Dude, Where’s My Computer?

Headline: Cryptojacking

Date: 3/2/2022

Body: 

What is Cryptojacking?

Cryptojacking is a new word that refers to  a new kind of crime.  Technically, it is the unauthorized use of other Peoples’ devices.   These hackers take over the computers and cell phones and use them to create a network to more effectively mine cryptocurrency.  This is kind of like the “zombie computer” spread of a virus, but in this case, the computers being co-opted are being tasked to mine cryptocurrency instead of spreading a virus.  It is important to note that the aim is to keep this co-opting hidden from the local users so that the hijacker can use the increased computing power without additional expenses for electrical power.

Is this really a big deal?

Yes, there are 2 potentially significant effects:

1.  A decrease in speed and performance of your computer or network.
2. A significant increase in electricity usage.   Before you shrug this off, consider that the Bitcoin network currently uses more than 73TWh of energy each year.   In addition to increasing energy bills, this could potentially add a significant amount of heat that will damage your computer or network.

Is this problem getting larger or smaller?

This is one way to start a fight at a cybersecurity conference.   Some say that due to the efforts of police agencies and the shutdown of Coinhive, the problem is being mitigated.  But the severity of the problem can quickly ramp back up when the value of cryptocurrency begins to climb.   According to one security expert,  “When we did our midyear threat report for 2018 we found that Cryptojacking had a 35 percent share of all web threats and that is honestly absolutely insane,” says Tyler Moffitt, senior threat researcher at the security firm Webroot. “This is a new threat that just came out in late September 2017. Even if it drops down to 25 percent by the end of the year, it’s still clearly a force to be reckoned with.”

How does this malicious code make its way onto a network or computer?

There are 2 main techniques that hackers use:

1.  People who are not very careful, click on a link  and cryptomining code is installed.
2. If a website is infected with JavaScript coding, it can be co-opted.  When you visit the site, the malicious code is installed on your machine.
3. Please note that sometimes, we say “yes” to limited Cryptojacking.   For instance, assume that there was this site where you do gaming.  Before you log on, the site may ask for your permission to use your computer for mining, while you are on the site.  If they stop using your machine when you leave, this is permissible.    But, to be honest, it’s difficult to know for sure whether they use our machines when we are logged off, so, be aware of the risk/reward tradeoff.

Have there been well known examples of Cryptojacking?

Yes.   2018 appears to have been the high-water mark, but in 2019, eight different apps were kicked out of the Microsoft Store site because Cryptojacking software was suspected to be active.  In 2018, there was an intrusion into the LA Times Homicide Report page, one attack on a European Water utility control system,  and there were multiple issues regarding Coinhive.

How can I tell if there is Cryptojacking going on?

Symptom	Comment
Decreased Performance	If the computing cycles are being used to solve these math problems, there will be many less to run your software, and you will be likely to detect a lag.
Overheating	Cryptomining is a resource-intensive process.  You will likely notice that your device is running hotter than usual.  Much electrical power is used in cryptomining, so, if Cryptojacking is an issue, your processer will run hot and you might notice that your energy bill is a little higher than you would expect.
CPU Usage is not in proportion to the immersive nature of the site.	If you are visiting a site that is very basic  and has a few small pictures and no video, your CPU usage should stay minimal.   If it is working hard for no apparent reason, there could be Cryptojacking afoot.

So, how can I prevent Cryptojacking on my machine?

There are a few preventative measures.  Many of these might seem pedantic, but the are all important, just like eating your vegetables.

1.  Get a good security program to protect your machine from viruses and malware, and keep it up to date with patches and updates.
2.  Be aware of the newest Cryptojacking techniques: Most cryptojackers are not too creative.  They will often hop on to a trend and use this one technique for as long as they can.
3. Use browser extensions to control Cryptojacking attempts.
4. Use AdBlocker software.
5. Disable JavaScript.  Websites that have Cryptojacking software will often code it in JavaScript, so if it doesn’t “work” on your machine, then, there is no chance for Cryptojacking.
6. Block pages where Cryptojacking is very likely.   Porn sites are very likely users of Cryptojacking software.   But, there are others too.    (Prepper websites are notorious for this activity too, so, be aware.)
7. The biggest key here appears to be user training.   Your end users have to be trained how to avoid phishing attacks and to detect other forms of social engineering.   Often, cyberjacking software and other malware (e.g. ransomware) will ride in on the same permission given when they click an innocent looking link.

The Verdict

OK, I am not a cyber-security expert, and I don’t play one on my own video-blog either, but it seems that a few commonsense  approaches can be of use here.  Don’t click on any links  for e-mails from unknown sources (e.g. don’t take candy from strangers either.)  Since you are likely not a cyber-security professional either, be sure to get the  benefits of having one on staff by signing up for a Web security program.  (Kaspersky has been noted often in these readings, but WebRoot, Symantec and others are good too.  Once again, Ben Franklin was right, an ounce of prevention is worth a pound of cure.

