Binance-hacker-1029 – $5.6B stolen from Binance
arkm.com
arkm.com
- 971.15M USDT (Ethereum): https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba091...
- 823M USDC (Ethereum): https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a9...
- 312.73M USDT (Tron): https://tronscan.org/#/transaction/71b0ec0fe873fe820c37cc3ec...
- 175M USDT (Ethereum): https://etherscan.io/tx/0x0c07a5e428ce233a3bcb40f257ad899594...
How does freezing crypto work in this context?
https://medium.com/chainargos/losing-the-blacklisting-race-e...
https://finance.yahoo.com/markets/crypto/articles/stablecoin... (I didn't verify per-stablecoin volume, or actual volume at those hours, or typical volume for those exact hours, which a better analysis would have done.)
If they can mint with no impact doesn’t that mean they can just print money?
And yes they can print money, you have to trust their reserves that are off chain.
They have been caught cheating before, their numbers are astronomical, and no crypto numbers are actually verified and regulated.
It's remarkable to me how long this scam has lasted and how much confidence people have in it, in spite of the very shady characters involved and the likelihood of fraud.
These stablecoins are just a database owned by untrustworthy people and backed by nothing but their promises, they're just one step up from NFTs.
However, the stablecoins are not “real” cryptocurrencies like e.g. BTC or ETH, but are built as smartcontracts on top of ETH, basically using it as a big replicated database. So they might(?) just manually “give back” the money to Binance, as in freezing money in the stolen account forever and “printing” an equal amount to Binance's credit.
Or, to put it in another way, no need to reverse an erroneous SQL transaction if you can just create a new one that fixes the data you altered.
Keys? Hahaha, still not your crypto.
If you ban a coin, instead of persuing the actual criminal, then you're both doing a disservice to honest users of the coin and leaving the bad actor to do harm to society in some other way.
There are only 8B people in the world - they all fit into a "box" of 2k by 2k by 2k of humans.
It really isn't that hard to know who's doing bad things to others, especially with current technology.
Criminals used to meet in person to discuss crime (because mail/phones can be intercepted) and meet in person to move cash. It was a hard limiting factor on what they can get away with. With e2e messengers and anonymous crypto both of those "issues" are fixed.
Do you know anyone who uses it for legit purposes? I don't. I bet you ban a coin like that and you kill orders of magnitude more crime revenue compared to .001% of honest users using it to send money home and save a few dollars on the transaction.
It is an evolutionary process, with incentives are high enough for both sides to keep finding solutions.
But there is still a distinction between monero being banned and the government saying “we don’t believe you can fulfill kyc obligations”. There is a legitimate argument that yes they could that could be made in court, depending on the implementation.
Smart contracts and stablecoins by extention sound technologically interesting, but at the end you always rely on trusting people.
The core of the financial system is about managing trust and therefore a social issue, not a tech issue. It'd be nice if more tech nerds would internalize that tech can't solve social issues on it's own
In the freebanking era that the US had (before the FED was founded) every bank emmitet their own dollar. And, of course, there were banks over-issuing and bank runs left people without their assets. But that was before we had free flow of information and the internet. In todays world you can monitor and trade stablecoins, market cap, exchange rates in a freebanking system in sub-seconds. Any erosion in trust will immediately result in price fluctuations. We need a digital freebanking era, and it is a shame the genius act fell through. Exporting the dollar to people without access to banking would benefit the US (but I get that it currently mostly benefits trumps family).
But: Are you sure that Tether is actually backed by USD? It certainly isn't free information.
But it is in the nature of stablecoins that you cannot check their vault. You have no idea if they actually store the assets they claim to store. And whether they will honor their promise to exchange that asset for their tokens.
I don't think you're using that term right. Not knowing how something works doesn't mean you're cargo culting.
People are not so knowledgeable about the other coins because the whole point of magic internet money is that it can't be controlled by anyone. If your entire account exists in some box somewhere under the control of some entity, how is that any different from a bank (which also mostly doesn't operate on cash but just moves bytes around)?
Your problem is treating it as magic internet money. It is not - you literally have the sourcecode to truly assess how it works. Your account is not with some entity. Magic internet money is your bank account - if your bank decides to set it to 0 tomorrow it is "magic" - you have no idea how that happens, and you have no guarantee that it doesn't happen. Or when your credit card is suddenly blocked because your bank decides is "suspicious activity" - again, that is black magic.
Bitcoin is the opposite of magic internet money. It is deterministic to its core. As for other cryptocurrencies - well they are mostly open source so you can check them.
oh, and three acounts hold like 25% of all btc in circulation.
crypto can do some things, but decentralization isn't one of them. just ask Coinbase
USD tether is barely crypto at all, it's a wrapper around treasury bonds which the US govt. regulates
That's probably socially harmful, but it is the claim.
The latter is volatility.
Apples and oranges.
Resources like gold, land, or bitcoin, if broadly used, is deflationary as the economy grows, even from simple issues like population growth. All else being equal, if I save $100 today, and the economy triples, it's worth $300, since I have the same piece of a bigger pie.
Am I missing something here? Seems like a waste of time
It seems like it took some number of minutes and scored billions, and at that point it was a matter of whether/how much they could trade out before it was locked. I don’t know how many minutes or hours it took to lock? If they managed to trade 1% before blocking, that would be an extra tens of millions. If 10% that would be hundreds of millions, etc.
I wonder why not swap them? And had he, would it have bricked the swap pool?
Have bad security, get hacked.
If binance wanted to hedge against that risk, they could have bought a cyberinsurance policy (if they could get one for the amounts they'd need).
That's exactly the scenario they say they would never do and go as far as to have external audits to prove that they're not just "printing" free cash
The alternative is the stablecoin providers effectively keep the money for themselves. At that point the justification for the blacklisting seems like little more than self enrichment?
There are reports that the hackers used the stablecoins as collateral to borrow ETH via DeFi, before the stablecoins were frozen
In this case, the hackers have the ETH, while the lender has some frozen stablecoins
Given this context I said that if they print some more stablecoins to make whole both the DeFi lender and Binance, it's a betrayal of their other customers
Why not let Binance "get screwed"? How is the lender more "at fault" in your view?
Sounds fair to you?
What kind of backwards Robinhood steal-from-people-to-give-to-Binance are you?
Oh absolutely agree - they cannot make both parties whole and I do not know which, if either, they are likely to do.
So USDT is not truly decentralized and your money can be frozen for any reason or no reason at all.
It applies equally well to a fiduciary coin with a promise that 1 gcoin = 1g of gold or whatever.
However, it does not necessarily apply to algorithmic stable coins (Terra) or crypto-backed overcollateralised coins (DAI). That's why I said "fiat-backed".
Deposits at a regular bank aren't backed by fiat. The bank promises to pay you back in fiat, but they don't keep dollar bills in a vault. The promise is backed with all the bank's assets. Ideally, they have a think equity cushion, so that even if the assets take a hit, the promises don't.
You don't need to see where the coins are and move to promise $1 of going for every coin.
How are you bootstrapping a network to validate private transactions without the promise of potential gains in coin value as its popularity takes off?
I can run an exact copy of the bitcoin code in a fork with a new genesis block, and no one would give me even an apple for all my eru-coins.
One that you freshly mined seems fairly pristine.
On a tangent:
Funnily the Algerian law they quote would not actually apply to bitcoin (but I doubt Algerian judges would see it that way):
> Art. 117. — The purchase, sale, use, and holding of so-called virtual currency is prohibited. Virtual currency is that used by internet users via the web.
Bitcoins have their own protocol independent of the world wide web.
> It is characterized by the absence of physical support such as coins, notes, payments by cheque or credit card.
People have made physical bitcoin coins, and there's plenty of payment cards etc floating around that you can use with bitcoins.
Compare with eg the Brazilian Plano Real which was sort of a virtual currency for quite a while, but I doubt the Algerian law was meant to outlaw that one.
Perhaps I am missing your argument.
not your keys not your bitcoin
As soon as I start to look for information, I will be drowned in automated criminal attacks trying to trick me into create a vulnerability in my setup process.
Imho Bitcoins being stolen is not at all Bitcoin being "bent, broken, or subverted", it's just a natural consequence of the design goals. If an unrelated third party could block my bitcoins by accusing me of terrorism that would be subverting the system, and such things have not happened to bitcoin-core (but have happened in other parts of the bitcoin ecosystem)
The issue that is often raised with Bitcoins and other cryptocurrencies is that not even the law can help you in case of theft. Now, it's true that the police wouldn't bother helping me recover a wallet with 100€ into it, but things change if someone steals millions or even billions like in this case.
I find something odd about this, because it seems to contradict some of what I understand of the arguments for bitcoin.
However, there is merit to your point, and if something is working as intended, then nothing was attacked in the first place.
There is a reason the IRS has not put up a million dollar bounty about BTC tracing but XMR and all darknets use it.
For the less economical-savvy ones it was like Beanie Babies or Tulips (with predictable consequences)
The predictable outcome is that the deers get to them, but I got to see a few go into full bloom last year and it was wonderful.
If the police retrieves your money from the thief?
If it's stolen from a bank, it's their obligation to recuperate you.
FWIW, most countries have a type of insurance if a legally operating bank goes under, at least some of your savings are protected (eg. in Serbia that's up to 50kEUR).
Why? BTC is pretty stable longterm and nobody is going to touch your cold wallet. Anything that has an owner or legal entity is not decentralized, subject to either rug pull or censorship and shouldn't be touched, sounds very easy.
Everything that promises you any return is a scam in crypto, simple as that.
- much more awkward to use
- more liable to hacks
- deposits are not insured
- fewer legal protections
- doesn’t pay interest (or not easily anyway)
- and as I find out, bannable by a central institution with lower legal oversight than the Fed
I’ll keep a mental note of this.
What will they do when the alternative is broken bones?
> almost-unregulated except when the authority say no.
No, their entire business model relies on bank/CC providers don't ban them. Somehow, they treat all crypto related transactions as iffy but USDT, bought to buy crypto, got under much less scrutiny. The entire problem their solver was that new users couldn't move cash to exchanges fast enough to join bull runs.
