About $2.4 billion out of this is already frozen by Circle and Tether. Some of the big ones:<p>- 971.15M USDT (Ethereum): <a href="https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659" rel="nofollow">https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba091...</a><p>- 823M USDC (Ethereum): <a href="https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a95fbdae9d2d58e13166afb7a1f4fc5f" rel="nofollow">https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a9...</a><p>- 312.73M USDT (Tron): <a href="https://tronscan.org/#/transaction/71b0ec0fe873fe820c37cc3ecbab4e83087f87e833d191012a0a4027d20594e1" rel="nofollow">https://tronscan.org/#/transaction/71b0ec0fe873fe820c37cc3ec...</a><p>- 175M USDT (Ethereum): <a href="https://etherscan.io/tx/0x0c07a5e428ce233a3bcb40f257ad899594421341d63ce94016822063362707bf" rel="nofollow">https://etherscan.io/tx/0x0c07a5e428ce233a3bcb40f257ad899594...</a>
What's the point of even stealing the stablecoins? They're controlled by private companies that can easily freeze them<p>Am I missing something here? Seems like a waste of time
> waste of time<p>It seems like it took some number of minutes and scored billions, and at that point it was a matter of whether/how much they could trade out before it was locked. I don’t know how many minutes or hours it took to lock? If they managed to trade 1% before blocking, that would be an extra tens of millions. If 10% that would be hundreds of millions, etc.
Fair enough
Most likely this would be used as a trial and error by the perpetrator. Most likely who took (6.xb) what he can when he was able to do so. There is an expectation of some sort of loss. Next time the people they're working with will see this as an opportunity for improvemennts, either in crypto vulnerabilities or related sectors that share similar procedure and safety.
Apparently [1], he managed to put them as collateral on a lending platform. That allowed him to borrow ETH. The way it works is that if you don't pay back the loaned ETH, the lenders can take the collateral. Except that here the collateral is itself frozen. So apparently, the ETH as now safe in the hacker's wallet and the lenders just lost a bunch of money.<p>I wonder why not swap them? And had he, would it have bricked the swap pool?<p>[1] <a href="https://x.com/czesmaill/status/2115988477905080716" rel="nofollow">https://x.com/czesmaill/status/2115988477905080716</a>
Maybe swap pools and/or law enforcement working together with stablecoin issuers are more vigilant about pools than they are about various DeFi lending pools, given that one usually represents a change of ownership while the other does not?
Thanks for sharing, very smart move from the badboys.
That's smart
Just wondering, how do we know the hacker was a 'he'?
In this case it looks like the attacker managed to swap some stablecoins into ETH before they were frozen.
I'm not clear whether the stablecoin providers will then be "creating" new coin to make binance whole - without which you've still fucked binance
That's a quick recipe to lose all their customers<p>That's exactly the scenario they say they would never do and go as far as to have external audits to prove that they're not just "printing" free cash
I guess the point is simply that "blacklisted" coin is no longer a liability. They wouldn't be "printing free cash" they'd be cash neutral.<p>The alternative is the stablecoin providers effectively keep the money for themselves. At that point the justification for the blacklisting seems like little more than self enrichment?
Pardon me, I should've explained my point better<p>There are reports that the hackers used the stablecoins as collateral to borrow ETH via DeFi, before the stablecoins were frozen<p>In this case, the hackers have the ETH, while the lender has some frozen stablecoins<p>Given this context I said that if they print some more stablecoins to make whole both the DeFi lender and Binance, it's a betrayal of their other customers
> if they print some more stablecoins to make whole both the DeFi lender and Binance<p>Oh absolutely agree - they <i>cannot</i> make both parties whole and I do not know which, if either, they are likely to do.
How? Just let the lender get screwed, don't lenders have some risk after all?
They absolutely are just printing free cash
They just freely delete their credit.
Why would they? In addition to moral hazard (next time), this is binance's fuck-up.<p>Have bad security, get hacked.<p>If binance wanted to hedge against that risk, they could have bought a cyberinsurance policy (if they could get one for the amounts they'd need).
