Imagine if hospitals were filled with natural light, greenery and warm colors instead of the sterile, windowless and blue light polluted prisons they’ve become
Patients would heal much faster
My experience with the FBI: a wake-up call to public-facing crypto people.
“Hey, are you Alexandre Masmejean, CEO of Showtime Technologies, Inc? This is the FBI calling in from Los Angeles.”
Last week I had a very strange call that surprised me so much I didn’t know whether I was in trouble or speaking to a scammer. Turns out both of these predictions were wrong.
I was the target of Asian cybercriminals who got a malware running on my computer, I was told, and was strongly encouraged to turn off my WiFi, rotate my wallets, change all my passwords, move my files to a hard drive and entirely wipe out my compromised MacBook.
The two FBI agents on the line seemed serious, but I couldn’t tell if it was real intelligence officials or scammers pretending to “protect” me. Regardless, I immediately realized one mistake I had made that could potentially fit the bill:
Three weeks prior to this call, a Telegram user “Chao Deng” “@/chaodeng” claiming to be from the known fund Hashkey signaled interested in investing in Showtime. I somehow remembered that fund name and thought nothing more of it. Long story short, that impersonator refused to join my Google Meet and proposed me to chat via a VPN-friendly “alternative” video link, which contained a script that I ran, like an idiot, in an effort to not be late.
“That sounds like a typical attack”, the FBI admits as I recount the conversation. My trust in them grew. They asked to call me back with the Telegram handle of the attacker.
But my crypto friends were skeptical. “Dude, you’re getting scammed”. One of them, who was also backed by Paradigm before, told me to reach out to samczsun.
My chat with samczun was brief. If my so-called FBI agents only called me to tighten my security practices, it could never hurt, Sam said. After telling Sam the full story, they said “I could see it” and advised me to call back the FBI to confirm their legitimacy, which I did.
I called back the number who called me. The agents gave me their full name and phone, which was matching their caller ID. They told me to call the FBI LA office and check with them, saying I could even ask to be transferred right back to them if I asked. So I did.
I google’d “FBI Los Angeles” and call the number on there. I open with “two FBI agents just called me, is this real?”. Like me, the lady on the line was suspicious but asked for more details. She shortly matched my surprised mood. “Oh yes, they are working with us on cybersecurity investigations. The contact details are matching. You have indeed been dealing with us”. So I wasn’t credulous, and the Telegram hackers truly infected my computer.
That’s it. After a laptop hard-reset and passwords/keys rotation, I was safe again. Fortunately, most of my funds were in hardware wallets, and I lost nothing.
Unfortunately, I also warned by another technical figure in crypto that beyond money, I should assume all of my data has been compromised, which is how the FBI identified me. The agents say hackers may contact my family, colleagues and friends, and I should warn everyone, which is why I’m writing this post.
Takeaways:
- if you are guilty, the FBI shows up IRL. But if you are a target like I was, the FBI may call you. It’s not always a scam.
- Never install any software on your computer from someone you don’t know. I feel so dumb typing this.
- Hardware wallets are safe. My @Ledger likely saved my personal and company funds.
⚠️ May this be a wake-up call to audit and/or upgrade your opsec before the bull market comes.
The public may be safer soon with Account Abstraction smart protections, but crypto professionals still use Far West tools, have enough money to attract villains, and can see their opsecs quickly degrade if not rigorous.
Thank you to the FBI; @samczsun@snarkyzk@eddylazzarin for the quick help + @hosseeb for pushing me to write a post-mortem. Stay safe.
PS: the FBI advised me to share this.