Issue 58 – Threats to the stability and integrity of Ethereum

Issue 58 – Threats to the stability and integrity of Ethereum

0:00

/1441.38449

1×

It's time for your regularly scheduled cryptocurrency industry update!

Behind the scenes, I have been hard at work on a pretty cool project that I'm excited to share with you all soon(™️), so stay tuned for that. I've also got a post in the hopper about the recent Tornado Cash verdict in the Netherlands, which should be in your inboxes in the next few days.

But until then:

In the courts

Tornado Cash

Alexey Pertsev, one of the developers and operators of the Tornado Cash cryptocurrency mixing service, has been sentenced to 64 months (over five years) in prison in the Netherlands [W3IGG].¹ I have complicated feelings about it. I think this case — along with similar ongoing litigation in the United States and elsewhere — is one of the most important cryptocurrency-related cases to watch, even though it hasn't gotten nearly the press coverage of some other cases like FTX. Because of this, and because my thoughts on this case are pretty lengthy, I'm going to be covering it in a separate issue in the next few days.

FTX

We're coming up on the sentencing of the first FTX executive besides Sam Bankman-Fried. Ryan Salame was the CEO of FTX Digital Markets, which was the Bahamian portion of the business. He pleaded guilty to one count each of conspiracy to operate an unlicensed money transmitting business and conspiracy to make unlawful political contributions and defraud the Federal Election Commission in September 2023 — just before Bankman-Fried's trial began. He was the only co-conspirator of the four to not plead under a cooperation agreement, and he did not testify at Bankman-Fried's trial. His charges carry a maximum sentence of ten years in prison.

Salame has just submitted his sentencing memorandum, in which he argues that he should be sentenced to a maximum of 18 months imprisonment.² As you might expect, he downplays his role in the wrongdoing at FTX, laying most of the blame on Bankman-Fried, the other co-conspirators, and others at FTX including Dan Friedberg [I32]. According to the memo, Salame "had absolutely no knowledge that the four people at the center of Alameda and FTX had conspired to lie and steal from their customers. ... [He] stole from no one. He did not lie to customers. And he was duped, as was everyone else, into believing that the companies were legitimate, solvent, and wildly profitable."

Salame also argues that his charitable work and family commitments should be considered in his sentencing, as with the fact that he was abusing substances (alcohol and unspecified drugs) while working at FTX, but has since achieved sobriety. Along with Salame's wife, childhood friends, and neighbors, the conspicuously absent [I39] Sam Trabucco was kind enough to submit a character reference. As a part of his plea agreement, Salame agreed to forfeit $1.5 billion, which he says "will leave him with no remaining assets". He is scheduled to be sentenced on May 28.

MEV bot exploit

Two brothers were charged with an attack on Ethereum MEV bots — various types of automated software that sift through pending transactions waiting to be added to the Ethereum blockchain, and try to insert their own profitable transactions using a technique called "maximal extractable value" (MEV). MEV itself is a somewhat controversial practice, mostly because the profits from such a technique come from the losses of people who are just trying to use the blockchain, but who end up losing money to bots that frontrun them or otherwise cause their trades to have worse outcomes. Some think that "code is law", and if it's possible to do something within the confines of the code, it should be allowed. Others think that this adversarial profit extraction harms users in the long run, who are often at a disadvantage against the sophisticated bots.

In this particular case, the brothers were able to exploit the bots themselves by learning their trading techniques, and exploiting a flaw in software called "MEV-Boost" to get access to private information about upcoming blocks that allowed them to essentially profit from the profiteers [W3IGG].

Perhaps the most notable thing about this indictment is the level of technical familiarity the prosecutors seem to have developed with the issues at hand. The indictment navigates a technically complex web of topics including Ethereum's system of validators, relays, MEV, and MEV bots, and presumably the prosecutors are confident in their ability to walk a jury through it as well.

