Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login
More than 10 percent of $3.7B raised in ICOs has been stolen (www.reuters.com) similar stories update story
89 points by rbanffy | karma 158565 | avg karma 2.97 2018-01-22 08:34:57 | hide | past | favorite | 79 comments



view as:

The word 'stolen' doesn't have its usual meaning in the ICO world. Isn't all or most money made on ICOs, effectively stolen? Everyone knows that ICOs are a scam.

Not really. There are plenty of ICOs with legit projects. Have they gotten too much capital? Probably. But that doesn't make it a scam necessarily.

Plenty of pyramid schemes lay on the back of some sort of product, knives or energy drinks or what have you. The existence of a product doesn't mean it isn't a scam

It also doesn't mean it is. You could say the same about companies raising venture funding, or the stock market, or private equity dumping companies onto the balance sheet of other companies, etc

The equivalent venture fund to these ICO's is run by that token sketchy brazilian guy who spends half of your money on flying a bunch of models to a big house in Ibiza he rented for the weekend. He's not exactly stealing your money, he's wisely using it to entertain executives and potential investors.

Sounds wise to me, where do I sign up? I can take a pay cut for awhile.

I mean, I hate MLMs as much as the next guy, and would never participate, but they are slightly different than a pure pyramid scheme.

They're a pyramid scheme with a pinch of showbusiness sprinkled on top :).

No, they are not pyramid schemes per se - they are more of an inverse funnel.

I would have called it a shady trapezoid.

So we should rather invest in IPOs that pop as soon as they're available to retail investors right? If our monetary system was so good we wouldn't be in 19 trillion in debt and cryptocurrencies would have no reason to be adopted, there is a reason why Bitcoin debuted in 2009 after the 2008 Recession... When the government does bailouts and Quantitative Easing, this can be seen as a scam to some

> So we should rather invest in IPOs that pop as soon as they're available to retail investors right?

IPOs are regulated, so there isn't that much of a mess around them, and it's more difficult for people who shouldn't be investing to play that game. That's on purpose, and it came to be through some hard-learned lessons.

> If our monetary system was so good we wouldn't be in 19 trillion in debt

National / international debt is, first and foremost, a tool, and it doesn't work the same way the "regular" debt does.

> and cryptocurrencies would have no reason to be adopted

They still don't. They live as long as they get to be financial wild-west, where it's easy to get rich off fools.

> there is a reason why Bitcoin debuted in 2009 after the 2008 Recession...

Yes, because it was developed around then.

> When the government does bailouts and Quantitative Easing, this can be seen as a scam to some

Maybe, but then again taxes are seen as theft by some. We can talk about ideologies all day, but in the real world, the "traditional" system still remains somewhat suitable for running a technological civilization, whereas cryptocurrencies are not, and will not because they don't scale well.


Facebook, Google, etc, didn't scale well from day one either. The software infrastructure for blockchain space is improving. Cryptocurrencies markets are more egalitarian so they will always be more favorable than traditional markets who tell people they shoudn't invest because they are "less equal".

I present to you...BANANA COIN!:

https://i.imgur.com/4p7XFyd.jpg


> There are plenty of ICOs with legit projects

It's too early to say anything about the economics of ICOs, apart from that people are being oblivious to their risks. Until we see a business redeeming tokens for goods or services which which cannot otherwise be procured and are improved by virtue of their tokenization, ICOs will remain closer to moonshots than investments.


Yeah, good business is essentially the art of scamming people out of their money.

> There are plenty of ICOs with legit projects.

Name three.


You can't generalize and say all ICOs are scams. Sure, a lot of them are useless. But look at NEO (formerly Antshares). It had an ICO a while ago and it's becoming a top crypto.

Hahahahahaha... ha... you probably haven't read their codebase if you really think that. Tell me, how many of their promised features do you think they've implemented?

> You can't generalize and say all ICOs are scams

Honest question. Is there a single ICO where one can use the tokens to redeem a good or service which cannot otherwise be procured and which is improved by way of using a token to purchase it instead of cash?


Bonus question, is there a good or service with the aforementioned properties which also isn't illegal?

I can name one potential case, pretty much the only ICO so far I still think might be actually useful - Filecoin. The idea is to use the cryptocoin to provide an incentive layer for people to pin each others' stuff on IPFS. You could technically use dollars for the same purpose, except the required micropayment infrastructure doesn't exist, and AFAIR (from reading the whitepaper), Filecoin has a nice, integrated way of ensuring the counterparty is actually rehosting your data - so together with IPFS, this has the potential to create a distributed, bandwidth-efficient, universal CDN network.

