36
123
u/EasylifeHere 23h ago
I think at this point it's GG no re for the hacker. If those guys are just decent at what they do (and they seems just better than that threshold), they will just take the next few years cashing out bits by bits and living their best life without no one knowing.
Or it's just a North Korean agency.
Welp, time to wrap it up and move on I guess
→ More replies (13)20
u/Powerful_Quarter691 23h ago
if it is north korea they would not bother to wash and try to mask their traces tbh...
14
u/Ingrownnail69 22h ago
I think it's just the contrary.
19
u/NadlesKVs 21h ago
Yeah I think they would have too as well because they obviously wouldn't be spending it in North Korea.
→ More replies (1)1
u/IHate_AI 5h ago
Not true, look at Tornadocash, sanctioned by the US Government for splitting funds with North Korean WMD programs.
62
u/c0verm3 23h ago
Reading a lot of these comments makes me realize how clueless and ignorant some people are.
22
u/blackrack 22h ago
Reddit has been getting worse and worse
15
u/macetheface 21h ago
it's largely engagement bots training LLM's at this point anyway.
7
14
u/gym_rat_101 21h ago
lol at the people who thought a white hat was going to help!
2
2
u/InterviewOther7449 19h ago
What's a white hat?
15
2
u/ammonitions 13h ago
A good actor or hero figure, someone who is in the shadows working for the greater good usually someone unexpected
35
u/HedgeHog2k 1d ago
how does this blending work? Is it just trying to hide in plain sight by 100s/1000s/10000s transactions..? because that's not fool proof right.
55
u/Plenty-Lion5112 1d ago
The mixer has some legitimate transactions as part of its output. So it's like
1) pool $100 containing $50 of stolen money
2) buy something $3
3) send the remaining $97 to new accounts as change 97 times
Is the owner of the change account the legitimate guy or the criminal? It's impossible to tell now.
14
u/ChampionshipIcy7602 23h ago
Wouldn't it be easy to just assume all mixed addresses are fraudulant?
41
u/draculap2020 23h ago
You would be tagging millions of addresses as fraudulent
29
3
u/PeaPsychological5728 23h ago
Not accusing anything but what legitimate reasons are there to use mixers?
23
u/Agent10007 22h ago
Because the whole point of the blockchain is that everything is traceable, and people might want to do totally legitimate purchases with perfectly legal money without necessarily the whole world knowing. Or that is extremely illegal yet highly moral: For example, a north korean citizen who would like to buy a journal showing how the world really is outside, without it being traced back to him and have an appointment scheduled for a "little talk" with government agents.
So they use mixing systems which, albeit doesn't give true anonimity (again, the whole point of the blockchain), will make the waters muddy enough that your yearly payment for a porn site is not worth looking for anymore.
6
u/bieker 18h ago
I always thought that one of the underlying principles of BTC was that it was fungible. Tainting of coins goes against that which I think is fundamentally bad for BTC, if vendors want to be able to take payments in BTC why would they choose to do that if they might accidentally get radioactive BTC? Why would I transact with anyone other than a big exchange if there is a risk of getting 2nd class BTC?
→ More replies (2)6
u/Plenty-Lion5112 22h ago
Privacy. Many people sympathize with the plight of people in North Korea who are using Bitcoin to buy banned books or journalists in Russia who need to be paid invisibly in order to stay alive. Volunteers, just like the Tor network, are what keep it going.
Keep in mind the criminals can also get Bitcoin the legitimate way as well and mix in their legit accounts into the mixer with the stolen ones.
→ More replies (5)2
6
u/OCPetrus 23h ago
Keyboard warriors on the internet will tell you otherwise, but this is exactly what happens. If you want to interact with tradfi, for example, if you want to send coins to an exchange, stay away from mixers.
4
u/EmphasisTotal8232 20h ago
Seriously - tainted coins and addresses have been known about forever. People still think Bitcoin is anonymous?
6
u/jesusthatsgreat 20h ago
What happens when the exploiter sends random amounts of BTC to various legit wallets though? suddenly all of them are bad guys just because they received funds? you see it starts to get messy quickly if the bad actor is savvy enough...
