MIT students stole $25M in seconds by exploiting ETH blockchain bug, DOJ says

https://arstechnica.com/tech-policy/2024/05/sophisticated-25m-ethereum-heist-took-about-12-seconds-doj-says/

by em3rgent0rdr • 2 years ago

59 26 2 years ago

Pretty careless almost idiotic to just search with history and sync? about the crimes you are going to commit.

It shows that those guys aren’t really technical, exploiting a blockchain bug sounds like they hacked the system but instead they misused a feature.

They haven’t been even smart enough to understand that the blockchain is for tracing.

4gotunameagain• 2 years ago

sounds like they hacked the system but instead they misused a feature.

Isn't that quite often the definition of hacking though ?

If they were based on a different country they would've never been caught. And they do seem pretty technical to me, just not entirely thoughtful.

metachris• 2 years ago

This was a pretty sophisticated attack and deeply technical execution.

democracy2• 2 years ago

Wow, what happened to the "screw the government" position? As soon as there is a problem with "free money", its adepts run to the police for help ))))) It's hilarious, frankly. tbh after ETH modified their "unmutable" blockchain in DAO attack, they are just full of BS "innovators" and "investors".

throwaway114602• 2 years ago

You're talking about an opinion of a bunch of early hackers as if it was a common world view of everyone in the crypto/blockchain space. It's not (sadly, IMHO). There are many who are exploring merging government regulation and crypto currency.

Not sure what you mean by modifying unmutable blockchain, that never happened. What happened is that people stopped using that blockchain and switched to another one.

nohup2• 2 years ago

They switched to another blockchain… that has the same exact name and is maintained by the same people. So in my opinion, Ethereum broke the “unmutable” promise after the DAO debacle. You could argue that as Ethereum Classic kept the original blockchain, the promise was kept. But even so, it was the spirit of that promise was broken, and ETC is not maintained by Ethereum. I lost trust on Ethereum because of that and never touched it again since 2016.

vsuperpower2020• 2 years ago

What would you rather they do? Let themselves be stolen from? Personally hunt down the people that wronged them? That's what happened when certain gangs lost money on crypto. This is a lame "gotcha" whether you like crypto or not.

democracy2• 2 years ago

If we talk about "stealing" - there was a huge effort to make people believe crypto is worth of investing as some "new money super technology that makes everyone rich", right? Were the risks higlighted? Not really. The richest person in the world (E.Musk) shills an inflationary unlimited bitcoin clone as something valuable (DOGECOIN) - this is fraud on a giant scale. I would love to see him calling out the BS in crypto "industry" - he didn't and instead did dogecoin thing. I frankly don't believe he is some kind of tech genius after this. And this is ok, right?

Do simple people know that they put their money into useless "technologies" that are fundamentally fragile and they are at risk of losing everything as soon as there are advances in computing (breaking sha/ecc, doing 51% attack)? They don't. So, that's really stealing, on a grand scale. This 21 million should be an award for the hackers, really. Unless ETH wants to change the "immutable blockchain" once again ))) noone cares these days anyways

atoav2• 2 years ago

Well. I'd say the anti-government¹ type generally has 3 options here:

1. Realize their stance is flawed, change it and go to the police

2. Stick to their stance and not go to the police

3. Ignore the cognitive dissonance and pretend going to the police is coherent with their political ideas. Rationalize about why in this narrow case it would be okay.

Now you can guess which one it will be yourself. As this is purely hypothetical talk about an stereotypical archetype of person, things may differ in the single case.

Personally I think just because you are stupid doesn't mean you forfeit your right to call the police. It just makes you a fucking hypocrite if you aren't consequential enough to adjust your stance to the choices you made (or adjust the choices you make to your stance).

¹: there are many flavours of anti-government, but we are talking about views, if fully realized would leave our victim with no police they could go to. Maybe they could beg in front of a local war lord?

faeriechangling• 2 years ago

I don't see anybody who got stolen from here. I see idiots who wilfully opted out of the benefits of the blockchain and then hoisted themselves on their own petard in a bad trade. I see the government as essentially trying to legally enshrine the idea that the public should bankroll the protection of people who neglect the security features provided by the blockchain with public funds.

vagrantJin• 2 years ago

Adepts? That is genuinely hilarious.

BLanen• 2 years ago

Wow, what happened to the "screw the government" position?

It was always just a meme.

John Perry Barlow was deeply, deeply, wrong.

CommitSyn• 2 years ago

It's your type of black/white thinking, and making the association that everyone in support of a specific idea shares an identical set of ALL values with everyone else interested in that idea, that enables fascism to rise to power.

Someone is interested in privacy? They must be a criminal, better watch closely and prosecute on whatever we can before they get too dangerous.

Someone is interested in crypto? They must be fully anarchist. Better lump them in with the anti-government crowd and make sure they are denied police protection.

These were multimillion dollar trades being done by white collar investors with the trading bots, I don't think they mind the police help one bit, and I think you'd be hard-pressed to find anti-state messages from any of them. They are just rich people taking advantage of a system to get richer. Nothing more nothing less. It is not possible to extrapolate political views based solely on participation in part of a capitalistic system.

yashg• 2 years ago

So nothing of value was actually stolen.

stuffoverflow• 2 years ago

IMO the title is a bit misleading since the bug was in the mev-boost library which isn't part of the ethereum protocol nor is it needed to validate blocks. As I understand, the "victims" were arbitrage bots that one could argue simply had their risk realized. I wonder if the brothers could have gotten away with it by just paying taxes.

Here is an in-depth post-mortem on the incident: https://collective.flashbots.net/t/post-mortem-april-3rd-202...

Earlier threads about this:

https://news.ycombinator.com/item?id=40369522

https://news.ycombinator.com/item?id=40371371

https://news.ycombinator.com/item?id=40372018

baobun2• 2 years ago

In particular, the malicious proposer constructed their own block that broke the sandwich bots’ sandwiches up and effectively stole their money.

Deep cognitive disonnance or do these people really think they have enshrined privilege already? Because I don't think they mean to imply that their own sandwhich bots are "effectively stealing" from traders and other bots as part of normal operations...

netcruiser• 2 years ago

So they front ran the front runners. Made the front runner buy shitcoins. Crime? Not an ETH bug though.

dctoedt• 2 years ago

Misleading headline — are they really MIT "students"? The accused brothers are 24 and 28 years old respectively; the DOJ press release says they "studied" at "one of the most prestigious universities in the world" (the indictment says "in the country"). But that doesn't mean the brothers are currently students at MIT.

mensetmanusman• 2 years ago

Another reminder that crypto is simply an ever growing bug bounty.

ChrisArchitect• 2 years ago

[dupe]

Some more on official Justice post:

https://news.ycombinator.com/item?id=40371371

https://news.ycombinator.com/item?id=40369522

MIT students stole $25M in seconds by exploiting ETH blockchain bug, DOJ says

Related Stories