277
MIT Students Stole $25 Million In Seconds By Exploiting ETH Blockchain Bug, DOJ Says (slashdot.org)
submitted 2 years ago by to c/technology@lemmy.world
91 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 22 points 2 years ago (6 children)

Frustratingly vague for a Slashdot write-up.

“These brothers allegedly committed a first-of-its-kind manipulation of the Ethereum blockchain by fraudulently gaining access to pending transactions, altering the movement of the electronic currency, and ultimately stealing $25 million in cryptocurrency from their victims,” said Special Agent in Charge Thomas Fattorusso of the IRS Criminal Investigation (IRS-CI) New York Field Office.

Good to know the prosecutors have an understanding of what they're prosecuting... Not even a single mention of MEV in the DoJ press release.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 2 years ago

    What's funny is that that's a description of MEV.

    gaining access to pending transactions, altering the movement of the electronic currency, and ultimately stealing $25 million in cryptocurrency from their victim

    I skipped "fraudulent" because neither MEV bots nor this attack can be called fraudulent imo, although MEV is definitely taking value one didn't help create.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 2 years ago (4 children)

    by fraudulently gaining access to pending transactions

    That makes no sense to me. The mempool is public, everyone can see pending transactions.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago (3 children)

    Because it's not the public mempool. It's a private MEV mempool that people pay to add their transactions to for special priority or conditional inclusion. For instance, asshole profiteers can use it to sandwich attack traders to siphon off "market inefficiencies" or some people just want immediate front of the line inclusion in the next block.

    Presumably they exploited something in this MEV system (completely unrelated to the Ethereum protocol) that allowed them to see the pool and they shouldn't have. Wish I knew more but everything I read was incredibly vague and misleading.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    It’s a private MEV mempool

    Are you sure there is such a thing? My understanding was that they just submit their sandwich transactions to the mempool with higher and lower gas respectively to achieve their desired priority ranking. Could be wrong though.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago (1 child)

    I'm sure, yes. If you submit to a public mempool, you have no guarantees that your two transactions will land on either side of the target transaction in the same block (They likely won't). You need to leverage conditional transactions with MEV so you guarantee the miner will select and position your transactions where you need them. In this case, before and after the target transaction.

    Check out the Ethereum Foundation's page on MEV for more info.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •