerdawson wrote:
         | Could it have been on an exchange or something that used his
         | number for 2FA? I'm not sure how else a SIM swap could lead to
         | access.
        
           | Jerrrry wrote:
           | It was a major exchange that did not understand what the 2 in
           | "2FA" meant, yes.
           | 
           | Most exchanges did not have proper 2FA until the sim-swath-
           | swoop of 2018-2020.
        
             | nerdawson wrote:
             | I hate when companies ask for my phone number on sign up.
             | At no point do I ever want that used for auth!
             | 
             | The first thing I usually do is enable OTP but I know some
             | companies will still fallback to SMS.
        
             | miohtama wrote:
             | All major exchanges have supported TOTP (time codes) based
             | 2FA since 2014. However it is a different matter if they
             | force users to use TOTP, as it hinders adoption. Need to
             | get that IPO done first.
        
           | ziddoap wrote:
           | Yes, I should have been more accurate and said "accessible by
           | phone", not necessarily _stored_ on the phone.
           | 
           | One would think with any significant amount of crypto that
           | you store it somewhere non-network accessible (at the very
           | least, not holding it all in a single online exchange).
        
           | miohtama wrote:
           | Yes. Likely Coinbase. SIM swap is such a well known attack
           | vector, so it is pure stupidy to leave such high amount
           | behind an SMS.
        
             | AlexCoventry wrote:
             | Seems kind of crazy to leave that amount on an exchange at
             | all.
        
               | amatecha wrote:
               | Yeah like, this happened years after the mtgox debacle...
        
         | PragmaticPulp wrote:
         | > Not to victim blame, but it really is odd to me that someone
         | would leave any amount of BTC on their phone, let alone
         | millions of dollars worth.
         | 
         | The SIM swap attack was used to access an online service where
         | the BTC was stored.
         | 
         | I know the classic cryptocurrency trope is that Bitcoiners will
         | move money to a paper wallet and then store the passphrase
         | securely somewhere, but in reality that's about as attractive
         | as cashing it out as 46 x (hypothetical) $1 million dollar
         | bills and storing it in a safe.
         | 
         | In other words: Most people who have that kind of money
         | _really_ don 't want to do anything like that. Most people who
         | _don 't_ have that kind of money really overestimate how easy
         | it is to safely and securely store something like that.
         | 
         | But that's beside the point. We could debate all day about
         | storing paper wallets in bank safety deposit boxes or using
         | Shamir's Secret Sharing or any other number of increasingly
         | complex scenarios, but in practice most with that kind of
         | wealth aren't really interested in locking it away and not
         | touching it. If they want to make an investment, trade, or
         | purchase, do they jump through all of the hoops to unlock and
         | move some of the money and then securely store it all away
         | again? Surely someone might, but in practice most people want
         | it somewhere that that can trade, invest, transfer, and access
         | with reasonable security.
         | 
         | This inevitably turns into one of those internet OpSec debates
         | where people on the sidelines imagine scenarios where they are
         | smarter than the victim (with the benefit of hindsight, of
         | course), but in reality there are many, many people out there
         | storing vast amounts of wealth accessible by 2FA with their
         | phone and it's rarely ever a problem. Cryptocurrency makes this
         | more complicated because the transactions are irreversible,
         | fast, and (somewhat) easy to hide.
         | 
         | So if you happen to be internet famous for bragging about your
         | Bitcoin wealth, definitely take steps to make it impossible for
         | people to access it via phones or anything else. But you also
         | probably want to obscure your physical location and invest in
         | personal security, because in-person attacks are the next step.
         | But in reality, a huge number of people have access to a lot of
         | funds via digital access without such problems on a regular
         | basis. It's fun to fantasize about ultimate OpSec, but in
         | practice most people want the money accessible and tradeable on
         | short notice.
        
           | ziddoap wrote:
           | I'll leave alone all of the comments which imply I don't know
           | what I'm talking about and that I'm not very smart, suffice
           | to say you don't need crazy secret sharing systems or bank
           | deposit boxes or anything of the sort to prevent this attack.
           | 
           | A dead-simple soft-wallet, which requires about 2 steps to
           | setup and 2 more to transfer and hold your millions of
           | dollars in, would have prevented this. Roughly 15 minutes of
           | time, at most.
           | 
           | You don't need to be the NSA to secure your crypto, as you
           | seem to be implying.
        
