Stolen Funds

[Qowevisa]

Unauthorized Transaction of 60,000 FIL - Request for Recovery Discussion

Summary

We experienced an unauthorized transaction on our Filecoin wallet, where 60,000 FIL was sent without our team's authorization. Despite our thorough internal checks, we are certain that this transaction was signed with our private key, but it was not initiated by any of our team members. We would like to propose a recovery solution to the Filecoin community, potentially in the form of a Filecoin Improvement Proposal (FIP) or a specific Filecoin Recovery Proposal (FRP), to restore our lost funds.

Transaction Details

• Message ID: bafy2bzaceb7x3xx7mgxzrppzor7xgawb5r7ns3ilfzl6jehjpximr5xabm2zo
• ETH Transaction Hash: 0x7f7ddeff61af98bdf9747f7302c1ec7ed96d0b2e57e490e97dd0c8f6e00b3597
• Height: 4182853
• Block Confirmations: 58224
• Time: 2024-08-16 10:06:30
• From: f3wojvzaqw7vb26r42thzgwee3egqw4qsredsghjjy3cley7km2oypjgvx2xc5hppwytz4t74bzuqbkn6aalrq
• To: f3q4mwqkf5sczmfo3guicn4um44ct7ukbsrct73x5a3yyceraheh6vd33mzytkgzy3lyyxtuvykrp6c4cinclq
• Method: Send
• Value: 60,000 FIL
• Status: OK

Background

On August 16th, 2024, two transactions were sent from our Filecoin wallet:

1. The first transaction, sending 1,000 FIL, was authorized and executed by one of our administrators.
2. Immediately after, a second unauthorized transaction sent 60,000 FIL to another wallet without any approval from our team.

We are absolutely certain that no one from our team initiated the second transaction. We have thoroughly audited our systems and concluded that the servers were not compromised. However, the transaction was somehow signed with our private key.

Request for Assistance

We would like to propose that the Filecoin team discusses the possibility of a recovery mechanism to help us regain the funds. Ideally, we would like to request a reversal of the unauthorized transaction. One potential fix could involve soft-locking the recipient wallet that received the 60,000 FIL and exploring options to return the funds.

We understand that creating a recovery process for such incidents might be complex, but we believe it would be beneficial for the community to have a framework in place to handle situations like this in the future.

Next Steps

We would greatly appreciate the Filecoin community's input on possible solutions. If technical information is needed to investigate further, we are happy to invite colleagues from our team to join the discussion and provide detailed insights.

Thank you for your time and consideration. We hope to work together with the community to resolve this unfortunate situation.

[Shadealex]

Such a mechanism is badly needed.

[HumbleShark]

User funds security should be a priority in blockchain. If a mechanism for canceling unauthorized transactions and recovering funds is implemented, it will increase Filecoin's attractiveness. I strongly support this proposal!

[Pony-Zzz]

It is a good idea to block funds on the recipient's wallet. This approach will prevent losses early on and protect users' assets. This will help to make Filecoin safer for everyone.

[Bulbazavrenok]

Introducing a mechanism for blocking recipients for unauthorised transactions is a great idea. It would add a new level of protection and prevent the loss of large sums of money. I am glad that such issues are being raised for public discussion.

[IKu4er]

I support the creation of a FIP to address such issues. This mechanism will protect user funds. It is very important that the community adopts such measures as a standard.

[garveworm]

I am very glad that such cases are being discussed publicly, it will help the whole community. Transparency in such matters is essential to create effective solutions. I hope that this will be the beginning of work on improving the protection of all Filecoin users.

[ASGardian1311]

It is very important that this case is brought to the community for discussion. The more such incidents are discussed openly, the more chances to create a reliable security system for all Filecoin users. We need to develop new improvements and defence mechanisms.

[jennijuju]

As an implementer, I will not support an FIP to restore fund to a wallet that has lost fund due to key mismanagement, and lock an account b/c someone made a claim.

[Qowevisa]

As a system administrator, I can confirm that there was no key mismanagement. We thoroughly checked our servers, and no hacks took place. I have one simple question:
If this was indeed a case of "key mismanagement" and theft, why would a hacker leave us with 5000+ FIL still in the account? You can verify this: there was a 60000 FIL transfer immediately following a 1000 FIL transaction authorization, leaving us with 5000+ FIL on the account.
My guess is that some unrecognized bug occurred, but I can't prove it because Lotus does not log messages it creates. We did not anticipate a large transaction appearing randomly in the Lotus mempool.
Also, how are we expected to manage our keys effectively when the only reliable way to send FIL involves BLS wallets, which use 32-byte keys that are easily readable?