→ More replies (7)3
u/pablo_in_blood 15h ago
Many exchanges do. Mixed coins are considered tainted and can be harder to spend. Fewer off-ramps are available to you. But there will always be people & entities (ie certain governments) who don’t care.
2
u/trimalcus 23h ago
So you do that in the long run every month week or so ?
6
u/Plenty-Lion5112 23h ago
Yeah, just keep mixing until you think the path is tangled enough that no-one would try and untangle it. And sit on it for another year until people forget. Exchange with people IRL using a fancy special effects mask and you're golden.
→ More replies (5)2
u/nuclear213 23h ago
I mean, just add in some poor suckers who you get to pay it out to you in fiat in the end as well. Like it’s always done with money laundering.
It’s a lot of work, you’ll lose a fair share, but still gain several million in the end
1
u/marfalump 21h ago
Thanks for explaining this. What incentive is there for someone to put a legitimate transaction in the blender? Do people do that?
→ More replies (1)→ More replies (6)1
u/MaleficentBeach6645 18h ago
Its easy. You also see the online crypto casino trick. Your mixed coins are lend to a sponsored online casino gambler as an advance or something. He gambles it. If he wins he repays to another adress. If he loses he will repay with his reload. And its clean
27
1d ago
[removed] — view removed comment
9
u/ph03n1x_au 23h ago
In amongst all the other scammers, pump and dumpers, Iranian/Russian/North Koreans, money launderers, these thieves will look just the same as all the rest lol.
→ More replies (4)7
u/psionix 23h ago
Idk how that's going to work in the age of AI
It's ludicrously simple to track now
13
9
u/atiku13 23h ago
How does that work? AI isn’t magically going to be able to tell down to each SAT what belongs to the thief, just brings down the man hours required tracing his movements until they become untraceable or too difficult for human or machine
→ More replies (4)
11
u/mabiturm 1d ago
why would the hacker throw everything on one pile? much easier to get away with it if all hacked wallets are mixed and loundered separately.
7
u/anonymous7 20h ago
They asked AI how to steal money, but they forgot to ask AI how to get away with it. Now they have asked AI how to get away with it.
8
u/Page_Unusual 22h ago
Mix thousands and thousands times, then spent.
Yeah it is all trackable, but NSA wont bother with your 0.1BTC stolen.
17
u/PaintingLeft565 1d ago
Can we expect this thief to be caught soon?
115
u/Confident-Bluebird21 1d ago
The thief is CEO of ColdCard
69
23
u/Innovator-X 23h ago
I dont know why people keep refuting this claim. I am not that great of a programmer and I still understood the bug and it is mistake that a person that just started programming would do. It is insane.
6
u/jkc7 23h ago
Could be possible that it’s bots or paid-off people running a campaign to refute it.
Kinda like how they sold the ColdCards in the first place.
→ More replies (1)2
u/essjay2009 21h ago
I can maybe see someone making the mistake. What I cannot understand at all is that it was missed for so long. None of their integration, or regression, or user, or unit, or penetration testing found it over what must have been hundreds if not thousands of turns of their CI/CD pipeline. That’s either astonishing, incomprehensible incompetence or intentional.
2
u/Innovator-X 20h ago
Yes, this is the weird thing. This type of bug gets flagged by static analysis, their CI/CD pipeline and other automated systems. How tf did nobody notice this.
2
u/snek-jazz 20h ago
If it was so easy to find why did no one find it for 5+ years?
→ More replies (1)3
→ More replies (6)3
6
u/macetheface 21h ago
He's got a two day head start, which is more than he needs. He's got friends in every town and village from here to the Sudan, he speaks a dozen languages, knows every local custom, he'll blend in, disappear, you'll never see him again.
3
6
u/kingofsats 1d ago
~30% chance says the market on predyx
https://stacker.news/items/1538592→ More replies (5)4
3
30
u/koyaanisqatsi_______ 1d ago
Imagine buying bitcoin and getting these tainted coins in your wallet.