 REFERENCES

https://www.kaspersky.com/resource-center/definitions/what-is-cryptojacking

https://www.crowdstrike.com/cybersecurity-101/cryptojacking/

https://www.wired.com/story/cryptojacking-took-over-internet/

https://blog.barracuda.com/2021/10/22/whos-using-your-computers-cryptojacking-degrades-network-performance/

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Going Whole Hog!!

Headline: What is a “Pig butchering” cryptocurrency scam?

Date: 5/2/2022

Body:  I was watching one of the podcasts I like (Legal Eagle) and he mentioned a few cryptocurrency scams.   I thought this would make for a dandy blog post.   But there were too many of them for only one post.  So, we have already looked at rug-pulling, pump & dump schemes, and now we are led to a really terrible-sounding one (and it is) called “pig butchering.”  OK, please stay with me, I promise we will keep things kosher, and there will be no pictures, but for text conversations.

Pig Butchering appears to be a slow-play to get cryptocurrency from people.  It is serious.   In 2021, there was an estimated $7.7 Billion in cryptocurrency fraud, and $139 Million of it was associated with this pig butchering approach. In a rug pull, or in a pump & dump, the focus is on speed.  In this terrible paradigm, somebody is targeted, and temporarily the investment goes well.  Then, over months, the mark is bled dry.  Most often, it appears to begin over dating sites.  I can only assume that there are bots out there, looking for target people.   This is not surprising as the people on dating sites are probably lonely, and in a position to show off what wealth they have to a prospective  mate.  Don’t laugh: You might not believe some of the targets they successfully fleece.  This includes a man with more than a 20-year tenure in all types of law enforcement.

WHAT??  HOW???

This man was slow-played, over several months, using pictures of an attractive woman, and there were several “gestures” shared between them.   Text conversations were frequent and e-mail was pretty frequent too.  Eventually, she got him to sign some sort of mining contract  that promised to net him untold wealth.  In reality, it allowed her and her associates to “mine” all of the cryptocurrency he owned.   (They did this by having him sign up for a digital wallet at a site that was spelled very much like a reputable exchange.   In a cruel twist, he can see his money, right on the blockchain, but he can never touch the $15,000.

OK, well, this guy was probably unique, yeah, I understand…

No, this gentleman was not unique, in any manner.  As cryptocurrency investment in the United States skyrockets, Jenkins’s story is no longer a rarity. Scams are rapidly multiplying in the lightly regulated province of crypto, experts say, each boosted wallet and disappeared dollar underscoring just how mainstream the thievery has become. The Federal Trade Commission estimates that Americans lost $750 million to crypto scams in 2021, and the number could rise this year.

Law enforcement has been slow to rise to the challenge. The Justice Department recently announced a new task force focusing on cryptocurrencies, but it’s still very new and it remains to be seen how many scammers it can investigate, let alone arrest.

No one agency seems to have latched onto the scam that snatched Jenkins’s money, even though a Washington Post analysis of the blockchain records available suggests it is truly of staggering dimensions — with likely more than 5,000 victims in multiple states and $66.3 million stolen since August. The FBI did not respond to a request for comment.

Victims interviewed by The Post say that despite numerous attempts to alert law enforcement, they’ve yet to be contacted by authorities, leading them to believe no agency is even aware of the scam, let alone investigating it. Instead, they have organized on their own, in Reddit and Facebook groups, to commiserate and strategize.

“This is really, really hard because crypto is so thinly regulated and folks are used to picking up the phone and calling 911,” said Joe Rotunda, the enforcement director of the Texas State Securities Board, which investigates investment scams. “Oftentimes, the law enforcement agencies deal with violent crimes or street crimes. They simply don’t have the resources necessary to prosecute a case like this and don’t know where to turn.”  Jenkins says that when he went to his local police station, they didn’t understand what he was talking about. He tried contacting both the FBI and Securities and Exchange Commission via their websites but never heard back.

Isn’t this simply some kind of Crypto catfishing?

Crypto catfishing appears to be a new harmony placed atop a very familiar melody.  In the Old West, women were tasked to “interact” with a  man who just had a lucky strike at a new mine, and find the location, so that the gold could be purloined first by somebody else.   I have even heard of some religious sects using, well, sex, to lure new recruits into the fold.   Is it any wonder that, with this new Internet tool, somebody is using a cat-fishing approach here too?  The tricky bit (atop the beautiful woman) is that the concepts concerning cryptocurrency are so new.   This means that an unethical person stands a pretty good chance to find a valid high-tech term and wrap an entirely nebulous cryptocurrency.  The law enforcement gentleman above was lured in with a scheme called “liquidity mining.”   (As an aside, as I write, in fact, a “woman” probably a bot is trying to catfish me on Facebook to do a similar thing.)

In case you were in any doubt, the mining certificate was phony, turned out to be one line of computer code, a smart contract that gave Alice complete access to his whole wallet.   He  went to the exchange and was unable to do anything to help.   He contacted the staff of Tether (the currency he was denominated in) and they were unable to do anything either without a valid law enforcement request.   Within the federal government, at least 6 agencies are  angling to be the regulator of cryptocurrency, as their budget and prestige would expand.  Given this environment, he found no help at all.