[Stebalien]

You can, in fact, use an HSM like a Ledger to manage your keys. Or, even better, an HSM plus a multisig. You can even implement your own multisig with spend limits, delays, etc.

BLS wallets are only required to sign blocks (worker keys).

why would a hacker leave us with 5000+ FIL still in the account?

Because:

1. 60k is a nice round number, and approximately what you had left, and easy to type while attempting to quickly drain your account.
2. If they over-shot, the message would have failed and they would have gotten nothing.

We thoroughly checked our servers, and no hacks took place.

You need to involve law enforcement, don't just "check your servers". Thefts like this are often rogue team members, fraud, etc.

[Stebalien]

To be clear, I'm sympathetic to your situation. But there's nothing the implementers can do to help you recover your funds. Even if we wrote the code, the network participants, exchanges, etc. would reject the changes on principle.

[pandacrypto]

@Qowevisa Have you consult with 3rd party security firm, to review and check this issue?

Whether it's Human factor, or bug, it would always have a trail that could be trace and find what's went wrong.

I also strongly disagree with your proposal on retrieval of so called stolen fund, this defeat the purpose of decentralised, immutable blockchain.

Also, it will open a floodgate and precedent in future for anyone to abuse this to retrieve their fund.

[AndruhaMan]

I support a mechanism for cancelling an unauthorised transaction and restoring funds is important for any blockchain. If Filecoin can implement such a feature, it will make it one of the most secure platforms on the market. This proposal definitely deserves attention and elaboration.

[ansermino]

This request negates many of the valuable properties of a decentralized network. As an ecosystem contributor, I do not support this.

I also question the legitimacy of most of the previous commenters here given:

• the short time frame they were posted
• circular relationship of followers/followees
• lack of GH activity
• similarity of the comments

[Stebalien]

Yeah, I noticed that as well...

[Shadealex]

A person raises the topic of protection against fraud. As I understand it does not really hope for a refund.

The protection mechanism will help all users of the network.
As I remember during the existence of the project filecoin several times on the slack described similar cases and always all stubbornly argued that the owner “lost” the keys.

In the comment above, the author of the discussion describes a very illogical situation with theft.
I can't even imagine that the fraudster left a “tip” of any amount.

By the way, a locking or double-checking transaction mechanic could help the STFIL command as well. As I read in Slack they also asked to block wallets to avoid third party actions.

This is of course just my opinion. But even a project like Chia thought about it.
Link https://docs.chia.net/guides/clawback-user-guide/
It is strange that filecoin did not make such mechanism or it is not made specially.

[Stebalien]

The right way to implement this is to use a smart contract wallet with spend limits, delays, multisig requirements, etc. That's what Chia is doing here.

The Filecoin account is equivalent to a basic Ethereum account: it can sign/send transactions, that's it.

[Stebalien]

Note: The objection here isn't to building a better wallet with a clawback mechanism, I agree that would be awesome. The objection the implementers are raising is to:

We would like to propose that the Filecoin team discusses the possibility of a recovery mechanism to help us regain the funds. Ideally, we would like to request a reversal of the unauthorized transaction. One potential fix could involve soft-locking the recipient wallet that received the 60,000 FIL and exploring options to return the funds.

Nobody has the authority to do anything like this unilaterally and, if anyone did, the system would no longer be decentralized.

1. No sane person wants that kind of authority/responsibility.
2. The network would never agree to granting anyone such authority anyways.

[MariaHerasimenko]

I hope your suggestion will resonate with the Filecoin team. The introduction of FIP or FRP can really make the blockchain more secure and resistant to fraudulent activities. This is an important topic to protect funds.

[KepAlex-404]

Revoking unauthorized transactions is an excellent idea. Such a mechanism will help strengthen trust in the Filecoin ecosystem

[Reiers]

As a technical support engineer at Curio Storage Inc. I’ve worked closely with Filecoin’s network and its users, and I’d like to voice my opposition to this idea. While the case is unfortunate, I believe that implementing a recovery mechanism for such events sets a dangerous precedent for the Filecoin network.