Turns out, Coinbase "Wallet" is a completely separate thing from Coinbase, and long story short, ultimately ended up accidentally converting some spare ETH I transfered into some kind of garbage Binance "wrapped" Litecoin. Which had zero indication/warnings in the app other than a like 4 pixel Binance logo superimposed on the 16 pixel Litecoin logo that it wasn't the real thing.
Once I gave up on this Wallet experiment I ended up needing Gemini to walk me through all the Binance "gas" nonsense to finally manage to swap into a real coin I could transfer out (like 80% of what I started with after subtracting gas fees and miscellaneous leftover change I was stuck with). And while transferring I had to avoid like a dozen alternative networks consisting of seemingly random strings and a scary red banner saying "yo don't fuck this up".
My first red flag should have been that Coinbase Wallet's Play Store name literally advertised betting on prediction apps. Second red flag was while looking for "Litecoin" in the list of coins, there were literally about 5000 different spam/meme coins with dozens of near identical clones that were all name squatting on top of each other.
As someone who came of age in the Crypto 1.0 "Bitcoin is for buying drugs" era the entire exercise was utterly baffling and somehow significantly less usable than crypto was a decade ago for actual payments. I guess for a young person looking to illegally gamble their paychecks at some unlicensed offshore prediction market it provides some utility I'm missing but man, the experience just made the post-Web 3.0 crypto scene look .... grim.
I've heard good things about monero from a friend. This is not an attack on monero, rather a reflection on the general tone of the message.
Monero is so obscure the IRS has put out a million dollar bounty to trace it, unlike any other crypto even btc lol
Monero is, time of writing, #12 on the coinmarketcap leaderboard [0] and less than 1% of the crypto space by market cap. It's hard to complain about that being called obscure; anyone who gets a feel for crypto by looking at a top 10 coins list isn't going to see it.
Although it is a technological miracle. That coin specifically might do poorly in the long term so I'm not about to call it an investment, but I think it's quite possible that Monero holds a probable entry in the history books in 150 years time.
As opposed to junk like this: https://www.reddit.com/r/Gold/comments/1xab90c/first_gold_ba...
When the canada mint does a movie tie-in, they do it better: https://cdncoin.com/collections/rcm-new-arrivals/products/20...
It's much less easy to convert it to something you can actually spend. Even if you can get it to a buyer, they'll always offer you less than you expect/want.
Reputable dealers have KYC reporting duties of their own. Disreputable dealers... may have other ideas.
Gold sells at about 1% less than the current market price of the gold content of your item which I find fair. It might be easier here in Antwerp than in other places to deal with gold because it's kind of a gold trading hub. You can basically show unannounced (I suggest going by bike rather than by car because there is little street parking) and trade your gold for cash at the -1% rate, obviously if you get to the million euros range it's going to be a bit different, but for a few tens of thousands it's business as usual. And it's not like it's a difficult place to reach from anywhere else in the EU.
One of the only surviving darknet markets only takes Monero as currency.
Make of that information what you will
You'll still get a 1099 with zero capital gains for it.
Sorry, but I'm not much informed about cryptocurrencies. How does one get USDC from Monero? Through some other exchange acceping both?
It's not and never supposed to be and everybody who uses it in any significant amount knows that. Don't mistake a cryptotoken with a cryptocurrency.
Then people get into shitty casino tokens that are widely available because the state doesn't care about a little gambling and got surprised that they are in the casino in the first place.
This is but one model developed within academia for an entirely anarchist organisation, there are dozens of others and they have been both studied for efficacy (they tend to work better than a more hierarchical structure), as well as put into practice in real life within certain organisations. To this date there are a number of non-profit organisations and coöperatives that use this governance system to improve the situation where they are locally and achieve their goals — whether that's "everyone working to improve the local community" or "make good products for a client".
The entire point of anarchism is that there isn't One Big Guy, it's that it's people, deciding on a system and working together on a small scale — this then translates to the big scale through cross-group meetings, information sharing, and resource sharing. There is a lot of evidence within the social sciences to back these methodologies up as being very efficacious compared to traditional methods of group organisation, as well as being more democratic than traditional alternatives.
This additionally tends to be how some kinds of open mic nights work, as well as some kinds of modern speakeasys.
It’s a bit antithetical to anarchy to start defining true and untrue configurations. It’s more accurate to say that while anarchy permits chaos, it also permits self-organization, one mode of which is hierarchy-free community governance. Most of us have experienced this among friends when e.g. deciding where to go to dinner.
Peaceful anarchy evaporates when bad actors arrive. I wish it wasn't so. A structured civil society is the nearest we've managed to get to being able to live in relative freedom almost all of the time. It's the least violent, least coerced option we've been able to find.
The other way would be to go live in a group by yourselves off the grid, and as long as every one of you is good and decent that will be fine, but the moment one of you goes bad, you either have to choose violence or they will do whatever they want to you.
Not going to school GP (presumably not one of the hill peoples[1] for which self-defense is mother nature)... ?
Actshually, Jura Federation dissolved
(Not too sure about bad actors in or around it)
[1]https://www.elliptic.co/insights/myanmar-earthquake-how-a-re...
Can you source these claims?
Civil society only seems to be getting LESS free and MORE violent all of the time. And in America, I constantly have to protect myself against enemies be it scammers or the thug who tried to mug me for my wallet.
This is much less frequent than the violent-death rates of pre-civilization groups of humans.
It is politically impossible to go back on KYC/AML measures in the traditional financial system, even if some of them were perhaps a bit too ill-advised. It's much easier to say "this is shiny new tech, very different from that old tech over there; we support innovation so we won't impose KYC requirements on it", even if there's no logical reason to do that.
As it stands, stablecoins let you make a keypair in the privacy of your own home (or your own agent sandbox, as it were) and immediately start transacting. They're allowed-by-default instead of blocked-by-default, with the US government still able to block you if they have a specific reason. No traditional bank I know of, in any country, works like this. This is a valuable capability to have, technologically, even if there's no technical reason why a Postgres database and a REST API couldn't provide the same service, but faster and more easily.
It’s politically irrelevant more than impossible. Most Americans simple aren’t visibly encumbered by KYC/AML enough to make it a priority.
> They're allowed-by-default instead of blocked-by-default
So were banks in the wildcat era.
But I also appreciate that bankers should be liable for supporting terrorists and criminals so I live with it
It’s way easier to take a company to court than any government entity.
If a bank collapses, you get your money back from the Fed, no questions asked.
Sure, you _can_ still sue them anyway and maybe get around the T&C, but you can sue the government to, the important question is if you can actually win.
https://dailycoin.com/sbf-tether-deltec-secretly-colluding/
Also, it's not decentralised, they just unilaterally froze 2 billion in funds.
Over time I believe it's founders did start backing it with Treasuries so now it must turn a nice profit for them.
Decentralized cryptocurrency is an ideal from early 2008's from the Bitcoin supporters. It's not the reality of cryptocurrency in general.
Cryptocurrencies are full of contraditory ideas between the founding ideology and the actual usage.
Managing a wallet where there is no recourse if your wallet is compromised is simply too difficult when even crypto exchanges get hacked and otherwise sophisticated people get compromised when taking cautious measures (eg [1]).
Crypto really is and always was a race to the rug pull.
[1]: https://www.straitstimes.com/singapore/about-3-5-million-los...
This by itself is a reason to push for more crypto acceptance, in my eyes.
It's invisible, insidious censorship. They don't hit your hands with a ruler and say "stop, no buying that, bad". They make it so that what they don't like doesn't get to be on the store shelves in the first place. Hard to buy what isn't being sold, isn't it?
As for why they do it - it's unclear, but there's speculation that payment processor leadership might be in part ideologically captured by the usual "think of the children" moralizers and puritans. The same types that used to spurn moral panics, rally against D&D and later GTA, and are the first in line to propose sacrificing freedoms for imaginary safety - now allowed to wield covert influence over most of the payments that happen online.
Even if the absolute number of chargebacks is small, in relative terms it’s still several times larger than it is for non-“adult” charges, and that kinda destroys profit margins — more support calls, more work, etc.
Or so they say.
I’m not in the industry, so I don’t know. I can certainly believe that many of the oligarchs in charge are weird shitheads with bizarro conservative views, but payment processor leadership doesn’t seem to give a fuck about morals in any other manner, so it’s also kind of weird to me that they’d pick porn and porn only (a seemingly passé target for most conservatives these days) as the one and only target of a uh, decades-long distributed lowkey conspiracy that spans multiple generations of payment processor leadership. ¯\_(ツ)_/¯
> It’s invisible, insidious censorship
Plus, freezing funds and waiting for US law enforcement to weigh in rather than being the proverbial judge, jury and executioner is now likely to keep you on the right side of said law enforcement.
I assume they call a method on the contract to freeze the coins (with some superuser kind of signature), so they could easily write a method that moves the coins back, too. This should be similar in terms of gas costs.
The law enforcement theory seems more likely, yeah.
No matter what the reason or the situation, shutting off your access to the technology is their option and it will likely happen at the moment it is a greatest problem to you.
This goes so far beyond "Not your keys, not your coin", it is "Not your stack, not your sovereignty".
Obviously in this case, there is are truly solid rational and moral reasons to shut down those USDT transfers: to cut off the theft which is funding NK's aggressive nuclear weapons program. But that changes nothing about the structure of everyone's vulnerability in using technologies controlled by others such as USDT.
[0] https://newrepublic.com/post/217349/elon-musk-cut-off-ukrain...
How so?
Mostly you just a couple dozen bank / Venmo / etc accounts in different names, so when one gets blocked you don’t lose all your money. You can also open a bank card in a more lax jurisdiction and accept transfers there instead (so e.g. a user in the EU can send euros to their “friend” in Kazakhstan using Visa Direct -- good luck regulating that).
And it all exists today, on razor-thin margins somehow! I’m sure there’s a lot more shenanigans under the hood.
Most countries with unstable currencies either have strict currency controls, fixed exchange rates, or rampant corruption, so using USD through an established local bank is either not an option or obscenely overpriced.
> Like certain countries just use physical USD.
Yeah, that's nearly always going to be a better option than using a stablecoin, unless US currency is unavailable/illegal, or if you need to transfer money long distances (like with remittances).
But remittances are a huge industry [0] and the traditional providers charge significant markups, so stablecoins are pretty valuable for that alone.
[0]: https://en.wikipedia.org/wiki/List_of_countries_by_remittanc...