The pattern continues…

One woman  went on Hinge, and met a “man” who surprise, grew up in the same remote village in China as her adoptive parents.   She was slowly conned out of the $140,000 she derived from her late mother’s house.  The money was earmarked to help her family create a new life in California, and slowly, Hao convinced her to move more and more into the now bogus wallet.  When she saw the appreciation, she convinced her father to match the $140,000, which he did.  When the account appreciated to $1.2 Million, she tried to cash out, and was told that there would be “tax” of $380,000.  She’d been had.  When she went tearfully to tell her father, she was truly gutted.   “I messed up my life. I messed up my dad’s life,” Hutchinson said.  

Are there studies that have been done?

The Washington Post did a study and found 5,046 similar accounts with an average loss of $13,000.  (Quick math that’s $65,598,000 identified by the Washington Post, alone.)  These thieves have to take a lot of money because, to meet the “right” person and sucker them so badly, takes a large investment in time and risk.

Who is being targeted?

Simple answer: EVERYBODY!!  It’s not just the elderly and infirm being targeted, it’s professionals from all walks of life.  The Fear of Missing Out (FOMO) effect is quite powerful.  Powerful enough to overcome any kind of cynicism or conservative cast of mind.  Per the Washington post report, it is the “savvy people  in midlife are common victims” according to activists.

What can I do?

Well, you can do  a lot.   

1.  When you go online, if a “person” unknown to you tries to strike up a friendship, ask them how you know them, and look for real connections.   If there are none, please consider not e-mailing back.
2. Know that there is risks ahead of time.
3. Contact your Representative or Senator and ask them to regulate these firms.

What do these scams look like out in the “wild?”

They are so insidious because the conversations begin in such a benign way.  The following text exchange was the start of a pig butchering that was quite “successful.”

In many reported cases, scammers spend weeks or months in a relationship before bringing up crypto and the potential it offers. Anyone who uses the web is at risk of crypto scams – not just those who have crypto investments. In fact, scammers put a lot of effort into walking you through your first crypto purchase through legitimate exchanges like Coinbase or Binance, as the screenshot shared with CoinDesk shows below. Things only go downhill from there.

Scammer text message 2 (CoinDesk)

We might be tempted to laugh at this, but remember that this exchange and hundreds of others unfolded over months, and was engineered to seem very organic.  I could present many more examples (roughly 56,000 reported in 2021, so, due to embarrassment, there were likely many more), but they all seem to follow the same script.

The Verdict

This is the point where I usually give you good news, alas, I have none in this case.   This all seems to boil down to lonely people who have an intense FOMO feelings.   Said one victim, “You hear all these stories about people becoming millionaires,” she said. “It just felt like, oh, well, cryptocurrency’s the new trend, and I need to get in.”  So far, nothing public has been done for the victims.  “The blockchain is kind of this permissionless frontier space,” said MetaMask’s Finlay. “You know, I don’t know if every user understands how much they really are kind of on their own.”  As you consider investing in cryptocurrency, please keep this statement in mind.

Oh, and Mr. Jenkins mentioned above, is undeterred by his misadventure.  Jenkins said he realizes now just how vulnerable he is. But, perhaps surprisingly, he wants to keep investing in crypto.  “I just feel like there are ways to make money,” he said. “Sure, some of it feels too good to be true. But if you treat it like gambling, if you have that mentality and approach it wisely, you can make a lot more than having it sit in a bank.”  He is right, it is gambling, and sometimes “The House” is not owned by your hosts.  Be careful out there!!

REFERENCES

https://www.washingtonpost.com/technology/2022/04/04/crypto-scams-coinbase-liquidity-mining/

https://www.cbsnews.com/news/crypto-dating-scam/

https://www.coindesk.com/learn/crypto-romance-scams-dont-fall-for-these-dating-app-swindlers/

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Rug Pullers, Called on the Carpet!

Headline: Rug pulls are dangerous.

Date: 4/28/2022

Body:  In studying the stock market, people run into “chart patterns” and each pattern has an endearing name.  (I think there’s the iron butterfly, the pennant and several others.)   These are indeed evocative, but, do they have anything to do with cryptocurrency?    Hard to say for sure, but there are some evocative names for scams within the cryptocurrency ecosystem, and I’d like to say a few things about “rug pulling.”  Hundreds of hours of my childhood were mis-spent watching cartoons, and without exception, when one character would pull a rug from beneath another, hilarity would ensue.  It’s not quite so funny when it’s your personal fortune and future on the line.

Outside of a Tom & Jerry cartoon, what is a “rug pull”?

Rug pull is a reference to how suddenly the currency loses value.   In such a scam, usually just after a very successful ICO, the founders disappear with millions of dollars.   The rumors spread, and the value of the cryptocurrency they were touting goes down precipitously.  This particular scheme is quite popular and was responsible for losses of $2.8 Billion last year alone.  Usually these happen on the very open DEX (de-centralized exchanges) because there are no code audits.  Code audits are very important because each of the smart contracts (remember, really, just pieces of code) are inspected for backdoors that can make it easy for unethical promoters to steal money quickly.  (As I am doing my research for this piece, I have found dozens of examples of rug pulls on DEX exchanges and only one on a centralized exchange.)