They can just pocket the corresponding 5.6b USD.
It reveals what they are to the public. It's fake crypto with all the downsides of crypto but none of the upsides.
Probably not everyone knows, but USDT has a "black list", and admins can prevent any address holding USDT from spending. The black list is implemented in USDT contract.<p>So USDT is not truly decentralized and your money can be frozen for any reason or no reason at all.
So USDT is a great amazing decentralized censorship-free drop in replacement to USD except:<p>- much more awkward to use<p>- more liable to hacks<p>- deposits are not insured<p>- fewer legal protections<p>- doesn’t pay interest (or not easily anyway)<p>- and as I find out, bannable by a central institution with lower legal oversight than the Fed<p>I’ll keep a mental note of this.
That technically true for any coin where miners are organized enough, see the ethereum fork where bad contract made <i>wrong</i> people lose money so they forked entire chain to get the money back
Suddenly, physical Gold in a safe at home looks fairly decentralized and censorship-proof
Until someone robs you. I've seen teams of burglars target asian households around weddings, because they know that all the family gold will be in the house. Fastest way to lose 100k.
i'll have to recommend "practical doomsday" here - <a href="https://lcamtuf.coredump.cx/prep/" rel="nofollow">https://lcamtuf.coredump.cx/prep/</a> (edit: because it spends a lot of time on the topic on how to secure your wealth). or ask lcamtuf himself.
Gold is down YoY. I prefer banks and stocks.
Until you need to move or share it. That's why monero XMR is the only serious fungible and decentralized cryptocurrency
I don't doubt what you're saying. But as someone who is really not buying into cryptocurrencies, this is exactly what someone who holds a big amount of some obscure cryptocurrency would say.<p>I've heard good things about monero from a friend. This is not an attack on monero, rather a reflection on the general tone of the message.
It's a store of value, rather than a medium for transaction. If you want to move or share it, you pick it up and move or share it mostly...
Not sure about this, isn't it hard to convert to fiat currency for real-world spending? Since it is often used for illegal activities, Coinbase (and I guess other big exchanges as well) don't trade it.
Unless you are moving more than about 1 million dollars in gold, it's actually quite easy to move it.
It's very easy to pick it up, put it in a car or van, and move it to a different location.<p>It's <i>much</i> less easy to convert it to something you can actually spend. Even if you can get it to a buyer, they'll always offer you less than you expect/want.<p>Reputable dealers have KYC reporting duties of their own. Disreputable dealers... may have other ideas.
Of course dealers have KYC (you generally need to give your id) but this thread was about having one's own gold in a safe, not about shady dealings or stealing gold.<p>Gold sells at about 1% less than the current market price of the gold content of your item which I find fair. It might be easier here in Antwerp than in other places to deal with gold because it's kind of a gold trading hub. You can basically show unannounced (I suggest going by bike rather than by car because there is little street parking) and trade your gold for cash at the -1% rate, obviously if you get to the million euros range it's going to be a bit different, but for a few tens of thousands it's business as usual. And it's not like it's a difficult place to reach from anywhere else in the EU.
I would be nervous moving borders with ~1 million dollars worth of gold.
Talk to airport security people. The number of travelers, particularly from India and the middle east, with gold bars is nuts. It isn't loose bricks in a sock bag, but piles of one-ounce bars in plastic wrappers, stacked like playing cards, is not unusual. The Canada mint has a reputation for excellent gold/silver. Middle eastern tourists regularly return home carrying stacks of canadian gold/silver bars.<p>As opposed to junk like this:
<a href="https://www.reddit.com/r/Gold/comments/1xab90c/first_gold_bar/" rel="nofollow">https://www.reddit.com/r/Gold/comments/1xab90c/first_gold_ba...</a><p>When the canada mint does a movie tie-in, they do it better:
<a href="https://cdncoin.com/collections/rcm-new-arrivals/products/2026-deadpool-wolverine-pure-gold-collectible" rel="nofollow">https://cdncoin.com/collections/rcm-new-arrivals/products/20...</a>
Not sure why this is getting downvoted.<p>One of the only surviving darknet markets only takes Monero as currency.<p>Make of that information what you will
Look into the history of USDT. It's creation was dodgy to say the least.<p>Over time I believe it's founders did start backing it with Treasuries so now it must turn a nice profit for them.
I have said this many times, and will probably have to say it many more: Stablecoins are nothing but a face-saving measure for the US government.<p>It is politically impossible to go back on KYC/AML measures in the traditional financial system, even if some of them were perhaps a bit too ill-advised. It's much easier to say "this is shiny new tech, very different from that old tech over there; we support innovation so we won't impose KYC requirements on it", even if there's no logical reason to do that.<p>As it stands, stablecoins let you make a keypair in the privacy of your own home (or your own agent sandbox, as it were) and immediately start transacting. They're allowed-by-default instead of blocked-by-default, with the US government still able to block you if they have a specific reason. No traditional bank I know of, in any country, works like this. This is a valuable capability to have, technologically, even if there's no technical reason why a Postgres database and a REST API couldn't provide the same service, but faster and more easily.
> great amazing decentralized censorship-free drop in replacement<p>It's not and never supposed to be and everybody who uses it in any significant amount knows that. Don't mistake a cryptotoken with a cryptocurrency.
USDT is created by a super shady company and is not at all decentralized or censorship-free. You could have made the argument for Bitcoin (and still can to a certain level) but most cryptos that propped up after that or stablecoins do not follow the hacker philosophy and more the banker one. Ironic that the whole crypto movement got co-opted by the likes of JPM which it seeked to replace.
Recently I tried to donate to a project using their preferred crypto payment processor flow, which purported to support "Coinbase Wallet" integration. So thinking that was just like, Coinbase, I said "sure why not" thinking it'd save me the effort of copy/pasting long strings back and forth.<p>Turns out, Coinbase "Wallet" is a completely separate thing from Coinbase, and long story short, ultimately ended up accidentally converting some spare ETH I transfered into some kind of garbage Binance "wrapped" Litecoin. Which had <i>zero</i> indication/warnings in the app other than a like 4 pixel Binance logo superimposed on the 16 pixel Litecoin logo that it wasn't the real thing.<p>Once I gave up on this Wallet experiment I ended up needing Gemini to walk me through all the Binance "gas" nonsense to finally manage to swap into a real coin I could transfer out (like 80% of what I started with after subtracting gas fees and miscellaneous leftover change I was stuck with). And while transferring I had to avoid like a dozen alternative networks consisting of seemingly random strings and a scary red banner saying "yo don't fuck this up".<p>My first red flag should have been that Coinbase Wallet's Play Store name literally advertised betting on prediction apps. Second red flag was while looking for "Litecoin" in the list of coins, there were literally about 5000 different spam/meme coins with dozens of near identical clones that were all name squatting on top of each other.<p>As someone who came of age in the Crypto 1.0 "Bitcoin is for buying drugs" era the entire exercise was utterly baffling and somehow significantly less usable than crypto was a decade ago for actual payments. I guess for a young person looking to illegally gamble their paychecks at some unlicensed offshore prediction market it provides some utility I'm missing but man, the experience just made the post-Web 3.0 crypto scene look .... grim.
You missed out that it is run by crooks closely associated with SBF and shady banks like Deltec<p><a href="https://dailycoin.com/sbf-tether-deltec-secretly-colluding/" rel="nofollow">https://dailycoin.com/sbf-tether-deltec-secretly-colluding/</a><p>Also, it's not decentralised, they just unilaterally froze 2 billion in funds.
if its bannable by a centralized place please explain how it is decentral? i thought that was the kind of controls a decentral system was specifically designed against. is that understanding of mine flawed?
Your thinking is not flawed. It's just not decentralized.<p>Decentralized cryptocurrency is an ideal from early 2008's from the Bitcoin supporters. It's not the reality of cryptocurrency in general.<p>Cryptocurrencies are full of contraditory ideas between the founding ideology and the actual usage.
It might be decentralized in terms of infrastructure, but the more precise property is that it is <i>permissioned</i>. Permissionless stablecoin exist - see DAI, etc, but USDT is absolutely not one of them. It is the worst parts of cash and the worst parts of crypto put together into one unholy pile of suck.
Tether isn’t decentralized or censorship free in any way
No one ever said USDT was decentralized.
> bannable by a central institution with lower legal oversight than the Fed<p>It’s way easier to take a company to court than any government entity.
Well actually, no. The Tether T&C says that they can basically do whatever they want with your wallet, all disputes have to be resolved via arbitration, and you waive your right to a jury trial.<p>Sure, you _can_ still sue them anyway and maybe get around the T&C, but you can sue the government to, the important question is if you can actually win.
But the company can just turn around and say, soz we don’t have your deposit. We invested it in Labubu dolls and they crashed in values. Also we lost them. Next time, DYOR.<p>If a bank collapses, you get your money back from the Fed, no questions asked.
[flagged]
[flagged]
Tether's entire business model, providing an almost-unregulated USD cryptocurrency, relies on them not arbitrarily banning people. They don't do it frequently or without thought. You're far less likely to get banned from USDT than just about any non-cryptocurrency financial institution.
> Tether's entire business model, providing an almost-unregulated USD cryptocurrency, relies on them not arbitrarily banning people<p>No, their entire business model relies on bank/CC providers don't ban them. Somehow, they treat all crypto related transactions as iffy but USDT, bought to buy crypto, got under much less scrutiny. The entire problem their solver was that new users couldn't move cash to exchanges fast enough to join bull runs.
Yeah, until Trump (or whoever is president at the time) tells them to.<p>What will they do when the alternative is broken bones?
You can say the same for many other industries:<p>> almost-unregulated except when the authority say no.
Turns out that there are quite good reasons to have a centralised currency after all. Who would’ve known.
yeah the issue is if you built it they will co opt it
Isn't the centralization the reason they got stolen? It was Binance that was hacked, not the blockchain technology.
Individuals get hacked and their bitcoins taken so often that it doesn't make the news.
By the way, it wasn't just Binance that got hacked. Several other exchanges were hit too.
Well in traditional banking you essentially have the ability to reverse
Turns out the reason crypto was invented isn't "decentralization" at all, it was nerds feeling left out and wanting their own financial instrument grift.
Yes, but there are more good reasons to have it be decentralized.
Well sure, but the average consumer needs and/or wants some protections, safeguards and insurances. If my bank gets hacked or even if I get skimmed it's considered their fault and I'll get my money back.
Arguably any fiat-collateralised stablecoin is ipso facto centralised and trusted (someone needs to 1) issue the coins <i>only</i> against fiat collateral and then 2) hold onto that collateral reliably and 3) return it upon presentation of the coin), and at step 3 they can always say "no, we won't give it to you".
Your point has nothing to do with fiat.<p>It applies equally well to a fiduciary coin with a promise that 1 gcoin = 1g of gold or whatever.
Why couldn't a privacy focus coined, like Monero, be a stablecoin?<p>You don't need to see where the coins are and move to promise $1 of going for every coin.
Probably the founders/employees of the company issuing/redeeming the token would be arrested very quickly. Tornado Cash people got arrested for much less.
How are you guaranteeing that your private stablecoin will keep its $1 value?<p>How are you bootstrapping a network to validate private transactions without the promise of potential gains in coin value as its popularity takes off?
Who makes that promise? That's who you are ultimately trusting.
Decentralized is a great concept but it’s 99.9% rug pulls and you can’t get any safety unless you centralize. As an investor there is no way to protect yourself because the rug pulls are several orders of magnitude more sophisticated than most people’s understanding.
> As an investor there is no way to protect yourself<p>Why? BTC is pretty stable longterm and nobody is going to touch your cold wallet. Anything that has an owner or legal entity is not decentralized, subject to either rug pull or censorship and shouldn't be touched, sounds very easy.<p>Everything that promises you any return is a scam in crypto, simple as that.
The U.S. government is the largest beneficiary of this service. More than $2.1 billion in USDT connected to or requested by U.S. authorities out of over $4.4 billion in total illicit USDT freezes globally.
If they baked in a function to freeze USDT, why not also add a function revert a transaction flagged as part of a hack?
Because they own and control their own smart contracts but do not own the network that the contracts are deployed to.<p>Plus, freezing funds and waiting for US law enforcement to weigh in rather than being the proverbial judge, jury and executioner is now likely to keep you on the right side of said law enforcement.
> Because they own and control their own smart contracts but do not own the network that the contracts are deployed to.<p>I assume they call a method on the contract to freeze the coins (with some superuser kind of signature), so they could easily write a method that moves the coins back, too. This should be similar in terms of gas costs.<p>The law enforcement theory seems more likely, yeah.
Anyone can refuse any bitcoin, too. But that's not implemented in the contract, just by how much real money people want to give you for bitcoin.
A shame that they can and do so here but happily facilitate transfers or scam victims, human trafficking and sexual abuse including of minors.
I lost ~20,000 USDT by accident once and the CTO just sent me some freshly printed ones. That was many years ago though.
So when tether is blacklisted, is it reissued?
Did they ever show proof that they actually hold $1 for every tether? This was big a few years ago but never heard anything about it since. (I could Google it but others here probably want to know)
The financial system has evolved over 5000+ years and is like an endless series of Chesterton's Fences at this point. Here we find another: the ability for a regulator or a bank to freeze assets is once again proven to be a feature not a bug.<p>Managing a wallet where there is no recourse if your wallet is compromised is simply too difficult when even crypto exchanges get hacked and otherwise sophisticated people get compromised when taking cautious measures (eg [1]).<p>Crypto really is and always was a race to the rug pull.<p>[1]: <a href="https://www.straitstimes.com/singapore/about-3-5-million-lost-in-spore-due-to-tampered-ledger-crypto-hardware-wallets" rel="nofollow">https://www.straitstimes.com/singapore/about-3-5-million-los...</a>
You know what isn't a Chesterton's fence? Payment processors being able to dictate what I can or can't spend my money on.<p>This by itself is a reason to push for more crypto acceptance, in my eyes.
Yeah but what if I hacked that money fair and square? Why should anyone have the right to block my hard earned not-cash?
Frozen assets are still a wallet with no recourse.
Indeed! And Elon Musk just gave the entire world a lesson in not trusting someone else's technology, by shutting down Ukraine's Starlink/Starshield used to defend against Russian jet-powered drones, cutting down the speed to near-stationary, and for no evident reason, blaming the President, and then it turns out it was likely a ploy to "upgrade their subscription". [0]<p>No matter what the reason or the situation, shutting off your access to the technology is their option and it will likely happen at the moment it is a greatest problem to you.<p>This goes so far beyond "Not your keys, not your coin", it is "Not your stack, not your sovereignty".<p>Obviously in this case, there is are truly solid rational and moral reasons to shut down those USDT transfers: to cut off the theft which is funding NK's aggressive nuclear weapons program. But that changes nothing about the structure of <i>everyone's</i> vulnerability in using technologies controlled by others such as USDT.<p>[0] <a href="https://newrepublic.com/post/217349/elon-musk-cut-off-ukraine-starlink-force-pay-more" rel="nofollow">https://newrepublic.com/post/217349/elon-musk-cut-off-ukrain...</a>
So they got “only” ~$3 billion
Interesting I didn’t know you can block/cancel transactions. Does this have to happen before the new block is minted. or it can happen after, that’s what I’m inclined to think just based off of the word block
Centralized stablecoins like USDT and USDC aren't layer-one cryptocurrencies like Bitcoin or Ethereum. They're more like applications running on top of other blockchains, usually as smart contracts, and their issuers hold admin keys which can freeze, mint, burn, and otherwise redistribute funds at will. As far as timing goes, stablecoin issuers can't actually cancel or reverse a transaction that's already in a block that's been mined, but they can freeze the receiving address afterward and burn the funds there, then reissue them elsewhere, which has much the same effect.
