Skip to content

Latest commit

 

History

History
94 lines (53 loc) · 26.3 KB

MEW-Rebranding.md

File metadata and controls

94 lines (53 loc) · 26.3 KB

🔷🔹🔷🔹🔷 The Brand Split of MyEtherWallet (MEW) 🔷🔹🔷🔹🔷

Investigation header image

Background

MyEtherWallet logo MyEtherWallet (MEW) is a "free, open-source, client-side interface for generating Ethereum wallets." MyEtherWallet LLC was founded by Kosala Hemachandra and Taylor Monahan in Los Angeles, California. The repository was opened on August 9th; the domain was registered on August 19th 2015.

Twitter gives its users the option to change their username (also known as a 'handle') without having to create a new account and lose existing followers. The reasons for changing handles are numerous, but from a business perspective this often coincides with the launch of a new product / service, or as a way of improving brand recognition. As a general rule, Twitter suggests that "you alert your followers before you change your username."

On December 23rd 2017, front-end developer Taylor Monahan (@tayvano_) published an article in CoinDesk about user experience issues in the blockchain ecosystem. She described MyEtherWallet as "the de-facto interface for interacting with the ethereum blockchain, especially when it comes to ethereum-based tokens."

Twitter Account Split

On February 6th 2018, Monahan changed the copyright attribution within the MIT license on a forked copy of MEW to include a new company called "MyCrypto." On February 8th 2018, Monahan changed the Twitter handle of the MEW account to "MyCrypto," causing the account to split into one with the new handle and one with the old handle. The old account was removed of its +70k followers and verified status. Because this was done without warning, the MEW account (reportedly still run by Hemachandra) was one of the first to tweet about the handle change. From his personal account, Hemachandra described the account split as "improper, perhaps unlawful," but upon being asked for further comment explained that he was "unable to make any comments without discussing this situation with my lawyers." When asked why he described it that way, Monahan responded, "I don't know. I don't know why other people do things. I'm sorry."

On February 9th, Hemachandra released a statement about the split on Reddit:

During the transition yesterday, however, MEW’s Twitter account was switched from @myetherwallet to @mycrypto, and tens of thousands of MEW followers were left scratching their heads. Indeed, the change was unexpected, and I’m still in the process of determining the justification behind the switch, and how this issue will be resolved. I don’t know what the fall out from this will be ultimately, but I will not be on the offensive or defensive discussing the circumstances surrounding our decision to separate beyond my statement here.

People from the Ethereum community, as well as the general cryptocurrency space, continued to tweet at all four accounts expressing confusion, disappointment, anger, and questions of whether they had been compromised. MyCrypto's first tweet instructed people to not "freak out" at the sudden and unannounced change, linking to the first of three blog posts. They later posted a "condensed version" of that blog post, PGP-signed by Monahan, along with a picture of her with MyCrypto logo stickers to show she had not been "kidnapped." Ethereum BLUE, an ERC20 token, claimed they had "confirmed that @mycrypto is run by the real @tayvano_ and @spencecoin" because "they reached out to us personally, and provided photo evidence."

Monahan also shared several paragraphs describing her "emotional attachments to the MEW brand."

I have treated the MEW Twitter as my personal Twitter since day one. As much as I tried to let my emotional attachments to the MEW brand go as we were working through this whole transition, I have had daily, personal conversations with people via MEW's Twitter. Everyone following @MyEtherWallet did so because of a tweet that I tweeted and/or security announcements about the wider crypto ecosystem.

I value the relationships and conversations and the trust that we have built and didn't want that to go into the unknown. Perhaps this is selfish. Selfishly, I didn't want to lose those relationships that I value and live to protect. I wanted to make sure that if there was a crazy hack somewhere in the ecosystem tomorrow, I could tweet about it to the people relying on us to tweet about it.

Was this the right decision? I still don't know. Things could be different and it could be worse and it could be better. Regardless, I didn't expect this and I'm sorry for the confusion that it caused. I'm really sorry.

Despite claiming that she "didn't expect this," she had previously tweeted, "So... my fears are coming true and I really don't like it." Note: For readability, this message has been slightly edited from the original form. She is also aware, due to a previous incident, that fake news of "rebranding" is an attack vector. Although there had indeed not been any clear public announcements about the upcoming split, on November 22nd 2017 Monahan had indicated that Hemachandra was no longer the lead developer of MEW.

