About 2/3 of the other affected projects had yet to launch or had no social media presence. Crypto sleuth zachxbt tried to contact the other 1/3, and some of the projects were able to migrate contracts before any malicious actions. zachxbt wrote, "Funny enough when I reached out to all the different projects the ones that responded said they either didn't read over the smart contract beforehand or weren't the most technically inclined teams." On April 7, OpenSea contacted zachxbt to say they had frozen trading for all contracts created by the developer.
One contracted developer writes malicious code for 32 different NFT projects
A developer offering his services on the freelancer marketplace Fiverr was hired by 32 different NFT projects, for which he wrote and deployed the smart contracts. The first project to be compromised via the malicious code was "TheStarsLab" project, when the developer renounced ownership on the mint contract, making it impossible for the project team to access the funds. The developer is the only one who has the ability to move the money out of the project contract, though as of a month after the attack on the project, the 197 ETH stuck in the contract (~$580,000 at the time of the attack; ~$648,000 as of April 10).
Hackers who stole data from Nvidia demand the chipmaker remove cryptomining limitations on GPUs
In late February, the Lapsus$ ransomware group claimed to have breached Nvidia's corporate network and stolen more than a terabyte of data, which they say includes schematics and source code for drivers and firmware, as well as employee credentials. Instead of the typical monetary ransom, Lapsus$ demanded something unusual: that Nvidia remove the "Lite Hash Rate" (LHR) feature from their graphics card. LHR is an artificial limitation that Nvidia has applied to their line of gaming chips, which makes them less attractive to cryptominers who have otherwise been causing shortages in GPUs.
Lapsus$ initially promised that if Nvidia removed LHR from their 30-series line of chips, they would "forget about [the hardware] folder (it's a big folder)". However, they updated their demand on March 1, demanding that Nvidia either make all current and future drivers for all of their cards open source ("while keeping the Verilog and chipset trade secrets... well, secret"), or else they would publish all files for Nvidia chips. They wrote that Nvidia had until March 4 to make a decision. As of March 3, Nvidia had not made a statement around whether they would acquiesce to the hackers' demands.
Former ConsenSys employees demand audit regarding MetaMask and Infura's transfer to a new company
A group of 35 former employees of the startup incubator ConsenSys filed a request for an audit of a transfer of the company's "crown jewel" assets to a new company, which they say "was to the detriment of the minority shareholders". The requested audit relates to an August 2020 deal that saw the cryptocurrency wallet MetaMask and the developer platform Infura be transferred to a brand new entity. The transaction also resulted in the banking giant JPMorgan taking a 10% share in ConsenSys, and in a $39 million loan by ConsenSys founder being offset. The shareholders allege that MetaMask and Infura were massively undervalued in the trade; an allegation that a ConsenSys spokesperson has rebutted, saying that "the group would like to apply a valuation that might be achieved today to a set of projects that were pre-monetization during the darkest days of Covid when the transaction took place".
Far-right social network Parler launches an NFT platform where you have to pay with credit cards
You might think if Parler was going to create an NFT celebrating their hero, they wouldn't include along with their promotional material the example most reminiscent of Milo Yiannopoulos, the man who's been so effectively deplatformed that he's had to resort to selling statues of the Virgin Mary on a home shopping TV channel. On March 1, the far-right social network Parler announced their "CryptoTrump" NFTs, which will sell on their "DeepRedSky" NFT platform. The platform is built on the Solana blockchain, and has already helped Melania Trump "sell" (wash trade) her NFTs. Their inaugural project is a collection of 250 algorithmically-generated Trump NFTs, which will sell for $2,750 each and eventually be part of a collection of 10,000 items.
Although Parler's press release contains a lot of their usual chest-thumping about "freedom from Big Tech", the DeepRedSky NFTs can only be minted with credit cards, with payments being processed through Stripe. The good news: if you aren't getting enough of a rush out of the risks involved with crypto in general, you can get a new thrill from giving your personal information to a platform that's been hacked multiple times.
GenomesDAO wants you to give them your genetic data, which they acknowledge is "data that can be exploited in ways we cannot even imagine yet"
GenomesDAO has created a platform which they promise will allow people who wish to sell their genetic data to have more control over it. They write that genetic data is "data that can be exploited in ways we cannot even imagine yet" and go into a list of these possible exploits — and this is apparently why you should definitely entrust it to a company building in a space known for its endless hacks. The company promises to help users earn money through selling access to their genome — though of course this isn't until step five in their roadmap. They're currently at step two or step three, depending on which version of your roadmap you look at; both steps seem focused on creating cat NFTs out of your genetic data for some reason.
Randi Zuckerberg tests your secondhand embarrassment tolerance with her second crypto-themed parody song
Apparently hoping to create the "rallying cry for the women of web3", Randi Zuckerberg released her second crypto-themed song "WAGMI", a parody of Twisted Sister's "We're Not Gonna Take It". Earlier that month, she had released another parody video, of Adele's "Hello". "WAGMI" is loaded with crypto in-jokes, with Zuckerberg at one point yelling "LFG! sweep the goddamn floor! we're hodling, yes we are!" The reaction on Twitter appeared to be fairly universally one of cringe, and more than a few users drew comparison to the terrible raps of alleged Bitfinex money launderer Heather "Razzlekhan" Morgan.
Partway through the song, Zuckerberg sings "carpe the crypto diem". This raises the question of whether she intentionally included a dig at her brother Mark's failed Diem cryptocurrency project (formerly Libra), or if the project was such a flop even his own sister didn't know about it. I truly can't decide which scenario would be funnier.
NFT collector files $6 million lawsuit against OpenSea, LooksRare, and the company behind Bored Apes for not doing more to discourage thefts
Robert Armijo is the former owner of three valuable NFTs — one Bored Ape and two Mutant Apes — which he bought for a total of around $300,000 between November 2021 and January 2022. On February 28, he filed a lawsuit against the NFT marketplaces OpenSea and LooksRare, as well as the company behind the Bored and Mutant Ape projects, Yuga Labs. The lawsuit was filed only ten days after another former Bored Apes owner filed suit against OpenSea for allegedly failing to secure their platform.