             | PragmaticPulp wrote:
             | > You don't need to be the NSA to secure your crypto, as
             | you seem to be implying.
             | 
             | I said that people keep their funds hot to _use_ them, not
             | that you need to be the NSA to secure them.
             | 
             | Trust me, I know how to set up a crypto wallet and secure
             | it.
        
           | wmf wrote:
           | Hardware wallets aren't that cumbersome to use; it only takes
           | a few minutes to move coins on/off. Waiting for confirmations
           | takes longer than dealing with the wallet. For daytrading
           | you'd definitely want to keep coins in an exchange though.
           | 
           | I'm speaking neither hypothetically nor in hindsight since I
           | pre-ordered the first hardware wallet back in the day and
           | have never lost coins.
        
           | trompetenaccoun wrote:
           | A paper wallet can be password protected. Shamir's Secret
           | Sharing can also be used with paper wallets. Practically
           | everyone who messes around with serious amounts of crypto
           | money has a more sophisticated setup than keeping it on a
           | phone, even many people who only have a few hundred dollars
           | worth have hardware wallets like a Trezor. Just because cases
           | like the above happen doesn't mean they're the norm. Every
           | once in a while you also read stories about someone leaving
           | their suitcase full of cash on a train or such. But that
           | doesn't mean the average cash user is that careless.
        
           | kragen wrote:
           | > _I know the classic cryptocurrency trope is that Bitcoiners
           | will move money to a paper wallet and then store the
           | passphrase securely somewhere, but in reality that 's about
           | as attractive as cashing it out as 46 x (hypothetical) $1
           | million dollar bills and storing it in a safe._
           | 
           | That's very hypothetical, though. There are a few key
           | differences:
           | 
           | 1. Moving money to a paper wallet is not difficult in
           | practice. Ideally, yes, you would generate the private key in
           | an air-gapped computer running a secure operating system and
           | print out the private key and the Bitcoin address, then
           | incinerate the computer, storing away a second identical
           | computer that doesn't have the wallet on it yet, and that
           | would have a similar level of difficulty to buying and
           | installing a safe. In practice, you can probably get better
           | security than a physical safe just by generating a new wallet
           | in Electrum, writing down the seed phrase, and deleting the
           | wallet from Electrum. When you need to spend some of the coin
           | you can reanimate the wallet, sign a transaction, and delete
           | it from Electrum again. If your cellphone is backdoored then
           | the thieves can loot your wallet at reanimation time, but
           | that's probably harder than drilling a safe, most of the
           | time.
           | 
           | 2. As you point out, million-dollar bills are hypothetical.
           | The largest US dollar denomination ever printed was US$10k,
           | and the largest in circulation since 01969 is US$100. So, in
           | practice, you're talking about a safe containing 460,000
           | US$100 bills, which will be very difficult to either acquire
           | or dispose of without getting robbed.
           | 
           | 3. The dollar inflates, by design, so it's a terrible
           | investment. It's lost 96% of its value since the end of the
           | gold standard in 01971, and an additional 6.2% over the last
           | year. That's the reason why a safe full of dollar bills is a
           | total failure for wealth preservation. Bitcoin suffers from a
           | lot of volatility but it's structurally designed to not
           | suffer from secular inflation, and in fact one of the
           | principal criticisms of Bitcoin is that it's inherently
           | _deflationary_. It seems to have returned an average of about
           | 150% per year over the last 10 years: https://bitcoincharts.c
           | om/charts/bitstampUSD#tgSzm1g10zm2g25..., and while that
           | trend surely must be nearly over (it can't continue for more
           | than another 5 years and might already be over), it also
           | clearly hasn't been suffering from inflation. In this sense,
           | the most important difference, the dollar and Bitcoin are
           | opposites.
           | 
           | Yes, it's true that there are people who like to gamble by
           | day-trading cryptocurrencies, but most people who do that end
           | up losing all their money. Investing wealth doesn't require
           | your assets to be "accessible and tradeable on short notice";
           | it requires rebalancing asset classes every three months.
           | Berkshire Hathaway makes a few dozen transactions per year.
           | You don't need to make more transactions than Berkshire
           | Hathaway.
           | 
           | You say, "there are many, many people out there storing vast
           | amounts of wealth accessible by 2FA with their phone and it's
           | rarely ever a problem," and in a sense that's true; it's
           | relatively unusual to have a meltdown like the Argentine
           | collapse of 02001 (where all bank depositors lost all the
           | dollars they had in the banks), Mt. Gox in 02014 (where all
           | Bitcoin depositors lost all their Bitcoin, about 850,000 BTC
           | or US$450M), Bitfinex in 02015 (where their depositors lost
           | about 1500 BTC), the Greek banking system in 02015 (where
           | Greeks were prohibited from carrying more than 3000 euros out
           | of the country and could only withdraw a limited amount of
           | cash from their bank accounts for three years), and Bitfinex
           | in 02016 (where their depositors lost 119,756 BTC).
           | 
           | But it would be a terrible mistake to conclude that, just
           | because an event like this happens only about once every four
           | years, it is unlikely to happen to you. It's true that it's
           | "rarely ever a problem", but when it _is_ a problem, it 's a
           | problem for millions of people, sometimes hundreds of
           | millions. Hosted wallets do not and cannot offer "reasonable
           | security".
           | 
           | Today I see a lot of people who are "trading Bitcoin" but
           | actually holding Tether in Binance accounts (which has
           | replaced LocalBitcoins as the retail hosted wallet of choice
           | here in Argentina).
           | 
           | Tether has historically been backed by fraud, and it's
           | operated by Bitfinex, which (as noted above) has a history of
           | its customers' money mysteriously disappearing, and which is
           | locked out of the world banking system.
           | 
           | Binance is banned in the US and UK, is being criminally
           | investigated by both governments, and has had to move its
           | headquarters from China, to Japan, to Malta, which also says
           | they're investigating it. It's also being prosecuted in
           | Thailand.
           | 
           | Without casting any aspersions on the integrity of Binance's
           | people, it's clear they're at significant risk of having
           | their assets confiscated, at which point all of their
           | depositors would lose their deposits. And Tether is at
           | significant risk of collapsing, either due to fraud or to
           | mismanagement. So these people are dancing on a tightrope,
           | and most of them don't even know it.
           | 
           | So, run a wallet on your own hardware. At least a thin wallet
           | like Electrum. Or get a Trezor.
        