I say potential case, because while the goal seems noble, so far I don't see the tokens available, and it seems the project is still knee-deep in some mathematical and technological issues around the coin itself.


You've picked a bad example. NEO is likely a long con based on how much actual work has ever been done on it

They have an ambitious roadmap and a long way to go. Maybe it will fail, but so do most startups and projects. But right now, whether you think it's a worthless token or not, the market values it insanely highly (3,166X the ICO price of $0.036) and any token holder can sell it this instant and get liquidity. So how is that a scam?

Ethereum was an ICO.

Was Ethereum a scam?


To some degree yes. Many members of the Ethereum foundation have made large profits from the price of Ethereum going up. They have also taken a cut from the more scammy ICOs by acting as advisors (brand ambassadors).

Furthermore the Ethereum foundation itself has been spending a lot of its reserves on research grants and other activities that directly benefit the members without providing much benefit to the public at large. Under Swiss law it should be audited regularly however no audit had been published publicly.


> Many members of the Ethereum foundation have made large profits from the price of Ethereum going up.

So what, many early adopters and sellers of Bitcoin have done the same - and heaven forbid Satoshi decides to cash in, that person / group alone is a billionaire (on paper though).


So block it- isn't that the point of having One True Ledger?

Once the coins are converted to USD, JPY, EUR, etc, it's gone.

Since it's on a block chain, and there is therefore a specific coin that can be traced back to the fraudulent transaction. Can the transactions then be rolled back?

Edit: Assuming the underlying ICO transaction happened in Bitcoin or similar. If the funds were wired in say, USD, it would not be able to be rolled back after 3 days or so.


> Can the transactions then be rolled back?

No -- well, kinda. This is unintentionally hilarious because, of course, Ethereum has done just that once before. By creating a new network that picked up from just before the "fradulent" activity.

The part that might be confusing to some folks is that in order to operate a truly trustless and decentralized cryptocoin ecosystem, we have no way of distinguishing between "fraudulent transactions" and legitimate ones. They're all legitimate otherwise they'd have been rejected by the network.


So there IS a way - if it was rejected by the network, it was fraudulent.

Sure, but it also wasn't a transaction.

Necessary but not sufficient....

I can't quite tell whether you're trying to underscore a point about cryptocoins' benefits or if you're misunderstanding the conversation.

Just in case it's the latter -- I was probably a bit too fast n loose with the quotes around "fraudulent" so I will explain in more detail.

From the article:

> Phishing was the most widely used hacking technique for ICOs, with hackers stealing up to $1.5 million in ICO proceeds per month, according to the report.

This is a kind of "fraud" which cryptocoins are not designed to thwart. If you steal someone's keys and take their money, it can't be returned to them unless the thief decides to return it. This is very much like cash.

The problem comes from decentralization. In the Real World, we usually defer to authorities when it comes to crime and restitution. The authorities come to a determination and publish their decree. This is very much centralized. Cryptocoins are decentralized and are simple automata. There's no authority that we can appeal to in order to reverse a transaction that was executed in bad faith. Part of the problem is that there's no way for the automaton to trust this authority without destabilizing the entire system.


Except the network actually forked, and both half's still exist (ETH and ETC) and both are still used. Really, it should not viewed 'a way'. The fun part will be when half the world forks bitcoin, but forcefully takes over the network. The incentives at play do not cover this well, but it is also unlikely... but only because there is too much money is false signaling and playing both (many) sides of the battle.

To clarify, the network would basically be agreeing to honor the possibly already spent coins... and that isn't really going to happen at this point.


" By creating a new network that picked up from just before the "fradulent" activity."

I thought they just created a new transaction that moved all the stolen funds to a new smart contract?


Wouldn't that be even worse?

My understanding was that if they rolled back the entire network to just before the hack, lots of transactions would be rolled back that didn't need to be.

That's why, from what I remember, when etheruem was hardforked created a transaction from the thief's wallet to a new smart contract, and everyone agreed to validate that transaction even though it wasn't signed by a private key.


Yeah, thats what I mean, isn't it worse to be able to create a forced transaction than to be able to fork the chain at any given point?