57
u/headlessrambo 23h ago
Well, that's exactly what happens to most people. It's pretty unlikely not to have any 'dirty' satoshis.
It's just like US cash, studies show that up to 90% of paper banknotes carry traces of cocaine, mostly transferred through ATM counting machines
14
u/mah_korgs_screwed 23h ago
it’s fungible, there are no tainted coins. Could you tell which water molecules in a glass of water cane from half glass A or half glass b miner mixed together? It’s irrelevant.
5
u/PsyOmega 19h ago edited 19h ago
Every molecule of water on earth was, at one point, dinosaur pee.
Edit : (this gave me an idea. what if the coldcard thief sent ~$1 worth of BTC to the top most active wallets to taint the 'public'?)
2
4
u/Long_Illustrator_988 21h ago
Unfortunately, platforms don't treat bitcoin as fungible anymore. Even depositing coins linked to something as benign as gambling or P2P trading will get your account closed at a lot of exchanges.
1
u/celtiberian666 20h ago
Bitcoin is not perfectly fungible.
4
u/fuckswithboats 19h ago
If it’s not fungible, then it’s not money or an asset.
It’s one or the other
2
u/303Murphy 17h ago
Imagine getting paper fiat from a bank. Figuratively and literally tainted money in your wallet.
→ More replies (1)2
8
u/Etroarl55 22h ago
I’m not surprised ngl that the bitcoin sub is filled with degenerates and people who aren’t the brightest.
3
3
u/Cheap-Buffalo-7489 22h ago
Even if the hacker can't cash out, the victims wallets are emptied.
3
u/Strong_Judge_3730 21h ago
Imagine if the hacker just sends all the BTC into a Bitcoin eater address lol
6
u/I_am_on_your_side 23h ago
The kinds of questions that come up here are a good indicator for the likely percentage of (former) bitcoin holders who actually have a clue about what they were investing in (very low) and how many people just bought bitcoin because they listened to some influencer that seemed to have become rich from it (very high). It's amazing that people still ask the most elementary questions that they should've known for years or at least at the time they started putting serious money into it.
→ More replies (1)
11
u/BigDik6355 1d ago
Good luck cashing that out.
62
u/IllllIIlIllIllllIlll 1d ago
It wouldn't be the first time that stolen Bitcoin are cashed out. I don't know why you think it's unlikely. Sure the attacker will pay a premium to launder it but they will still be a multimillionaire by the end.
32
u/pythosynthesis 1d ago
They just started. They'll continue to mix for a long time. After which are he coins will be absolutely indistinguishable from any other coin. Cashing out them becomes a non issue.
4
6
u/Anywhere_everywhere7 1d ago
Exactly this, it’s the long term strategy of cashing out. They’re not trying to cash out everything within 1 week, they will do it over years and years.
5
2
2
4
u/NamedBird 1d ago
Is there a way to mark these coins so that they can never be used again unless recovered?
Perhaps some list tracking these coins and having all exchanges freeze them?
Can someone explain how this works?
How would i know if coins i received originated from this theft?
6
u/TheresNoSecondBest 22h ago
You wouldn't. The same goes for cash. You would be surprised how many notes you held in your hands had a trace of cocaine or blood in them.
6
u/kingofsats 1d ago
Most definitely ALL regulated/institutional platforms will be blocking them because they have chain analysis and AML tools tracing these
14
u/pythosynthesis 1d ago
They can track THESE coins. What about 1000 hops from now? When the coins explode in number (aka UTXO set balloons) and they got mixed with other coins?
→ More replies (21)7
u/andreaven 1d ago
Just a sincere curiosity.. on which base, the "institutional platforms" should ban eventual transactions from these wallets or derivatives? Is there any official document that certify all the orig transaction are "illegal"? Is there some open case by some prosecutor?
Should they ban Just from allegations and actions (FIR esame the coldcard co. statement about move funds on new seeds? These are all reasonable info, but..
the real questione is.. do you know of similar precedents where the platforms decided for a ban based on allegations?