On February 1, he was the victim of a phishing attack in which he lost the three pricey NFTs. He had agreed to trade one of his Mutant Apes for another NFT he was interested in, but he and the prospective buyer had to perform the transaction through a platform other than OpenSea or LooksRare because it was a swap rather than a purchase for ETH. Armijo turned down several suggestions of platforms by the other party, saying he was unfamiliar with them, and instead suggested one of his own choosing. However, the other party was still able to send him a trading link that appeared to be from the site he had suggested, and Armijo approved what turned out to be an illegitimate transaction that allowed the other party to take all three of his NFTs for nothing in return. Armijo alleges that although he quickly realized he'd been phished, he was not able to get OpenSea or LooksRare to freeze sales of the stolen NFTs, and they were flipped for resale within days.
Armijo alleges that OpenSea and LooksRare have "utterly failed to protect consumers or do anything to disincentivize or stop the thefts" because they profit from each trade on their platform. He has also named the company behind the Apes NFTs, Yuga Labs, in his lawsuit, stating that they have not done enough to disincentivize theft by failing to "monitor its proprietary and exclusive ape community by denying entry to individuals whose access is predicated on a stolen BAYC NFT". Once again, my heart goes out to the judge hearing this case.
In terms of damages, Armijo states he has been "deprived not only of the significant monetary value of the NFTs he owned, but also [has been] strip[ped] of his membership in the BAYC community and the commercialization rights he possessed in his underlying Bored Ape and Mutant Ape images", and as such is seeking damages "in no event less than $6 million". Interestingly, the name Robert Armijo also appears as a defendant in SEC charges from June 2021, where the individual is alleged to have unlawfully sold securities managed by an organization also alleged by the SEC to be a Ponzi scheme. It's not immediately clear if this is the same person, or someone who shares a name.
- Armijo v. Ozone Networks, Inc. d/b/a Opensea, CourtListener
- "SEC Charges Additional Unregistered Brokers Who Sold EquiAlt Securities to Retail Investors", U.S. Securities and Exchange Commission
- "SEC sues La Mesa financial adviser over selling investments linked to a Ponzi scheme", The San Diego Union-Tribune
Elexir draws in more than $1.3 million, then announces an end to the project a week later and "reimburses" investors with $300,000
Elexir Finance promised a platform where users could build passive income via "yield bearing NFTs". They drew in more than $1.3 million in investments since the project's launch on February 22. However, on February 28, the team suddenly sold off their assets, tanking the $ELXR price in the process. They explained in Discord that this was because they had discovered a flaw in their tokenomics design, and so they had sold in order to cut losses and put "almost all early investors... either in positive profit or breakeven". The team also announced that they would distribute $300,000 to other early investors via airdrops. They notably failed to mention their plans for people who were not "early investors", or who were unknowingly snapping up doomed tokens that the project was offloading. Notably, the announcement also mentioned that the remaining treasury of more than $1 million would stay with the project developers, to be used for some new project they did not describe.
After their announcement went over about as poorly as you might expect, Elexir offered their community a choice: take the $300,000 they planned to airdrop, and either continue with that plan or re-add it to the liquidity pool. Community members by and large seemed to support an unlisted third mention, which was to refund the entire treasury to people who bought in, but the project developers seem intent on keeping that amount.
The project development team had had their identities verified by the organization StaySAFU, who subsequently tweeted that "We are currently communicating with both the team behind Elexir and the legal authorities", and that they had identity documents for the team members as well as video confirming they were responsible for rug pulls.
Cryptocurrency exchanges refuse requests by Ukrainian Vice President to freeze Russian and Belarusian addresses
Ukrainian Vice President Mykhailo Fedorov publicly requested major cryptocurrency exchanges to freeze addresses of all Russian and Belarusian users, to increase economic pressure on Russia to end its attacks on Ukraine. Several crypto exchanges including Binance, Kraken, and KuCoin publicly refused to do so. CEO and co-founder of the U.S.-based Kraken Exchange, Jesse Powell, wrote a Twitter thread in which he stated that Bitcoin was "the embodiment of libertarian values" and supposed to be "a weapon for peace, not for war".
Although perhaps unsurprising that these exchanges refused a request like Fedorov's, it will be interesting to see if and how sanctions may affect various cryptocurrency exchanges' actions. Binance, the largest crypto exchange, has already indicated it will comply with sanctions. Kraken, whose executives have tended towards more ideological stances, has also indicated that it will comply with legal requirements to freeze accounts.
Gavin Wood decides war in Ukraine is a great opportunity to promote his Polkadot project
On February 26, the Ukrainian government tweeted Bitcoin and Ethereum addresses, allowing cryptocurrency donations directly to the government to support their resistance to the ongoing Russian invasion. Gavin Wood, a co-founder of Ethereum who is now primarily involved with the Polkadot cryptocurrency network, apparently thought this could be a great marketing opportunity for Polkadot if the Ukrainian government would list a Polkadot address alongside BTC and ETH. He took to Twitter to offer a generous donation contingent on them doing so: "If you post a DOT address I'll personally contribute $5m". I'm sure the Ukrainian government have nothing more important to do than futz around with making wallets for every millionaire who wants to promote his crypto project.
Some with a more optimistic view of Wood's tweet suggested that perhaps his request was motivated by a desire to avoid capital gains taxes that could be incurred by converting his DOT to ETH before donating it, but another commenter pointed out that 1) Wood almost certainly holds more than $5M in ETH already as a co-founder of the project, and 2) Wood lives in Switzerland, where private individuals are generally exempt from capital gains taxes.
Co-founder and primary artist for Starcatchers NFT project uses insider knowledge to buy the project's rare NFTs to flip after reveal
The Starcatchers NFT project sold NFTs which did not immediately show the image associated with them, but would instead be revealed at a later date. An observant collector noticed that several of the NFTs in the project sold for considerably higher than others. Following the reveal, it turned out that these were the rarest NFTs in the project. One of the NFTs (#1755, pictured) has been described as the "project mascot", and later sold back to the Starcatchers team for 30 ETH (~$83,400).
It turned out that "Beutrec", a co-founder and the primary artist behind the collection, had used his access to the project metadata to identify and buy the rarest NFTs in the collection. Although he attempted to use distinct wallets to perform the transactions, they were trivially linked back to him. He made around 50 ETH (~$140,000) in profit from flipping the NFTs he bought with insider knowledge. After his actions were revealed in April 2022, Beutrec's new NFT project, Boki, announced that Beutrec would no longer be a part of their team.