No the stolen funds remained on the original chain, ETC on most exchanges, and the attacker maintained ownership.

That doesn't contradict my understanding of how the hard for occurred though. Obviously the etc chain didn't change.

The Ethereum Classic chain changed later in a hardfork. While this was a 'cleanup' job to remove empty accounts belonging to the DAO hacker, it was done without using his private key and puts lie to the claim that the ETC chain is 'immutable'.

I have heard of ICO's where they only have a wordpress site and no code or backend at all (other than a bitcoin address). Which means that its impossible because they already turned your btc into fiat.

But in general the answer is no because once they have your bitcoin and cash out to cash who are you going to ask the money from? The person that just disappeared?


I kindof doubt it, because I don't think there are any mechanisms to do that.

Since these ICOs are all running on top of some existing coin/blockchain, unless there is a native mechanism for undoing a transaction (I don't believe any mainstream coin/blockchain supports this), the only option would be a hard fork.

Side note: You'd also be impacting other transactions which have occurred after the transaction that you want to roll back. Considering how blocks incorporate the identity of previous blocks, all of the block-minters would have to participate in the roll back.

By the way, how would you verify that ICO tokens were actually stolen? In the modern world, that is normally done using a police report, but not everyone in the world is going to trust that.

And even with a police report, if the police are unable to get the stolen good back, then you're stuck. That's why people commonly take out insurance on their possessions, and why (in the United States) most cash deposits are insured by the NCUA or the FDIC (up to certain limits).


Does that include the 513,774.16 ETH (currently about $500M) lost due to the Parity Wallet bug?

Why would it? What does the parity wallet have to do with ico's?

Parity Wallet was used by several large ICOs https://www.coindesk.com/ico-funds-among-millions-frozen-par...

And? The parity wallet was not hacked, just is unable to be withdrawn from.

The headline is a bit clickbaity, the article itself says "lost or stolen". I think it's unlikely that ETH will be able to be withdrawn without a hard fork, so "lost" is accurate.

If I understand the article correctly, it is saying that the proceeds of the ICO were stolen.

The impression I got from the headline was that "More than 10 percent of the $3.7B raised in ICOs came from stolen funds".


The only surprise here is that it's so little. I wonder how much higher that number will go.

10% is awful. ICOs desperately need sensible oversight and regulation.

Credit card companies steal 3-4% on every transaction and consumers don't even blink.

If that is your definition of "steal", then bitcoin easily steals more (for small transactions)

All the libertarians are now learning the downside to a fully unregulated market.

On the flip side, basically this means that if you're willing to accept a 10% risk of total loss, ICOs are not a bad investment -- knowing that going in.


You can have third party risk management solutions in this environment. Why such solutions haven't emerged is a mystery to me.

One solution I've been kicking around is something like an escrow + shareholder voting. It would play out as follows:

1. Devs come up with an idea, decide they want to ICO to fund it.

2. Devs come up with game plan including set of milestones with timelines.

3. Devs reach out to escrow who arranges an ICO. ICO occurs, all ether besides a starting amount is held by the third party.

4. When devs hit first milestone, they show work to holders of ICO coin who then vote on whether the milestone has been achieved. Devs have to report any coins they previously mined or held so that they can't vote for themselves and agree to not purchase any further coins in a contract with the escrow. They also have to identify their relationships with any early coin buyers for the same reason. If they get approval from their shareholders, the next batch of money is released so that the work for the next milestone can be complete. If not, no money is released or the coins are voided and all monies are returned to the investors.

The third party company would take a management fee, purchase insurance to protect against theft of the assets, and be a registered US corporation so legal action could be taken if they committed fraud.

An added benefit is that if you are early to market you could help SEC shape ICO policy (assuming it's not too late) potentially becoming a mandated gold standard.


seems reasonable as a Kickstarter++ model to implement this platform

Vitalik Buterin[1] last week brainstormed a proposed development, fundraising and stewardship structure combining elements of a DAO[2] and ICO called a DAICO[3]. People are still debating and considering whether this is a true improvement. The structure outlined in the parent comment is similar to the DAICO model proposed by Vitalik.

[1] https://en.wikipedia.org/wiki/Vitalik_Buterin

[2] https://en.wikipedia.org/wiki/Decentralized_autonomous_organ...

