×
The Almighty Buck

Bitcoin Could Become 'Worthless,' Bank of England Warns (theguardian.com) 271

The Bank of England has said that bitcoin could be "worthless" and people investing in the digital currency should be prepared to lose everything. The Guardian reports: In a warning over the potential risks for investors, the central bank questioned whether there was any inherent worth in the most prominent digital currency, which has soared in value this year to close to $50,000 a piece. The deputy governor, Sir Jon Cunliffe, said the Bank had to be ready for risks linked to the rise of the crypto asset following rapid growth in its popularity. "Their price can vary quite considerably and [bitcoins] could theoretically or practically drop to zero," he told the BBC.

The Bank's financial policy committee, set up in the wake of the 2008 financial crisis to monitor risks, said on Monday there was little direct threat to the stability of the UK financial system from crypto assets. However, it warned that, at the current rapid pace of growth, such assets could become more interconnected with traditional financial services and were likely to pose a number of risks. Publishing its regular health check on the financial system, the Bank said major institutions should take a cautious approach to adopting crypto assets and that it would pay close attention to developments in the market. "Enhanced regulatory and law enforcement frameworks, both domestically and at a global level, are needed to influence developments in these fast-growing markets in order to manage risks, encourage sustainable innovation and maintain broader trust and integrity in the financial system," it said. In a separate blogpost published on its website on Tuesday, a member of the Bank's staff said bitcoin failed to fulfill many of the features required of a currency and that it risked being inherently volatile.

Thomas Belsham, who works in the Bank's stakeholder and media engagement division, wrote: "The problem is that, unlike traditional forms of money, Bitcoin isn't used to price things other than itself. As Bitcoiners themselves are fond of saying, 'one Bitcoin = one Bitcoin'. But a tautology does not a currency make." He said scarcity of the crypto asset -- which is limited to 21m bitcoin -- is among the key reasons for its attraction for investors, but this feature embedded into its design "may even, ultimately, render Bitcoin worthless." About 19m bitcoin is currently in circulation, with new coins added when "miners" validate changes to the blockchain ledger underpinning the cryptocurrency. While the ultimate number of bitcoin in circulation is not expected to be reached until February 2140, it would become harder to sustain this system over time, Belsham said. "Simple game theory tells us that a process of backward induction should, really, at some point, induce the smart money to get out. And were that to happen, investors really should be prepared to lose everything. Eventually."

Government

USPS Built and Secretly Tested a Blockchain-Based Mobile Voting System Before 2020 (washingtonpost.com) 60

An anonymous reader quotes a report from The Washington Post: The U.S. Postal Service pursued a project to build and secretly test a blockchain-based mobile phone voting system before the 2020 election (Warning: may be paywalled; alternative source), experimenting with a technology that the government's own cybersecurity agency says can't be trusted to securely handle ballots. The system was never deployed in a live election and was abandoned in 2019, Postal Service spokesman David Partenheimer said. That was after cybersecurity researchers at the University of Colorado at Colorado Springs conducted a test of the system during a mock election and found numerous ways that it was vulnerable to hacking.

The project appears to have been conducted without the involvement of federal agencies more closely focused on elections, which were then scrambling to make voting more secure in the wake of Russian interference in the 2016 contest. Those efforts focused primarily on using paper ballot so the voter could verify their vote was recorded accurately and there would be a paper trail for auditors -- something missing from any mobile phone or Internet-based system. The project appears to have been conducted without the involvement of federal agencies more closely focused on elections, which were then scrambling to make voting more secure in the wake of Russian interference in the 2016 contest. Those efforts focused primarily on using paper ballot so the voter could verify their vote was recorded accurately and there would be a paper trail for auditors -- something missing from any mobile phone or Internet-based system.

