Hacker News Reader

Comment by ohy | Hacker News Reader

For whom it seems surprising, that's actually rather small, considering hacks can end up in an irreversible $100M+ transfer to the malicious party.

You can check Immunefi's Bounty-Board for reference, currently paying up to $15M per find.

Another good source is rekt.news, creating post-mortems about all the DEFI-hacks and an own leaderboard, $624M for #1.

View on HN

Sure, but you get to enjoy your bounty payout. Having $2M legally vs. having to become a money launderer?

Right, yeah. I estimated that a savvy attacker might have been able to get out with 50 or even 100m from this, but they would also go to jail. So...

What sort of crime are you envisioning that exploiting this would fall under? It's not always fraud to satisfy a poorly written contract, although that is commonly the case.

Everything is wire fraud / securities fraud

Someone has been reading Matt Levine

Wire fraud, at minimum. This would constitute direct theft. Very similar cases have been tried and convicted several times now.

Despite what many programmers think, code is not law.

Just like a bug in a smart lock does not allow you to enter a house because "you were allowed in".

Not so sure it is that clear cut. A few infamous stories of bug bounties not getting paid for even trivial amounts

So it is $2 million x probability payment vs $100 million x probability escape without getting caught.

Even with the threat of non-payment, not sure I could ever feel at ease with a multimillion bounty hanging over my head.

I think there is another factor that some people would pay every penny they have to not go to prison for a meaningful length of time.

Yeah, I think stealing that kind of money pretty much guarantees that you'll need to be paranoid for the rest of your life. I wouldn't take that for any amount.

People keep saying that, but not even one case is documented.

These chains are created by startups with VC money, they are not going to hire hitmans.

North Korea might. Silk Road went under due to attempting to hire one.

The more likely concern is that someone will sell you out to any of the numerous governments who feel you wronged them. Leading to decades of life in prison.

I wouldn't expect there to be documented cases yet. The hypothetical case in question is a hacker taking hundreds of millions of dollars, not being caught initially, but then being caught years later. Crypto as a whole is just 15 years old, and it's only really been hot for under a decade. There have only been a handful of cases with such large dollar amounts, and most occurred in the last 5 years. And I expect most of the people who pull this off will be properly paranoid.

https://www.cbc.ca/news/canada/toronto/crypto-king-pleterski...

It's not so much the projects themselves who are a threat, but the thousands (?) of random individuals whose value is stolen.

Taking advantage of bad contracts can be legal depending on various nuanced circumstances. If the potential payout is lucrative, then it makes sense to consult with legal counsel first.

I am not making a judgement about this specific case.

tell that to avraham eisenberg https://www.axios.com/2024/04/18/avi-eisenberg-convicted-cry...

That person committed fraud. My point wasn't even about cryptocurrency or DeFi.

Here's a simplified hypothetical example to help you understand the legal nuance: I offer all of my money to the first person that can solve 5x5, and I errantly believe that it's a difficult problem to solve.

Can you provide a more real-world example? I don't understand what point you are making, if it isn't about making money via cryptocurrency. When you say "bad contracts", I assume you are talking about smart contracts. Is that not the case?

Reply on news.ycombinator.com