Are there flavors of cryptocurrency scams?

Generally speaking, cryptocurrency scams fall into two different categories:

1. Initiatives aiming to obtain access to a target’s digital wallet or authentication credentials. This means scammers try to get information that gives them access to a digital wallet or other types of private information such as security codes. In some cases, this even includes access to physical hardware. 
2. Transferring cryptocurrency directly to a scammer due to impersonation, fraudulent investment or business opportunities, or other malicious means.  This includes social engineering of all types, and imposters who claim to be somebody they’re not.
3. With the rise of new crypto-based investments such as initial coin offerings (ICOs) and non-fungible tokens (NFTs), there are now even more avenues for scammers to try to gain access to your money. The background of these investments is beyond the scope of this article, but what’s important to know is that although crypto-based investments or business opportunities may sound lucrative, this doesn’t always reflect reality. For example, some scammers create fake websites for ICOs and instruct users to deposit cryptocurrency into a compromised wallet. In other instances, the ICO itself may be at fault. Founders could distribute tokens that are unregulated by U.S. securities laws or mislead investors about their products through false advertising.
4. DeFi rug pulls are the latest type of scam to hit the cryptocurrency markets. Decentralized finance, or DeFi, aims to decentralize finance by removing gatekeepers for financial transactions. In recent times, it has become a magnet for innovation in the crypto ecosystem. However, the development of DeFi platforms is beset with its own problems. Bad actors have made away with investor funds via such avenues. This practice, known as a rug pull, has become especially prevalent as DeFi protocols have become popular with crypto investors interested in magnifying returns by hunting down yield-bearing crypto instruments.

I’m not a coder.   How do I avoid these?

1.   Check for low liquidity.   If it is very difficult to transfer into another cryptocurrency or into cash, that might be a signal to not invest in that particular currency.  Be sure to check the 24-hour trading volume to see if it has liquidity issues or not.
2. Do background checks.   Download the whitepaper associated with the currency, and really understand how it works.     Identify how you can change back into cash.   Identify the management team and understand how solid they are.  If the management team is not identified, perhaps you should take this as a sign not to invest.  Remember, the core team within management should be using their real names.  If some minor officials within management appear to be using pseudonyms, this could be OK.
3. If it is a valid cryptocurrency(and not a scam) the developers will “lock” their control of the liquidity pool, and make it impossible for them to gain control of the financial assets.   They do this by “burning” the private key they used to start the liquidity pool.   So, as you read the whitepaper (you DID read the whitepaper, right?) look for a policy to burn their private key to the liquidity pool.
4. As you read the whitepaper, you should not see dozens of grammar and spelling mistakes.   If you do, this is probably a bad sign.

Are there some current examples?

In November 2021, a cryptocurrency token associated with the hit Netflix series went from $2,586 to a penny. The project promised that an anti-dumping mechanism was written into the code, making the $SQUID token immune to a flash-crash. Supposedly, token-holders could only sell by also holding the $MARBLE token. Yet, the anonymous founders made off with approximately $3.3 million with virtually no consequences.  

Filed under the hashtag, “ironic” there was a project called “Waronrugs” and there was a DEX campaign to raise money to look carefully at some of these projects.  As soon as the liquidity pool was $2 Million, the developers skipped town with all of the money.  (Kind of like The Producers, huh??)

Who is supposed to regulate these markets?

Well, nobody really.    Let me explain.   Some of the frauds are investigated by the DOJ after receiving a heads-up from the IRS.  The FTC writes information about cryptocurrency in a variety of publications.    The CFPB is also involved.   To be blunt, it’s really alphabet soup run amuck right now.  There is little organization, cooperation is, well…  Everybody CAN find a way to get involved, so nobody is held accountable.  (I keep seeing references to the “Wild West” but this seems simplistic.)  Whatever agency comes to regulate cryptocurrency, they will have their hands very full, as the novelty will bring numerous scammers, jammers and spammers.

The Verdict

Still ringing in my ears are the words from my Dad.  “If it seems too good to be true, it probably is.”  Multiple articles point this out in various ways, but, it all comes out to the same thing.     If you see the word “guarantee” run away.   If you see a term within the whitepaper that you are unsure of, please consider investing elsewhere.  If you can’t understand the purpose of the ICO, consider not investing with them.  If you can’t see the possibility of selling an NFT, consider not buying it.  Cryptocurrency can be exciting, but it shouldn’t include a near-death-experience with that excitement.

REFERENCES

https://fortune.com/2022/03/02/crypto-scam-rug-pull-what-is-it/#:~:text=Rug%20pulls%20are%20a%20lucrative,hundreds%20of%20millions%20of%20dollars.

https://www.coindesk.com/markets/2021/12/17/defi-rug-pull-scams-pulled-in-28b-this-year-chainalysis/

https://www.theverge.com/2022/3/24/22995107/us-arrest-charges-crypto-nft-rug-pull-frosties-ethan-nguyen-andre-llacuna

https://www.washingtonpost.com/world/2021/11/02/squid-game-crypto-rug-pull/

https://www.investopedia.com/articles/forex/042315/beware-these-five-bitcoin-scams.asp

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Bot, and Paid For.