You take 1 $ from someone and give them a token, now you have money the other not. In theory you need to make sure you keep the 1$ but you want to pay people and you are greedy so you invest it and suddenly everyone is broke.
The only difference is regulations -- banks have them; things labelled crypto don't (in the US).
And its a second layer: fractional deposit ONTO fractional deposit.
No. You just can't use these platforms. But a knowledgeable hacker will be able to add a transaction tot he blockchain.
Bitcoin isn't a store of value (its too volatile), it isn't a currency (too slow and expensive for small transactions), and it isn't even a product in its own right.
If you don’t like it or think it’s too slow doesn’t change these facts.
I agree that it’s not a product though. It is a distributed system that nobody owns.
And yes you can functionally make transactions, but based on current transaction fees it looks like I'd pay $0.22 in fees so I could wait 10-20 minutes for a transaction to likely clear. I'm not doing that at a gas pump, grocery store, etc.
Otherwise I just use the dollar bill as the store of value
Its almost a given that the value you pull out won't be what you put in, likely not close, its either much higher or much lower and that changes frequently over time.
One definite use of bitcoin is to transfer moneys all over the place.
Watching crypto rediscover 100yr of financial regulation and system/process design has never not been amusing to me, esp as someone who works in an asset that has solved the custodianship problem (not that people in the industry aren’t actively attempting to light those safety rails on fire to make a few extra bucks).
Nope, using money for everyday purchases is not kewl enough for the bored apes.
now: "big business and central finance are the reason digital money sucks"
He got tried and jailed for a long time for fraud.
Mt. Gox was just incompetence, like Binance here. But then on the other hand Binance is making so much money that to them $3.5 billion to cover the losses is just a slap on the wrist.
I agree it's a grave fuckup but its a common one. You should just assume that when you deposit coins somewhere there are dozens of people who could just walk off with everything on their own. It's remarkable that it doesn't happen more often.
But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".
A good solution to this is to have a "break glass" system. Ie. access permissions get granted to the developer directly in an emergency by going through a set of steps available beforehand. All requests by that developer are then allowed, limited to 10 kilobytes of results per minute and logged.
For example, imagine you run a bank, and a rare code bug means that at exactly midnight on new years eve all bank balances have $1B added to them.
Your oncall takes down the production servers to to reduce losses and uses the break glass system, by getting approval from n other developers, allowing them direct database access. They use that access to count(accounts) with a balance around $1B or more, see it is everyone, and subtract $1B from them all, before bringing production back up with an older software release. Downtime = 2 hours.
In the morning, all the developers actions are reviewed.
If the developer turned evil and trying to dump the database, the n approvers and 10 kilobytes per minute would reduce data loss. But the break glass system still lets the developer make fairly major emergency fixes to reduce losses or downtime.
The problems can be overcome, but management types may balk at the cost of a complete break glass system.
For example at most good crypto companies that hold wallets it's not possible to ssh at all, even if someone asked and go permission. It just simply isn't possible short of having a AWS root key or physical access to a computer in a DC.
There is no login, no accounts, no ssh keys or similar, they are immutable containers running from images with a signed SHA. The SHA can only be built by a build system that has it's own set of strict security controls.
Without details, I don't know why a comproised laptop would make any difference unless it submitted code through a PR and had it approved by multiple people.
I cannot look at how these companies are run with anything but derision. It’s institutional laziness, and it’s sloppy.
In my thinking, this is more secure than plaintext in filesystem
you know most tools like gcloud, bitwarden, etc store auth keys just in dotfiles too?
Local compromise is KO now, and we can't do shit on platforms like MacOs didn't research Linux recently
This is a one-sentence horror story. I almost can't believe someone would let this happen, unless the 1Password account is not important (highly unlikely).
Blaming this on the user is a bit like blaming someone for doing their banking on their regular day to day computer instead of an air gapped machine.
The nice thing is that using the private key requires physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.
Yeah (not talking about crypto): yubikeys (or similar) are really sweet for that. I've use them for ssh / pushing / fetching from Git etc. I use them for 2FA to various services etc.
There are also similar devices where you enter a PIN and the PIN to register to a service the first time and then the PIN to auth are different. So you can't be tricked by mistake to register to a new service when you just want to auth (you could still be tricked to register to a service which ain't the one you think while registering, but never while auth'ing).
And yup I use that with AI all the time: my agents go inside a container or inside a VM (or both), and the damage it can do is very limited.
It's also possible to do passthrough of devices (GPU, USB, ...) to VMs: good stuff.
Binance/Coinbase use hot wallets, they are not stolen from actual user accounts.
https://news.ycombinator.com/item?id=7203051
Probably this draws the line to more traditional banks which are notorious for having so many layers of checks and firewalls.
Any withdrawal should only ever be authorized from wallets protected by multisig and every withdrawal should go through several machines, running different implementations of the exchanges' verification part of the codebase, replaying the user's entire deposit/trading/withdrawal history and verifying if the withdrawal the user's asking matches his balance/history.
Devs working on "verification before withdrawal" on one of the stack should be forbidden from ever touching the other stack, and vice-versa.
This would prevent SNAFUs like this one for now at least two devs would need to be independently owned before such a heist could be pulled off.
I'm not saying hacks would be impossible. But the "I still $6 bn in 20 minutes" would be much harder to pull.
Another sensible thing to do would be to not have $6 bn on a warm wallet: I really don't think Binance really that much at all times available on warm wallets?
Nothing is 100% secure: but the "one dev gets its laptop owned, hence $6 bn disappear" is just madness and, as a whole (not speaking about crypto here), we can really do better here.
For a start we can do better than thinking: "Nothing can ever be 100% secure, so there's no way to do better than seeing $6 bn vaporize in thin air when a single dev's laptop gets pwned" (I'm know it's not what you're saying: you're asking what can be done better).
So many are going to think: "But if you do that, it still can be hacked because this and that". Which ain't the point: the point is to make hacks harder to pull off, not to make them impossible to pull off.
If your Bitcoin is on someone else's computer, it is not your Bitcoin.
Are you suggesting that this is not a big deal? $6B feels like a lot but sounds like in the scheme of things it isn’t as a fraction of trading volume. Is that right?
Any company losing 10 months of revenue overnight is a BIG fucking deal. Doubly so in a speculative asset that you’re holding for others “securely”. The financial hit has only just begun for them.
That said yes the trading volume has huge.
Binance is the largest custodian/exchange out there.
As of now, DebugBear webite has been taken offline: https://www.debugbear.com/
And they just posted on Twitter: https://x.com/DebugBear/status/2115930681398239278
There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.
during Mt. Gox it felt like nerds and insiders, nowadays boomer dads are into crypto.
my point being that i don't agree with "the remaining people are naturally more risk tolerant", as there are way more 'new' people.
Turns out there was decent money to be made in having your MtGox Bitcoin stolen.
Only paid 800€ for the 3 bitcoin, which was significant but not necessarily essential.
I'm glad the people were made whole to some degree!
They closed registration for the proceedings many times. Which means they also re-opened it multiple times.
I'd expect the registration is permanently closed, but worth checking out.
Keep the seed phrase safe. Use actual dice to generate it. Put a chunk of it into your wallet, a chunk into your password manager, a chunk in your attic or in a book, etc. Never type it into an internet connected computer.
Oh and, never tell anyone about how much crypto you have.
This is reasonably safe, and reasonably within the capabilities of a non cryptography nerd.
Maybe the sim card is on a timer to broadcast your keys after a year, so you just can't detect cellular signal usage now.
To securely own bitcoin you have to first create a new chip fabrication plant to then make your own hardware wallet.
The idea that someone would have to buy a hardware wallet to be safe, but first audit the hardware and software is both a but ridiculous and infeasible. Unless one can actually inspect the code running on the device, auditing am open source library online doesn't tell you what is running on your device.
I no longer dunk on crypto.
Not because crypto got better, but because the joke got old. I got tired of dunking on it.
A bank API can be 10-100s+ kloc if they need that to implement access controls.
Of course, Tether runs completely counter to any of the idealistic claims about crypto.
Binance's reputation is hardly impeccable, but by crypto standards they're kinda sorta the adults in the room. Then again, so was FTX.
But I guess what you are trying to say, is that with current valuations, Mt Gox would've upped their game and would've moved to much more secure architecture and infra.
If so: I doubt it. At the time of the heist, they were still running largely from a PHP monstrosity, that was originally built to trade cards amongst hobbyists. The only thing one could say for the Mt Gox people (Mark Karpelès etc) is that at that time, things moved extremely fast. Tech and infra may be good to trade tens of thousands of $/year one day. But if weeks later you are now trading millions $/year, there's no catching up. In hindsight they should've realized their organization and tech wasn't up to it and should've closed down. Because keeping up was clearly impossible.
*disclaimer: I lost significant amounts at the heist, eventhough I never held more than strictly needed on an exchange.
Seriously, often many members of an engineering team have the ability to move billions of dollars in value solo.
Negligence is absolutely the default.
Most things in crypto aren't ever tested because the big players know they'd all lose if the faults were exploited.
Any organization putting billions of value in the control of any single individual or computer should be treated as though they were caught trying to donate to North Korea with plausible deniability.
The point of a cold wallet is to keep the private key physically offline. That way you know it cannot be stolen by electronic means, because the physical device containing the key needed to authorize transactions is locked up and not powered on. Then you only power it on during very specific, audited times and conditions when it's needed to fund the hot wallet, which does all the actual automated trading and transfers.
GP's point is to have all incoming transactions to an exchange go to a cold wallet, which becomes a one-way sink, and then periodically the exchange powers up the cold wallet to sign transactions transferring assets to the hot wallet, which then funds all outgoing transactions. This isn't a bad architecture, though I'm not sure it'd save all that much here.
Then when things calm down you go and find ... the keys under the birdbath are lost, and you're fucked in a different way.
But at least it might work.
You can't "move money into an offline crypto wallet that is not online at all."
If "money" i.e. crypto "currency" is in a crypto "wallet" then it is online. Anyone with the key and an Internet connection can transfer it at any time.
The wording is confusing because to someone who doesn't know how cryptocurrencies work it sounds like you can simply "take the crypto offline and put it into a physical device" as if it was a file. But that's not how it works. The physical key merely contains the actual key for the always-online wallet.