Discord server for the Doodles NFT project is compromised
The enormously popular "Doodles" NFT project announced on February 26 that their Discord server had been "penetrated by a hacked bot", and that all messages should be ignored. They wrote, "Our lawyers, friends at discord, and the community are helping us". Later that day they announced that they had regained control of the server, and that they would compensate community members affected by the attack. It wasn't clear the scale of losses that may have been suffered by members of the Discord who believed that messages coming from an attacker were from the official team.
Howlerz NFT drop goes incredibly badly, with heavy botting, a poorly-implemented contract, and buyers falling for a scam contract
A heavily-hyped NFT project called "Howlerz" released its project via "secret mint" with no allowlist, and it went very, very poorly. Would-be buyers who were excitedly waiting for the mint to begin were fooled by a fake contract that scammed buyers for a total of 250 ETH ($675,000). When the project did mint for real, its NFTs sold out within seconds to the swarm of bots waiting to snap up the assets. Some prospective buyers who tried to buy the NFTs ran into "out of gas" problems, where they spent too little gas to cover the transaction, and ended up losing the gas fee on a failed transaction. This is a problem that is usually addressed by NFT developers in their contracts by adding a buffer to the estimated gas required.
Part of this collection's draw has been the promise that "you own the art". However, the artwork is released under the CC0 license, which dedicates the work to the public domain — that is, any ownership of the work in a copyright sense no longer exists.
Crypto and NFT scammers take advantage of the invasion of Ukraine to boost their grifts
Cryptocurrency scammers have turned to the crisis in Ukraine to provide fodder for their scams. Some have taken the tactic of pretending to be a person trying to escape the country and asking people via private message to send cryptocurrency; others have set up sketchy crowdfunding projects that claim they will send the money to various Ukrainian causes. One scam project tried to get people to buy "UkraineToken", with vague promises of "regular donations and support".
Ukraine-themed NFT projects have also sprung up all over the place, promising to donate portions of proceeds, with very few avenues to distinguish the legitimate from the scams. Some existing NFT projects have created Ukraine-themed items to add to their collections. Other NFT projects that have nothing to do with Ukraine have tried to tempt buyers by claiming they will donate a portion of proceeds (5%, in one case) to Ukrainian war relief funds. Individual sellers have also tried to use the crisis to increase the sales of NFTs they own, promising to donate their profits.
Needless to say, my advice if you're hoping to donate to relief would be to skip the cryptocurrency and NFTs altogether and pick any of the many verified relief funds out there.
Pixelmon raises $70 million only to reveal hilariously bad NFTs
The Pixelmon project promised an ambitious roadmap including a Pokémon-like game where the pixelized Pokémon could be caught and traded, a land project, and rewards to buyers of their "Generation 1" Pixelmon. The 3D pixelized Pokémon on their flashy website and on social media certainly looked promising to the buyers who sunk a total of $70 million into the project. Those buyers, who spent 3ETH per mint (~$9,300), were excited to unveil their "fully modeled 3D character[s] that you can interact with". However, when they "hatched" their Pixelmon, buyers were greeted with some truly terrible models, if they were lucky enough to have a model at all — some unveiled just an empty patch of grass, and others found their models appearing partway in the ground.
Although the project lead wrote on the Discord that they had "made a horrible mistake" but that they would "completely revamp and redesign" the NFTs, the project appeared to be a cash grab. On the night of the reveal, 1,000 ETH ($2.8 million) had already been transferred out of the project and split among various addresses. One of the recipients who received 400 ETH ($1.1 million) immediately went on a shopping spree, buying various big-ticket NFTs with their windfall.
Bitconnect founder indicted by federal grand jury on charges of orchestrating a global Ponzi scheme
BitConnect founder, Satish Kumbhani, founded the Bitconnect "investment program" in 2016, which attracted investors with its impossibly high payouts. From then until its dramatic 2018 shutdown, Kumbhani and his team drew in around $2.4 billion from investors. The whole thing turned out to be a Ponzi scheme, as many had suspected, and Kumbhani now faces a long list of charges: "conspiracy to commit wire fraud, wire fraud, conspiracy to commit commodity price manipulation, operation of an unlicensed money transmitting business, and conspiracy to commit international money laundering". If convicted of all charges, Kumbhani faces up to 70 years in prison.
- "BitConnect Founder Indicted in Global $2.4 Billion Cryptocurrency Scheme", United States Department of Justice
The Associated Press continues to mishandle its NFT fiasco with mass Discord bans and scrubbing of messages
After the fiasco the previous day in which some group of people at the Associated Press apparently decided turning an image of human suffering into an NFT was a brilliant idea, some at the Associated Press seem to be intent on tarnishing the organization's reputation even further. Horrified individuals took to the project's Discord, as the AP had previously invited people to use that as a way to give feedback and ask questions. The AP's "Director of Blockchain" Dwayne Desaulniers spent a while trying (but not really succeeding) to explain why the AP has decided to turn some of its photojournalism into NFTs. However, around 24 hours after the initial NFT tweet had been made, he apparently decided enough was enough and nearly everyone who'd asked a question was banned from the Discord, with their messages were removed. Some of Desaulniers' replies were also removed, such as where he had replied "Fucking right" to a user who said, "Dwayne wants a world without adblock, without archive.is, without a possibility that someone somewhere might wring a tiny bit of the AP's journalistic output out of them without paying for the privilege."
Nelson Mandela's paintings from prison to be sold as NFTs
The Guardian reported that five watercolor paintings created by former South African president Nelson Mandela depicting scenes from his years of incarceration will be sold as NFTs next month, as well as a handwritten description of why he created the artwork. His daughter is the one behind the project, and she says that "My dad was all about creating an accessible society. This is a way of democratising his art." She does not explain why there is a need to sell them as NFTs in order to accomplish this, or why this makes them more accessible than them already being available to view online. She also doesn't explain how pricing them at $3,500 for a set including one of each, or $700 apiece, can be considered "accessible".