Headline: Bot and Sold

Date: 4/23/2033

Body:  The key to cryptocurrency, and what keeps me up at night if I owned any, is the extreme volatility of the prices.  This is nothing new to readers of my blog and readers of any kind of article about cryptocurrency.   But, the reasons why this extreme volatility exists might not be so visible.   In the stock market, there was an arms race of who could get their orders fulfilled the fastest, and year after year, firms would invest millions of dollars to get a foot closer to the servers closing the deals.   In terms of timing, this advantage was measured in nanoseconds or less, literally.

So, should it be any surprise that when dealing with something even more abstract, like cryptocurrency, the arms race begins on an even higher level?  I hope that your answer was NO!!  Back in the halcyon days of trading “real” stocks, there was a brief period (measured in microseconds) between a large institutional investor, say CALPERS, placing an order and getting that order filled.   Some computers, were they fast enough, could “see” this large order coming and order the same stock first.   This would guarantee them a lower sales price than CALPERS was getting, and then, microseconds after the big sale, they could sell their stock back at an inflated price, and pocket the difference.  This is the essence of “front running” and in the realm of cryptocurrency, this has taken on Olympian proportions: perhaps that’s an understatement because, it is physically impossible for any human to do this accurately. (There is a great book about this called Flash Boys.  Great read.)  Enter the “bots.”

The bots are essentially small pieces of code that “see” a potential change in prices upcoming and try to take advantage of it.   As you can probably guess, this army of code pieces adds significantly to the volatility in pricing of cryptocurrency.  In fact, some experts have made this exact point.

“Under the surface of every transaction that finds its way to the blockchain, there are fierce wars over every bit of profit,” said Manuskin. “If you happened to come across an arbitrage opportunity, or even notice an error in some contract, it is very likely that it will be hard to extract this value without either operating a bot yourself to fend off the front-runners, connecting to and paying a miner to conceal your golden goose transaction, or making the transaction complex enough for the front-runners to not notice.”

This is hard to believe.   Is there proof that these bots exist?

Good question.   Researchers looked at this very question, in fact.   They put together a large transaction that was engineered to be attractive to a bot like this.  The Ethereum based contract was pending for about 3 minutes.  Then in the same transaction block (before the engineered bait transaction) a similar transaction took place.   Why did the Ethereum miners prioritize this transaction?   The bot paid them 0.0001111 more gwei.   (This is a currency paid for the miners to substantiate a transaction.   This payment is also called “gas.”)  The researchers engaged the services of an Analytics company and figured out that the bot had been used since 2018, and it had taken profits amounting to $10,000.  Not quite enough to live on near DC, but, one single person can operate MANY different bots, and the results can multiply quickly.      In the next stage, researchers hid their transaction behind a proxy server, and even with this protection, there was a different front-running bot that was not fooled.  Arms race has officially begun!

So, we know there are front-running bots, so we can avoid them, right?

No such luck, I’m afraid.    Said one researcher, “Each [bot] operates differently and might be triggered by different factors of the transaction,” he said. “The bots themselves are in competition with each other over who gets the reward. This is only the tip of the iceberg in the full picture of the bots out there, which makes it even more interesting.”

Enter the Flashbots

Of course, somebody out there put together a free, open-source “kit” from which you (or somebody with nefarious intent) can assemble your own bots, set to be attracted to the transaction parameters of your choosing, with instructions personalized to that bot.  But, the stereotyped 19 year-old guy with thick glasses who lives in a used camping trailer under a highway bridge is not the only one who can do these shenanigans.  The miners themselves can make choices about which transactions to put before other transactions, so, the arguments against these bots often fails at this point.  Most experts seem to agree that the current situation is not ideal, but it has the potential to improve the system drastically, over time.

Has there a reaction to these Flashbots?

Binance is a well-known cryptocurrency exchange, and has put together a policy statement on how they will fight these Flashbots.  Their defense is organized around the following areas:

Defense	Comment
Fast matching of transactions within blocks.	If the transactions are verified and executed quickly, these bots have a much smaller window of time in which to operate.
Transparent Match Engine	The rules for matching and executing transactions are known by all participants, and anybody can “replay” the verification of a block, to ensure that the prioritization rules have been followed.
Periodic Auction Matching	When the Auctions are Matched later, the bots work perfectly, too perfectly.  So, these can be traced back to individuals, and there can be consequences.

This is not a perfect defense mechanism, but it does seem to work pretty well.

The Verdict

Whenever anything new under the sun is trotted out, there is one and only one thing that can be counted on: The crooks WILL try to take advantage of this new mechanism to enrich themselves.  So, given this, we seem to have 2 choices to remain safe.  The first alternative is to not play in the cryptocurrency sandbox at all.  This would prevent any front-running bots completely.  But, we would have to forgo the potential benefits too, and that could be substantial.  The second is to choose your cryptocurrency exchange very carefully. 