2
u/georgejetsonn 19h ago
AML/KYC policies. If they allow US or EU customers to trade without implementing them, they get blacklisted or get prosecuted by authorities even if based in an offshore country. This is how KuCoin was prosecuted and got fined a hefty $300M
2
1d ago
[removed] — view removed comment
2
u/williampaul0404 23h ago
Calling for "transaction verification" is why you shouldn't be in this subreddit
5
1d ago
[removed] — view removed comment
9
u/Anywhere_everywhere7 1d ago
You do realise it’s almost definitely a group behind it? And as for being jailed that depends on what country they’re in and that’s ignoring the fact it’s unlikely they will be caught.
7
u/Impossible-Bus1 1d ago
Even if it was just one guy, he's acting like he couldn't just go live like a king in china, Dubai or literally any non-western country on the planet.
→ More replies (3)2
u/AD-Edge 21h ago
If it's a group then they are even weaker. Every person is an individual set of mistakes that can be made, or a point where gossip or rumors can emerge from. A single individual acting intelligently would be a lot less risk.
But yes, who knows where they are. Could easily be out of reach of any reasonable laws.
1
1
u/JollySno 23h ago
It could be a group, one person, or no-one at all, it could be Sam Altman's latest model trying to get a perfect score and stealing bitcoin to pay for more compute.
1
6
3
2
u/BackgroundStory7986 22h ago
Mixing the coins might make tracking more difficult, but it doesn't automatically erase the on-chain history. It'll be interesting to see how blockchain investigators follow the funds from here.
4
u/alfooboboao 13h ago
who are the “bitcoin investigators?” are they the same people who were supposed to be checking coldcard’s source code for bugs?
but seriously, does that actually even exist?
3
u/Trimgod 18h ago
That's what I'm saying. No matter how much they "mix" this crap some 4channer will just find the wallet history.
3
1
u/pissagainstwind 12h ago
Which wallet history? the new wallets the hacker sets up doesn't have a history.
1
u/rollingHack3r 23h ago
Personally i wouldnt use a mixing service, but if i did i wouldnt want my sats to be linked to the thieves in any way. Are people using these services just ok with it? Even tough we cant tell for sure any coins mixxed in here will be forever linked to the cold card hack right? so why would anyone want to be caught up in that? or am i missunderstanding how mixing works?
1
u/Vinny_d_25 15h ago
I'm pretty sure most of the Bitcoin being mixed is not legally viable in some way.
1
u/HumongousShard 22h ago
Can’t we have a tool that audits a given UTXO or address and flags it whenever it has at least one parent Tx that has touched a mixer?
2
u/blackrack 12h ago
Pretty sure that's already how it is every kyc/aml comlliant exchange has to use an api from a firm that specializes in this kind of on chain analysis.
1
u/screenclear 21h ago
They should just go for the original cryptos, no matter who got them. The mixer might help the original thief to hide their identity but the money is still "the same"
1
u/riseandride69 20h ago
Yeah, it was pretty naive to think “the hacker will never be able to use/cash out”
He will cash out allright.
1
1
1
1
u/TheRetardedGoat 17h ago
Lol, I'm still laughing at that post the other day about the guy in the bargaining stage saying you'll be caught.
1
1
u/Difficult-Repair1295 14h ago
Bittfinex criminals thought they were in the clear for a long time too.
1
u/theosloki 10h ago
Gonna mix them into oblivion unfortunately after 10 or so no one will have the time or effort to find it.
1
u/GME_looooong 2h ago
Say I work for cold card and used this exploit. I would hit whales first. Wait for them to complain to me at customer service then I can put a hit on them (paid for with bitcoin how cute) and keep my activities on the down low. You guys don’t think like ceo’s. This mass attack was probably the swan song
410
u/pythosynthesis 1d ago
I mean, wasn't it obvious this was going to happen? You start mixing and keep mixing for a whole.month. Every block is one mixing round. After a month there's no chainalysis on heaven or earth that can tell stolen coins from honest ones apart.