At which point they might as well use a database to keep track of the money, like banks do, and drop the cryptocurrency aspect, which was only ever a fig-leaf to keep regulators away.
That sounds interesting. How is that different from a bank? What are the advantages and disadvantages compared with a traditional bank?
If traditional banking is available to you, then I don't think that there are any significant advantages. But lots of people—notably those in countries with unstable currencies [0]—don't have access to high-quality banking, so for them, stablecoins can be an acceptable substitute in some cases. It's probably not a great idea to hold stablecoins long-term (there's always a risk of the sponsoring company going under, and unlike bonds they don't pay interest), but it should be fairly safe to use them for transfers, since the transfers are quick enough that there are very low odds of the company becoming insolvent while the transfer is underway.<p>[0]: <a href="https://news.ycombinator.com/item?id=50012907">https://news.ycombinator.com/item?id=50012907</a>
Its a weird loophole or so.<p>You take 1 $ from someone and give them a token, now you have money the other not. In theory you need to make sure you keep the 1$ but you want to pay people and you are greedy so you invest it and suddenly everyone is broke.
It’s completely unregulated and they can print infinite money.
That doesn't sound very decentralised.
Stable coins are not decentralized
Stablecoins only use the accoutrement of blockchain as smoke and mirrors to distract and confuse regulators, not because they actually benefit from it at a technical level. They aren't really decentralized at all and could just as easily be a database, except for the regulatory thing
nothing about crypto is decentralized. it's verified by enormous mining farms, who contribute hashes to centralized pools, all stored on one central ledger, and interfaces with the fiat/legit financial system only by using that very financial system.<p>oh, and three acounts hold like 25% of all btc in circulation.<p>crypto can do some things, but decentralization isn't one of them. just ask Coinbase<p>USD tether is barely crypto at all, it's a wrapper around treasury bonds which the US govt. regulates
If USDT gets to a frozen list - that means that Tether does not need to comply with requests to convert it into USD? I guess this is very useful for Tether and the other stable coin emitters.
Less than half is frozen then?
Wait, it is decentralized but can be frozen ?<p>No. You just can't use these platforms. But a knowledgeable hacker will be able to add a transaction tot he blockchain.
> About $2.4 billion out of this is already frozen by Circle and Tether. Some of the big ones:<p>How does freezing crypto work in this context?
The smart contract for those tokens supports freezing. Tether just calls the freeze function on that address.
Can they forcibly reverse the transaction so that Binance gets their money back?
No. The last time this happened, it led to the Ethereum/Ethereum classic split, and that was 10 years ago.<p>However, the stablecoins are not “real” cryptocurrencies like e.g. BTC or ETH, but are built as smartcontracts on top of ETH, basically using it as a big replicated database. So they might(?) just manually “give back” the money to Binance, as in freezing money in the stolen account forever and “printing” an equal amount to Binance's credit.<p>Or, to put it in another way, no need to reverse an erroneous SQL transaction if you can just create a new one that fixes the data you altered.
And it's impossible to mix them because Ethereum is even anonymous than Bitcoin.
Isn't it already too late at that point? The tokens would have moved already.
I think the idea is that they freeze them indefinitely, and then they no longer count against the centralised reserves, since they can never cash out. Now they can mint the equivalent amount back to Binance and remain solvent.
Moved where? Moving to a different wallet wouldn't prevent freezing. It's 5B, impossible to cash out or exchange for different crypto quickly.
Excluding wash and artificial activity, supposedly stablecoins trade 400M/h so <i>if</i> it took 2h to notice and lock they might have been able trade about half a billion without overwhelming existing volumes?<p><a href="https://finance.yahoo.com/markets/crypto/articles/stablecoin-transfers-hit-891-billion-225100970.html" rel="nofollow">https://finance.yahoo.com/markets/crypto/articles/stablecoin...</a> (I didn't verify per-stablecoin volume, or actual volume at those hours, or typical volume for those exact hours, which a better analysis would have done.)
here's an interesting article by DataFinnovation arguing that blacklisting crypto is doomed to fail.<p><a href="https://medium.com/chainargos/losing-the-blacklisting-race-eea51d0a0f7b" rel="nofollow">https://medium.com/chainargos/losing-the-blacklisting-race-e...</a>
right but too late to call freeze on the original wallet address as per gp's post. I would imagine it got distributed to many wallets and attempts to tumble by the time Tether could move on it.
they took loan against it.
Most crypto assets are operated by a smart contract that controls every transfer. So the contract can decide to not perform certain transfers.
It doesn't, the hacker already loaned against it to get eth so they froze saves assets.
Frozen? What are they going to do, fork the blockchain?
USDT and USDC are both centralised crypto currencies with a single source of truth.
If people dont know, they should look up DAO hack and Ethereum hard fork.
[flagged]
That's not the whole point at all. And there are truly wild west cryptos, but most people want some trustworthy regulatory body, whether it's a government or not, backstopping their funds when they get large enough.<p>For instance to unwind a 5 billion dollar robbery
"people want some trustworthy regulatory body"<p>Have you talked to Crypto-enthusiasts before? They very much don't want that.
But if I am the victim of a $5k or $50k robbery, I'm out of luck. Yay.
That’s why crypto is so dumb
Stablecoins are fiat on-chain and they are legal so they need to have the freezing mechanism in the smart contract otherwise they could go to jail.<p>So crypto + legal company means not really following bitcoin ideology anymore
At least a motivated person could audit the smart contracts on this. It isn't like it's a surprise when it turns out it's possible to freeze these coins.
this isn't crypto, it's US dollars with a techno-wizard sheen on the top for no reason
governments, banks freeze currency all the time
> Freezing crypto is so disgusting to me I don’t know…<p>The feature literally appears to have just saved over two billion USD from being stolen! I mean, fine, "disgusting" is subjective. But the need for the feature is real and quantifiable (and very large) and it did what it advertised.
[dead]
[dead]
I thought crypto was built specifically to prevent these 'freezing' actions? wtf
Does anyone on this website realize there are different types of crypto coins?
USDT is implemented as a contract written in Solidity, working over other network like ETH, and it has a blacklist managed by admins. Once address is added to a blacklist, you cannot spend anything from it.
yeah bitcoin indeed was
Looks like a DevOps guy is going to take the blame for this: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." <a href="https://x.com/binance/status/2115993361517891592" rel="nofollow">https://x.com/binance/status/2115993361517891592</a>
If a compromised laptop was the entry point and that allowed someone to steal 6 billion dollars, it’s not really the engineers fault, right?
"A loss of X dollars is always the responsibility of an executive whose financial responsibility exceeds X dollars." - Weinberg’s 'First Principle of Financial Management' and 'Second Rule of Failure Prevention’
- 'First-Order Measurement', Quality Software Management, Volume 2, Gerald Weinberg
Well it is engineers fault. But not that engineers. Some engineer designed a system without extreme oversight that should be involved in the process.
If you follow that trail far enough it's whoever designed cryptocurrency, right? Because banks can and do reverse transactions as last resort.
We have determined that the initial conditions of the universe and the laws of physics are at fault for this incident.
No, because this is explicitly the design of Bitcoin. If you give me a foo machine but it makes a bar, that's your fault. If you give me a foo machine and the foo hurts me, that's my fault.
[flagged]
Broken by design?
Banks can't reverse wire transfers. Unless there is some super-level intervention that is very rarely used. But they can trace where it went.
And the amount of process and control around a wire transfer is monstrous to reduce risk.<p>Watching crypto rediscover 100yr of financial regulation and system/process design has never not been amusing to me, esp as someone who works in an asset that has solved the custodianship problem (not that people in the industry aren’t actively attempting to light those safety rails on fire to make a few extra bucks).