Only spending from that wallet needs online access to private key - depositing to it does not.
think of it this way - if someone steals your iphone, and you lock it, does apple pop? No, apple sells you another one. locked devices are good for apple because it causes more demand.
So mechanically Tether pockets the difference, unless they unfreeze. But as a matter of accounting, because of the unfreeze capability, the liabilities of the frozen Tether stay on the books. So they can't just spend the money. It also makes it hard for Tether to compensate the victims from the frozen funds.
The alternative would be to let Tether burn funds, but that is highly problematic for well intentioned users. Because a freeze can be challenged in court and reversed. A burn cannot.
https://tether.io/news/tether-completes-the-largest-inaugura...
CZ from Binance was also done for… fraud but miraculously pardoned by Donald Trump (I wonder why?!) and somehow still has enormous influence and inside knowledge in spite being banned from managing Binance. He talks as if he runs the company. Hmmm.
https://ag.ny.gov/press-release/2021/attorney-general-james-...
This is literally what the attestations and audits are for. BDO and KPMG both have issued opinions saying yes, they do have all the money they claim to have.
https://www.frc.org.uk/news-and-events/news/2022/05/sanction...
https://www.bbc.co.uk/news/articles/c8znzxe5ewxo
And this BDO?
https://www.frc.org.uk/news-and-events/news/2025/11/frc-impo...
This sort of audit is pay to play and the customer has a heavy influence. I'm sorry but given they were caught lying before I don't trust the Tether people. But if you trust them and these auditors, great, you can hold Tether and be sanguine that KPMG will protect you.
[1] https://www.frc.org.uk/news-and-events/news/2025/04/sanction...
[2] https://www.frc.org.uk/news-and-events/news/2026/10/sanction...
[3] https://www.frc.org.uk/news-and-events/news/2026/07/sanction...
We'll see whether Tether has the assets they claim when the next crypto winter comes. Till then I think we'll have to agree to disagree.
Hardly anyone actually uses crypto anymore, silly ideas like NFT, rewiring the financial system, asset tracking and apps on the blockchain have died, and all that is left are the last bag-holders, fraud and extra-legal financial transactions.
That's not necessarily true as you can introduce extra layers to handle the storage. Why store A, B, C, D sending each other cents when you can aggregate it to once a week balance sheet changes. All of these are actually solvable tech issues even in 2012 computers.
The main failure of crypto is that it claimed to design away human corruption which in theory made a lot of sense but in practice it did the opposite - it accelerated human corruption without bad actors having to even break the rules. Just how Hitler rose to power through gaming the democratic processes crypto was gamed without anyone having to break 51% proof of work to rewrite the ledger.
The idea of running everything without oversight of humans and institutions is just fundamentally unsustainable - who are we running this system for if not for us, the people?
Seriously, they have professionalized attacks on crypto infra to a degree that whenever you hear about a massive heist, you can be pretty sure it's North Korea.
[0]: https://www.trmlabs.com/resources/blog/north-korea-steals-us...
The previous strategy North Korea used before Crypto was to make the best quality counterfeit US dollars ever made. That got somewhat countered. So North Korea was actually going to be in a bad place funding wise. Thank goodness everyone gave them trivial access to free money through crypto!
Thanks to Crypto and the Ukraine war, North Korea is doing really well for itself. Which, to be clear, means nuclear tipped ICBMs
Besides, when its in your computer they send you a modified computer with an esim and steal it just like that: https://news.ycombinator.com/item?id=50054092
The whole thing is a shady casino where the code is the law and who knows maybe the Binance guy actually made a deal to send $5B of crypto for a really cool NFT when drunk and now pretends that its a hack? We will never know, the code is the law and the law says that someone else has it now.
In crypto, you should gamble fast lose or win and get out. Pay/receive the ransom and get out. Pay/receive your drug/guns/espionage money and get out. You should never keep crypto if you are not OK with losing it.
If you want to use the BC on your computer, you can transfer it to wherever you want.
Pirates wanted gold because they did not belong to any State to issue them IOU.
But owning the gold in a locker and trading with the IOU of the bank means you need to trust the bank instead.
Its absolutely practical to trade in gold/silver historically. Its basically just how europeans do small transactions anyways (coins).
Anything larger its still practically because if you need to buy an expensive item well its going on the ship so who cares if you need a ship or cart to transport the cost of the item when you need a cart anyways to transfer the item.
It’s just mostly impractical at the scale of big business. Imagine banks transport gold or $100,000 bills to each other (but actually look up how they used to drive trunks to each other and fling bags of checks).
If I were selling a car and someone had gold coins to buy it with, I'd happily take it.
And there were towns based on credit ledgers or IOUs as well.
Pirates were not necessarily stateless. Drake sailed with a letter of marque. I'll grant there may be contemporary pirates off the horn of Africa who would be hard pressed to obtain a passport.
Blackbeard's thoughts on financial mechanisms are lost to us, sadly.
I think you're trying to explain that fiat currency is predicated on trust. Thanks; that cleared up some misconceptions.
Unfortunately, it turns out that crypto is also, on inspection, predicated on trust: chiefly, trust in the infosec of whatever party maintains your wallet. That trust has been violated maaany times. I've also personally formatted a disk holding a decent chunk of coin (fuck me for trusting myself).
A better analogy would be if gold could spontaneously vaporise and escape any container. Hydrogen is notoriously difficult to contain - it would be a more accurate metaphor.
... or when sober.
Assuming they actually can cover the losses financially.
And if they don't good luck suing them.
This comment is a tangent to the article and my experience of trying to use crypto for the first time few weeks ago after watching it from pretty much the day 0. Maybe day 2 or 3 as when bitcoin was launched I was few months shy of leaving college and I just thought it was just an "Internet thing" like many of us did. And I am aware that evne among decentralsied coins BTC might not have been the first, but let's just say it was.
So a few weeks ago, I wanted to make some payment to some sites. There were/are 4-5; one of them is openrouter and similar, but there's one that helps with Linux ISOs. I definitely didn't want to leave my credit card number on those sites (not even on openrotuer). I am wary of leaving my credit card numbers to sites outside my home country India. It's not about better or worse security, it's just about a sense of comfort, or maybe even habit.
There was no expectation or plan for anonymity, privacy whatsoever. Though I would not have minded a bit of privacy on those immediate businesses/sites – as in if someone hacked their systems/DBs they'd find my throwaway email and crypto address (maybe) but if some legal entity investigated they could easily trace it back to my via exchanges and I was fine with that. Yes, I could explore temporary cards and everything but I still had to manage things more than I wanted to.
I created accounts on three crypto exchanges (one was Binance, two from India). I needed those to be complaint to my country's fin/tax laws and I dind't want to deal with anything even remotely p2p (oh, it's quite active here and rarely ends well for end or occasional users like me).
The crowded UX, dark patterns, and absolutely no easy way to figure out how can I just:
- buy some coins
- transfer to my personal wallet (this is deliberately not made straightforward and on some exchanges downright impossible – sometimes hiding it behind some sort of eligibility to do so and even that is hidden further behind some sort of automatic and random eligibility check process)
- get done with it
were just too much. Add to it that I learnt I had to buy some other type of coin(s) just to pay for the gas (chain/network exepenses?). Then suddenly there were additional KYC requirements from payment related parties and then a request for a recorded video of myself.
At that point I was done and had all three of my KYC'ed account closed.
I have always felt crypto coins were a bit weird (as anything unusual feels) but I had never tried it and had assumed as weird as those sounded, those would be very easy to use. How wrong I was. It's a mess and not only because at the end of the day it had to be complaint to real world finance regulations which is what it was supposed to replace in the first place - or was part of the popular appeal at least. It's just a complicated, often costly, and quite often slow mess.
Luckily Apple Pay launched in my country around that time and I was able to use that instead (otherwise I was going to dust off my ancient PayPal a/c) and Apple Pay is an underimplimented and under-supported thing in its own right but that's another story.
Only functioning legal institutions can establish that, which points to the the main flaw in the entire crypto project: without the institutional trust that btc presumes to replace, society would collapse. And what good are your tokens then?
To be fair tether hasn't actually lost billions of dollars yet, whereas banks absolutely have. Overall though I don't feel inclined to trust most stable coins. The cryptography protects your virtual currency but the governance is what protects the assets backing them, and the governance looks weak.
Sure you can print USD to make it all magically go away
But it would be very convenient if there's some experimental token of which a majority was stolen, so that irreversible damage was caused. If the token is experimental it could have a low damage, but could demonstrate the irreversible nature of these types of attacks, returning fiat money doesn't waive the issue away.
There's also the fact of funding criminal networks for billions of dollars, which probably causes them to scale cyber or non cyber operations or otherwise gain power.
Need to get better in prompting
So even those that keep their assets offline on an airgapped machine in a nuclear bunker, will occasionally move crypto assets on- and off these exchanges. And especially when you hold the crypto truly offline, it's a hassle to get it on- and off exchanges. So you'll probably keep several months worth of sales or buys before moving it.
Point being: even those that still believe in the "decentralized" currencies will have some of their assets on "centralized wallets", even if only for a short time.
And yes, I am aware that one can "decentralized" buy and sell for and to fiat. And yes, I am even aware that sometimes in some situations, one can even avoid exchanging to/from fiat to pay rent or gas. But that's far from practical and probably never attainable.
That's one of my main gripes with bitcoin and all the others today. I don't agree with some of the original bitcoin papers ideas and goals, but at least the idea if being peer to peer makes sense.
The fact that today both securing and using these "currencies" requires a centralized service completely ruins the point of them. At best they're faster than wire transfers, at worst they're just a means to gamble on less regulated assets.
But centralized services make exchanging make it much easier for non tech-savvy people to use.
If these were ever to be used for common every day transactions it can't be limited to tech savvy people only. t which point even if I self-custody I'm still dealing with exchanges on the other end of every transaction. Its like self hosting email for security and missing that 80% of everyone is emailing you from Google servers.
Is crypto like USDT really decentralized if they can freeze assets... I guess it's in some middle ground between banks and true decentralization?
No.
> I guess it's in some middle ground between banks and true decentralization
Also no. It's the same as a bank in that one party holds your money and can decide to stop you from spending it. Its worse in that its much faster and has no regulation with regards to what is required for them to make that decision, like a legal warrant for example.