The Associated Press wants to sell you an NFT of migrants adrift at sea
The Associated Press announced they would be dropping a new NFT on the platform they launched in January, which notably doesn't allow users to sell their NFTs off-platform or really do much at all with the image or video associated with their NFT. Most NFTs they've offered to date have been fairly benign, like a photo of a shooting star over a house in a field, or of a person spray-painting "illegal" on a brick wall (edgy!)
However, on February 24 they announced that their newest NFT would show a short, top-down video of around fifty migrants crammed into a small inflatable boat, adrift at sea in the Mediterranean. Any goodwill the AP might have had for their NFT project was likely shattered by their choice to monetize a video of human suffering. The already horrific NFT announcement was particularly ill-timed, given its juxtaposition on many Twitter feeds amongst news of Russian military action against Ukraine. The Associated Press deleted the announcement tweet four hours later.
Founders of BitMEX crypto exchange take guilty plea, pay $10M fine for failing to implement an anti-money laundering program
Arther Hayes and Benjamin Delo, the founders of the BitMEX cryptocurrency exchange, pled guilty to violations of the Bank Secrecy Act, which they violated by ignoring requirements to implement any anti-money laundering (AML) programs, including programs that would verify customer identities (KYC). They also separately agreed to pay a $10 million fine, which represents the monetary gain from their crime. "BitMEX was in effect a money laundering platform", said the U.S. Department of Justice statement, which also described how the platform was reportedly used to launder funds from a hack of another exchange, and how the executives both had direct knowledge that some of their customers were from countries under OFAC sanctions.
In March, the third co-founder, Sam Reed, also pled guilty and agreed to pay a $10 million fine. In August, top BitMex employee Gregory Dwyer entered a guilty plea and agreed to pay a $150,000 fine.
BitMEX had attempted to evade sanctions by claiming they didn't serve customers in the United States, though in reality they served thousands of U.S. customers and marketed in the U.S. At one point, when an early investor inquired as to why an investment in the company hadn't triggered a report to regulatory authorities, Delo responded with a meme of a man smiling, superimposed with the text "Incorporated in Seychelles, come at me bro". Hayes and Delo face a maximum sentence of five years in prison as a result of this plea. The exchange had in August paid $100 million to settle a separate lawsuit from the Commodity Futures Trading Commission, in an agreement which had also required them to implement proper blocks to prevent U.S. customers from using the service.
- "Founders Of Cryptocurrency Exchange Plead Guilty To Bank Secrecy Act Violations", The U.S. Attorney’s Office, Southern District of New York
- "BitMEX to Pay $100 Million to Resolve Regulator’s Lawsuit Over Crypto Derivatives Trading", The Wall Street Journal
- "Third BitMEX Founder Pleads Guilty to Anti-Money-Laundering Violation", The Wall Street Journal
- "Top BitMEX Employee Pleads Guilty to U.S. Charge", The Wall Street Journal
Space Crypto game surprises its player base with new, disadvantageous tokenomics
Space Crypto, a play-to-earn game that launched on February 15, announced on February 23 that users wouldn't be able to withdraw all their reward tokens, as expected. Without previously informing investors, they decided that players won't be able to withdraw the necessary amount of reward tokens ($SPE) to repair all their ships, essentially locking everyone in to artificially extend the game's life. They also decided that the token exchange rate would be 5 in-game tokens = 1 $SPE (also not specified in the whitepaper), essentially hiding the true amount of in-game currency needed for positive return on investment. The community was fairly universally enraged, and the $SPE token price dropped in value by 93% after the announcement.
- Space Crypto (SPE) to USD Chart, CoinMarketCap
- Tweet by mikacrypto__
Utility promising to restore mining performance on Nvidia GPUs actually malware
The popular Tom's Hardware and PC Gamer websites both ran articles about a utility called "Nvidia RTX LHR v2 Unlocker", which claimed to increase the artificially-limited cryptocurrency mining performance of its RTX graphics cards. These graphics cards are shipped with performance-limiting software to reduce the GPUs' attractiveness to cryptocurrency miners, whose thirst for GPUs has made it difficult and expensive for gamers and various others to acquire the hardware. Unfortunately, both publications had to run a second article just a day later to warn their readers away from the software they had just advertised. "Instead of fixing the capped mining performance, the utility infects the host system with malware", wrote Tom's. Though it is now clear that the tool is malware, it's not immediately clear what exactly the malware does — speculation has ranged from keylogging to, well, cryptocurrency mining.
NBA player De'Aaron Fox ditches his NFT project after raking in $1.5 million
Sacramento Kings player De'Aaron Fox announced his "SwipaTheFox" NFT project in mid-December, and the "high utility NFT collection" went live on January 15. The project roadmap promised a metaverse basketball court, a scholarship to a University of Kentucky student, and chances to win all-star game tickets, as well as "much more to come". The project had over 100,000 people in its Discord, and pulled in about 475 ETH (about $1.5 million at the time).
Suddenly, on February 23, the project deleted its social media accounts and most of its Discord. Fox wrote in the remaining Discord announcements channel that "The time and attention that y'all deserve and that I wanted to give you all/what this project requires, was not known to me and I overstepped and stretched myself too thin, trying to do this project in the middle of an NBA season." He promised to send anyone who bought more than five NFTs (which would have cost ~0.4 ETH, around $1,300, if bought at mint price) a signed jersey (available for purchase online for around $100).
The following day, after some attention was drawn to the rug pull, Fox released a Twitter statement that said basically nothing at all, and made no mention of reimbursing holders. Meanwhile, the floor price of the NFTs dropped to around 0.003 ETH ($8).
Seller withdraws Sotheby's CryptoPunks auction minutes before it's due to go live, likely due to "tepid" reception
Two weeks prior, collector 0x650d announced that they would be partnering with the Sotheby's auction house to auction a single lot of 104 CryptoPunks. CryptoPunks are some of the earliest NFTs, and trade for hundreds and even thousands of ETH (equivalent to hundreds of thousands to millions of dollars). The collector wrote in a Twitter thread that they "simply could not pass up the opportunity to elevate CryptoPunks in the international art community. And with this sale, the CryptoPunk collection will be solidified in the broader art world." Media reports speculated that the auction would fetch as much as $30 million.
