Missing from the article - the hacker first compromised Resolv Lab's AWS account, took a private key from KMS that was used to control minting, then managed to extract $25 million into ETH before all protocol functions were suspended.
According to a writeup at <a href="https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/" rel="nofollow">https://www.chainalysis.com/blog/lessons-from-the-resolv-hac...</a> this started with a plain old hack that compromised their signing key.<p>They also had a smart contract which didn't do some proper checks, but the hack was only possible with the stolen private key. Whoever held the private key was able to mint a lot of money, unchecked.<p>So there was a traditional hack at the core of this heist, not just a smart contract exploit.
If the admins can "lock all transactions", what's the point of it being a crypto?
Exactly. Stablecoins make zero sense.
Micro transactions? Giving agents access to money ?
Unless you are also trying to prop up the us government by buying treasuries (us based stable coins)
Stablecoins enable cash-like (instantly redeemable and verifiable) payments for large amounts, for almost free.<p>In EU countries, you can't now buy a car with cash. You have to buy a bearer's check from your bank, which is expensive, requires that both parties have a brick and mortar bank, and doesn't work cross-border. Stablecoins solve this.
you can send them around easily without having to deal with bullshit payment systems
No-one in the real world wants to be paid with a $USR. Most everyone wants a cashapp/zelle/PayPal/wire transfer. The bullshit payment systems gained ground on crypto while crypto became more difficult/less usable
PYUSD is run by PayPal afaik.
I don't know what USR is, but I would prefer to be paid in USDT or USC if Wealthsimple supported it as deposit method. When I withdraw, I do Deel -> Wise -> Interac e-Transfer -> Bank -> Interac e-Transfer -> Wealthsimple. This is incredibly stupid and I am forced to buy Canadian dollars. For groceries or electronics, you can buy gift cards using crypto.
If you track the FATFs crushing of bearer bonds, bearer notes, non-KYC/non-AML offshore banking, and Hawala it almost perfectly tracks with the rise of crypto.
But you <i>do</i> have to deal with bullshit payment systems. I can't receive stablecoins in my regular bank account, I'd have to set up some crypto nonsense on DankRocketBets or whatever for it to even work.<p>Why would I do this when I can already receive actual USD without any extra ceremony?<p>Stablecoins are a solution in search of a problem.
The problem presents itself when you have dirty money to launder. It isn't a product for non-criminals but they have to convince enough gullible people to participate and blend in with them.
If your employer does direct deposit of USD into your USD bank account, you don't need stable coins. This is not the case for most people outside of the U.S.
Monero is better for that task.
Until it becomes another bullshit payment system
Makes it easier to do pump and dumps, was never about "privacy" or "decentralization" as web3 types parroted 4-5 years ago. Monero is the exception btw.
Stablecoins aren't cryptocurrencies in any sense of the word. It's just electronic FIAT.
I mean they use Blockchain, right? Isn't that like the only real requirement for the name crypto?<p>As long as you burn as much electricity as Andorra does in a week just to make a transaction, you're probably a cryptocurrency. And that's their sole benefit it seems.
Most blockchains nowadays are not proof of work anymore.
>I mean they use Blockchain, right? Isn't that like the only real requirement for the name crypto?<p>Absolutely not. Cryptocurrently exclusively refers to permissionless, decentralized, cryptographically secured, irreversible, fungible monetary system with a disinflationary or non-inflationary supply, following a voluntary, collectivized governance model.<p>A vast majority of tokens colloquially referred to as "cryptocurrency" couldn't be further from these principles. There are no stablecoins that are cryptocurrency. Ethereum is not cryptocurrency. Any coin issued by a corporation (e.g. Ripple) is not a cryptocurrency.
I don't know how this specific thing works, but I don't really see any fundamental problem with mixing and matching. If you believe in the benefits of crypto, then 50% crypto is still possibly better than 0%.<p>It's not like I forgo a lock on my front door just because my windows are made of glass.
Could this be an inside job?