One thing that stuck out as a little odd to me, though, was the prosecutors' apparent concerns over protecting the integrity of the Ethereum blockchain. In the indictment, they wrote: "Tampering with these established MEV-Boost protocols, which are relied upon by the vast majority of Ethereum users, threatens the stability and integrity of the Ethereum blockchain for all network participants."³

Everything else

Aiden Pleterski, the self-described 25-year-old Canadian "Crypto King" who managed to convince people to give him CA$40 million (~US$30.5 million), has been arrested and charged with fraud and money laundering [W3IGG]. He was sued in 2022 [W3IGG], forced into bankruptcy later that year, and then allegedly kidnapped and beaten [W3IGG] in 2023 by angry investors, but now he's facing criminal charges as well. Even after the bankruptcy proceedings and kidnapping incident, Pleterski had continued to flaunt his supposed wealth online. Much to the indignation of the creditors in his bankruptcy, he has continued to regularly livestream himself gambling online for hours, spending $150,000 on Legos, and driving luxury cars [I46]. Now he's out on CA$100,000 (~$US75,000) bond, thanks to his parents.

The group responsible for monitoring Binance's compliance has been appointed, and it's not Sullivan and Cromwell (as once seemed likely [I52]). Instead, Forensic Risk Alliance (FRA) will be the group making sure the company abides by the terms of its plea agreement.⁴

The SEC has filed two responses in its ongoing legal cases with Coinbase, which has been trying to get the courts to force the SEC to write bespoke rules for the cryptocurrency industry. Over in the Third Circuit, where Coinbase is appealing the SEC's denial of Coinbase's Petition for Rulemaking, the SEC has submitted a filing urging the appeals court to uphold its decision to "take [a] more incremental approach" to applying the longstanding securities framework to crypto assets rather than "build a new regulatory framework from the ground up" as Coinbase has requested [I47].⁵ Over in the District Court for the Southern District of New York, the SEC has opposed Coinbase's motion requesting they be allowed interlocutory appeal in the civil case from the agency. The SEC writes that Coinbase's basis for the appeal is unsound, and that "Coinbase continues to insist, as grounds for interlocutory review, that '[t]he digital asset industry labors under an intolerable cloud of uncertainty' or under a 'cloud of legal uncertainty.' But the Court’s crystal-clear Order, others like it, and the decades of legal authority they are based upon, provide that certainty. Coinbase just does not like the answer. Having made the weather, Coinbase cannot now complain that it is raining."⁶ [I54].

Two people have been arrested for laundering at least $73 million in pig butchering proceeds through Deltec Bank in The Bahamas [W3IGG].⁷ If that bank name rings a bell, it's probably because of its close ties to the cryptocurrency industry — particularly to Tether, but also to FTX and Alameda Research.⁸

Remember that surreal period when every big brand decided they needed to try to stay hip by embracing crypto and launching NFT projects? Budweiser, Pepsi, and Porsche all decided they should give it a try. McDonalds launched McRib NFTs. Luxury clothing and accessories brands like Louis Vuitton and Tiffany tried to introduce "phygital" into the lexicon by pairing physical items with digital copies that a person might, one day, be able to wear in a metaverse somewhere. Even the Charmin toilet paper brand launched... "NFTP". Most reasonable people wouldn't be surprised to hear that these gimmicky projects didn't have much staying power.

At least one person was surprised, though: Luke Brown has filed a class action complaint against luxury fashion brand Dolce & Gabbana for its "DGFamily" NFT flop.⁹ Dolce & Gabbana had promised that its NFT holders would regularly receive some combination of "digital wearables",^a physical clothing items, and access to live events. Many people spent around 1.2 ETH (~$3,500 at the time) for a random tier of what was essentially a loot box. Some high rollers were given private access to pay 40 ETH (around $120,000) for a guaranteed top-tier box. However, the rollout was full of snags, including the weird decision to manually fulfill NFT rewards one by one, shipping issues and high customs fees for people receiving physical items, and a lackluster experience in Decentraland, which is described in the lawsuit as "a metaverse platform with barely any users". Brown contends that he spent $6,000 on the NFTs, but that the items distributed in turn were only "generously" worth $20–$30. Secondary market sales also quickly plummeted, making it challenging for holders to recoup much of the money they'd spent. Brown accuses Dolce & Gabbana of rug pulling by failing to follow through on what he describes as false advertising.