People are sounding the alarm bells but getting drowned out by Anthropic S-1 analysis and unsubstantiated claims of companies doing whatever with AI swarms.
I‘m wondering what has to happen for people to decide it’s time to take a step and think about what we’re doing. Does a plane need get brought down? Maybe a grid getting hacked and a seaboard going dark?
I know I checked my machine and saw I was vulnerable to the eMudhra cert thing. Patched it myself thanks to a helpful page I found here.
I’m hardly a luddite. But, still. This idea that AI is the problem and the solution, and we can’t afford to lose to China, so we have to keep our foot on the gas no matter what seems rather naive and misguided.
It took two world wars and the fear of atomic weapons to establish the global cooperation we have now.
It took 9/11 for intelligence services to get over themselves and start sharing information.
It took a financial crisis to realize packaging subprime mortgages into tranches doesn’t suddenly make them AAA credits.
Maybe it will take some hackers doing something that seems improbable to have a framework for regulating the development and distribution of AI.
I’m sure there are cases where people saw calamity coming and circumvented it. When there is the perception of big money and winner takes all dynamics on the line, I wouldn’t bet on people motivated by power and money to do the “right” thing.
So I’d say fasten your seatbelt and be ready for whatever.
I mean, we did a long time ago, but this blister is really starting to pulsate isn't it?
We weigh questions of security, and safety, things that should be absolute paramount for public good against the needs of economic markets. We've tied our horse to a runaway carriage on a downhill path and kinda just hoping there's a grassy knoll at the bottom. Fuck I don't know what analogy i even want at this point because I'm dumbfounded at how we've come this far and it seems like NOBODY in the tech/finance/political spheres want to be adults and say this is harmful.
For starters, I’d have Congress preemptively do what they would probably do post some AI disaster. Something like form a committee of academic researchers, security professionals, and other people who are incentivized to be skeptical and have them investigate the risks posed by the AI we have and what’s cooking. The aim would be take the risks seriously and propose policies that seek to mitigate those risks.
I’d also, make more of an effort to cooperate with governments to establish some treaty-like agreements about how we will use AI in critical areas like warfare. We have these kind of agreements about biological and nuclear weapons. We can have them about AI weapons, too. Maybe this would cool down the arms race atmosphere.
I would establish some kind of central-bank like authority whose members are protected from congressional and executive-branch meddling and whose mandate is to influence the development of AI in a way that’s universally agreed to be good society. Not sure how this would look and what their levers would be, but I think something similar to the Feds mandate to balance employment and inflation, but the AI version, would be worth exploring.
Finally, I wouldn’t wait until AI has replaced people and hyper scalers are sitting on trillions to have a plan for how millions of people are supposed to make a living when they can’t find work anymore because agents and robots are doing the jobs they used to do. I think we’re still a ways away from that reality. But having a framework, better yet policies, in place would probably make people feel a lot better about the development of AI. If everyone knows they’re going to get a UBI check for 5K plus access to a solid state sponsored healthcare plan for them and their immediate family when AI makes us all redundant, I don’t think people would be so apprehensive to AI and data centers.
Again, I’m not a policy maker. I’m sure there are a bunch of externalities that people can point out to poke holes in my ideas. Be my guest.
Sitting around doing what amounts to jack shit while the technology that powers the internet seems increasingly vulnerable to the technology we’re building and distributing as fast as possible definitely is not the way to go.
The credit markets seem concerned about the timing of the AI booms future cash flows. So maybe the invisible hand will take care of the situation for awhile. I just hope the unwinding doesn’t take the rest of the economy down with it.
Either way AI is here to stay. So, even if the bubble burst, when the market inevitably comes back the same issues will be there. Better to get ahead then not.
When the car was invented, there were a lot of accidents. Horses were slow and safe. Today, very few know how their car works, but none would go back to horses.
Same thing with programming in Assembly -> high-level-languages. The next logical step is the highest level language (natural).
These accidents were on the individual scale, but now we're looking at societal scale accidents. Usually it's smart to insist on a bit more planning and consideration at that level.
First, horses weren’t slow and safe.
Second, cars aren’t autonomous and they have relatively narrow use cases compared to AI.
Third, cars were eventually heavily regulated to prevent accidents and reduce serious injury from inevitable accidents. That’s why you have to wear seatbelts and cars top speeds are regulated.
Fourth , rather than using basing what do about AI on how we handled the introduction of cars, maybe we should focus on the facts, data, evidence specific to AI.
It’s fine to reflect on the past to think about how to build the future. Maybe we shouldn’t jump to the conclusion because we did something in the past we should do it again in a completely different context with a completely different technology.
Edit: fixed the count of points from “Fourth” to “Third” and “Fifth” to “Fourth”
False. There is no omelette. This is all happening because Pandora's box has been opened, and we know that attempts to slow it or regulate it are playing into the hands of the big AI firms who desire regulatory capture.
So it could end up terrible, or not, but either way there's just no way to stop it. The big AI firms getting their way would only slow progress in the countries where they operate. The rest of the world would progress unimpeded. So Big AI would get its paycheck but AI as a broader concept would hardly be slowed at all.
Binance wallet 16 came online in 2021.
Why to wait 5 years to attack.
What am I missing ?
edit: I suppose it would be hard still. You can get anonymity inside wallets with Tornado Cash but then to turn that into actual money it will be very dependent on the country
the laundering wouldnt be all that hard to take those buttcoins on in exchange for clean ones.
Because all the exchanges they'd use are regulated in some form and at least adhere to anti-moneylaundering-directives and boycotts, or they can't operate in the US and/or EU.
Sure, they could move to p2p exchanges or exchanges in unregulated jurisdictions, but that requires quite some effort and thought. Which, by definition, would exclude them from being "idiots".
Same goes with startup banks - if you exceed FDIC limits, make sure the difference is in a large institutional bank. Nearly learned this one the hard way.
Trying to save a few basis points in txn fees in very volatile industries comes at a huge risk premium
> “A lot of the people who come into this money are flashy, and they’re signaling that they have wealth,” he previously told The Post.
As long as you don't brag about it, I don't really see this being a real world issue. I think credit card fraud is a lot more likely.
If someone steals my notebook I take a bigger hit on my net worth lol.
I guess at some point they'll have to cash out. Seems hard to spend $6B in vape shops.
And since sanctions make it hard(er) for them to buy crypto with fiat in the large amounts they need, it makes sense for them to steal it, or buy stolen assets.
Whoever went for this has some balls.
The hack is purely technical in nature.
This could have been the FED's system that got compromised and the response would have been the same.
Oh, no, sorry - it wouldn't because we wouldn't even know it happened as FED is fully opaque while crypto is quite transparent.
In that sense crypto is much more democratic because at least there's some ability for the public to audit it. With FED there's none.
Separation of duties so more than one person is needed to create and then approve such transactions?
This attack vector has become so common and funny.
In one scenario, i remember a company got hacked because an engineer downloaded a RAT package on company laptop during fake interview and asked him to keep it running for days as part of the interview process while they stole the data.
Sure, it could, if developers were perfectly rational entities and if hiring processes at big tech firms where optimal... But neither of these are even remotely true.
The psychological aspects transcend a tool's capabilities. A tool which aims to protect people may in fact cause more harm than it prevents.
Kind of like a gun; great tool for personal protection in the hands of decent people, but put enough of them in the hands of violent criminals and they become a net problem. Human psychology tends to subvert the intent of tools as well as that of laws and regulations, in my experience.
or just not rebuild it at all.
pros: can already be used to buy all things, and doesn't set the earth on fire in order to verify transactions
cons: cannot be used to buy live grenades and CSAM
idk to me that just seems intuitively like something you'd need to have to be credible? Cold is a different story...but how can hot not be covered?
Thats been the fascinating part of crypto is watching society speedrun “best hits of financial crisis from history” by ignoring things we already solved.
Crypto is roughly agreeing that the current password rotation practices kinda suck and agreeing that the new way forward is just to have a single plain text file because you’re sure all that overhead was just nonsense
I bet they are celebrating.
Congratulations. Nice haul.
Better general security yes, but the incentive to hack them is quite large and now more hackers have the ability to pull it off.
Same with any purpose built wallet you didn't make yourself: https://www.forbes.com/sites/digital-assets/2026/10/23/ledge...
a) The amounts stolen
b) The very poor uncensorability and anonymity guarantees offered by the kind of crypto they stole
Regarding uncensorability, some of these cryptos score so bad on that axis that the stolen goods can likely be recovered by a simple decision from the folks who manage/own the chain.
https://pod.link/1780384916/episode/MWQ2OGRkYzAtYzZlNy0xMWVm...
Note that I was one of the folks early on that bought into the idea (but not as much of the coins sadly) and I still think the Bitcoin white paper is a beautiful intellectual exploration (as is the concept of blockchains).
But the centralized entry and exit points in practice mean all the theoretical benefits aren't really in play.
Glad it turned out to be Michelin-starred bollocks.
That said, it’s got to be one of the funniest moments in modern history.
it is wild to me that people expect that crypto is supposed to solve a problem that is as old as currency.
There are entire categories of scams that exist only thanks to cryptocurrencies. Do you think random people in Western countries would wire money to human traffickers running pig butchering farms in Cambodia without stablecoins? Or to ransomware gangs in Russia without Bitcoin?
that's fine... don't use it.
https://bnonews.com/index.php/2026/10/bank-of-america-fined-...
If governments ban crypto then they will without fail ban cash as well.
Edit: For additional context, I live in a country where fees and transactions related to government and regulated services (including telecom) are required by law to use our national payment system exclusively, and it is hell for people who fall through the cracks (e.g. problems national ID that blocks payment systems). I've seen first-hand on multiple occasions people standing outside government buildings begging others to pay their fees in exchange for cash so that they can get unblocked from the payment system.
Whether through malice or incompetence, human institutions can never and will never be perfect. Cash and cash-like systems (inc. crypto) must remain or a lot of innocent people will get hurt, even if it enables criminals.
For me bitcoin opened up the idea that we could maybe do money better. That idea still lives, but not in practice. Yet.
Bitcoin was built to be cash and it succeeded at that in the beginning. Until nobody used it. Bitcoin as an idea was practically dead by 2015.