However, 0x650d withdrew the sale only minutes before the auction was due to start, tweeting only "nvm, decided to hodl". CoinDesk reported that, "Perhaps contributing to 0x650d's reversal were rumors of a tepid reception for the CryptoPunks mega-lot. Three sources, including one bidder on-site at Sotheby's, told CoinDesk that the highest pre-bid offer was $14 million, which was also the reserve price."
Journalist says she's been able to use chain analysis tools to discover the person behind the 2016 hack of The DAO
"The DAO", one of the first DAOs, was famously hacked in 2016, requiring a hard fork of the Ethereum blockchain to "undo" the breach. (So immutable!) Had Ethereum not forked, members of The DAO would have lost 3.6 million ETH — then worth around $50 million.
Journalist and researcher Laura Shin reported on February 22 that she had successfully used a forensics tool from Chainalysis to discover the identity of the hacker: Toby Hoenisch, a co-founder of the TenX "crypto debit card" project. Hoenisch refused to speak with Shin, and has denied the allegation.
For a technology that makes lofty promises of anonymity and privacy, increasingly-powerful technology is being released that at least claims to be able to unwind crypto mixing and make other connections between wallets and transactions that were previously extremely difficult, if not next to impossible. I imagine there may be a few people behind various crypto crimes sweating a bit as these technologies progress and threaten to unmask those behind other hacks and scams.
Security researchers desperately try to contact Ocean Protocol about a critical security problem
Ocean Protocol is a web3 project promising to help people "publish, discover, and consume data in a secure, privacy-preserving fashion". Recently, they've been promoting the ALGA defi wallet, a project created by an external development team called Data Whale. Security researcher Christopher Bleckmann-Dreher, also known as "schniggie", resorted to publicly replying to one of Ocean Protocol's promo tweets to try to get the group's attention on a security vulnerability he and his collaborator Daniel Matesic ("mtd_0x00") had discovered. The duo found Kubernetes infrastructure that appeared to be completely compromised, and were able to get a shell, call their underlying AWS metaservice, and more. When Bleckmann-Dreher tried to report the bug through Ocean Protocol's Github bug bounty program, he found it was retired. He also tried to contact the team via their security email address, Telegram, and Discord, but received no reply.
After Bleckmann-Dreher's attempts to contact the project were published on Web3 Is Going Great on February 26, Ocean Protocol's founder Bruce Pon commented to say they were "on it", and that he had alerted Data Whale about what appeared to be an issue in the ALGA project. Several hours later, Data Whale announced they would be taking the app offline due to concerns that there was a vulnerability, and that they had contacted the researchers. ALGA was later brought back online after they confirmed the vulnerability was not an issue with their project, but rather with Ocean Protocol itself. Pon acknowledged on February 27 that "there was a configuration issue on Ocean compute-to-data which is being fixed now", and later that day Ocean Protocol cut a new release of their operator engine which appeared to be a patch.
Coinbase CEO tries to weave a compelling story about how their own team came up with a Super Bowl ad that "broke the rules on marketing", is quickly revealed to just be taking credit for the work of an outside ad agency
Coinbase CEO Brian Armstrong embarked on a 12-tweet-long thread congratulating Coinbase employees for coming up with the bouncing QR code Super Bowl ad. He wrote, "I guess if there is a lesson here it is that constraints breed creativity, and that as founders you can empower your team to break the rules on marketing because you're not trying to impress your peers at AdWeek or wherever. No ad agency would have done this ad."
Unfortunately for him, CEO of The Martin Agency Kristen Cavallo showed up with receipts: "It was actually inspired by presentations our agency showed your team on 8/18 (pages 19-24) and 10/7 (pages 11-18) with ad concepts for the Super Bowl with floating QR codes on a blank screen."
I guess if there is a lesson here it is that if you're going to take credit for someone else's idea to try to make your team sound good, maybe you shouldn't also use it as an opportunity to dunk on the people who actually came up with the idea.
Another pseudonymous defi project exec revealed to have a checkered past
Composable Finance is a company that makes infrastructure tools for defi. Until recently, their head of product has been known only as 0xbrainjar, and has operated pseudonymously. However, on February 18, the crypto detective zachxbt revealed his discovery that 0xbrainjar was actually Omar Zaki. Zaki was charged with fraud by the SEC in 2019 for misleading investors while operating an unregistered investment adviser and hedge fund. He ultimately settled the case for a $25,000 fine, and a three-year ban from working in the investment industry. Although I personally think it's reasonable not to describe anything crypto-related as an "investment", I'm curious how the SEC might feel about him working on defi projects.
On February 20, 0xbrainjar confirmed that he was indeed Zaki. He wrote, "I did this so that my efforts to build up a suite of products would not be shadowed by a mistake that I made in my past.... 0xbrainjar was a place for me to not be defined by this serious misstep (which has been settled and was amplified by the media)". He also wrote on Twitter that "I do not want a mistake in my youth to cloud all of the team's efforts", though the SEC charge was filed less than three years ago, when Zaki was 21.
Avalanche-based Atom Protocol rug pulls within a day of its launch, claiming a bug
Atom Protocol, a project built on the Avalanche blockchain (and not to be confused with the Atom/Cosmos project on Binance), rug pulled within a day of launching. The developers posted a tweet reading, "There is a problem/mistake in contracts, we can't do anything. We have to close the project, sorry". Shortly afterwards, they deleted their Twitter account and Discord.
Some users directed their anger at Assure DeFi, a project that claims to "privately verify the identity" of various projects. The group had reportedly verified the identities of those behind Atom Protocol, lending the project credibility to some who bought in. Assure later tweeted that "many people are still misunderstanding the role of KYC/verification. KYC is a deterrent and not a scam prevention and if anyone says otherwise they are misleading you."
Indian authorities arrest a group accused of $5 million cryptocurrency scam
Indian authorities arrested at least eleven people accused of running a cryptocurrency scam that drew ₹40 crore (around $5.3 million) from investors. The alleged ringleader, Nishid Wasnik, flaunted his luxury lifestyle to help convince investors to put money into his firm, which he said traded Ether. According to one official, "He manipulated the website of the firm to show a steady rise in the value of investments, while transferring money into his accounts fraudulently between 2017 and 2021". Wasnik is also facing outstanding cases, including two murder charges, and had been in hiding since March 2021.