In bankruptcies

FTX

Headlines have, once again, been going around claiming that FTX customers will not only be repaid in full, they'll receive their money back plus interest!¹⁰ However, these claims are still [I50] based on the price of cryptocurrency assets at the time of FTX's bankruptcy — which were, in part because of FTX's collapse, lower than they had been in a long time. I think some are dismissing creditors' complaints that they're not receiving back the current price of their bitcoin or other crypto assets — almost seeing them as entitled for wanting to be able to cash in on the gains bitcoin has enjoyed in the time since.

But to put a number on it, if a customer held one bitcoin with FTX, the estate is considering that bitcoin to be worth about $16,800. But many of these customers put far more money into FTX than that — if a person decided to buy one bitcoin when they saw the Super Bowl commercial that promised FTX was a "safe and easy way to get into crypto", they would have spent $42,000 on it. Some bought in at even higher points, when bitcoin prices were as high as almost $70,000, and are receiving about a quarter of that original money back. Today, bitcoin is back around that $70,000 mark, but the people who bought a bitcoin for that amount and put it on FTX will be repaid something around $20,000 (and are stuck reading headlines about how they're so lucky!)

That's not to say there aren't people trying to pull one over on the FTX estate, though. Recent bankruptcy filings show that people have filed a combined $27.3 quintillion in claims.¹¹ My guess is there are a lot of people trying to claim their illiquid shitcoins are actually worth their paper values.

Genesis

The bankruptcy judge has approved Genesis' plan to return about $3 billion in cryptocurrencies and fiat to its creditors. Though the way recovery is being calculated in this case is much more friendly to creditors than in the FTX case, Genesis customers are still estimated to receive only around 77% of their assets back. Genesis' parent company, Digital Currency Group (DCG), tried to argue that, like FTX, Genesis should only repay creditors what their crypto was worth at the time Genesis filed for bankruptcy in January 2023, when bitcoin was priced at around $21,000. This would have made recovery substantially less for creditors, though it would have allowed DCG to claim that its subsidiary's customers had been "repaid in full".

DCG had seemed to hope that if the bankruptcy judge approved their objection and required the company to return a smaller portion of the company's remaining assets to its customers, there would be more left over for DCG at the end. However, the judge pointed out that there is still nowhere near enough money to pay the $32 billion in outstanding claims, including some fines by federal and state regulators [I50], which would come before DCG was left to pick at any scraps.¹²

In governments and regulators

The big crypto topic over at Capitol Hill recently is the SEC's Staff Accounting Bulletin 121 (SAB 121), which the cryptocurrency industry and some banks have been pushing hard to overturn [I53]. Opponents of SAB 121, a rule which requires banks to report crypto assets as a liability on their balance sheets, argue that it unfairly prevents banks and other financial institutions from getting into crypto by making it extremely expensive. Many are also upset over the procedural side of things, arguing that the SEC was inappropriately setting policy via an SAB instead of through its more formal rulemaking process, or by seeking new legislation from Congress. Supporters, on the other hand, argue that SAB 121 is a perfectly reasonable stance by the SEC taken in response to the serious risks posed by cryptocurrency assets, and that repealing it would undermine the SEC's ability to regulate the cryptocurrency sector.

One such supporter is President Biden, who has stated he will veto the bill if it gets to him.¹³ It looks like it will come that, as the Senate passed a resolution to overturn the policy 60–38 — enough to pass, but not the two-thirds majority that could overcome a veto.