The Postal Service system allowed people to cast votes on an Internet-connected mobile app similar to how they might add items to an online shopping cart or fill out an online survey. The votes were designed to be anonymous and to be recorded in multiple digital locations simultaneously. The idea is that each of those digital records would act as a check to verify the accuracy of the other records. This is essentially the same method that cryptocurrencies such as bitcoin use to ensure transactions are accurately recorded. But the system didn't protect against the numerous ways hackers might fake or corrupt votes, the University of Colorado researchers said. Those include impersonating voters, attacking the blockchain system itself so votes can't be trusted, flooding the system with information so it becomes too overwhelmed to function, and using techniques that undermine voters' privacy and the secrecy of the ballot. The researchers were able to successfully perform all those hacks during a mock election held on campus.
"The Postal Service was awarded a public patent for the concept in August 2020, but had not previously revealed that it built a prototype system or tested it," the report notes.
The Internet

What Is Web3 and Why Should You Care? (gizmodo.com) 113

Gizmodo's David Nield explains what Web3 is, what it will mean for the future, and how exactly the third-generation internet differs from the first two. An anonymous reader shares an excerpt from his report: Let's cut to the chase: For Web3 evangelists, it's a revolution; for skeptics, it's an overhyped house of cards that doesn't stand up to much scrutiny. [...] As you might remember if you're of a certain age, Web 1.0 was the era of static webpages. Sites displayed news and information, and maybe you had your own little corner of the World Wide Web to show off your personal interests and hobbies. Images were discouraged -- they took up too much bandwidth -- and video was out of the question. With the dawn of the 21st century, Web 1.0 gave way to Web 2.0 -- a more dynamic, editable, user-driven internet. Static was out and webpages became more interactive and app-like (see Gmail, for example). Many of us signed up for social media accounts and blogs that we used to put our own content on the web in vast amounts. Images and video no longer reduced sites to a crawl, and we started sharing them in huge numbers. And now the dawn of Web3 is upon us. People define it in a few different ways, but at its core is the idea of decentralization, which we've seen with cryptocurrencies (key drivers of Web3). Rather than Google, Apple, Microsoft, Amazon, and Facebook (sorry, Meta) hoarding everything, the internet will supposedly become more democratized.

Key to this decentralization is blockchain technology, which creates publicly visible and verifiable ledgers of record that can be accessed by anyone, anywhere. The blockchain already underpins Bitcoin and other cryptocurrencies, as well as a number of fledging technologies, and it's tightly interwoven into the future vision of everything that Web3 promises. The idea is that everything you do, from shopping to social media, is handled through the sane secure processes, with both more privacy and more transparency baked in. In some ways, Web3 is a mix of the two eras that came before it: The advanced, dynamic, app-like tech of the modern web, combined with the decentralized, user-driven philosophy that was around at the start of the internet, before billion- and trillion-dollar corporations owned everything. Web3 shifts the power dynamic from the giant tech entities back to the users -- or at least that's the theory.

In its current form, Web3 rewards users with tokens, which will eventually be used in a variety of ways, including currency or as votes to influence the future of technology. In this brave new world, the value generated by the web will be shared out between many more users and more companies and more services, with much-improved interoperability. NFTs are closely linked to the Web3 vision. [...] For our purposes here, the link between cryptocurrencies, NFTs, and Web3 is the foundation: the blockchain. Throw in some artificial intelligence and some machine learning to do everything from filter out unnecessary data to spot security threats, and you've got just about every emerging digital technology covered with Web3. Right now Ethereum is the blockchain attracting the most Web3 interest (it supports both a cryptocurrency and an NFT system, and you can do everything from make a payment through it to build an app on it).

Bitcoin

Hard Drive With 7,500 Bitcoin Buried in Landfill. Can It Be Dug Up? (newyorker.com) 198

In 2013 a British man accidentally threw away a hard drive that contained 7,500 bitcoin. Today it'd be worth over $350 million, reports CNBC: His name is James Howells. He's an IT worker from Wales... He once told NBC News, "It is soul-destroying, to be honest... Every second of the day I am thinking about what could've been." In a last-ditch effort earlier this year, Howells offered his local town tens of millions of dollars to help him find it.
By "find it," he means "digging through his local dump" (where the hard drive ended up). The New Yorker reported that this spring Howell finally got a meeting with two city officials, one of whom was responsible for the city's waste and sanitation services. But after he'd delivered his home-made PowerPoint presentation over Zoom, he says their response was, "You know, Mr. Howells, there is absolutely zero appetite for this project to go ahead within Newport City Council." When the meeting ended, she said that she would call him if the situation changed. Months of silence followed. (A spokesperson for the city council told me that the official permit for the site does not allow "excavation work....")

"The total area we want to dig is two hundred and fifty metres by two hundred and fifty metres by fifteen metres deep," Howells told me, with excitement. "It's forty thousand tons of waste. It's not impossible, is it?"

