Hacker News Reader

Comment by layerv-ai-qurl | Hacker News Reader

This is a really insane hack in comparison to the other ones we've seen. Genuinely Binance was so big that this is a real big wtf moment for crypto. If they can get hacked then what about all the other exchanges?!

View on HN

So was Mt Gox. No lessons were learned. No lessons will be learned this time.

People got out of crypto after the Mt Gox thing. The ones who stayed accepted the risk.

There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.

By definition maybe they’re more risk tolerant. But I’m not sure they consciously identify as that.

Most people in crypto are noobs, not hardened veterans of previous hacks.

The vast majority of crypto being held now was purchased by people who had never even heard of Mt Gox.

the crypto consumer base is veeeery different than durint Mt. Gox.

during Mt. Gox it felt like nerds and insiders, nowadays boomer dads are into crypto.

my point being that i don't agree with "the remaining people are naturally more risk tolerant", as there are way more 'new' people.

Well I've learnt my lesson after having lost 3 bitcoins as a student on Mt gox I finished writing my thesis on blockchain technology and then never touched crypto again.

Did you do the bankruptcy proceedings? They payed out quite well.

Turns out there was decent money to be made in having your MtGox Bitcoin stolen.

Nah I was a student struggling with responsibilities and decided to play World of warcraft instead before getting my shit together a few years later and becoming an engineer.

Only paid 800€ for the 3 bitcoin, which was significant but not necessarily essential.

I'm glad the people were made whole to some degree!

I think it's too late, but I'd consider seeing if you can still get into those bankruptcy proceedings. If you held 3 BTC there, you could expect around 30 000$ from the proceedings.

They closed registration for the proceedings many times. Which means they also re-opened it multiple times.

I'd expect the registration is permanently closed, but worth checking out.

What's the supposed lesson? To close the shop?

Never use someone else's wallet to hold your money.

Not your keys, not your crypto. Use a nice safe hardware wallet. Just check for extra SIM cards first, and audit the key generator.

It's insane that one has to go through this to be somewhat safe.

Roll the dice

Genuinely though, you're probably better off with an actually airgapped computer. Buy a $300 oldish dell or lenovo that you can slap ubuntu on to. Single purpose, no gaming, no email. If you keep it off the net, updates aren't needed. Sign transactions completely offline.

Keep the seed phrase safe. Use actual dice to generate it. Put a chunk of it into your wallet, a chunk into your password manager, a chunk in your attic or in a book, etc. Never type it into an internet connected computer.

Oh and, never tell anyone about how much crypto you have.

This is reasonably safe, and reasonably within the capabilities of a non cryptography nerd.

It's almost impossible to verify the code on the hardware wallet really matches the code they released and that the hardware has not been tampered with.

Maybe the sim card is on a timer to broadcast your keys after a year, so you just can't detect cellular signal usage now.

To securely own bitcoin you have to first create a new chip fabrication plant to then make your own hardware wallet.

Which is itself ironic as some of the most common hardware wallets have also had issues recently.

The idea that someone would have to buy a hardware wallet to be safe, but first audit the hardware and software is both a but ridiculous and infeasible. Unless one can actually inspect the code running on the device, auditing am open source library online doesn't tell you what is running on your device.

But that lesson does not apply here.

The difference is that Bittance loses only a few percent of their reserves and the dance continues. Gdox did ~70% of the daily volume for crypto and wrecked the entire ecosystem when they got 100% pwned. Maybe they've learned something!

Its more than their total reserve fund. Its a fraction of the money they hold for customers.

To put things in perspective, I used to dunk on crypto because of how dysfunctional and how people kept losing money in scams, hacks, or even by accident.

I no longer dunk on crypto.

Not because crypto got better, but because the joke got old. I got tired of dunking on it.

How do you prevent it though? My understanding is that it’s genuinely hard in crypto. Any automated access control must be baked into smart contracts, which are very limited in terms of the logic they can implement (in practice - in theory Solidity is Turing complete Id imagine).

A bank API can be 10-100s+ kloc if they need that to implement access controls.

The lession learned is: Tether now exists as a casino chip central bank. They can just freeze and print more and provide a backstop to the major CEXs.

Of course, Tether runs completely counter to any of the idealistic claims about crypto.

That shouldn't need to be a lesson learned though. Its been obvious from the beginning of tether and reinforced by how interested governments are in the idea of stable coins and CBDCs.

Mt Gox was widely reckoned to be a clown show long before they got hacked (it was originally a Magic the Gathering trading site for chrissake).

Binance's reputation is hardly impeccable, but by crypto standards they're kinda sorta the adults in the room. Then again, so was FTX.

I’d be worried about my crypto if I had any accessible online right now. AI based hackers must be looking for juicy targets as we speak and what’s better than crypto for stealing ? So many exchanges and wallets and shitcoins that could fall to some brute force agent swarms

Reply on news.ycombinator.com