Meanwhile, the House is set to vote this week on the Financial Innovation and Technology for the 21st Century Act (FIT21), a bill that has received strong support from the cryptocurrency industry.¹⁴ Most notably, it would make the CFTC the primary regulator of the cryptocurrency industry — something the industry has been clamoring for for years, mostly because it is a smaller agency than the SEC with fewer resources, and a historically less aggressive approach to the sector. Unsurprisingly, around 60 cryptocurrency companies and industry lobbying groups including Coinbase, Circle, DCG, Gemini, and Kraken signed on to a letter in support of the bill.¹⁵

The Treasury Department released its annual report on combating terrorist and other illicit financing. The report calls out "the ongoing trend in virtual asset investment scams", and recommends updating regulatory requirements around anti-money laundering and terrorist financing to better account for cryptocurrencies.¹⁶

Elsewhere in crypto

The Wall Street Journal published an investigation into Binance's internal handling of market manipulation among its VIP customers — or, more accurately, its lack thereof. According to the Journal, after Binance investigators received a complaint that their customer, trading firm DWF Labs, was manipulating markets, the investigators discovered that DWF had manipulated token prices and performed more than $300 million in wash trading. However, after those investigators submitted their report recommending that DWF be removed as a customer, a Binance executive in charge of handling the company's VIP clientele complained to company leadership. A subsequent investigation of the investigations team found insufficient evidence that DWF had intentionally manipulated markets, and alleged that the head of the investigations team had collaborated too closely with the DWF competitor who had submitted the complaint. That person was fired soon after, and over the next few months, several other investigators were laid off for "cost-saving" reasons. That version of events might be more believable if the Journal hadn't also dug up a report from DWF to one of their own customers, which outlined how they had created a massive amount of artificial trading volume for that customer's token, and were trying to make the trading patterns look "believable".¹⁷

The people behind the scam-as-a-service software known as "Pink Drainer" have announced their retirement after they "reached their goal". Altogether, their drainer software has been used to steal somewhere around $75–85 million in cryptocurrency in the past year, with the Pink Drainer team taking a cut. In their farewell message, they offered some words of advice: "If you have enough money right now to financially support yourself, we advise you hold onto it and take a step back from the grind and enjoy what this world has to offer. Life is too short to get caught in the perpetual cycle of needlessly spending, going broke, and trying to make it back."¹⁸ One wonders what advice they might offer to the roughly 20,000 people who have been scammed with the help of their service [W3IGG].

The Web3 is Going Just Great recap

There were nine entries between May 8 and May 17, averaging 0.8 entries per day. $124.62 million was added to the grift counter.

Former employee of pump.fun steals $2 million in an attempt to "kill" the project

[link]

An employee who briefly worked for the pump.fun Solana memecoin creation project took responsibility for a $2 million theft they perpetrated with the private key access they had gained by working for the operation. The employee then began seemingly randomly airdropping the stolen funds to holders of various Solana memecoins, and took credit for the attack.

In a slew of Twitter posts, the thief seemed somewhat unstable, writing things like: "everybody be cool, this is a r o b b e r y. ... I'm about to change the course of history. n then rot in jail. am I sane? nah. am I well? v much not. do I want for anything? my mom raised from the dead n barring that: life without parole." In a later Twitter Spaces chat, he explained, "I just kind of wanted to kill Pump.fun because it's something to do... It's inadvertently hurt people for a long time."

Unlike some cryptocurrency company employees, the identity of the attacker is known to pump.fun, who wrote they would be working with law enforcement. The hacker responded to this announcement in a tweet: "Neener neener neener."

Sonne Finance is the latest to fall victim to the well-known Compound bug

[link]

A lot of cryptocurrency projects build off of code developed by Compound Finance. This is good for them in the sense that it saves them development effort, but it also means that bugs in that code can be passed through to various other projects.

A well-known idiosyncrasy in the Compound Finance code has been the downfall of a number of projects who failed to properly account for it. The latest in this string is the Sonne Finance lending protocol, which was hacked for around $20 million. Another $6.5 million were "rescued" by various whitehat hackers, in operations in which they took the money themselves and then returned it to the project team.

Everything else

• $2 million stolen from ALEX's XLink bridge by bumbling exploiter [link]
• Cypher contributor admits to stealing over $300,000 due to "crippling gambling addiction" [link]

Worth a read

In the news

That's all for now, folks. Until next time,

– Molly White