         | kube-system wrote:
         | > It's mildly interesting that stealing $46M and stealing
         | $5,000 result in equivalent charges.
         | 
         | The reason for the differentiation is not to make a $5k theft
         | and a $46m theft equivalent. There is a threshold because, for
         | instance: stealing some pocket change is not a serious crime,
         | and stealing large amounts of money is serious.
        
           | ziddoap wrote:
           | > _stealing some pocket change is not a serious crime, and
           | stealing large amounts of money is serious._
           | 
           | I'm curious if you actually think that I wasn't aware of
           | this? I don't think many people need that pointed out to
           | them.
           | 
           | My comment was on the arbitrariness of the line, or why there
           | is a single line at all (opposed to a gradient, or multiple
           | "theft over x" categories, etc.).
        
             | kube-system wrote:
             | To be more specific, the reason for that single line is
             | because some legal systems (like in the US) have different
             | "classes" of offense. That line is the differentiation for
             | which class the crime is. The lesser could be a "summary
             | offense" or "misdemeanor" and the higher a "felony"
             | 
             | I, of course, was not suggesting that you didn't know the
             | difference in seriousness. I am stating that the difference
             | in seriousness is the reason for the line, because the
             | underlying legal system generally differentiates crimes
             | this way.
        
               | ziddoap wrote:
               | Fair enough. I suppose if a single line must be drawn, it
               | must be drawn somewhere. And that line is apparently
               | $5,000.
        
               | ALittleLight wrote:
               | It could be a function of amount stolen, victim's wealth,
               | perpetrator's wealth.
        
               | kube-system wrote:
               | That could very well be a sentencing guideline even if
               | the crime is still called "theft over $5000"
               | 
               | Just because a crime has a title [x] doesn't mean that
               | the sentence is always [y]. Often the laws will provide
               | for a range of sentencing depending on other factors.
        
         | elliekelly wrote:
         | I could be mistaken but it looks like the $5,000 is from the CA
         | Computer Crimes statute. For larceny (theft of personal
         | property) in CA the bar is even lower: $950.
        