REFERENCES

https://www.coindesk.com/tech/2020/12/29/new-research-sheds-light-on-the-front-running-bots-in-ethereums-dark-forest/

https://www.bloomberg.com/news/articles/2021-09-23/crypto-trading-how-flashbots-work-to-front-run-ether-and-other-coin-purchases

https://docs.binance.org/anti-frontrun.html

https://www.morningbrew.com/daily/stories/ethereum-gas-fees

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Research is Currency

Headline: Methods to Research the right kind of Crypto to Invest in

Date: 3/26/2022

Body:

Investing guru Peter Drucker is quoted often.   One of his most famous quotes is, “You should be able to illustrate their business model with a crayon.”  Cryptocurrency is simply a different type of investment, so it stands to reason that you should be able to illustrate the value proposition “with a crayon.”  To be able to simplify such a complex decision to such a level, requires significant research.  When researching stocks of companies, you can go to the corporate website and peruse the 10-Q and 10-K statements (paying extra attention to the actual financial statements) and then scan the commercial press to find articles indicating a good future is probable, or the reverse.  With a cryptocurrency, this process is not possible because the same statements are not required by the Federal Government.  But, be of good cheer, there are things that you can do to ensure that you are making the best investment possible, for yourself.  Recognizing that nobody has a perfectly functioning crystal ball, these research ideas cannot and will not  provide guaranteed wins.   But, they will significantly increase your odds.

First, understand what it does and how it functions.

To do this, please be sure to download the whitepaper that is behind the currency you are thinking of investing in.  Before a cryptocurrency is launched, the team behind it will  create a whitepaper that introduces the currency to potential investors.   It will outline the purposes of the currency, introduce the management team and brief you on some of the major policies that the currency follows.  I know that this can be tiresome, but, reading and digesting this document is part and parcel of your investment.  But, if you don’t, what could happen?    I mean, nobody has had a disastrous blind date before, did they?    But, this potential partner has some of your money, so, it’s a bit more serious.

Please pay serious attention to the market capitalization of the currency you’re considering.   If it is too small, it could be a very illiquid investment that is hard to exit.  Also, pay some attention to how much currency will be held by the founders.

Second, scan the press (i.e. Google) and see if it is active

Currency isn’t worth the metal it’s minted with if you can’t turn it into something else of value, and crypto has no metal to it.  So, look to see if it seems to be actively spoken of in the internet.   Look to see if the website works well.   Look to see if there is an active community.   Look to see if people are actively developing apps to add functionalities to the currency.  Be sure to stop at CoinGecko or some similar site to get general information on price fluctuations and how your currency compares to others.

Third, check out the competition

OK, so you want to invest in Bitcoin.   But then you look at Ethereum and realize that the functionality might be better, and there are several metaverses that you might like that run on its infrastructure.   Be aware of how good or bad the competition is.

Fourth, do some research on your own situation

Do you have an emergency fund set up?   Are you currently contributing to a retirement account?  Do you have enough money to cover normal expenditures absent this money you’re about to invest?  Be very frank and honest with yourself, and if you said “no” to any of the foregoing questions, perhaps you should consider it a red flag.

Are there common scams to avoid?

There are some common scams to avoid.  Fortunately, if you use good research practices, they can be identified.

First, if something seems too good to be true, it probably is.   This is true in the realm of cryptocurrency as well.   If somebody is promising to make you 10X your money within a quarter, be very skeptical.   Sliding away from them is probably a good move too.

More specific to the internet, shilling and sybil attacks are quite common.   If watching a video or reading a website, the line between “educational material” and “promotional material” can be razor thin or less.   (Trust me, I have taken a very large variety of workshops where they explain techniques and tricks to make this work.  That’s why I never charge for these blogs or have advertising on my site.)  Sybil attacks are related, only instead of one “voice” giving you “educational material”, a user with an agenda will open several websites and try to appeal to multiple audiences, and make it appear that there are several people with this point of view.  This chorus can be quite convincing: your only option is to put plenty of wax in your ears, strap yourself tight to the mast, and ride it out.  (Sorry for the long-winded Odyssey reference.)

The Verdict

Wait a minute… this is all supposed to be fun, right?  Well, no.    This is supposed to be a way for you to hopefully make some good money, and that requires work.   If you were hoping to make money and have fun risking it, you’re probably better off to go to a real casino.    On the other hand, if you’re truly of the stripe to do this investing, you will find this researching to be enjoyable.  Just be sure to remember to keep things in perspective.

REFERENCES

https://www.fool.com/the-ascent/cryptocurrency/articles/your-7-point-checklist-to-crypto-research/

https://academy.binance.com/en/glossary/do-your-own-research

https://www.thebalance.com/how-to-invest-in-cryptocurrency-5078408

https://www.experian.com/blogs/ask-experian/how-to-start-investing-in-cryptocurrency-beginners-guide/

https://www.cpacanada.ca/en/news/canada/2021-11-30-crypto-investing

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

Be Careful to not Contribute to the Delinquency of a Miner.

Headline:  What does a Crypto-Miner do?

Date: 3/28/2022

Body:  The usual bitcoin miner is unlikely to wear a helmet or carry a pick.   He or she is much more likely to wear shorts and sandals and carry a laptop.  Why shorts?   This is important because on “the rig” it gets REALLY hot.