[3] https://ethresear.ch/t/explanation-of-daicos/465


The difference seems to be that rather than using third-party escrow, his idea uses code running on the Ethereum network to allow investors to vote on the release of funds (because we know that complex smart contract code of this kind worked perfectly in the past and certainly didn't have bugs so severe the entire Ethereum protocol was forked to undo them).

This sounds like Vitaliks DAICO model.

It doesn't matter because there's no incentive for companies that raise to do this. Dumb money is easy to raise, why try to fight for smart money?

In other words, you could come up with this really complicated scheme to verify trust with your ICO in order to win over savvy investors. Or you could just hack together a buggy, insecure ICO in a few weeks and get flooded with retail investors clamoring to get their dumb money into any crypto they can lay their hands on. Barely computer literate friends and relatives have asked me recently how they could get into crypto. There's virtually an army of these woefully uninformed "investors" to get money from in an ICO. Why the heck would anyone lose months (at a minimum) of development time to build some trust that nobody cares about anyway?


After this bubble inevitably collapses, the dumb money will largely exit and people will be forced to deal with smart money. Moreover, regulatory agencies won't tolerate this level of fraud long term. Either ICOs need some sort of regulator or they will be banned.

Assuming crypto survives (I personally hope it doesn't), escrow will happen - after the bubble collapses and the dumb money exits the market.

That's a big gamble. If that's what you're banking on there's a high risk that regulators will simply overreach and ban any type of ICO, or at least ban ICOs except to "accredited investors". You could build a trust system nobody trusts anyway, because the concept is discredited.

> The third party company would take a management fee, purchase insurance to protect against theft of the assets, and be a registered US corporation so legal action could be taken if they committed fraud.

Doesn't that basically mean your ICO is subject to US law, essentially eliminating the main benefit of a "trustless transaction"?


If your escrow is not subject to some basic laws or threat of violence which prevents them from running off with money, then you're no better off than if you just gave the money to the devs running the ICO directly. The entire point is to build in external protections for the investor.

The idea that you can have large investments and crypto backed companies without someone in the financial chain being subject to external governance is completely unrealistic. No rational investor would participate in that. Large numbers of people will inevitably commit fraud, and they have, as noted by the article.


Yes, exactly.

So how is having an escrow that is subject to US law an answer to "I want to have a trustless network with no government intervention"?


It's not, but this provides a hybrid approach which blends the best of both worlds. It allows companies to raise capital globally without being fully subject to SEC laws (depending on implementation and the SEC's willingness to play ball) while also eliminating much of the fraud and bullshit inherently baked into a trustless system by leveraging existing legal structures.

At the end of the day it depends on what the goal is. Is the goal to lower the barrier to entry for new companies to raise money, or is it to create some idealistic free market? The former is possible and useful, the latter is not.


The risk of total loss isn't 10%. That's just the risk of total loss due to literal theft.

There are many other ways that an ICO could result in total loss to you. Just as a back of the napkin estimate, it used to be conventional wisdom that 90% of startups fail. I'd say that's a more reasonable lower bound than 10%.


Yeah that's true, I wasn't actually advocating for ICOs as an investment, I was just poorly trying to be sarcastic.

Yes, scammers exist and people who don't put in the time to research their investments will get burned. Things are just how they should be.

Edit: Obviously a world without scammers would be ideal. However, I'd rather have an unregulated market than one with gatekeepers.


Are you arguing that people never get scammed in regulated markets? I would say that's not true!

Usually when that happens someone makes them whole again. Either the perpetrator of the scam is sued, or the government steps in and reimburses the losses.

Not sure I agree with making them whole, look at Bernie Madoff. The only restitution is what the gov't can recover.

And for ICOs, fraud is fraud. If someone promises one thing and instead runs off with your money, the gov't will prosecute that.


The other 90% apparently will be stolen at some point in the future.

We've never seen a new internet technology this big before, and no organization is powerful enough to put the ICO genie back in the bottle.

What we need is a framework for users so that they can make informed decisions about what to invest in. And we need laws that make it completely legal.

Wall Street is the 1%'s point of control over the 99% and it's going down hard. Their power seemed strong in the old world but is absolutely meaningless in the face of a large scale citizen uprising.

Trying to fight this new technology will do nothing but accelerate the process, as it did on a smaller scale with P2P file sharing.


To paraphrase the old saying (https://quoteinvestigator.com/2010/05/19/gambling-women/#mor...):

"10% was stolen. The rest was spent foolishly."


Legal | privacy