The New Yorker also reports that in mid-November Howells got a second response from the local city officials — declining to authorize his landfill digging yet again, calling it "environmentally risky."

The incident raises the question as to whether there should be a better way to recover lost cryptocoins — but Howells himself remains opposed to that. So meanwhile Howells keeps checking a phone app telling him how much his bitcoin would be worth if he hadn't thrown away the hard drive.

One day, he watched its value swing by $20 million.
Bitcoin

Foreign Policy magazine: 'Bitcoin Failed in El Salvador.' Is the Answer More Bitcoin? (foreignpolicy.com) 100

"Bitcoin mining is a process of competitively wasting electricity to guess a winning number every 10 minutes or so," writes author David Gerard in Foreign Policy magazine.

And he's got an equally negative take on Salvadoran President Nayib Bukele's experiment in making Bitcoin an official national currency alongside the U.S. dollar. "When a con artist's grift starts to fall apart, he knows to move onto the next one fast..." More than 91 percent of Salvadorans want dollars, not bitcoins. The official Chivo payment system was unreliable at launch in September — the kiss of death for a new system. Users joined for the $30 signup bonus, spent it or cashed it out, then didn't use Chivo again. The system completely failed to check new users' photos, relying solely on their national identity card number and date of birth; massive identity fraud to steal signup bonuses ensued. Bitcoin's ridiculously volatile price was appreciated only by aspiring day traders. Large street protests against compulsory Bitcoin implementation continued through October. The government stopped promoting Chivo on radio, TV, and social media. Chivo buses and vans were seen with plastic taped over the company's logo.

Bukele's financial problems remain. El Salvador can't print its own dollars, so Bukele urgently needs to fund his heavy deficit spending. The International Monetary Fund has not lent the country the $1 billion Bukele asked for, and has indicated its strong concerns about the Bitcoin scheme... At the Latin American Bitcoin and Blockchain Conference on Nov. 20, Bukele came onstage to an animation of beaming down from a flying saucer and outlined his plans for Bitcoin City: a new charter city to be built from scratch, centered on bitcoin mining — and powered by a volcano. Bitcoin City would be paid for with the issuance of $1 billion in "volcano bonds," starting in mid-2022.

The 10-year volcano bonds would pay 6.5 percent annual interest. $500 million of the bond revenue would be used to buy bitcoins... Holding $100,000 in volcano bonds for five years would qualify investors for Salvadoran citizenship... Holders of El Salvador's existing sovereign debt were unimpressed. The volcano bonds would be a strictly worse investment than buying the country's existing bonds and hedging them with bitcoins. The existing bonds dropped from 75 cents on the dollar to a record low of 63.4 cents after the volcano bond announcement...

[T]he volcano bonds are Bukele's way to get Bitcoin holders' money into the Salvadoran economy and count it as dollars. Bukele will brazen all of this out as long as he can, periodically throwing new plans on the table as a distraction. If he can maintain power, then the Bitcoin users will discover that he's taken their money. If he can't maintain power, then his successor will have no love for his failed Bitcoin schemes. Either scenario ends with a lot of disappointed Bitcoin users — because a national economy really can't run on a volatile and manipulated speculative commodity that's unusable as a currency.

Both the Bitcoin users and Bukele seem to think the other is a sucker who they'll take for everything they've got. It's possible that both will lose.

The article also points out that with El Salvador's high electricity rates, one of their power plant recently spent $4,672 in electricity to mine $269 in bitcoin.
Bitcoin

Visa Launches Crypto Consulting Services (cnbc.com) 18

Visa is launching new consulting and advisory services to help its clients navigate the world of cryptocurrencies. CNBC reports: The payments processor said Wednesday its crypto advisory practice, housed within its consulting and analytics division, will offer advice to financial institutions, retailers and other firms on everything from rolling out crypto features to exploring non-fungible tokens. The move marks Visa's latest attempt to push deeper into the crypto industry. From Oct. 1, 2020 to Sept. 30, 2021, the company processed $3.5 billion in digital currency transactions through its crypto-linked card schemes, according to Nikola Plecas, Visa's European crypto lead.