Think of the movie Star Wars, Episode I.   In this film, we see Anakin for the first time, and he is flying a pod.  (basically a blocky little passenger compartment connected  by cable to two ridiculously, ludicrously over-sized engines.)  In this example, the little cockpit is the laptop controlling the “rig”.   This rig (the engines in our illustration) is essentially a tacked together supercomputer.  On second thought I quite like this illustration because both generate a tremendous amount of heat and they occasionally explode.  When we are speaking of bitcoin mining, this is the image I want you to have in mind.

OK, so what do they DO?

A bitcoin miner tends to this machine.  The machine is tasked with verifying the transactions on the blockchain by solving ridiculously complex mathematical functions called hashes.  In return for this verification, the miner is given some quantity of bitcoin.  (The first miner to get the right answer is given the most reward, but several other miners can get lesser prizes for being 2^nd , 3^rd or 4^th.  )  As each block is solved, it is added to the blockchain, which is the publicly available ledger for the entire network.  The algorithm organizing Bitcoin will alter the complexity of the hashes, and currently one new block of transactions is added, about every 10 minutes.

To even get started is some sort of journey.  They need a cryptocurrency wallet, and this is no problem.    Mining software can be downloaded at no cost.  But, the hardware with the graphics processing units or the Application-specific integrated circuits can easily cost over $10,000.  Once set up, the miner has to have some impressive investors lined up to pay the electricity costs because they can be extreme!!  They must also have an incredibly stable and unlimited connection with their Internet provider.  All of these things can be obtained in an economical manner only if the price of Bitcoin remains elevated.

Lest we forget, the mining rigs improve in speed every year.   So, you have to upgrade your rig to stand a chance against the newest ones.   This is a REAL arms race here.   This represents real expenditures that must be made.  

One new approach is to join a mining pool.   True that you don’t have the enormous hardware costs anymore, but you have to split the reward money with a lot of people, and there are membership fees charged.   These are still interesting enough that there will likely be an entry about them on their own.

So why should I consider NOT being a miner?

This is actually a simple question, then a philosophical one.   It’s true that you can make some money, but that requires some major investment of time, energy and money and with the volatility of Bitcoin pricing, this can easily become prohibitive.    More along the global concerns, the carbon footprint is HUGE!!  Crypto-mining accounts for more than 91 Terawatt-hours of electricity annually.  If you need some perspective (I did) each Terawatt-hour is equivalent to 1,000,000 kw/h and according to Digiconomist, a single Bitcoin transaction takes 1,544 kWh, which is equal to 53 days of power for an average US household.   This is a LOT of power!)  Much fossil fuel has been consumed and pollution created to make this happen.   Do you want to be one of the people responsible for this, just for a chance of making a little money?  Not judging, this is your call.

We are really slinging some Hash here.

We spoke of hashes above.   These totals represent 64 digit hexadecimal numbers which must be computed to make a block accepted for the Bitcoin blockchain.  (They are simply inconceivably complex.)  But wrong answers don’t matter, only the right one does.    So, the strategy is for your rig to throw out as many “guesses” as possible as quickly as possible.  The speed of your rig is therefore known as the hash rate.  A “good” rig can push out 100 hashes per second.   In order to stand a chance in this realm of computing, you do essentially need a supercomputer, or at least the distributed version of a supercomputer.

The Verdict

Well, my landlord would be very upset if I set up a mining rig in his house.   I suspect yours would too.   Joking aside, to do this right requires an industrial-scale facility, with some massive cooling equipment to keep the computers from melting into expensive slag.  If you can join a pool, or find a patron who will open a very large checkbook for you (regularly) I guess this could work for you.   But, you’d better be good, because this will be your job and your life, and sleeping will become negotiable.   This is not the life I would choose, maybe you would.  Just be careful to do this with open eyes and understand your competition.  Goodnight, and good luck!!

REFERENCES

https://www.pcmag.com/how-to/how-does-bitcoin-mining-work

https://www.thebalance.com/how-does-bitcoin-mining-work-5088328

https://money.usnews.com/investing/term/bitcoin-mining

https://www.coinbase.com/learn/crypto-basics/what-is-mining

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.

KYC, here we come!!

Headline: What are Know Your Customer restrictions and how do they relate to Anti-Money-Laundering efforts

Date: 3/30/2022

Body:  KYC, kind of sounds like a Midwest city with big ambitions.  But it’s not.  In the context of cryptocurrency, KYC is “Know Your Customer” or “Know Your Client.”  Even though cryptocurrency aims at a decentralized transactions, the exchanges still have to try to moderate the potential of money laundering.   Enter the KYC requirements.   Before you can open an account for some party, there are some details you need about them to ensure that they are a real entity, and they are the entity they purport to be.  This is all in an effort to minimize potential for money laundering and tax evasion.  If you refuse to give this basic information to the exchange, they could decide not to setup an account for you, or throttle you back as to how much cryptocurrency you can have in your account.

What will they ask me for?

They ask, generally, for the basics like birthdate, TIN or something similar.   They are also quite likely to ask for a government issued ID card.

What if I don’t want to identify myself?