Within two days after the split, Monahan and the MyCrypto team published three Medium articles in which they attempted to explain the account change and why the project had parted ways with Hemachandra:

In the first post, Monahan included edited screenshots of repository contributions on GitHub. By marking the number of commits that she and Hemachandra had made, she implied that he had not contributed as much to the project and his 'inactivity' justified the split.

GitHub commits calendar

However this may be a misrepresentation, because the number of commits is only one data point to consider. For example, when looking at the 'Contributors' page, one can also view the number of lines of code changed since the repository was created. Even though Monahan has made more than twice as many commits, she has only made addition changes to about 2%, and deletion changes to about 13%, more lines of code than Hemachandra.

GitHub commits calendar with 'lines of code changed' https://archive.is/3eO5y

Sometime around February 11th, Monahan joined the first half of "The Bitcoin Podcast #184" to talk about the circumstances of MyCrypto's launch. Before stating that she felt "forced into this leadership position," she defended the decision to not give advanced notice to followers / users about the change:

[23:20] One of the biggest questions that I'm seeing right now is, 'Why didn't you give us weeks and weeks of warnings?' Okay guys, sorry but... we've been dealing with these phishing attacks, these malicious attacks, these fake ICO addresses, for so long that I'm not going to extend the period of change-time.

With an ICO, this is what happens: you do marketing, you do marketing, you do marketing, you start the countdown clock. You do more marketing, you're tweeting "one day left guys, you ready?! You ready to invest, you ready to do this?" Then about twelve hours later, the phishers come in and start throwing addresses at people and all these naïve investors just throw the money right into the phisher's hands.

So there was no good way to do this. We're not going to pretend that this was flawlessly executed. But I will say that 'weeks and weeks' of announcements, or pre-announcements to the announcements... all it would have done is extend the period of confusion, let the phishers and the malicious players in this space get an even bigger toehold.

Despite the condemnation, several individuals vouched for Monahan and / or her new initiative, including Ethereum Foundation coordinator Hudson Jameson, Mist browser team lead Alex Van de Sande, Etherscan.io, Aragon Project tech lead Jorge Izquierdo, Boost VC founder Adam Draper and co-founder Brayton Williams, who indicated he would "continue supporting" Monahan's team. There are many indications that the San Mateo-based venture capital firm may have plans to invest in MyCrypto, after formerly investing in MEW during 2017 due to their interest in cryptocurrencies, Ethereum and initial coin offerings (ICOs); however, MyCrypto has not yet been listed as one of their "blockchain companies." Williams' bio on Twitter states that he is already an advisor for MyCrypto, though his bio on Medium still listed him as an advisor to MEW; he recently updated that to MyCrypto as well, and continues to publicly show interest in its progress.

Monahan and other MEW team members

Pictured: Daniel Ternyak, Jordan Spence, Taylor Monahan, and Kevin Monahan at Boost VC offices in 2017

Between February 13-14th, the MyCrypto team created a new account and returned the followers to MyEtherWallet. MEW was also re-verified by Twitter the next day. However the confusion between the handles remained until February 16th, as tweets made by the MEW account while it was under "MyCrypto" were not deleted immediately before or after the transition was reversed. At least one person claimed the account was returned after they reported it for impersonation. Ethereum developer Vlad Zamfir's response to the announcement was: "Wow this sucks!"

Meanwhile, Hemachandra said he was onboarding a new support team. On February 20th, Hemachandra posted a statement about the status of MEW, his new team, and how "sentiments of inequity" led to his split with Monahan.

MyEtherwallet remains an independent company. We have not disbanded or rebranded, and have no affiliation with MyCrypto. The truth is, more often than not, two-person business partnerships don’t last forever. This is particularly true in cases when one person starts to believe that one can succeed without the other or when sentiments of inequity begin to brood. This [is an] inconvenient and often painful truth, that I have been forced to come to terms with in recent weeks.

On February 23th, he launched a new team page and soon tweeted a group photo from his personal account.

In her MIT Bitcoin Expo keynote, Monahan described the split as "a little brand-fork."