"Some of these leading exchanges have millions or, in some instances, tens of millions of users," Plecas told CNBC, adding that the company allows users to spend their crypto at over 80 million merchants. The company is also developing products geared toward stablecoins -- virtual tokens tied to the value of sovereign currencies, typically the dollar -- and central bank-issued digital currencies. Visa hopes its crypto consultancy can help further mainstream adoption of bitcoin and other digital currencies. Like rival Mastercard, the credit card giant sees cryptocurrencies as a key growth opportunity as it expands into areas beyond card payments.

Bitcoin

Ubisoft Becomes First Major Gaming Company To Launch In-Game NFTs (decrypt.co) 48

An anonymous reader quotes a report from Decrypt: Today, the publisher behind Assassin's Creed and Just Dance revealed Ubisoft Quartz, a platform that lets players earn and purchase in-game items that are tokenized as NFTs on the Tezos blockchain. Quartz will launch first in the PC version of Tom Clancy's Ghost Recon Breakpoint, the latest online game in the long-running tactical shooter series. Quartz will launch in beta on December 9 in the United States, Canada, France, Germany, Spain, Italy, Belgium, Brazil, and Australia. Ghost Recon Breakpoint players who have reached XP level 5 in the game can access the NFT drops. Ubisoft's release says that players must be at least 18 years old to create a Tezos wallet for use with the game.

Ubisoft is referring to its NFT drops as "Digits" and plans to release free NFTs for early adopters on December 9, 12, and 15, with further drops planned for 2022. An infographic shows items such as weapon skins and unique armor and apparel, along with a message that teases future initiatives: "This is just the beginning" [...] Much of Ubisoft's announcement today highlights the difference in environmental impact between the proof-of-stake Tezos blockchain and the energy-intensive Bitcoin. Tezos claims that a single transaction on its network uses "more than 2 million times less energy" than Bitcoin, the leading cryptocurrency. It also suggests that a single Tezos transaction uses about as much energy as a 30-second streaming video, whereas a Bitcoin transaction is estimated to measure up to the environmental impact of a full, uninterrupted year of streaming video footage.

Bitcoin

The CIA Is Deep Into Cryptocurrency, Director Reveals (vice.com) 39

An anonymous reader quotes a report from Motherboard: There's a long-running conspiracy theory among a small number of cryptocurrency enthusiasts that Bitcoin's anonymous inventor, Satoshi Nakamoto, was actually the CIA or another three-lettered agency. That fringe theory is having a fresh day in the sun after CIA Director William Burns said on Monday that the intelligence agency has "a number of different projects focused on cryptocurrency" on the go. Burns made his comments at the tail end of a talk at the Wall Street Journal's CEO Summit. After discussing everything from the possible Russian invasion of Ukraine to the challenges of space, someone in the audience asked if the agency is on top of cryptocurrencies, which are currently at the center of the ransomware epidemic that U.S. officials are attempting to get a handle on and stamp out.

Here's what Burns said: "'This is something I inherited. My predecessor had started this, but had set in motion a number of different projects focused on cryptocurrency and trying to look at second- and third-order consequences as well and helping with our colleagues in other parts of the U.S. government to provide solid intelligence on what we're seeing as well.'" Cryptocurrencies "could have enormous impact on everything from ransomware attacks, as you mentioned, because one of the ways of getting at ransomware attacks and deterring them is to be able to get at the financial networks that so many of those criminal networks use and that gets right at the issue of digital currencies as well," Burns said.

Bitcoin

Self-Described Bitcoin Creator Must Pay $100 Million In Suit (bloomberg.com) 84

An anonymous reader quotes a report from Bloomberg: The Australian computer scientist who claims he invented Bitcoin was told by a U.S. jury to pay $100 million in damages over claims that he cheated a deceased friend over intellectual property for the cryptocurrency. Jurors in Miami federal court took about a week to reach Monday's verdict, following about three weeks of trial. The jury rejected most claims against Craig Wright and the outcome probably won't resolve the debate over whether Wright is the mythical creator of the peer-to-peer currency, Satoshi Nakamoto.

