DeFi Platform Qubit Finance Begs Hacker To Return $80 Million In Stolen Funds (zdnet.com) 70
Qubit Finance took to Twitter last night to beg hackers to return more than $80 million in stolen cryptocurrency this week. ZDNet reports: On Thursday, the DeFi platform said their protocol was exploited by a hacker who eventually stole 206,809 binance coins from Qubit's QBridge protocol, worth more than $80 million according to PeckShield. An hour after the first message, the company explained that they were tracking the exploiter and monitoring the stolen cryptocurrency. They noted that they contacted the hacker and offered them the maximum bug bounty in exchange for a return of the funds, something a number of other hacked DeFi platforms have tried to middling success. They shared multiple messages on Twitter that they purportedly sent to the hacker offering a bug bounty of $250,000 and begging for a return of the stolen funds.
"We propose you negotiate directly with us before taking any further action. The exploit and loss of funds have a profound effect on thousands of real people. If the maximum bounty offer is not what you are looking for, we are open to have a conversation. Let's figure out a situation," the Qubit Finance Team wrote. The company later explained in a blog post that their Qubit protocol "was subject to an exploit to our QBridge deposit function." [...] Blockchain security company CertiK released a detailed explanation of how the attack occurred and has been tracking the stolen funds as the hackers move them to different accounts. "For the non-technical readers, essentially what the attacker did is take advantage of a logical error in Qubit Finance's code that allowed them to input malicious data and withdraw tokens on Binance Smart Chain when none were deposited on Ethereum," CertiK explained.
"We propose you negotiate directly with us before taking any further action. The exploit and loss of funds have a profound effect on thousands of real people. If the maximum bounty offer is not what you are looking for, we are open to have a conversation. Let's figure out a situation," the Qubit Finance Team wrote. The company later explained in a blog post that their Qubit protocol "was subject to an exploit to our QBridge deposit function." [...] Blockchain security company CertiK released a detailed explanation of how the attack occurred and has been tracking the stolen funds as the hackers move them to different accounts. "For the non-technical readers, essentially what the attacker did is take advantage of a logical error in Qubit Finance's code that allowed them to input malicious data and withdraw tokens on Binance Smart Chain when none were deposited on Ethereum," CertiK explained.
When you beg, you need more punishment. (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
What about NFTs of Tulips? Will I have to cry "All my Tulips! Gone!" or are these safe?
may need an soldiers of fortune gun for hire ad to (Score:3)
may need an soldiers of fortune gun for hire ad to get anything from this hacker
Re:may need an soldiers of fortune gun for hire ad (Score:5, Funny)
"In 1972, a crack commando unit was sent to prison by a military court for a crime they didn't commit. These men promptly escaped from a maximum security stockade to the Los Angeles underground. Today, still wanted by the government they survive as soldiers of fortune. If you have a problem, if no one else can help, and if you can find them....maybe you can hire The A-Team."
Note: The A-Team works for cash and gold chains only. The A-Team does not accept or endorse crypto or other fake currencies, but they do pity the fool who has poured money into such dumpster fires.
Re: (Score:2)
Someone [ispot.tv] begs to differ.
So the reason some thieves returned funds (Score:5, Insightful)
And why yes, this does mean that most cryptocurrencies are centrally managed now just like our federal reserve and banking system here in America.
The beauty of crypto is that if it works it doesn't work and when it doesn't work it works except it still doesn't work. Did you get all that?
Re: (Score:2)
There's been several cases where the hacker (Score:2)
The hackers in those cases return the money because it was worthless to them and that way they largely escaped prosecution because the people who are hacked wanted to keep things quiet and not involve the authorities if they could help it. Likely to avoid dr
Re: (Score:2)
It's easy enough to launder the funds (Score:3)
What's happened in several cases is they didn't link the wallet or catch the guy, they knew which coins were stolen and the exchanges got together and did a 51% attack on the chain (using the large amount of crypto they hold for the purposes of being exchanges) to stop the trades going through and/or roll them back. That made the currency worthless (since they couldn't start up a money laundering engine), so they gave it back.
Re: (Score:2)
Is there a difference? (Score:2)
Re: (Score:2)
Re: (Score:2)
Because I don't know, and I would love to find a citation.
If you steal bitcoin via a hack, is the crime of bit coin theft punishable in the USA?
I know the hacking yes, but the coins themselves.
Other News: DeFi Platforms Agree on a Standard... (Score:2)
The CEO of one company stated: "We don't necessarily want hacks, but if they are going to happen then we might as well set some standards to reduce work.
This should reduce the amount of work we have to do in response by simplifying our request to the hackers to return funds. This also reduces work for the hackers by eliminating some of the things they do to try to hide their tracks, so we think they will buy into it also, it's a win-win"
Re: (Score:2)
"it's a win-win"
Re: (Score:2)
Definitely a win-win all around!
