Avatar
<old>cypherhoodlum
e17273fbad387f52e0c8102dcfc8d8310e56afb8f4ac4e7653e58c8d5f8abf12
I try to avoid posting from this profile. npub1h00dlum44jnxdjeqms0d9s0l0n0lslv84mcw5420qpu277d8y4mqpv0cnf <-- my main profile

Who needs maps, all roads lead to the Romestr

At least when the user requests a note deletion they expect the note to be deleted from all of the relays it was published to. The deletion request should be sent to all of them anyway.

Dearest customer,

Lukewarm regards. Actually why don't you just let me just slap my big limp warm regard accross your stupid face you corporate drone of a droolface

*send to boss*

I believe it's the player furthest away from the base because they can throw the ball very far.

No worries, I'm glad you figured it out and didn't even lose any funds in the end. That's as close as it can get!

Not necessarily digital. You can be a "resident" in another country while not being a citizen of that country. This might give you some tax benefits depending on the country. Usually taxes are paid based on your residency. Only a handful of countries claim taxes based on your citizenship, the US being one of those. It means US citizens can get taxed by two countries at the same time if they live abroad. So called double taxation. The best deal might be to have your residency in a country where there's "territorial taxation".

Many countries have great tax policies for bitcoiner expats, for example UAE (Dubai), Malta, Paraguay, Portugal, Germany, Malaysia, Puerto Rico, Cayman Islands, Singapore, Belarus, Switzerland, Georgia.

The best combination of countries which works for you dependends on where you come from in the first place. But it's always better to "plant the flags" early, that's true for every expat. You don't need to have your bank account(s) in the country where you're a citizen. You don't need to live in the country where you're a resident, etc.

Wallet descriptors help with importing/exporting wallets. They basically tell the new wallet where the funds are and how to spend them. It's not trivial to figure out the addresses and derivation paths used by the old wallet when "migrating" to a new wallet, so descriptors help with that process.

The crafty part of the scam here was getting the victim to "reveal" the seed indirectly by asking for the wallet descriptor (machine readable instructions for the new wallet to spend the victim's funds).

Here's a bitcoin stackexchange thread about descriptors:

https://bitcoin.stackexchange.com/questions/99540/what-are-output-descriptors

Turns out he downloaded a scam wallet (sparrow mobile) while trying to set up a "watch only" wallet. It asked for the wallet descriptor which is essentially everything a new wallet needs to spend UTXO's from the old wallet. So it was not a "watch only" wallet at all.

A fairly advanced scam which relies on:

1) The user not knowing there is no Sparrow mobile wallet

2) The user not knowing what wallet descriptors are

Always verify your downloads. In this case the user could have noticed the scam by not finding the mobile release on Craig Raw's trusted release listings while trying to verify with PGP.

Wallet descriptors are used to import/export wallets by telling the new wallet how to spend from the old wallet, so that's exactly what a scammer would need to spend your UTXO's. The scam is telling the user you are setting up a "read only" wallet.

Replying to nobody

It was an imposter mobile version of Sparrow. All I did was try to set it up as a watch-only by sharing my wallet descriptor and somehow that was enough for someone to broadcast a transaction. But the transaction couldn’t fully fly because it was not signed by my actual device for some reason. At one point I got down to ten minutes to confirmation showing for the unauthorized TX, but the ten minutes came and went and the unauthorized TX didn’t get added to a block. If I had been using a software wallet instead of a fully air gapped security model, it would have been a different story. Talk about a lesson in online security. On the bright side, I inadvertently got to learn how RBF works in Sparrow, and now get to double down on security by severely minimizing my attack surface by staying away from mobile apps and, by the end of the week, even having sparrow on a segregated server on StartOS. I am hoping all of these lessons will one day allow me to assist others in their journey and help them confidently start their Bitcoin journey with confidence. I have a fairly technical background and was able to navigate this with a couple of Google searches, but I really wonder about mass adoption of safe self custody being within reach for people that haven’t put in the work. It’s just funny that I was just reaching the threshold for what I am willing to protect with a single seed when this all went down. I had already begun a second stack elsewhere with plans to keep my assets that exist in a single place sub 15M sats. After this incident I am thinking about backing that off to no more than 7M in a single location. This whole thing still has the hair standing on the back of my neck. I wish there were some way to trace the unauthorized address to a physical person.

Thanks for the follow-up. I've never seen that scam before personally. Another tip: Always verify your downloads with PGP. If you already have Sparrow on desktop (the only legit Sparrow wallet) then you know the trusted place where to get Craig Raw's PGP keys. All wallet releases are listed there. If it's not there, it's a scam.

True, but it's so easy to change pools I see no reason miners wouldn't do it in case of real manipulation attempts.