The brother of Dave Kleiman, a computer security expert who died in 2013, alleged that the late Florida man worked with Wright to create and mine Bitcoin in its early years. As a result, the plaintiffs claimed the estate was entitled to half of a cache of as many as 1.1 million Bitcoins worth some $70 billion, which are thought to be held by Satoshi. Some cryptocurrency investors see Wright as a fake, and years-long litigation in Florida has done little to quiet the skeptics. Wright has declared many times in court that he invented Bitcoin, as he has previously in news interviews. Had the jury's verdict gone against Wright, that would have forced to him to produce the Satoshi fortune. To some observers, that would have been the true test.

"Many years ago, Craig Wright told the Kleiman family that he and Dave Kleiman developed revolutionary Bitcoin based intellectual property," he said in a statement. "Despite those admissions, Wright refused to give the Kleimans their fair share of what Dave helped create." The jury found Wright liable for conversion -- the illegal taking of property -- and awarded damages to W&K Info Defense Research LLC, the entity through which Kleiman and Wright are supposed to have done work together. In closing arguments to the jury, Freedman said Wright schemed and connived to "steal from his dead best friend with forgery and lies." The estate claimed that in addition to the Bitcoin mining the friends did together, Kleiman helped Wright create the intellectual property behind early blockchain technology worth $252 billion. Wright contended that the claims by Dave Kleiman's brother, Ira, were fabricated. He testified that his friend didn't help him launch the cryptocurrency and argued there was no paper trail showing that they had a partnership.

United States

Companies Linked To Russian Ransomware Hide in Plain Sight (nytimes.com) 32

When cybersleuths traced the millions of dollars American companies, hospitals and city governments have paid to online extortionists in ransom money, they made a telling discovery: At least some of it passed through one of the most prestigious business addresses in Moscow. From a report: The Biden administration has also zeroed in on the building, Federation Tower East, the tallest skyscraper in the Russian capital. The United States has targeted several companies in the tower as it seeks to penalize Russian ransomware gangs, which encrypt their victims' digital data and then demand payments to unscramble it. Those payments are typically made in cryptocurrencies, virtual currencies like Bitcoin, which the gangs then need to convert to standard currencies, like dollars, euros and rubles.

That this high-rise in Moscow's financial district has emerged as an apparent hub of such money laundering has convinced many security experts that the Russian authorities tolerate ransomware operators. The targets are almost exclusively outside Russia, they point out, and in at least one case documented in a U.S. sanctions announcement, the suspect was assisting a Russian espionage agency. "It says a lot," said Dmitry Smilyanets, a threat intelligence expert with the Massachusetts-based cybersecurity firm Recorded Future. "Russian law enforcement usually has an answer: 'There is no case open in Russian jurisdiction. There are no victims. How do you expect us to prosecute these honorable people?'" Recorded Future has counted about 50 cryptocurrency exchanges in Moscow City, a financial district in the capital, that in its assessment are engaged in illicit activity. Other exchanges in the district are not suspected of accepting cryptocurrencies linked to crime.

The Almighty Buck

Someone Stole $120 Million in Crypto From a DeFi Website (theverge.com) 72

The Verge reports: On Wednesday night, someone drained funds from multiple cryptocurrency wallets connected to the decentralized finance platform BadgerDAO. According to the blockchain security and data analytics Peckshield, which is working with Badger to investigate the heist, the various tokens stolen in the attack are worth about $120 million.

While the investigation is still ongoing, members of the Badger team have told users that they believe the issue came from someone inserting a malicious script in the UI of their website. For any users who interacted with the site when the script was active, it would intercept Web3 transactions and insert a request to transfer the victim's tokens to the attacker's chosen address. Because of the transparent nature of the transactions, we can see what happened once the attackers pounced. PeckShield points out one transfer that yanked 896 Bitcoin into the attacker's coffers, worth more than $50 million.

According to the team, the malicious code appeared as early as November 10th, as the attackers ran it at seemingly random intervals to avoid detection....

One of the things Badger is investigating is how the attacker apparently accessed Cloudflare via an API key that should've been protected by two-factor authentication...

The Almighty Buck

Bitcoin, Ether, Other Cryptocurrencies Suddenly Drop More Than 16% (marketwatch.com) 105

"Cryptocurrency was down by as much as 20% Saturday, hitting its lowest point in months," reports MarketWatch: Bitcoin, the largest cryptocurrency by market value, was down 18% at $46,571.84 at about 7 a.m. ET, according to data from CoinDesk. It temporarily dipped to $42,000 before bouncing back. Ether, the second-largest cryptocurrency, was down close to 16%.