What is the point of stable coins? Like why does anyone buy them?<p>It seems to me that their initial value is 1usd per token (or some other fiat I guess) and that's also the roof of their value: they kinda guarantee that they won't become more valuable than that.<p>They are less usable than fiat: more businesses accept fiat than crypto, especially weird and small coins like all stable coins are.<p>There isn't really a floor to their value, as demonstrated here.<p>I see plenty of downsides of owning one of these coins, but not a single upside?<p>Yet people apparently do buy them, so what is the upside? There must surely be something that's good about them?
They’re not really meant to go up in value.<p>The main use is just having something dollar-like that you can move around easily. That’s useful outside the US, but also for plenty of people inside the US depending on what they’re doing; especially businesses that have a hard time getting or keeping normal banking (cough gambling, porn, weed cough).<p>They’re handy inside crypto since you can move in/out of other assets without touching a bank. And sometimes you can earn yield on them, which is part of the appeal (with the usual “this can blow up” caveats).<p>Also, there’s a reason every company wants to launch one: if you control the stablecoin, you get the float and the rails. That’s a pretty nice business if people actually use it.<p>If you already have solid access to USD and don’t care about that flexibility, they’re less compelling.<p>But yeah, not risk-free at all (depegs, issuer risk, etc). And honestly there probably isn’t much real need for dozens of slightly different stables beyond the business incentives.
I think the idea is if you're attempting to actually use crypto in the way that you would normally use money (ie, to buy/sell stuff) then you don't want the volatility. So in theory, it takes away the volatility while living within the crypto ecosystem.<p>But obviously...things happen. Just like cash is usually relatively non-volatile, but financial crashes happen.
To take advantage of the ability to send money that way without the volatility
Let’s be honest, it’s principally for illicit use, a tiny fraction of privacy folks and then a lot of people caught in between who don’t understand yield but want to bet on a volatile asset and have to use a stablecoin to go between. (Because the backers of the volatile thing are doing something illicit.)
Has to be an inside job. One doesn’t just simultaneously hack into an AWS account, know exactly which key is needed for coin minting, and know internal details necessary to exploit a smart contract. The nature of the hack practically reveals their identity.
not even news.
And what happened next? He mixed those coins? Transformed them into monero?
>"However, the hacker was only able to siphon off $25 million; the rest was locked into the protocol after system admins got alerted."<p>"Only" ?!!! Poor thing.
Hacker? The coins were minted with perfectly valid code.
Oh wow, there's another interesting story on that site:<p>> Trump Administration Likely to Un-ban Bitcoin Mixers, Dept. of Treasury Says They are “Not Unlawful”<p><a href="https://bfmtimes.com/trump-likely-to-un-ban-bitcoin-mixers/" rel="nofollow">https://bfmtimes.com/trump-likely-to-un-ban-bitcoin-mixers/</a>
stable as in house always wins?
Self-Funding Bug Bounties strike again.
How is this industry still an industry?
Tl;dr another bug in a smart contract exploited, hacker got away clean.
Not that it matters much, but this summary isn't right. The contract wasn't "exploited." The company's AWS account was compromised, giving the attacker access to a (off-chain) private key.<p>The contract relied on the key to mint new tokens. The hacker gained access to the key (through AWS) and with it minted as much as they'd like. It is certainly a valid take that a contract that only required the private key to mint an unlimited amount of the token isn't a good one, but you don't exploit someone's front door lock by grabbing the key from under the welcome mat.
dang.. stealing money from fools and speculators.
But guys, what you don't understand is that the code IS the contract!!! That means you don't even NEED regulation!!
Yeah, people who genuinely believe that don't have any problem with smart contracts getting exploited. Of course there are people who _say_ that because it's financially expedient at the time, then change their tune. But both groups exist and this is not really a gotcha.
The contract code said, "if you have a valid (off-chain) private key, you can mint tokens." The hacker gained access to their AWS account and ultimately their keys.<p>While I am happy to celebrate dumb crypto stuff, this isn't a situation where someone's code was "exploited." Their code was stupid, relying only on an off-chain private key to allow the minting of tokens. Their security was just also bad.