Seventeen OpenSea users have their NFTs stolen and flipped for a total of $2.9 million by a phishing scammer
Panic erupted on February 19 as a few users saw their wallets emptied of valuable NFTs without knowing why, and many others feared the same could happen to them. Early explanations blamed a new contract that OpenSea had rolled out, or an airdrop from a new NFT marketplace called X2Y2. People urged NFT owners to revoke permissions for both the OpenSea contract and for X2Y2 until more was known, although one of the most popular websites helping people do so went down shortly after from the high traffic.
An hour and a half after users began to report missing NFTs, OpenSea finally acknowledged the issue. They tweeted that they were "actively investigating rumors of an exploit associated with OpenSea related smart contracts", and wrote that they believed it was a phishing attack coming from outside of OpenSea, rather than an issue with their contract. It was later determined that an attacker had successfully phished 17 OpenSea users into signing a malicious contract, which allowed the attacker to take the NFTs and then flip them. Bizarrely, the hacker returned some of the NFTs to their original owners, and one victim inexplicably received 50 ETH ($130,000) from the attacker as well as some of his stolen NFTs back. The attacker later transferred 1,115 ETH obtained from the attack to a cryptocurrency tumbler, worth around $2.9 million.
Former owner of a reportedly stolen Bored Ape files million-dollar lawsuit against OpenSea
Businessman Timothy McKimmy is the former owner of Bored Ape #3475, an NFT he purchased in December for 55 ETH (then about $232,000). In a lawsuit against OpenSea, McKimmy alleged that on February 7, a "security vulnerability allowed an outside party to illegally enter through OpenSea's code and access Plaintiff's NFT wallet, in order to list and sell Plaintiff's Bored Ape at a literal fraction of the value". The Bored Ape was purchased for 0.01 ETH (about $30), then flipped by the alleged thief within hours for 98.9 ETH (a bit over $300,000). McKimmy alleges that OpenSea knew about the reported vulnerability, and failed in their duties to him as a customer by not informing customers of the issue, or shutting down the platform while it was reportedly vulnerable. The lawsuit further argues that because Bored Ape #3475 has a higher "rarity score" than the one supposedly purchased by Justin Bieber for 500 ETH ($1.3M) in January, the value of #3475 is "arguably in the millions of dollars and growing as each day passes". The lawsuit seeks "any and all damages to which [McKimmy] may be entitled, including the return of the Bored Ape, damages equivalent to the valuation of the Bored Ape, and/or monetary damages over $1,000,000."
- McKimmy v. OpenSea on CourtListener
- Etherscan records for the Bored Ape NFT
Crypto.Chicks team member gives a non-apology for blatantly copying the work of another artist
Polly, a member of the popular Crypto.Chicks NFT team, apologized for "drawing inspiration from" artists and "inadvertently cop[ying]" their work, after it is discovered that she blatantly traced the artwork used in some of the Crypto.Chicks NFTs. Although she wrote that she had "redrawn" the NFT in question, the artwork was nearly identical to artwork by a Brazilian artist named Amanda, who apparently was never credited nor compensated. The Crypto.Chick in question had sold for $27,500 in late January.
The following day, Crypto.Chicks announced that they would be replacing Polly as a team member, and pausing their planned release of another NFT collection that also appeared to contain stolen artwork.
Appeals court allows legal claim to continue against online promoters of Bitconnect
An appeals court found that a legal claim could continue to be pursued against some of the major voices that promoted Bitconnect online. Bitconnect was a Ponzi scheme that collapsed in early 2018, defrauding investors of $2 billion. This claim, should it succeed, could set a frightening precedent for those irresponsibly hyping cryptocurrency schemes in online videos and other promotions.
Authorities raid Generación Zoe, an Argentine pyramid scheme propped up by cryptocurrencies
Authorities performed nine separate raids targeting Generación Zoe, a holding company raising money from thousands of Argentines. The company promised 7.5% monthly returns at the lowest level, but more if investors recruited others to the scheme. They said these returns came from cryptocurrency trading, sales of "coaching" courses, and other investment strategies. The group even had their own cryptocurrency, Zoe Cash, and had begun other ventures — including a church. The accountant from the firm and several others were arrested in the February 18 raid, but the head of the scheme was on the lam.
- "Detuvieron al contador de Generación Zoe", Página 12 (in Spanish)
- "Pierri será el abogado de Leonardo Cositorto, CEO de Generación Zoe", Infobae (in Spanish)
- "Estafas: qué es Generación Zoe y quién es Leonardo Cositorto", Clarín (in Spanish)
- "A bitcoiner against a powerful cryptocurrency pyramid from Argentina", Money Training Club
Kickstarter says they "won't make changes to Kickstarter without you" after blockchain backlash... but they will continue with blockchain plans
Kickstarter announced back in December that they planned to completely rebuild their product on a blockchain. It was quickly met with resistance from the community, including some big-name users announcing plans to stop using the service. Two months later, the company published an article titled "We Won't Make Changes to Kickstarter Without You". Despite the title, they did not appear to waver on the blockchain plans, and committed only to "not mov[ing] Kickstarter.com onto the new protocol unless it has been tested" and to gathering "input" while they move forward with the plans.
Kickstarter's COO, Sean Leow, did an interview with The Beat to discuss the announcement. He seemed to be a little bit confused on the whole concept throughout, and seemed to believe that "open source" is some sort of competing idea to blockchains. At one point he stated, "We believe that that data can be structured in a way through a blockchain where it ... can move in a much more efficient and effective way between services ... in a way that open source doesn't allow". Later in the interview he spoke about governance, saying, "our understanding is that [governance] is done more effectively with blockchain then with open-source."
Someone blows up a Lamborghini to "criticize greed", then makes NFTs out of the pieces
The person known on Twitter by the name SHL0MS bought a used Lamborghini Huracan, drove it to the desert, and recorded the enormous fireball as they blew up the car. The explosion, they said, was meant to be a "criticism of greed and short-termism in crypto".
SHL0MS then gathered 888 pieces of the wrecked car, took rotating videos of each one, and created NFTs from them. The NFTs were to be released on February 25 in an auction starting at 0.01 ETH (about $26), but the auction was delayed due to the news of Russia's military invasion of Ukraine.
It's likely SHL0MS will profit handsomely off the Lamborghini NFT. Their previous NFT collection, FNTN, involved similar rotating videos, in that case of an exploded toilet. The NFTs in that 185-piece collection have recently been trading at 1–2 ETH (several thousand dollars).