If this is your preference, there are options.   There are Bitcoin ATMs, and you could use these.    The other option is a decentralized exchange (DEX).   The author used an apt comparison, DEX is kind of like Craig’s List for cryptocurrency.  You’re never really sure who you’re dealing with, and you are really trading at your own risk.

Another option is an AMM.   In these exchanges, no identity verification is required, but they can only trade one form of cryptocurrency for another.   They do this trading by executing computer code in the form of smart contracts.  While AMMs don’t require identity verification, you need to already have a crypto wallet with funds to trade. You can’t buy crypto using cash on these platforms. Many users opt to buy crypto with cash on a centralized exchange first. Then, they transfer that to a crypto wallet and connect it to an AMM to have access to a wider selection of cryptocurrencies.

What is the history of KYC?

For many years, the Federal Government has had rules, telling financial services companies that they must help to detect and prevent financial crimes. In 2001, as part of the USA PATRIOT Act, the United States Department of the Treasury detailed specific KYC processes that financial services firms must have in place.  In 2013, the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) published interpretive guidance FIN-2013-G001 that declared that administrators or exchangers of virtual currency are money services businesses under the Bank Secrecy Act and FinCEN regulations. (What is a money services firm?  Think money services businesses like quasi-Banks.  Examples would include check-cashing services and casinos.) Money services businesses are subject to the AML and KYC requirements of the Bank Secrecy Act.  In 2016, the Treasury elaborated on and applied these regulations to the FinTech sector.  (Don’t be put off by “FinTech.”   This is just a “cooler” way to include all the services that make online trading and other electronic services possible.)

So, What Is KYC?

AML regulations usually leave the specifics of the KYC process up to the regulated entities, using a risk-based determination of what rules are appropriate. These KYC programs generally include the following three basic components:

1. Customer Identification Program (CIP): OK, first thing that an exchange has to do is identify you as you.  They will at least take your name, DOB, and physical address.     Some might ask for a SSN, driver’s license or passport.   Often, they will have a KYC template and the customer will simply enter all of the requested data there.
2. Customer Due Diligence (CDD): This due diligence has but one purpose: determine the level of fraud risk you bring to the exchange.  More or less, this is a background check.
3. Ongoing Monitoring/Risk Management: Essentially, this is looking for large, unusual or questionable transactions made by the customer, and yes, it is constantly on-going.  The idea is to catch any malfeasance early, and contain damages, both financial and reputational. 

How does crypto AML work?

The Financial Action Task Force (FATF) sets the standards for AML laws globally. FATF began publishing guidance on cryptocurrency AML in 2014, and policymakers in FATF’s member jurisdictions quickly took action; today, FinCEN, the European Commission, and dozens of other regulatory bodies have codified most of FATF’s cryptocurrency AML recommendations into law. 

From there, the baton gets passed on to virtual asset service providers (VASPs)—a group that FATF defines to include cryptocurrency exchanges, stablecoin issuers, and, on a case-by-case basis, some DeFi protocols and NFT marketplaces. These businesses do the heavy lifting to stop money laundering by employing compliance officers, requiring know-your-customer checks, and continuously monitoring transactions for suspicious activity.  When suspicious activity is observed, VASPs report this information to relevant regulators and agencies, which then use blockchain analysis tools like Chainalysis Reactor to investigate the flow of funds and link illicit activity to real-world identifiers.

By implementing a mandatory eKYC policy, crypto exchanges can guarantee a few things. The first and most important is that one singular account can be created per person.   This is important because each individual person has only one true character.   They might have (validly) several different addresses, but despite some changes, their character remains the same.  (This is made a little more complex in Europe where there is a “right to be forgotten.”   This is the idea that after a certain period of time, data about you should drop off the internet.  Under this law, the company can only retain these records online for a set period of time, and then the only copy allowed is an encrypted version held in cold storage, offline.)

The Verdict

Money laundering is a very large problem in today’s world, and deserves attention.    While it is true that we have very sophisticated computers to track transactions, these transactions can now go worldwide, in less than the blink of an eye.  This puts an onus on the financial regulators in all of these countries to work together as money laundering almost never stays within one jurisdiction.  This is made even more difficult because each financial institution involved desperately needs the revenue from customers, and those looking to launder money often have more than enough financial resources to make them appetizing targets for hungry banks.  Perhaps the pandemic taught major countries that it is possible to work together to protect citizens of this world: We can only hope.

REFERENCES

https://www.gemini.com/cryptopedia/kyc-meaning-know-your-customer

https://www.fool.com/the-ascent/cryptocurrency/articles/what-is-kyc-and-why-do-crypto-exchanges-require-it/

What is AML and KYC for Crypto?

https://www.forbes.com/sites/forbesbusinesscouncil/2022/02/17/why-kyc-is-one-of-the-keys-to-cryptos-longevity/

https://www.nasdaq.com/articles/lets-admit-it%3A-to-ward-off-crypto-scams-kyc-is-a-must-2021-09-29

Editor’s Note: Please note that the information contained herein is meant only for general education: This should not be construed as Tax Advice.   Personal attributes could make a material difference in the advice given, so, before taking action, please consult your tax advisor or CPA.