The declines were widespread across the crypto universe. Other widely traded cryptocurrencies including Solana, Dogecoin, and Shiba Inu coin lost more than a fifth of their value.

Dogecoin now appears to be down more than 33%. According to the article, a "market insights" official at cryptolender Genesis Global Trading speculated that a large sell order might have triggered cryptocurrency margin calls and liquidations.

Meanwhile, the president of El Salvador gloated on Twitter that they'd snapped up 150 bitcoins at an average price of $48,670 each, bragging that "El Salvador just bought the dip!" MarketWatch reports.

"He later wrote that the country had 'Missed the f***ing bottom by 7 minutes,' followed by a laughing emoji."
The Internet

Fake Covid-19 Vaccine Certificates Are Being Advertised On the Dark Web (bankinfosecurity.com) 207

Criminals have been selling fake vaccine certificates online and may be able to fool an EU system designed to verify the certificates' validity, researchers warn. BankInfoSecurity reports: [A] report released last week, "COVID-19 Vaccination Certificates in the Dark Web," which has not yet been peer-reviewed, notes that some darknet markets continue to sell supposed vaccine certificates for use in multiple countries. Four researchers - Dimitrios Georgoulias, Jens Myrup Pedersen, Morten Falch, Emmanouil Vasilomanolakis - who are all part of the Cyber Security Group at Aalborg University in Copenhagen, Denmark, reviewed vaccination certificate offerings from 17 marketplaces and 10 vendor shops. The researchers found that at least one vendor appears to be selling digital certificates, registered in Italy, that are being read as valid by mobile COVID-19 certificate-checking apps developed by both France and Denmark.

The Aalborg University researchers, however, note that many darknet markets forbid any listing containing any items related to COVID-19. But others, they say, do allow both physical and digital vaccine certificates to be offered for sale, and in some cases also "yellow vaccination cards" or other vaccination record cards that can be used as proof of vaccination, albeit only inside the country in which they were supposedly issued. "The listings are heavily focused on European countries and the United States, but there are also listings from other continents and countries, such as Brazil, Canada, Mexico and Australia," as well as Russia, the researchers write. "The pricing differs greatly between the different listings, with the cheapest certificate starting at $39 and the highest price reaching almost $2,800, which included both a physical and a digital certificate, registered in the United Kingdom," they write. Most markets accept bitcoin and monero cryptocurrencies as payment, they add, while a smaller number also take such digital coins as ethereum, cardano, litecoin and zcash. [...] The Aalborg University researchers note that buying a fake digital certificate gives the seller ample opportunity to scam a buyer.

If these fake COVID-19 certificates can indeed pass for valid ones, then one unanswered question remains: How? Many of the sites claim to have access to the systems used to issue certificates, either by hacking into them remotely, or having insiders who work at a healthcare or other health organization, the researchers say. "In the specific case of a listing on the Russian marketplace Hydra, the description even mentioned the exact location and hospital that the system was accessed from," they say. Another possibility, however, is that criminals have somehow stolen one or more private keys for the European system, which were issued to participating health organizations. If so, it would be difficult to revoke these keys, the researchers say, since doing so would invalidate what might be a large quantity of legitimate certificates too.

Bitcoin

Really Stupid 'Smart Contract' Bug Let Hackers Steal $31 Million In Digital Coin (arstechnica.com) 55

An anonymous reader quotes a report from Ars Technica: Blockchain startup MonoX Finance said on Wednesday that a hacker stole $31 million by exploiting a bug in software the service uses to draft smart contracts. The company uses a decentralized finance protocol known as MonoX that lets users trade digital currency tokens without some of the requirements of traditional exchanges. "Project owners can list their tokens without the burden of capital requirements and focus on using funds for building the project instead of providing liquidity," MonoX company representatives say here. "It works by grouping deposited tokens into a virtual pair with vCASH, to offer a single token pool design."

An accounting error built into the company's software let an attacker inflate the price of the MONO token and to then use it to cash out all the other deposited tokens, MonoX Finance revealed in a post. The haul amounted to $31 million worth of tokens on the Ethereum or Polygon blockchains, both of which are supported by the MonoX protocol. Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another. MonoX updates prices after each swap by calculating new prices for both tokens. When the swap is completed, the price of tokenIn -- that is, the token sent by the user -- decreases and the price of tokenOut -- or the token received by the user -- increases.