Andrew Yang announces plans to fight poverty with a lobbying group that distributes voting power in proportion to how much you pay
Perennial political candidate Andrew Yang, perhaps in a desperate bid to stay relevant, announced his plans to create "Lobby3". Lobby3 is a DAO which he says will push for crypto-friendly regulation and "eradicate poverty". Like many DAOs, the voting power is allocated based on how many tokens a member owns, meaning that those who pay more have more votes. A single token, representing one vote, costs 0.07 ETH (about $200). The "Founder" tier of participation in the DAO, which appears to offer access to Yang more than anything particularly lobbying-related, costs 40 ETH (about $125,000).
Interestingly, one of the people credited as a "contributing artist" to Lobby3 is "Robness", who had the previous day minted an NFT of a photo of a journalist as a child in an attempt to harass her.
Class action lawsuit names SafeMoon, its executives, Jake Paul, Nick Carter, and others in alleged pump-and-dump scheme
A class action suit was filed against SafeMoon, various executives, and a handful of influencers and celebrities who promoted the token. The plaintiffs allege that promotions included false or misleading statements, and that the defendants misrepresented their control over SafeMoon and its tokens in what is commonly called a "pump and dump". In addition to SafeMoon and its executives, the lawsuit named various celebrities and influencers who had promoted the token to their followers: Jake Paul, Nick Carter, Soulja Boy, Ben Phillips, and Lil Yachty. Promotions by the influencers occurred primarily between March and May 2021, and helped the coin spike to its all-time-highs of about $0.000008. However, the coin has spent most of its history worth less than half or, more lately, a quarter of that amount. The token underwent a migration in early 2022, which increased the price per token, but the value has continued to decrease.
These influencers join a growing list of celebrities who have been named in class action suits over alleged pump-and-dumps. The list includes names like Kim Kardashian, who was named among others in a January class action suit pertaining to a coin called EthereumMAX.
- "Jake Paul, Nick Carter, Soulja Boy, Lil Yachty Facing ‘Pump and Dump’ Class Action Over SafeMoon Tokens", ClassAction.org
- "I UNCOVERED A BILLION DOLLAR FRAUD", CoffeeZilla's YouTube channel
Binance halts activities and marketing in Israel over "licensing issues"—namely, the lack of one
Binance announced they had stopped "marketing to Israelis and all activities focused on Israel until we examine the issue of licensing." The "issue" in question seems to be that they don't have a license at all: according to the Israeli Capital Market, Insurance and Savings Authority, they never received an application that would license Binance to do business in Israel.
MetaDeckz ends trading card NFT project after facing legal action from streamers whose likenesses were used without consent
An artist creating and selling trading cards of various streamers without asking their permission claims he was "just trying to do something cool for the community". He originally claimed that he had emailed each streamer about the project and never got a response, but the enormously popular streamer Ludwig released a statement in a tweet reading summarized with "TLDR: I am not making a fucking NFT and I'll let my lawyers take it from here". The longer text said that the MetaDeckz creator hadn't emailed Ludwig at all, and only sent him a Twitter DM "less than 24 hours ago". "You didn't even follow me on Twitter until [a popular Twitter personality called out your project]. It feels like you just reached out to cover your ass rather than get permission.... This is nothing more than a low effort scam."
Following Ludwig's scathing statement and legal threat, MetaDeckz explained he was just "an artist who saw an oppertunity [sic]" and that he would disband the project. He later released a video explaining that he would stop the project, though his continued references to the cards as "the product" and his statements that he intended to continue working on the cards led some to question if he was just planning to try to monetize them in some other way. If that's the case, he may run into further issues given that the card illustrations all appear to be derived directly from photos of the streamers that don't belong to MetaDeckz.
NFT artist "Robness" mints an NFT of a journalist's childhood photo to harass her
"Robness", an NFT artist who is somewhat known for selling a photograph of a trashcan for more than $250,000, apparently took issue with BuzzFeed News journalist Katie Notopoulos, who published an article in early February revealing the identities of two of the pseudonymous Bored Ape Yacht Club team. Robness was not the only one unhappy with her reporting — many people claimed that she "doxxed" the founders, despite the fact that she only published names that were on public business records and which the Bored Apes company confirmed to her. Some went so far as to send threats to her about her parents, claiming to know where they lived.
Robness decided the best way to make his displeasure known would be to find a photo of Notopoulos as a young child and turn it into an NFT titled "VOTED MOST LIKELY TO BE A FAILED JOURNALIST: KATIE NOTOPOULOS". The NFT description read, "Failed journalism is a true art to master. With Buzzfeed's new article about the Bored Ape Yacht Club, Katie Notopoulos went where no journalist usually goes. She ousted [sic] both of the Bored Ape Yacht Club founders while providing baseless claims of racist tropes about their artwork to further stir up contention. We thank Katie for her continued pursuit in tainting the once respected practice of real journalism. Here we have what is known as doxx art. Enjoy."
The NFT platform where Robness originally listed the NFT, Known Origin, eventually took down the listing. However, due to the nature of blockchains, the NFT itself still exists and can continue to be accessed and traded despite one platform's intervention.
Even Gary Vee gets upset with the shady business in NFTs sometimes
Gary Vaynerchuk, an entrepreneur and now crypto/NFT personality, took to Twitter to express his frustration with some projects that airdrop their NFTs to big-name collectors and then market their projects by suggesting the person bought in of their own volition. There is no way for a person to prevent NFTs from being airdropped to their wallets, and if a person wants to get rid of them by burning or transferring them, they have to pay gas fees (averaging around $50 today on the Ethereum blockchain). In an exasperated Twitter video, Gary Vee said, "Hey NFT News and all the other accounts that take money from these projects that airdrop these products into my account and others accounts, and then say shit like 'Gary Vee owns this' or 'this person owns that' or 'this that'. Can you just stop doing that? It makes you look insane. This project is completely full of shit and is trying to trick people, and that sucks."