           | ziddoap wrote:
           | Yep, in Canada there is two "thefts" generally: over $5,000
           | and under $5,000.
           | 
           | I was charged with theft under 5 when I was 14 after stealing
           | two candy bars and a drink from Walmart. Same charge as I
           | would of had if I stole a 70" flatscreen TV, or a top of the
           | line computer.
        
             | stan_rogers wrote:
             | It's not just in Canada. Have you ever heard the term
             | "grand theft auto"? There have been two levels in almost
             | every jurisdiction for a very long time: petty (small)
             | theft and grand (large) theft. The dividing line in England
             | used to be a shilling, for which you could be hanged or
             | transported. Sixpence would get you a short-ish time in
             | gaol/jail.
        
             | amatecha wrote:
             | Seems they need a new category, "theft under $5" haha
        
         | Arrath wrote:
         | >I've always wondered why the line is drawn at $5,000. It's
         | mildly interesting that stealing $46M and stealing $5,000
         | result in equivalent charges.
         | 
         | A lot of those lines are drawn completely arbitrarily, and
         | might be very old and haven't been updated to reflect
         | inflation/rising prices.
         | 
         | A classmate of mine copped a felony property damage charge as
         | the threshold was set at a mere $500 at the time, for a typical
         | senior year high school rivalry prank and it really fucked up
         | his life.
        
           | anonporridge wrote:
           | Tacking on the conversation about arbitrary and static dollar
           | amounts in law.
           | 
           | There's an interesting effect where law makers can pass a law
           | with static dollar amounts that seems reasonable at the time,
           | but the force of inflation covertly expands the scope of the
           | state's authority deeper and deeper into the society without
           | any further action or political risk by present lawmakers.
           | 
           | A great example of this is the Bank Secrecy Act, which
           | requires reporting of transactions greater than $10,000 to
           | the federal government. At the time it was passed in 1970,
           | $10k was the equivalent of ~$70k in 2021 dollars. $70k
           | actually seems like a pretty reasonable amount as that's a
           | very large transfer that the average person does very rarely
           | for mostly legitimate reasons, like buying a house. It's easy
           | to justify why the feds could use this data to investigate
           | large scale criminals and money laundering. But as inflation
           | has stripped away the value of the dollar, more and more
           | people and activities are falling into that $10k limit.
           | 
           | Basically, the surveillance state gets to sneakily expand
           | when laws are pegged to a currency that's constantly
           | inflating by design.
        
         | amcoastal wrote:
         | I feel like everyone knows why the line is drawn at such a
         | value. So people like us can't afford to commit crimes, but the
         | rich can.
        
           | not2b wrote:
           | In many cases the amounts were written into the law so long
           | ago that money was worth maybe 20x as much, or more.
        
             | btilly wrote:
             | My favorite example of such is https://constitution.congres
             | s.gov/constitution/amendment-7/.
             | 
             | $20 doesn't buy as much today as it did in 1800. :-)
        
               | hermitdev wrote:
               | $20 doesn't buy as much as it did in 2020, either...
        
             | Terry_Roll wrote:
             | Inflation was known to legislators back then so its way for
             | legislators to lower the bar and catch more people in the
             | future, without anyone picking up on it at the time.
             | 
             | Anyway fabricating evidence has been around for as long
             | evidence has been needed to settle disputes.
        
             | hanniabu wrote:
             | And that's why we really need to start assigning equations
             | rather than static amounts in bills
        
               | seszett wrote:
               | It's not exactly that, but in Belgium penalties written
               | in law are an amount that is multiplied by a factor that
               | is regularly updated.
               | 
               | It went from 5.5 to 6 in 2011, then to 8 in 2017 and is
               | still there AFAIK. It seems a bit haphazardly managed to
               | me, but it's something.
        
               | bpodgursky wrote:
               | Alternatively we could maintain a stable currency people
               | can rely on as a store of value.
        
           | corndoge wrote:
           | I think that's a bit melodramatic. Lots of people can afford
           | 5k without being part of _waves hands_ "the rich."
        
           | therealcamino wrote:
           | What do you mean by that? $5000 isn't a fine, it's the amount
           | stolen that moves the offense into a higher category. How
           | does that translate into making the rich able to commit
           | crimes?
        
             | amcoastal wrote:
             | Because a rich person can steal 50m and get penalized the
             | same way someone like us would when stealing a paltry sum.
             | Though my comment also implies the rich can easily drag out
             | their court case and afford an army of representation so
             | they don't have to deal with whatever sentence they are
             | getting. Even though the sentence itself is a sham because
             | stealing 50m dollars being punished the same as stealing 5k
             | is obviously a sham.
        