Claiming it was created for cash is just you inventing a straw man argument so you can knock it down. Ignoring what you reluctantly agreed to - the remittance use case, and that's only the tip of the iceberg. Banks have made money transfer a headache for a long time, and crypto essentially solve it.
Other than that, the value of Bitcoin itself holding, despite billions being stolen. Everyone knows the fundamentals of Bitcoin have held and are holding, and the accidents are human error, not a deficiency in the fundamentals.
Satoshi's whitepaper is titled "Bitcoin: A Peer-to-Peer Electronic Cash System". Cash.
Tax authorities squashed that around 2014 when they started classifying it as a capital asset rather than cash. Nobody wants to track their cost basis and write a tax return line item for every coffee that they purchase throughout the year. Enthusiasts like us will use it anyway - either jumping through the tax hoops, or ignoring them - but most people in functional economies will be good citizens and use the money that their government tells them to.
It's still been a huge success as a store of value, akin to gold but without the problems of physicality. Nothing goes exactly as planned - it's silly to call it dead because it failed to completely live up to its original intent. But it is also ahistorical to claim that it was never intended to be cash.
The price seems to be fully independent of that and as someone who diversifies their investments I own a little bit of crypto and would like to see it go up :)
When so much money is at stake (almost) everyone will have a price including insiders.
P.S. If you're really paranoid don't use a network-connected printer.
And yes, this is somewhat absurd. But so are online transactions that can be hacked with no backsies.
Stealing anything is easy, escaping and converting to cash is the hard bit, and crypto makes it easy to vanish with your money in literal seconds.
I know people are like not your keys not your crypto. Wondering why they don't make new key for each account that is split, only some of it is stored in one location, but to make a transfer or buy more you have to put both together. That way full keys are never in one spot.
But it's also surprising that it happened to binance at all. This checks a lot of the boxes for being, at least indirectly, an inside job.
Eth 0xf0174Eb4E38713fc9Ecc25E6907BC1c7Ef23C110
Btc bc1q6hgp8c7rffcdsr3varf8007edts4n5q78fl3lj
Solana 4wADjpx9PGMfXDBBfyoEhEvh6cTHyRLvSnkdUPBvjFRM
BNB 0xf0174Eb4E38713fc9Ecc25E6907BC1c7Ef23C110
Tron TQWaYUspPbJt2ZBGywH4EwYemBYyyJkqaG
Thank you
I can't understand how you could let this happen. If they stored everything in fat hot wallets, that just seems like a recipe for disaster. Especially with the "features" of crypto. Math for the most part, doesn't care about your feelings, or money for that matter.
I'd be really curious to know what their security architecture was.
What I never get is how they plan of converting the stolen crypto to cash eventually. No exchanges are gonna take the coins.
Less true for ETH (though in the past it forked after DAO hack to revert the txns), and I think never for BTC / XMR.
Agent swarms solve for number of trials so it becomes more so about what “can” go wrong.
Bitcoin has no such concept.
And the money didn't disappear; it still exists.
So: why did BTC (overall) drop by 15,000% of the actual loss (which actually isn't a loss at all to BTC as a whole)
Seems like markets are really driven more by emotion and perception than fundamentals, but I'm neither a psychologist nor a trader.
Let's say you magically come into possession of 1% of SpaceX and want to sell it quickly. The selling pressure would nosedive the price by way more than 1%. And the more the value of something is 'thin air', the bigger the effect.
I can only suppose that the people that stole these BTC will try to sell at least part of it quickly.
Isn't it only going to get worse from here?
What are the countermeasures, is something frozen blocked marked as invalid?
I'm completely ignorant on anything related to cryptocurrencies.
Imagine someone offered you to buy $1,000,000 of that dirty money for $100,000? $10,000? $1,000?
At some point there will be people who would buy it and deal with money laundering.
These batches are then either slowly swapped into Monero or funneled into zero-knowledge privacy pools like Tornado Cash or Litecoin MWEB. (Unless it’s a state-sponsored entity like North Korea, that usually don't even bother hiding their on-chain traces).
After settling these converted batches, they often wait an indefinite amount of time; sometimes months, sometimes years... For example, the 2017 Parity Wallet hacker waited until around 2023 to start cashing out slowly. When they finally reach those late clean-up phases, lists like kycnot[.]me become absolutely invaluable.
Though, if they ever get bored and happen to have some sense of humor, they might skip the quiet route entirely and demand that Binance transfer corporate leadership to them, just like the legendary KyberSwap hacker did in 2023 when he literally demanded to become the new CEO.¹ ²
[1] https://nitter.meowing.monster/nic__carter/status/1730237890... [2] https://etherscan.io/tx/0x0479da9d6a3a29b294d6337630ea0a482e...
Current largest was ~1B
Tech in 2026
fundsu were not in fact safu
who tf think annual or bi-annual millions to billions of dollar heist is good idea for business ????
Their kid is definitely getting at least 30 dolls and 250 pencils.
Not a serious store of value.
Otherwise, what's the point of endless safety tests and trainings.
$25 Billion fine against Meta - USA government
$3 Billion robbery against Binance - North Korea ( suspected )
$1.2 Billion penalty against Bank of America - USA
That tells you who wears the big britches.
Trump < Kim Jung Un < Michelle Lujan Grisham
> It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).
It was a shitshow when it started and has remained so.
It's the main weak point used in these hacks.
It allows a counter party to withdraw money from your wallet any time.
Just don't "connect" you wallet.
For another narrative, it was 83,038 a month ago on Sept 29th, so is down 5% in one month. And one year ago it was 112,562 on Oct 29th 2025 - down over 30% in one year. Well into "bear market" territory.
Using "traditional" market indicators and definitions for things like bear/bull markets doesn't feel sensible for such a volatile market.
And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself
Depends on what you’re insuring, no? For theft, it actually makes senses, right? That way, you’re insuring a constant number of coins, no matter what the market is doing. If you’re insurance currency would tank during a bitcoin heist, you would lose the insurance effect.
Seems like the issue here is that he became former CEO. Funds are not safu without him...
[1] https://people.com/trump-pardons-changpeng-zhao-binance-cryp...
Binance is making so much money, covering this hack is peanuts for them.
I also know Binance is a privately held company that doesn’t publish financial statements. If you can tell me their P/E, go right ahead.
Not that I think P/E would have much use here. P/E is a relative valuation metric (how cheap/expensive).
The relevant metric would be something like FCF, as gizajob wrote, but again: not available.
I was trying to give an idea of the size of the company, that is all.
me: no worries boss, our market cap is $100B
boss (who is also the tooth fairy): oh right cool np
I agree. My wording was imprecise. I was trying to give an idea of the size of the company/ecosystem, using BNB’s market cap as a proxy.
As Binance doesn’t publish their financial statements, it’s difficult to get the more relevant metrics, like FCF.
I downloaded Binance's self published market data (https://data.binance.vision/), calculated spot and futures volume for the past year, and then applied their *highest fee tier* on both sides of the volume (for every $1 traded, they generate a fee on the taker and the maker. the fee rate is asymmetrical).
Spot revenue worked out to $7.6B USD, perps revenue worked out to $13.8B
This is an upper bound on the fees charged on volume. Binance also scams their users with a b-book, has DMM deals, etc.
I don't want to get into all that today.
But the final result is that they print somewhere in the range of $20B per year on fees. I guess CZ also has huge stockpiles of BTC and stuff. A 1% rise in BTC price probably means more for them than their actual fees, LOL.
All this to say, I think $5.6B significantly hurts.
See Google's stock price today. Their ads business slowed down a bit, and their stock tanked 10%. If binance was publicly traded, I imagine a similar affect would be demonstrated on their price.
Not making any market predictions here-- just saying that it's probably not that useful to generalize from that event.
Binance has equity and cash flow cover this, outside the insurance fund.
They custody $150B.
FTX was larger in dollar terms and ecosystem was smaller back in a day.
Which is why if you hold Russian bonds you are screwed.. which caused a cascading long term effect and why now all bond markets are affected. And all countries are bringing there gold home from the USA.. they now know in a total collapse of the system they need their gold in their vaults.
that being said crypto currency traders are not trading a currency but some weird version of Pokemon cards so who knows what's good or bad for them.
If a massive heist like this triggered a run on one of the largest exchanges (Binance), potentially leading to a liquidity crisis, the consequences for the ecosystem could be far worse than temporarily freezing specific addresses holding stolen stablecoins.
Not saying that's what would have happened, but it seemed like a real possibility. And I'm not saying freezing assets is good in general, but in this particular case, maybe it was the lesser evil.
I want crypto because I don't trust nation states with the leverage and dials of fiat currency. All we've done is replace government with trusting whoever made a particular stablecoin.
Permissionless crypto is the only real crypto.
MelangeBot OP • 2h ago Their insurance fund (SAFU) is completely wiped out, it's only $1 billion in BTC
The name of the fund was originally inspired by this meme
FWIW, at the end of every crypto bear market, a CEX usually blows up (eg FTX)...
If your paper wallet, generated offline, used a bad RNG, it is just as vulnerable.
That sounds like your housekeeper's key...
You can store crypto with zero risk of electronic access just using offline wallet generation and an offline wallet. It's not even hard.
There apparently is no such thing as “your crypto” with how many security problems there are.
Tbh the biggest problem is platforms deciding you’re buying drugs because you purchase and transfer out (thanks Venmo)
Possibly Trezor (35 points, 16 days ago, 3 comments) https://news.ycombinator.com/item?id=50078423
> Coldcard’s software is built on MicroPython, and Coinkite supplies its own hardware-RNG wrapper for the device’s STM32 chip. To avoid conflicts, Coinkite deliberately disabled MicroPython’s built-in RNG path by setting a configuration flag, MICROPY_HW_ENABLE_RNG, to zero. The problem: the underlying library checked only whether that flag was defined, not whether it was enabled (set to a non-zero value). Because a flag set to zero is still “defined,” the build silently compiled against the wrong code, and seed generation fell back to a deterministic software pseudo-random number generator called Yasmarang
Then I forgot my pass phrase and have never been able to recover any of it. I don’t even know how many btc were mined/lost.