Tabletop roleplaying game publisher Chaosium suspends their NFT project after backlash
Chaosium, a maker of tabletop roleplaying games (TTRPGs; think games like Dungeons & Dragons) including the popular Call of Cthulu game, launched an NFT project in July 2021. Their initial NFT offering was based around their Call of Cthulu game, but "didn't receive much attention from the gaming press or TTRPG community". However, their more recent discussion of plans to release more NFTs received major pushback from their community, leading the company to release a statement that "we have heard your concerns" and "we are suspending production". In a longer-form statement they wrote that, "In recent months, the debate has become prominent and contentious. Bad actors in this sphere have received widespread coverage. Many people are justifiably baffled, incredulous, and deeply skeptical."
BNB42 rug pulls for over $2.7 million
BNB42 was a "100% decentralized investment platform" that promised investors a 20% daily return on their investments. Unsurprisingly, that turned out to be too good to be true when the project owners deployed unaudited contracts that prevented anyone but themselves from withdrawing, and drained 6,445 BNB ($2.78 million) that quickly went to cryptocurrency tumblers. Around 6,000 investors lost money, presumably after being drawn by the unbelievable promises, like "earn 200% and double your investment in just 10 days". As is tradition, the project's Twitter account and website were wiped shortly after the investors cut and run.
"NFT influencer" Morgan (@helloimmorgan) repeatedly fails to disclose being compensated for NFT promotions
More shadiness emerges around the Jacked Ape Club as it's discovered that the popular NFT influencer account Morgan (aka @helloimmorgan and morgan.eth) failed to disclose being paid to promote the project, even directly denying it at one point. After the JAC deal was uncovered, someone asked her how many other projects had paid her that she hadn't disclosed, and she replied "I haven't been paid for anything except this one". However, it appears she has been compensated for multiple other giveaways for NFT projects including WomenOfCrypto and Squiggles.
Last year Morgan was caught up in scandal after it appeared she had bought a $24,000 Mutant Ape NFT while simultaneously running a GoFundMe trying to raise $20,000 for medical bills for her grandmother; she claims that the GoFundMe predated the MAYC purchase (though that seems to be in some doubt as well) and that all GFM funds went to her grandmother. Separately from that incident, she also created an NFT project called "Grumpkins" that was supposed to give 20% of profits towards children with cleft palates and also her grandmother's fund; after launching the project she quietly changed the donation amount to 10%.
Lonely Ape Dating Club launches to help Bored Ape NFT collectors find love, or maybe pay for it
Left in place for posterity's sake, but the inimitible Katie Notopoulos has determined that this "app" was all a well-executed prank in the post-ironic world that is web3.
The Lonely Ape Dating Club project announced their plans to build a dating app specifically for owners of Bored Ape NFTs — NFTs featuring illustrations of apes that trade for an average of around 90 ETH ($225,000). The app is not currently accepting signups from people who don't own a BAYC NFT, which raises more than a few questions about how successful a dating app will be when its pool of users seems to be overwhelmingly male, though perhaps I'm making too many assumptions about their sexualities. The app does promise plans to release a "Coin Digger" feature, which would "allow non-BAYC owners to connect with higher net worth individuals for mutual benefit", so perhaps that is their plan to solve that problem.
Sadly, the project was cancelled in May 2022 due to "unforeseen circumstances" which I have to imagine were pretty foreseeable.
Leaders of the Canadian truck protest come up with hilariously complex plan to distribute the Bitcoins they've collected
The leaders of the Canadian anti-vaccine trucker protest communicated their plan to distribute the 21 Bitcoin (worth almost $1 million) to the truckers blockading the border. Instead of giving the truckers the money in a cash format they can actually use, the "professional orange-piller" in charge of the Bitcoin distribution has explained a multi-step plan to give truckers pieces of paper with seed phrases printed on them. The seed phrases will be placed into sealed envelopes along with instructions on how to create a Bitcoin wallet, which are then "numbered and squiggly random lines should be drawn on the envelope to help with later identification". The volunteers then plan to physically destroy the printer with shears and screwdrivers, to try to prevent attackers from pulling the seed phrases out of the device memory. Of course once the trucker has their seed phrase, they have to go through the multi-step process of gaining access to the Bitcoin wallet on their smartphone, and then figure out how on earth to actually use their newfound Bitcoins to, say, pay for fuel. Anyway, I think this all goes to show that the future of money truly is upon us.
BuildFinance DAO project treasury drained after "hostile takeover"
A person managed to submit a proposal to the DAO that governs BuildFinance, a "decentralized venture builder", that would allow them to take over the project contract. The attacker succeeded in obtaining enough votes for the proposal to pass, primarily because they held an outsized number of governance tokens, and because they were able to disable community Discord features that would have alerted more of the community to the proposal. After the proposal passed and they were granted control over the project, they began minting and selling the project's native $BUILD token, draining the project treasury of about $470,000. According to BuildFinance, "As things stand, the attacker has full control of the governance contract, minting keys and treasury. The DAO no longer has control over any part of the key infrastructure." Some have questioned whether the incident can properly be described as an "attack" or "hostile takeover": everything worked exactly as it was supposed to in a "code is law" sort of way, even though it was against the intentions of the project founders and presumably most of its community.
The Belvedere Museum dreams big (or, rather, small) by splitting one single painting into 10,000 Valentine's Day NFTs
In a Valentine's Day-themed stunt, the otherwise reputable Belvedere Museum in Austria decided to sell Gustav Klimt's The Kiss as NFTs. But making one NFT was apparently not enough for the museum, which decided to section the digital copy of the artwork into 10,000 individual tiles. Although The Kiss is a very large piece of artwork, at nearly 6 feet on each side (180cm × 180cm), this means each NFT buyer gets an NFT representing a scrap of the painting measuring 0.7 inches to a side (18mm × 18mm), about the size of a U.S. penny. The Belvedere Museum has, somehow, estimated that each NFT will sell for €1,850 (about $2,100). If their dreams come true, selling all 10,000 NFTs would net them €18.5 million ($21 million).
The website for the NFT sale explains a six-step process to obtain one of these NFTs, including the standard steps of connecting a wallet and joining the allowlist, but ending with "Dedicate your NFT to a beloved one", which involves sending... their loved one a form email, apparently. My heart goes out to anyone receiving an NFT for Valentine's Day, much less a $2,000 one representing a portion of a painting smaller than a postage stamp. To anyone who thinks this is a good idea: I am begging you, please just buy your partner some flowers.