Conversation

2) NOT FINANCIAL ADVICE

3) Usually, phishing looks like an email, and it has a bad attachment, or something. In crypto, the scams have gotten sophisticated. For instance--we have a team of people who work to make sure fake FTX clones don't gain prominence.

102

4) Why fake websites? Well, generally, a phishing scam will copy someone's website, but intercept the username/password/etc.--so now they control the login, and can try to drain the user's account.

5) We have a huge number of controls in place to attempt to prevent fake FTX sites from being able to drain users' accounts. And generally they work: it was a lot of work but it's mostly successful.

6) To be clear, phishing is almost always a case where the user voluntarily (but unknowingly) gives their account credentials to a scammer by going to a bad site or something like that--but despite that, we take our duty to protect customers seriously, even from themselves.

7) (This was actually one of the first lessons we learned--way back in 2019, a few users got phished, and our initial reaction was 'that sucks please use 2FA'. Upon reflection--and reaction from users--we *mandated* 2FA, which helped a lot.)

109

8) Anyway, recently a frustrating thing happened. We’ve mostly stamped out sites that try to phish users by masquerading as FTX. But we can’t fix fake sites impersonating *other* services. A few users accidentally registered at fake other sites, including 3 Commas.

115

9) They provided their FTX api keys to use the sites' trading tools. Others users were probably phished through other methods. But one way or another, these users were exploited by third party attackers.

10) In general, there's very little we can do about this: other sites can fail to squash phishing attempts on them, and users can ask to let those sites control their FTX API keys. (This happened to accounts on other exchanges 3C was connected to as well, e.g. Binance.)

10:01 PM · Oct 23, 2022Twitter Web App

11) Mostly this sucks, and is something we should be fighting as an industry. Right now each company has to separately deal with phishing and it sucks. FTX has, but others need to as well.

Replying to

12) Anyway--not only was this not FTX getting phished, it wasn't even an FTX site. And in general we can't compensate for users getting phished by fake versions of other companies in the space! It isn't FTX and we have basically no control over it.

13) But in this particular case, we will compensate the affected users. THIS IS A ONE-TIME THING AND WE WILL NOT DO THIS GOING FORWARD. THIS IS NOT A PRECEDENT. We will not making a habit of compensating for uses getting phished by fake versions of other companies!

118

268

14) But this once, we'll do it; roughly $6m total. (To be clear, only for FTX accounts! Hopefully other exchanges will comp theirs.) BUT AGAIN NOT A PRECEDENT, WE WILL NOT GOING FORWARD.

197

15) Anyway -- maybe a time to try out the 5-5 standard on the 3Commas/phishing scammer! If they send back ~$5.7m (~95%) of the scam within 24h to 0xD15ff86129c3Da57756b33827DfFF6D252602284, we'll absolve them.

168

UnterseeBankofSwitzerland

16) Their addresses: a) 0x6D3e6Ba1b510287141b27F763A86E04c72a001D1 b) 0xaB8bd0D4Eda57cd9EE5A058e498A791dF13dFA65 c) 0x87c828593984381E50D55F755B8462e074047Cf7

112

@UnterseeS

Replying to