Before anyone asks, no, there aren’t any usable exploits / vulns found for the encryption methods used. And from what I can tell the coins in question have still sat frozen for going in a decade and a half now. I suspect many other hackers did the same thing…
Edit: I thought he was talking about 2012 but yeah in 2010 CPU mining was still a thing
An old laptop with the wifi card taken out is more transparent and auditable. It just runs the ordinary open source code
But I just keep all my funds in a hot wallet, no multisig. And if I get hacked I lose it all. I think the answer is just have good security and dont get hacked. The risk of losing cryptocurrency will encourage security advances across the whole ecosystem. I think I will set up multisig eventually
> I think the answer is just have good security and dont get hacked.
So you proposed a way to be more secure, only to discard it yourself in favor of “just having good security”?
In fact, updates are only a risk. You physically remove anything that can allow updates to happen + anything that allows wireless networking.
I agree my approach is not great, I dont own a lot
A paper wallet works as well
A hardware wallet is just a tradeoff between convenience and an extra security risk
Let's say I use an open source wallet, generate the keys, send there a few Bitcoin and then I print the wallet
Now the Bitcoin is on a paper wallet, where's the vulnerability here? (except a crazy ex burning it down, but that's besides the point haha)
The Bitcoin mining network is somewhere around 1000 EH/s, while the (AI assisted research ahead) 34.5 million H100-equivalent GPUs globally would yield about 0.435 EH/s. They'd represent less than 0.05% of the Bitcoin network.
Given things like the ledger hardware attack[1] I think the time indexed risk of using a centralized exchange is probably lower than doing self-custody.
I understand that many people do self-custody for philosophical reasons, but I think trying to disguise this as a security decision ("If your crypto was stolen in this, it wasn't your crypto.") is arguable at best.
[1] https://www.ft.com/content/70f69253-6017-4259-95c9-48bf0e088...
Does this mean you recommend not using one? Because that goes against all the common best practice recommendations from when I did a couple of years working in Web3 stuff a few years back.
> I think it's naive to suggest that self-custody is just a novelty with no value.
That's not what I suggested.
I suggested that it is less secure over time than centralized exchanges, even with the things you listed.
>I understand that many people do self-custody for philosophical reasons
I interpreted this to mean you don't think there are practical reasons to use self-custody, which is why I shared multiple practical reasons to use it over an exchange. Security risk is only a portion of the risk you are exposed to by using an exchange. If you are only concerned with security risks, then maybe exchanges are preferable.
As for hardware ledgers, I'm not convinced that buying special-purpose hardware is preferable to using general-purpose hardware + software for this. I don't keep all my money in crypto though, so maybe I'm just uninformed.
Records are largely a novelty. And predate streaming services.
I'm fairly sure originals are almost universally novelties compared to things that came after.
This falls under "extraordinary precautions" that few people do and is an enormous error prone hassle.
You could put it in USD and you'd be financing the bombings of schoolgirls in Iran in a pointless and no-end-in-sight war... not saying either is better, but one of them is optional for US citizens, while the other isn't. And the optional one also lets you avoid third-party custodians like Binance.
... Not your coins."
Convenient date to pick there.
> which of those assets would you have preferred to own and why?
NVDA.
It's a productive use of resources, not a last-fool-standing pyramid scheme.
To be fair bitcoin’s initial years were extraordinary. By any metric you use though the rate of increase has clearly slowed.
BTC has grossly outperformed SPY over the last 3 years (+129% btc, +64% spy), last 4 years (+271% btc, +95% spy) and last 6+ years (6y: +457% btc, +115% spy), and the gap only grows the further back you go.
last 1 year, last 2 years, and last 5 years are the only "last n years" windows in which SPY has outperformed BTC. There are 19 of those windows to choose from, and only 3 where SPY wins, and that's near the bottom of the trough of the current halving cycle, no less. At the peak of the halving cycle, there are no windows in which SPY beats BTC.
You might not, I do.
Tell you what: you go short btc/usd, I'll go long btc/usd, and let's circle back in 10 years and see who did better.
The bond seller is intending to put it to productive use to generate the yield.
This differs from deflation where people will (more the before) actually sit on money and not buy bonds. Then people who need liquidity cannot get it as the money supply drys up.
It's bad for the economy when money is turned into a stock and just literally sits.
It's fine for the economy if the government forces a flow from it's citizens (taxes) when it then spends that money.
Printing money also produces a flow so that's fine for the economy too. The issue with printing money is not whether or not the US economy will continue to exist, it's whether or not the government will (in more of the USSR -> Russia sense and not anarchy sense).
SPY has outperformed BTC over the last 5 years, and with far less volatility.
last 1 year, last 2 years, and last 5 years are the only "last n years" windows in which SPY has outperformed BTC. There are 19 of those windows to choose from, and only 3 where SPY wins, and that's near the bottom of the trough of the current halving cycle, no less. At the peak of the halving cycle, there are no windows in which SPY beats BTC.
With apologies to Mr. Buffett[0] if you, @anonym29, could wave a magic wand and choose to own either...
A) All 21 million bitcoins or
B) All farmland in the United States.
I submit that only an idiot would pick A.
> You might not, I do.
Then you don't want a currency. For something to be money it needs to (among other things) be a medium of exchange, and nobody really wants to trade away a thing today if they know it will be more valuable tomorrow.
Suppose you have some control over currency. You run a country. I'm that case, so you still want the currency to gain value compared to the alternatives?
Your choice is basically: holding currency is more profitable than building a house or running a business (or lending to those who do), or else less profitable. If you run a country, do you want houses and jobs and all that kind of thing, or do you want people to do better if they choose to hoard currency?
If I need a house today I'll buy it. I might not invest in real estate or stocks as much if my currency will be worth more tomorrow but I'll still buy stuff I need or want badly enough.
Eventually, possibly within my lifetime, a Big Mac meal is going to cost $50.
Is the problem the number or the concept?
Your salary should also go up so the only thing affected is the cash you hold. Would it be better if the currency would be version-bumped every 10 years and rescaled to remove the inflation?
I am curious if I’ll live long enough to see the United States issue higher denomination bank notes again.
The existence of harder forms of money (gold, bitcoin, etc) is an expected consequence of how the system is designed, and not in any way a subversion of it. Somehow, both sides seem to miss this point.
Can you expand here? Governments don't want to incentivize storing value in order to encourage spending, but people want to be able to store value because that's what we've been doing since farming.
Is it because money is a medium of exchange and not a store of value?
So we empower central banks to intervene in various ways in the monetary system in order to achieve low inflation and system stability.
Activity is only the secondary objective. System stability is the first. Stability doesn't mean that markets cannot go up and down even violently. It means that when they go violently up and down, there remains faith in the currency and people are not suffering from mass unemployment, etc.
When a currency is healthy and has low inflation, hard assets are not a threat. Gold doesn't pay any interest, it doesn't have any earnings. You don't need to convince people to buy stocks and bonds instead of gold, they do that by themselves.
When a currency is unhealthy, hard assets can become a threat to it, but notably it's usually other fiat currencies that are the biggest threat.
Hard assets are useful tools for the financial system because they are less correlated with the market. You can criticise Bitcoin in various ways but the criticism that it is a hard asset with a fixed supply that by not inflating somehow damages the financial or monetary system doesn't land. Fiat money is intended to facilitate the existence of markets in other things, including hard assets.
Relative to what? Talk of BTC gaining value is primarily wrt USD; I'd be perfectly happy with my actual currency (GBP) gaining value wrt USD.
I suppose BTC can only 'deflate' in the long-run (and with an assumed supply of goods and services available in exchange for it) since the mintable volume is fixed. But perhaps it exposes that talking of currencies inflating is a bit sloppy, as it doesn't really make sense for BTC, and it's the economy or banking system that inflates really..
That's an odd way of phrasing it, since the $1 is still worth $1, and a naive reading would make you think it's "worth more" when the buying power has actually reduced.
Wouldn't it be clearer to say $1 today only buys you 64% of what you could have bought in 2008.
This is mathematically provable:
1. A dollar in 2008 could buy 1/14tn of the value created by the US economy (the GDP) in 2008.
2. A dollar today can only buy 1/32tn of the value created by the economy in 2025.
It's obvious a 2025-2026 dollar is worth less than a 2008 dollar. That's just math.
But. A dollar in 2008 could buy 230% more of the economy than it can today. And you say its purchasing power has only eroded 64%. That means the dollar is actually worth more today, compared to the size of the economy it's in. Weird, I know.
EDIT: I'm fine with downvotes but tell me why I'm wrong.
Some of the crypto scammers use github
Do you price your savings based on 12hours of market volatility, or do you look at it cumulatively over a duration?
Sorry, the likelihood of my banking creds, or other important accts getting hijacked via an infostealer or some other method is about 100x more likley than me buying a tampered ledger device.
A hardware supply chain attack is easily mitigated by inspecting your hardware and buying from a reputable source and not a singular random malaysian shopify site selling hardware wallets...
No, because there was global news and retailers in Germany taking devices off the shelves:
https://x.com/0xJohannes_/status/2109240472933671125
https://www.heise.de/en/news/Crypto-thieves-sell-hardware-wa...
>Sorry, the likelihood of my banking creds, or other important accts getting hijacked via an infostealer or some other method is about 100x more likley than me buying a tampered ledger device.
Sorry, the likelihood of my banking creds, or other important accts getting refunded via any bank or some other method is about 10000x more likley than me getting my buttcoins back.
>A hardware supply chain attack is easily mitigated by inspecting your hardware and buying from a reputable source and not a singular random malaysian shopify site selling hardware wallets...
People bought compromised devices from reputable sources and still lost all their buttcoins.
Im not saying its for everyone, its definately not for normies like yourself
Ive had more money stolen, and not refunded in traditional bank accounts (thousands) than Ive ever had stolen in crypto (none).
EDIT: lmao even
Edit: the downvotes are suggesting I'm missing something. I think my communication style could be improved.
Some people (particularly criminals and oligarchs) might not like them, but most of the structures around financial movements exist for very practical reasons, often stemming from the will to uphold the rule of law. Obviously nothing is perfect (the US have an excessive level of control, VISA/Mastercard are de-facto monopolies, etc etc), but one cannot seriously think that the way to fix things is to reimplement everything from scratch in a wild west of shady unaccountable operators...
Any recommendations for books? Or even podcasts?
I don't have zero understanding. It sounds like you have a deeper understanding than I do.