On April 21st, The Merkle News published an interview with Hemachandra, where he acknowledged that there had been an ongoing legal dispute "since at least August 2017."

On April 29th, MyCrypto's chief marketing officer Jordan Spence told a concerned MEW user that Hemachandra "didn't want to do any work while the rest of us kept moving forward" and continues to market MyCrypto as an "alternative" to MEW, which Hemachandra has objected to.

We were all very confused when he came back on the DAY that we announced MyCrypto, and now is back working on MyEtherWallet. If he worked with us in the first place, none of this would have happened. But we're better off, MyCrypto is all around better.

Legal Dispute

Amidst the confusion with the MyCrypto and MyEtherWallet accounts, trader "Shane Corry" found a legal document provided by UniCourt which pertained to an ongoing dispute between Hemachandra and Monahan. Two more documents -- a 'Certificate of Cancellation' and a 'Certificate of Dissolution' -- showed that Monahan and another company member, Hubski (news aggregator) co-creator Mark Katakowski, had voted to shut down MyEtherWallet LLC on December 29th 2017 without any cooperation from Hemachandra. A few weeks earlier, she had registered "MyCrypto, Inc." as a Delaware corporation.

MyCrypto corporation info

In the first legal document, a "Petition for Writ of Mandate," Hemachandra alleges that he "asked Monahan to provide him with a copy of all of MEW's records and financial statements," but Monahan "failed to provide" them. On October 5th, William Yen of the Sapient Law Group (representing Hemachandra) emailed DeAnn Flores Chase of the Chase Law Group (representing Monahan) requesting "a time and place within the next two weeks for us to review MEW's books and records." Yen included his colleague C. Mina Kim, and Chase's administrative assistant Sally Stubbs, in the email. Kim sent a follow-up request on October 10th, urging Chase and Stubbs to inform "your client of her legal obligations to give our client access to the company accounts." On October 17th and November 14th, Kim sent two more requests and attached a membership interest purchase agreement, communicating that Hemachandra wanted to buy Monahan's share of MyEtherWallet LLC. After Monahan and/or her counsel failed to adequately respond, Hemachandra filed the petition in court and presented these emails as evidence, claiming that without being able to "know the status of MEW's operations and its finances," he cannot be "making any pertinent decision regarding MEW's future and his role in MEW, including prospects of dissolution of MEW." The petition was signed by Kim on December 13th 2017.

"Projects are projects until they are businesses."

While Monahan has not yet offered a defense for her failure to comply, one of the primary reasons that procurring financial documents for MEW might have been difficult is because the company did not have its own bank account until August 2017 due to a lack of up-to-date identification, nor a dedicated wallet for storing donation funds. On June 8th 2017, Monahan told an Ethereum investor on Reddit that she held "far more" than 100 ether. On June 17th 2017, Monahan told another user that she had "recently moved some of our donation funds to my Trezor for safe keeping."

DNS Hijack

On the evening of April 23rd 2018, the MEW account tweeted that the team was on a flight to the Blockchain Summit in Zug, Switzerland, though no one from the company was listed as a speaker for the event. Sometime between then and the afternoon of April 24th, MEW's website was subject to a DNS attack. Ethereum BLUE, now known as Blue Protocol, claimed that they had warned about DNS compromise for phishing purposes back in January, but it was disregarded as "a stupid lie" in a CoinTelegraph article. Jameson also accused them of "spreading lies about a rival to draw users." MEW issued a statement that Google's DNS registration servers had been compromised at 12PM UTC and that Cloudflare DNS servers should be used in the meantime. MyCrypto tweeted that they had not been compromised, as well as instructions to users about action they should / should not take if they were worried about their funds. Blue Protocol wrote a blog post summarising their experience and CoinTelegraph published an article that referenced the previous allegations, but neglected to acknowledge whether they had previously failed to verify the claims. Jameson countered that their claims from January remain "baseless" and Spence said, "It was all false." According to Kevin Beaumont, the attack also affected Amazon and the DNS traffic was redirected to a server in Russia.

On April 30th, Financial Magnates published an interview with Hemachandra about the attack. He claimed that because users were warned in the interface that the certificate was invalid, MEW is not to blame and there are "not any plans to reimburse users whose funds were stolen" at this time.