Re: (Score:2)
can't be bothered to go to the last detail of it myself, but it genuinely looks like a spectacular flunk in design or implementation that was hilariously easy to exploit.
https://twitter.com/CertiKComm... [twitter.com]
interesting case maybe showing that technicians are being as naive and gullible as investors or consumers, if not more. this is unreal, when this whole shit comes down it is going to hurt.
Re: (Score:2)
Tough or easy, it was hacked.
My guess is: Easy. A wallet should have serious guards, even proxy authentication/authenticators that obviate the BTC verification ritual dance, serializing transactions.
But no, then it's not transactional anonymity.
Security could be REALLY easy with its own blockchain. Kinda like Venmo. But that's not what cryptocurrency is about.
Re:Not possible (Score:5, Insightful)
It's not possible to "steal" from a smart contract, because the contract itself defines who owns what and what actions are legitimate.
What they mean is that they and their users signed on to a contract that didn't mean what they thought it meant.
Tough shit.
This so much. These people set out to destroy the existing systems of finance, they complain about the law courts ansd the central banks and are setting out to destroy them. There's a reason they are in there early. They hope that everyone else will be forced onto the same systems as them later and they hope to make a killing taking everything from the people that are forced to buy in later. Not all of that is bad - some people are experimenting and trying to develop better systems. Anyone that's gone in for real money now, though, is fundamentally relying on a pyramid scheme to rip off the rest of the world. If they are telling us that we should later start to run everything with their DeFi (DeregulatedFinance) they it had better be debugged properly. Don't come back asking for our sympathy and charity now.
Re:Not possible (Score:4, Insightful)
Yeah. The "code is law" crowd didn't really thought this one out, it seems.
Re: (Score:2)
Re: (Score:2)
Well, code is hard and most code is bad. But the thing is that most coders do not know their code is bad. Hmm.
Re: (Score:2)
Hmmmm.... (Score:3, Funny)
When you thought things could not get more stupid (Score:5, Funny)
Something like this happens. I mean, is this kindergarten? Will they complain to the kindergarten teacher next that the hacker was mean to them?
Stupidity should hurt badly (Score:2)
Stupidity should be punished with maximum suffering lest it be encouraged.
Are the rest of the exchanges the same? (Score:2)
Re: (Score:3)
This was a bug, not a hack. This is why a 3 letter agency isn't mentioned ($80 million isn't chump change).
Yes, they are one hack away from gone. Any protocol suffering an issue this bad where "protocol was exploited" IS the problem, is pretty much doomed and will go away...
Exchange active trade reserves is another topic, the hot wallets used for active transfers to/from accounts.
Huh? (Score:2)
Why should this affect “thousands of real people”?
Surely the company is insured against loss and can make its users “whole”? And surely they can blacklist individual coins, flagging them up as “stolen” when an attempt is next made to transfer them on the blockchain?
This company isnt stupid enough to act as a financial services company without insurance, right?
Re:Huh? (Score:4, Insightful)
Re: (Score:2)
Or the multiple goes of Libertarians going to create 'utopias', and end up appealing to the courts when they get screwed by suing people who wronged them. Suddenly they didn't have a purely capitalist solution and the courts they eschewed looked mighty good.
Re: (Score:2)
I have listened to the 911 tape of the guy screaming and pleading to save his home, while the fire department is watering the next door neighbors home. While this is not the case I recall, here is a similar citation https://www.nbcnews.com/id/wbn... [nbcnews.com]
I recall your story also, I know it as a sovereign citizen not a libertarian.
I dislike that Libertarians are clump up with Socialist and other groups ( I myself am a firm believer in capitalism, with higher taxes and free healthcare).
Re: (Score:2)
Sovereign citizens are a subgenre of the Libertarian/Bircher/Alt-right sphere. The Venn diagram isn't quite a circle, but it's close.
Also, everywhere but in America, Libertarian means center-left. An overly reductive spectrum is Libertarian->Liberal->Social Democrats->Greens->Democratic Socialists->Socialist->Marxist/Leninist/Communist.
Swim with sharks, get eaten by them ... (Score:2)
As you try to use crypto to pay for something in the real world, lots of counter parties would have no incentive to protect your identity. Once the wallet and a real world identity is connected all the transactions are public. At that point it is way worse than stuffing mattresses with cash.
This time the the platform got hacked.
If it is truly anonymous, what would stop croo
Re:Swim with sharks, get eaten by them ... (Score:4, Insightful)
If crypto works as advertised, that is the transactions are totally anonymous,
But it isn't. Every cryptocurrency transaction is logged forever. Anonymity comes if, and only if, you have the ability to keep your wallet anonymous.
Anonymity isn't a feature of the blockchain: it's something you maintain.
Re: (Score:2)
Well, nothing really. Except the crooks have figured out that the whole kidnapping thing is almost as bad as the whole collecting the ransom thing used to be.
People pay more to get their data back, and you can steal that online.