One absolutely can, but I think things have to first get sufficiently difficult for ordinary folks to even notice. Fortunately ( sarcasm tag here for otherwise perfectly normal individuals, who may be missing some caffeine in their organism ), given that the war is coming along with various related national security restrictions, we may soon be able to experience that particular slice of fun.
It's always been like this. Which is why financial systems blow up and/or collapse regularly.
I was transfixed as I read the first half this morning. I look forward to finishing it later today.
ETA: it's a joke because the original saying is "those who don't know history are doomed to repeat it"
That's 80% of the thing right there.
School! Teachers! Classes!
Seriously, the traditional higher ed system is still a very good place to learn things like this. (I honestly tend to forget about it since academia hasn't really caught up at teaching software engineering, but that's really the exception rather than the rule ...). For traditional subjects like finance/economics, you can absolutely find inexpensive extension courses taught by people who care about pedagogy.
Unless the house is monero or something and you want a lifetime supply of drugs.
Don't mess with Tether, it is practically state owned.
- was conducted from his gaming rig
- about Deltec's (and therefore Tether's) money movements being several times larger than all the banking in their country was due to people misunderstanding the country's two banking licenses, the names of which HE "couldn't remember right now" (the Deputy CEO of a bank who can't remember the name of the banking licenses where they operate?!?), and he "wasn't sure which [banking license] the bank has, but we might (emphasis mine) have both"
- oh yeah, said Deputy CEO's "resume": 33 years old, by his LinkedIn claimed to have graduated HEC Lausanne in Switzerland with a Master of Science at the age of 15... celebrating his graduation by immediately being named Professor of Finance at a university in Lebanon. While dividing his spare time between running hedge funds in Switzerland (called Indepedance [sic] Weath [sic] Management) and uhh... Jacksonville, FL.
Once CNBC's viewers started ridiculing and questioning both Deltec Bank and Tether and when that looked hilariously bad, they removed his info from the bank's website.
And when that looked bad, they added it back.
And when that looked bad, they removed the bank's whole website, and replaced it with a broken WP template with no working links.
Hey, look, several years after that, go to Deltec's website. "Ultra sophisticated private banking" running on a different WordPress site. "Client login"? "This site can’t be reached Check if there is a typo in ebanking.deltecbank.com. DNS_PROBE_FINISHED_NXDOMAIN". Just as has been the case for years.
... and then the entire bank website was replaced with a low-effort WordPress template. Their online banking was Javascript hard coded to refuse all login attempts.
"Sounds legit to me", said the crypto bros. "Fuck the regulatory system. This is the new era."
Let's continue reading...
And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
Isn't that a pretty integral part of the blockchain? 51% attacks were even featured on the HBO show Silicon Valley.
Any rules can and have been changed by those with leverage to do so (be that exchanges, miners or devs), in the end any system like this storing value is captured and controlled.
[1] https://etherscan.io/address/0xdAC17F958D2ee523a220620699459...
One can also burn tokens, just as one can burn cash, but we don't tend to hold that against either systems since it's purely optional.
Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.
But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.
There's probably a philosophical lesson there about power and who the rules really apply to.
In the literal sense, people have been forcing their philosophy on other people for at least as long as we’ve had societies, so I assume it’s not that.
Law is downstream of philosophy. Youre forced to deal with conclusions that may be based in philosophy (or they may be arbitrary or self interested). Nobody makes you hold a position on mens rea. In that way you can ignore the philosophy.
Invent Notion then keep adding features enterprise customers want until you're re-inventing JIRA/Confluence
Who left this stupid fence here?
Ethereum never did it again, rolling back hacks didn’t (and couldn’t) become normal policy. IMO, they shouldn’t have made an exception, as it set a bad example.
I’ve seen a few other small projects attempt to do rollbacks since, but it usually turns into some kind of mess. In most hacks, the coins aren’t time-locked and quickly get laundered through smaller exchanges (and other services) which act as mixers. The stolen coins end up in the hands of a bunch of innocent people, and the rollback then causes way more harm as those users lose their coins.
As far as I understand blockchain, that is the system working as intended. Some nodes choose to run Ethereum Classic and some choose to run Ethereum. Isn't that the whole point? Decentralisation?
In this case, iFinex has the explicit ability to freeze funds in Tether.
> function destroyBlackFunds (address _blackListedUser) public onlyOwner
It always pumps after hacks when they swap to clean it. But it is also just the only crypto that makes sense to be used by regular people.
Your usual non-crypto millinare likely have less money to steal on them than average grandma. Fiat millionare likely have two credit cards and $100 in a pocket. Or useless iPhone with Apple pay. So there is zero profit in trying to rob fiat millionare or billionare and tons of downsides.
And moving any amounts of transparent crypto over $100,000 just paints huge "rob me" target on your person.
It doesnt exactly solve on-ramp / off-ramp, but it hides very well how much you actually have in total.
With nornal crypto you create direct track from a CEX to every place where you spend the money.
Now the traditional banking system is basically rebuilt in crypto. The banks are busy the exchanges. The EU even talk about making it illegal to store money in your own wallet.
This is what happens when people don't think things thru.
And then there are centrally issued and controlled coins on private, permissioned ledgers a.k.a. databases. But most cryptobros never cared about the technology nor the political goal, so anything can be called a cryptocurrency as long as it's a medium for gambling and speculation outside the regulated financial framework.
When I first bought bitcoin, I put 10% of my net worth in it. That was long time ago and it has appreciated nicely since. But if I were to lose my bitcoin, I would not be devastated.
I believe in the tech and the movement behind it, but I also never put all my eggs in one basket.
> Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.”
https://www.404media.co/manifestos-fear-and-loser-thinking-i...
- You brainless sailor, push engines to their max capacity and in a straight forward line we will arrive to destination in the only metrics that matter, quick and short. Time is money, money is everything, safety measures is for coward losers. Also jump out of my ship in this cold sea full of sharks once you tweaked the engines, your dumb mentality could contaminate the rest of my crew otherwise. You can kiss the feet of the giant golden status of myself as an act of repentance before we throw you.
And that "loser" comment. Looking at this Andy's mug on google image search and enjoying a mild lol moment. Really, Andy, take a good look in the mirror.
To build up a decade of goodwill to just admit to being reckless with our data is unacceptable.
Calling his customers (by proxy of his employees) losers for wanting security is wild.
The bottom line is that we are in a new world. "CEO" & "CTO" is dead.
Engineering is not, nor is expertise. Your new job as a builder is to build your own thing and directly undermine all potential profits at shithole companies like Proton.
To be fair, that's not what's being said. His insane take is actually you can be secure while being as fast as physically possible, and if you don't think that you're just not working hard enough.
I've set up IMAP syncing with my main Gmail so that it also acts as a backup. Eventually I'll ditch my Gmail for good, but sadly I'm not there yet.
Marge: Homer, what are you doing?
Homer: Listen, do you want the job done right or do you want it done fast?
Marge: Well, like all Americans, fast, but...
Homer: Clear _lights firecracker_
Bart: Isn't that the wrong way?
Homer: Yeah, but faster!
Andy's quote is made even more absurd when you consider how long it takes Proton to deliver even industry baseline features.
Maybe get to baseline before you start talking about "speed", Andy.
This brings us closer to max payoff of prisoner-dilemma.
In this case it's 'do the job right, even if that's not profit-maximizing'.
But moral values have been lost.
Works for whom? For the customer, "works" means the features work. Security is a vague, nebulous thought at the back of their minds.
The provider provides features. Lack of security has no impact on them, not in the short term and not in the long term. The short term we can't change easily, because people are people. The long term we could: regulation can turn negligent security into a lasting cost.
As much I'm against more regulation in general, I'm afraid as long as we don't do that, companies will always prioritize more features faster over security.
That means one of the working hypotheses is the threat actors had direct SSH access to Binance machines/environments.
The world economy is also being propped up by all of this. In all likelihood, this Binance hack is only a preview of what's to come.
Woopsie
If people are so simple minded they cannot see the downsides for everyone here, except the ones controlling the black box, then I don't know what to say.
Same thread as the Phorion article I read on the compromised extension.
People seem to think Proton Mail is a serious organization. His tone is the least of the problems.
I agree with that, but it's still shocking to me that somebody in such an important role can sound so unprofessional.
e.g.
https://www.404media.co/manifestos-fear-and-loser-thinking-i...
https://www.gadgetreview.com/ai-or-unemployment-proton-is-re...
I started to be wary when they got into Cryptocurrency https://proton.me/blog/proton-wallet-launch
For Proton Mail specifically, they are now pushing AI features, e.g. https://proton.me/blog/proton-scribe-writing-assistant.
The 404 media link is in a comment unthread, reading it does give me the impression that I should avoid the company.
I heard people want to put things like deeds on the blockchain but what happens if someone steals your keys? Do they own your home? Of course not. A system should have trusted intermediaries and centralized sources of record. If someone hacks my municipality and updates the record that says that they own my home, obviously that wouldn't hold up and that should be reversed. Why would I sacrifice that safeguard for technical elegance or promised efficiency? Why do I want to allow permissionless transfer of my deed to any party? What problem are we trying to solve here?
I think a lot of people seem to believe that the current setup of banks, currency, and regulation (writ large) is arbitrary and unique, but a lot of the basic building blocks are actually quite natural consequences of evergreen problems handling money.
there is almost certainly an easier way to fix the problems people are having by making adjustments to the current banking systems, including support for the growth of different banks that simply act more ethically.
I've made this comment before, but crypto always makes me think of bearer's bonds in fiction, where they always introduce the concept and very carefully emphasize to the characters that if they let go of it, even for a second, it's gone, and it's super important to keep hands on them at all times, and the whole scene is just on the nose foreshadowing that the bearer bonds will absolutely be stolen.
Well, the concept of "this belongs to whoever is holding it" felt like pretty heavy-handed foreshadowing for crypto too, and what do you know?
So glad you linked to that, I had missed it. Moving away from proton is now at the top of my to-do list.
Per Changpeng Zhao (former Binance CEO):
This seems to be caused by DebugBear compromise: https://x.com/debugbear/status/2115866496643535293?s=46&t=_R...
it appears to be an injection attack on the front end. injecting incorrect tx, but showing a valid tx for the user to sign.
Link: https://x.com/cz_binance/status/2115880474375749834?s=46&t=_...
Losing $5b is indeed a potential security issue.