By using the same token for both tokenIn and tokenOut, the hacker greatly inflated the price of the MONO token because the updating of the tokenOut overwrote the price update of the tokenIn. The hacker then exchanged the token for $31 million worth of tokens on the Ethereum and Polygon blockchains. There's no practical reason for exchanging a token for the same token, and therefore the software that conducts trades should never have allowed such transactions. Alas, it did, despite MonoX receiving three security audits this year.
"These kinds of attacks are common in smart contracts because many developers do not put in the legwork to define security properties for their code" said Dan Guido, an expert in securing smart contracts and CEO of security consultancy Trail of Bits. "They had audits, but if the audits only state that a smart person looked at the code for a given period of time, then the results are of limited value. Smart contracts need testable evidence that they do what you intend, and only what you intend. That means defined security properties and techniques employed to evaluate them."

According to Blockchain researcher Igor Igamberdiev, the drained tokens included $18.2 million in Wrapped Ethereum, $10.5 in MATIC tokens, and $2 million worth of WBTC, along with small amounts of tokens for Wrapped Bitcoin, Chainlink, Unit Protocol, Aavegotchi, and Immutable X.
Bitcoin

Goldman Sachs, Other Wall Street Banks Exploring Bitcoin-Backed Loans (coindesk.com) 56

Goldman Sachs is among a handful of tier-one U.S. banks figuring out how to use bitcoin as collateral for cash loans to institutions, CoinDesk reported Thursday, citing people familiar with the plans. From the report: Banks such as Goldman will not touch cryptocurrency spot markets but lean towards synthetic crypto products such as futures. Emulating tri-party repo type arrangements (a way of borrowing funds by selling securities with an agreement to repurchase them, involving a third-party agent), banks are exploring ways to follow the same path of not touching bitcoin, like other synthetic products. It's an opportunity that lays the groundwork for more integrated crypto prime brokerage services in the future, according to the sources CoinDesk spoke with. It's also a continuation of Wall Street's relatively sudden embrace of a $2.7 trillion asset class -- albeit with somewhat niche products. "Goldman was working on getting approved for lending against collateral and tri-party repo," said one of the people. "And if they had a liquidation agent, then they were just doing secured lending without ever having bitcoin touch their balance sheet."
Businesses

Jack Dorsey's Square Changes Corporate Name To Block (businesswire.com) 26

Square, the financial services and digital payments company founded by Jack Dorsey and Jim McKelvey in 2010, announced today that it is changing its name to Block. From a press release: Block will be the name for the company as a corporate entity. The Square name has become synonymous with the company's Seller business, which provides an integrated ecosystem of commerce solutions, business software, and banking services for sellers, and this move allows the Seller business to own the Square brand it was built for. The change to Block acknowledges the company's growth. Since its start in 2009, the company has added Cash App, TIDAL, and TBD54566975 as businesses, and the name change creates room for further growth. Block is an overarching ecosystem of many businesses united by their purpose of economic empowerment, and serves many people -- individuals, artists, fans, developers, and sellers.

The name change to Block distinguishes the corporate entity from its businesses, or building blocks. There will be no organizational changes, and Square, Cash App, TIDAL, and TBD54566975 will continue to maintain their respective brands. A foundational workforce, which includes teams such as Counsel, People, and Finance, will continue to help guide the ecosystem at the corporate level. As a result of the name change, Square Crypto, a separate initiative of the company dedicated to advancing Bitcoin, will change its name to Spiral. The name has many associated meanings for the company -- building blocks, neighborhood blocks and their local businesses, communities coming together at block parties full of music, a blockchain, a section of code, and obstacles to overcome.
"We built the Square brand for our Seller business, which is where it belongs," said Jack Dorsey, cofounder and CEO of Block. "Block is a new name, but our purpose of economic empowerment remains the same. No matter how we grow or change, we will continue to build tools to help increase access to the economy."
The Almighty Buck

Getting a Crypto Refund Can Be Very Expensive (bbc.com) 132

Long-time Slashdot reader smooth wombat writes: Recently, Slashdot posted a story about a group trying to purchase one of the few copies of the U.S. Constitution in the public domain. The idea was to use pool donations by people via Ethereum to get the winning bid. Alas, Citadel CEO Ken Griffin outbid the group and took possession of the copy.

