Tech
How the MIT Brothers Allegedly Scammed a Harmful But Accepted Ethereum Practice Out of $25 Million
They had everything planned.
In late 2022, the Peraire-Bueno brothers – twenty-something Massachusetts Institute of Technology graduates who had set their sights on blockchain – embarked on a venture that ultimately netted them $25 million, in one of the most sophisticated exploits of the last ten years or so. of frequent cryptographic exploits. Initially, according to the US Attorney’s Office, a four-phase plan was outlined.
First there was “The Bait.” Then there was “The Opening of the Block,” followed by “The Search,” and finally “The Propagation.”
“Over the next few months, the defendants followed each step as outlined in their exploit plan,” according to an accusation.
Their father is Jaime Peraire, former head of the aeronautics and astronautics department at MIT, CNBC reported it.
The exploit occurred thanks to a vulnerability that the brothers discovered in MEV-boost, a software used by about 90% of validators who manage the blockchain, allowing them to see block transactions before they are officially sent to validators.
MEV, or maximum extractable valueit is sometimes known as an “invisible tax” that validators and builders can collect from users by reordering or inserting transactions into a block before they are added to the blockchain.
The practice is sometimes compared to “frontrunning” in traditional stock markets, but due to the difficulty of completely eradicating it, the Ethereum community has more or less accepted the practice and simply tried to downplay the deleterious effects.
One such mitigation strategy is through the use of MEV-Boost, a software program used by approximately 90% of Ethereum validators. The idea is that all newcomers could earn MEV more equally.
This “this is just how it’s done” attitude was explicitly acknowledged by prosecutors in their charging document.
“Tampering with these well-established MEV-Boost propositions, relied upon by the vast majority of Ethereum users, threatens the stability and integrity of the Ethereum blockchain for all network participants,” according to the indictment.
On Ethereum, users submit transactions that are added to a “mempool,” an area where transactions are in a holding pattern.
MEV-boost allows “block builders” to assemble mempool transactions from the mempool and put them into blocks.
Then, MEV robots, or “researchers,” look at the mempool and evaluate which transactions could generate profitable trades, and sometimes bribe block builders to rearrange or insert certain transactions for extra profits. Ethereum validators then take those blocks from MEV. -empower them and ink them on the chain, where they become irreversible.
All these steps are usually performed automatically by the software in fractions of seconds.
What the Peraire-Bueno brothers did in this case was target three MEV robots that lacked certain controls and set up 16 validators designed to lure the robots.
When researchers group transactions together, they have a target transaction, a transaction signed before, and a transaction signed after.
“The rules of the game are: ‘Well, I give you this packet, and the packet has to run atomically,’ meaning it will only go forward if all three transactions are included in exactly this order, and whatever else beyond that, it’s not going to work,” Matt Cutler, CEO of Blocknative, a blockchain infrastructure company, told CoinDesk in an interview.
As the brothers created malicious validators, their intent was always to seize the opportunity to exploit bots that didn’t have those checks by segregating those transactions.
“Because the honeypot transactions were very profitable and the bots lacked controls to prevent certain conditions from occurring and fundamentally trusted the integrity of the validator and the MEV enhancement ecosystem, the malicious validator gained access to signed transactions that were protected and were then able to manipulate signed transactions to drain $25 million in funds from the robots,” Cutler said.
In its indictments, the government went to great lengths to demonstrate that the activities – targeting a crucial point of the blockchain’s inner workings, at a technical level even for experienced blockchain developers – diverged from community norms and fell into the realm of fraud. .
Specifically, the brothers were accused of sending a “fake signature” in place of a valid digital signature to a crucial player in the chain known as “relay.” A signature is required to reveal the contents of a proposed block of transactions, including all potential profits contained in the package.
“In this process, a relay acts similarly to an escrow account, temporarily holding otherwise private transaction data of the proposed block until the validator commits to publishing the block to the blockchain exactly as ordered,” they wrote the prosecutors. “The relay will not release transactions within the proposed block to the validator until the validator has confirmed via a digital signature that it will publish the proposed block, as structured by the builder, to the blockchain.”
Based on their research and planning, prosecutors said, the brothers “knew that the information contained in the false signature was designed to deceive Relay into prematurely releasing the entire contents of the proposed block to defendants, including private individuals.” transaction information,” according to the indictment.
As Cutler said, “Stealing is stealing, regardless of the terms that permit it.”
“Just because your car door is open, doesn’t mean it’s okay to get into your car, right?” He said.
Ethereum is often susceptible to some controversial MEV business practices, such as front-running and so-called sandwich attacks. But many prominent figures in the MEV ecosystem view last year’s exploit as pure theft.
Taylor Monahan, lead product manager at MetaMask, wrote on X that “Yes, if you steal and launder $25 million you should expect to go to prison for a long time lmfao.”
“It’s a bit like robbing thieves, you might say, but regardless it was clearly an exploit, a manipulation of the rules, in a way that appears to be in violation of the established laws of the jurisdiction, right,” Cutler said.
As if to underline the point, the government said that in the weeks following the exploit, Anton Peraire-Bueno “searched online for, among other things, ‘best crypto lawyers,’ ‘how long do we have statue? [sic] of Limitations”, “Wire Fraud Act/Wire Fraud Act”. [sic] of Restrictions,” “Fraudulent Ethereum Address Database,” and “Money Laundering Statue.” [sic] of limitations.””
The indictment also noted that the day after the exploit, James Peraire-Bueno sent an email to a bank representative requesting “a safe deposit box large enough to fit a laptop.”