               | kube-system wrote:
               | No, it's literally the opposite. People who steal small
               | sums -- i.e. in street crimes -- get a smaller
               | punishment.
        
               | amcoastal wrote:
               | ??? The law has the same penalty for any crime over 5k,
               | its literally the parent comment I am replying to.
        
               | kube-system wrote:
               | Those that get a smaller penalty, i.e. those who steal
               | under $5k, are overwhelmingly _not_ wealthy. Wealthy
               | people are not snatching people 's purses on the street.
        
         | bostonsre wrote:
         | I'm not sure the general population knows any better.
         | 
         | It's bad and all and he is f'd, but "stole $46m" does sound
         | like a pretty bad ass line item on a teen's wrap sheet.
        
       | amatecha wrote:
       | "leaving such a large amount of Bitcoin accessible on a phone"
       | 
       | "A SIM swap attack [...] gives the hacker access to the victim's
       | phone"
       | 
       | Is it just me or this article massively misrepresenting what a
       | SIM swap attack actually does? Unless there's more to the story,
       | no one got access to Jones' phone. They intercepted 2FA SMSes so
       | they could get access to a wallet service or whatever.
        
       | bhouston wrote:
       | He should have run just a failed ICO and pocketed the funds as
       | fees to related parties. I understand this is how Metakoven, the
       | NFT king, got his start?
       | https://www.reuters.com/investigates/special-report/finance-...
       | 
       | Better to claim incompetence than it is to actually steal.
        
       | misiti3780 wrote:
       | Honest question:
       | 
       | We are all the bitcoin multi-millionaires storing their coins? It
       | seems like in an ideal world, you would use https://trezor.io and
       | put that in a safety deposit box, or maybe use Coinbase Vault,
       | but I am generally curious what is the current consensus on the
       | safest ways to store these piles of digital money.
        
         | pshc wrote:
         | There's no consensus because there's no best answer. Here's an
         | example of what you could do.
         | 
         | Generate a new seed phrase on a hardware wallet. Encrypt the
         | seed phrase using https://github.com/FiloSottile/age and print
         | out the encrypted seed. Store the paper in a safety deposit
         | box. Keep the hardware wallet at home in a safe.
         | 
         | Write down the encryption key and the hardware PIN in an
         | envelope to be opened in the event of your death.
         | 
         | All that said, this particular example is vulnerable in that
         | you could be held at gunpoint and lose everything. So next we
         | start talking about cold wallets vs hot wallets...
        
         | csomar wrote:
         | Trezor with a semi-gapped laptop. Connect the PC to synchronize
         | your wallet, disconnect, sign the transaction, copy the
         | transaction somehow (ie: QR codes), verify your transaction
         | inputs/outputs, broadcast transaction. You can also go fully
         | air-gapped by manually synchronizing instead of connecting to
         | the internet.
         | 
         | Edit: Alternatively, you could upload transactions via images
         | (airgapped laptops) and sign them with your trezor (on the
         | airgapped laptop). That should give the most security.
        
         | ur-whale wrote:
         | Jameson Lopp has a nice section in his Bitcoin resources site:
         | 
         | https://www.lopp.net/bitcoin-information/security.html
         | 
         | Look, e.g. at the Cold Storage section,
         | 
         | If you are truly paranoid, then follow this protocol:
         | 
         | https://glacierprotocol.org/
        
         | londons_explore wrote:
         | Move all the coins to a new wallet.
         | 
         | Make that wallet have a split private key, such that say there
         | are 13 keys, and any 9 are required to access the funds.
         | 
         | Distribute those 13 keys, on paper, in sealed envelopes, to 13
         | different locations. Make each location have at least basic
         | access control - either a door lock, or held by someone you
         | trust with specific instructions about who is allowed to access
         | the paper.
         | 
         | Distribute instructions to trusted friends on where to find the
         | 13 things, and what conditions are needed to access them. For
         | example "Hand over to londons_explorer only. If you know he is
         | dead, hand the key to XYZ person. If you cannot contact XYZ for
         | over 5 years, destroy the envelope."
        
       ___________________________________________________________________
       (page generated 2021-11-24 23:01 UTC)