Re: (Score:2)
Re: (Score:2)
Re: Swim with sharks, get eaten by them ... (Score:2)
Re: (Score:2)
You can't have anonymity without hiding the info in practice. In a ledger where *everything* is out in the open, it's pretty much a certainty that there's a transaction that ties a wallet to a human in an obvious way and from that point everything is connected. If you send me crypto for me to ship you a product, then I have your address. Once I use a parcel service, they know who I am because they had to get the parcel from me. Tying humans to wallets in practice is not that difficult for investigators a
Environmental Activism? (Score:4, Interesting)
At some point a hacker that is feed up with the energy waste or electronic waste or the general stupidity is going to crack one of these digital piggy banks and after pulling all of its loot will break all the keys.
I'm surprised it isn't already happing every day.
Re: (Score:2)
The volume is just way too small still. But as soon as the other polluters start to fix their ways, CryptoCrap will be annihilated. That may take some time though. The way things are currently going, we probably will exceed 5C and then it does not matter anyways.
Re: (Score:2)
Re: (Score:1)
you really shouldn't make fun of the misfortune of these people and the DeFi
AHAHAHAHAHA! my sides!!! Fucking dumb-asses, hahaha. Thinking begging will get the money back, AHAHAHAA
Re: (Score:2)
I don't know if "A fool and his money are soon parted" or "There is a sucker born every minute" makes more sense here
I'd say they're both applicable.
It would be even funnier if the hacker simply deleted the coins and they no longer exist.
Re: (Score:2)
https://youtu.be/VBkegy4aDvk?t... [youtu.be]
I repeat myself (Score:2)
Another day, another crypto hack [slashdot.org].
"Qubit" Finance... money is there and not there... (Score:2)
Re: (Score:2)
... at the same time, right?
It's there until you check the balance of your account.
I'm the haxx0r (Score:4, Funny)
Ha ha ha! (Score:2)
Let me repeat that: ha ha ha!
A $80,000,000 hack?! (Score:2)
I might be mistaken, but that has to be the most lucrative hack in history.
Man, crypto is a joke.
External Validation (Score:5, Insightful)
Requiring an external actor to maintain the integrity of the blockchain means both that the blockchain is not secure and that it is not decentralized. It means the basic premise of crypto is false. So if crypto isn't a decentralized currency with no outside control, that means that crypto can only be a scam.
As an aside, the reason the thieves accept the bug bounty money instead of the cash they've already stolen (even though it's questionable at best if they even violated any laws) is they ran into the fact that crypto is a scam. All crypto coins are inherently deflationary. The longer you leave your money in coins, the greater the value of those coins over time. This is a terrible attribute for a currency for a variety of reasons that I won't go in to now. But the relevant way this is terrible is that it means any exchange for crypto to real money inherently loses liquidity over time. That means there simply isn't enough dollars, pounds, euros, and francs in the exchange to cover the value of the crypto coins in the exchange. So while this thief stole $50+million of currency, that's only on paper. I'm guessing the actual liquidity available to them is much less than that. It probably would only be comparable to the bug bounty they're being offered.
Re: (Score:2)
Note that while it is true the advocates advocating for it because it 'always goes up!' fail to understand that's what happened in the Great Depression, it's not guaranteed to be deflationary. See the last 3 months for example, where crypto-currency has been quite inflationary. While it's true that more of a particular instance of a crypto-currency can be prevented from creation, the other half, people caring less about that instance of crypto-currency, can of course make the currency inflationary.
So in sh
Re: (Score:2)
Inflation/deflation is different than valuation. The valuation of the coins varies wildly and unpredictably. But the structure of the blockchain itself is such that fewer coins are minted over time as the rate of transactions go up. This means the money supply itself is shrinking, inducing deflation no matter what the particular valuation is. That's why it's inherently deflationary. It is designed to be artificially scarce.
Now if the designers actually understood economics, which they clearly didn't, they
Re: (Score:2)
In practice, inflation/deflation is not strictly a function of the number of units of currency, but is intrinsically linked to valuation.. By extension, you can't design the currency to maintain a 1-3% inflation rate, because you also have to factor in a complex universe of realities including international tensions, weather, disease impact, breakthroughs, fads, overall sentiment. The report about 7% inflation is based on CPI, not reports on the money supply.
Sure assuming all those factors are level, then t
Its not really hacking... (Score:2)
Anyone willing to pay the gas can call any method implemented by your contract, how is this hacking? Nobody exceeded their access limits..
Re: (Score:2)
Well, the one that wrote the code clearly is a hack, so there was some hack involved. Not on the side that apparently completely legitimately took the crapcoins though.
Re: Its not really hacking... (Score:1)
You can say that about most exploits...
"It's not hacking. They just called a function with an undersized buffer and the code did what its programmed to do..."
"It's not hacking. They just sent a perfectly valid request. Not their fault the code doesn't sanitize inputs..."
With this hack they used an invalid address to exploit the contract code.
Re: (Score:2)
The statutes talk about gaining exceeding your authorized access to a computer. Everyone is allowed access to all the functions on contracts on the blockchain, its not your computer anyone is exploiting.
Key takeaway (Score:2)
Victims of Crypto Hacks are getting help (Score:1)