Now the group, ConsitutionDAO, is in the process of refunding the donations, the BBC reports, and the people getting their money back are finding it can be quite expensive...

The BBC writes: That is because the Ethereum network records its transactions on the blockchain, the same basic technology idea that powers other cryptocurrencies such as Bitcoin. And like Bitcoin mining, it requires computational power to run. "Gas" is the fee paid to those who run the computer systems to facilitate transactions. And it changes price based on supply and demand. That means that at times, it can be much more expensive to make any kind of transaction, depending on how busy the Ethereum network is. And the network has recently seen high usage — and high gas prices.

On its official Discord — the chat app which allows anyone to create rooms and discussion channels for enthusiasts on almost any topic — the group said it had 17,437 donors with a median donation of $206.26. High gas fees mean that "small" donations could be severely hit by the transaction charge.

One user on the Discord said that in order to get $400 refunded, they would have to pay $168 in gas. Others complained of the fees being higher than the relatively small amount of their refund.

Bitcoin

Crypto Miners in Kazakhstan Face Bitter Winter of Power Cuts (ft.com) 135

Illegal miners and mass relocations after a ban on crypto mining in China have overloaded energy grid. From a report: Matthew Heard, a software engineer from San Jose, is worried about his 33 bitcoin mining machines in Kazakhstan. In the past week, they kept getting shut off in an attempt by the national grid to limit the power being used by crypto miners. "It has been days since my machines have been online," he said. "During the last week, even if my machines do come on, they barely stay on." Kazakhstan has been struggling to cope with the huge popularity of crypto mining, driven this year partly by the steep rise in value of cryptocurrencies and partly by a mass migration of miners to its borders after China made mining illegal in May.

After three major power plants in the north of the country went into emergency shutdown last month the state grid operator, Kegoc, warned that it would start rationing power to the 50 crypto miners that are registered with the government, and said they would be "isconnected first" if the grid suffers problems. Heard set up in Kazakhstan in August and his machines are managed by Enegix, a company that rents out space to run crypto mining machines. He said his income has dropped from an average of $1,200 worth of bitcoin per day to $800 in October, and in the past week his machines have only been on for 55 per cent of the time. Machine owners are not notified when shutdowns are going to happen or when they will go back online, he said.

China

China Looks To Set Up Digital Asset Bourse in Virtual Yuan Push (bloomberg.com) 30

China is considering setting up a digital asset exchange in Beijing as officials push to promote usage of the digital yuan and crack down on cryptocurrencies. From a report: Beijing will explore the possibility of establishing a bourse for digital assets trading, as part of broader efforts to boost financial services in the capital, according to guidelines issued by the State Council. The cabinet called for faster trials of the digital yuan and urged big banks to set up e-CNY operation firms. The statement provided no further details on the planned digital asset exchange.

China has been in process of creating a virtual version of its legal tender since 2014 in an effort to cope with an increasingly digitized economy as well as to fend off potential threats from virtual currencies such as Bitcoin. It banned crypto-exchanges in 2017 and stepped up scrutiny this year to ban crypto mining and all related transactions, in tandem with campaigns to promote the digital yuan.

Bitcoin

Europe Must Ban Bitcoin Mining To Hit the 1.5C Paris Climate Goal, Say Swedish Regulators (euronews.com) 222

Faced with a sharp rise in energy consumption, Swedish authorities are calling on the European Union to ban "energy intensive" crypto mining. From a report: Erik Thedeen, director of the Swedish Financial Supervisory Authority, and Bjorn Risinger, director of the Swedish Environmental Protection Agency, said cryptocurrency's rising energy usage is threatening Sweden's ability to meet its obligations under the Paris Climate Agreement. Between April and August this year, the energy consumption of Bitcoin mining in the Nordic country rose "several hundred per cent," and now consumes the equivalent electricity of 200,000 households, Thedeen and Risinger said.

In an open letter, the directors of Sweden's top financial and environmental regulators called for an EU-wide ban on "proof of work" cryptocurrency mining, for Sweden to "halt the establishment" of new crypto mining operations and for companies that trade and invest in crypto assets to be prohibited from describing their business activities as environmentally sustainable.

Slashdot Top Deals