What frustrates me is I _still_ can't buy a burrito with it! Cmon guys, I would gladly have a smart card or rfid phone app to efficiently move petty cash around and cut out the $0.50 that big banks make on every transaction. I won't have any more than $300 on it at any given time, so if I lose it im not out of a life savings.<p>Nope, using money for everyday purchases is not kewl enough for the bored apes.
Banks had 100 years to refine the user experience. Crypto is everything opposite of a good UX.
do you know how many laws and reg. exists to stop that? is it too hard for you to understand how finance steals that from you? you can build almost $0 fee system even today but regulator + lawyers in banks will come after you to put you in prison for not paying millions to licence for each state or several states. Things are simple, rent seekers stealing from everyone is not.
You can build a 0$ fee system, but how are you going to finance its support, KYC to prevent mad ransom money laundering, etc?
A bank can't unilaterally reverse a wire transfer, but in practice they can. If two banks realized 20 minutes after a wire that it was an error/fraudulent, the receiving bank could freeze the account and then work to send the money back in a new transaction.
This kind of low bar reminds me of FTX
More like Mt. Gox. FTX was downright fraud, from day one. SBF was already lying about Alameda's supposedly insane returns when it was all a ponzi.<p>He got tried and jailed for a long time for fraud.<p>Mt. Gox was just incompetence, like Binance here. But then on the other hand Binance is making so much money that to them $3.5 billion to cover the losses is just a slap on the wrist.
Did they get enough time to design and test in properly?
If nothing else it shows a complete disregard for insider threat.
Nope, that engineer had far too much access. I'm confident this is the case in pretty much all organizations to some degree, but a lot of engineers are also the only ones that can deny themselves the access so in a roundabout way it's their fault anyway.<p>But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".
It's not a access thing, it's a security control.<p>For example at most good crypto companies that hold wallets it's not possible to ssh at all, even if someone asked and go permission. It just simply isn't possible short of having a AWS root key or physical access to a computer in a DC.<p>There is no login, no accounts, no ssh keys or similar, they are immutable containers running from images with a signed SHA. The SHA can only be built by a build system that has it's own set of strict security controls.<p>Without details, I don't know why a comproised laptop would make any difference unless it submitted code through a PR and had it approved by multiple people.
I worked on a non-crypto, sensitive financial system two decades ago and similarly the end servers that ran the application stack were severely stripped down Linux instances with no shell, no interface to interact with outside of an application command channel, the hosts that could access that command channel were air gapped, and still the entire thing was wrapped in three layers of transaction auditing that were entirely disassociated from one another (different devs, different access, different source of data for auditing the same record).<p>I cannot look at how these companies are run with anything but derision. It’s institutional laziness, and it’s sloppy.
> access "in case they need it"<p>A good solution to this is to have a "break glass" system. Ie. access permissions get granted to the developer directly in an emergency by going through a set of steps available beforehand. All requests by that developer are then allowed, limited to 10 kilobytes of results per minute and logged.<p>For example, imagine you run a bank, and a rare code bug means that at exactly midnight on new years eve all bank balances have $1B added to them.<p>Your oncall takes down the production servers to to reduce losses and uses the break glass system, by getting approval from n other developers, allowing them direct database access. They use that access to count(accounts) with a balance around $1B or more, see it is everyone, and subtract $1B from them all, before bringing production back up with an older software release. Downtime = 2 hours.<p>In the morning, all the developers actions are reviewed.<p>If the developer turned evil and trying to dump the database, the n approvers and 10 kilobytes per minute would reduce data loss. But the break glass system still lets the developer make fairly major emergency fixes to reduce losses or downtime.
Break glass systems are very good but they are also challenging to make. It requires at minimum a system to get approvals from n other people and a system to do logging. It means your authentication and authorization systems must both be working, at least a small amount of non-volatile storage is available, and this often implies the availability of more foundational services such as service discovery, name lookup, distributed consensus, and replicated storage.<p>The problems can be overcome, but management types may balk at the cost of a complete break glass system.
In your scenario anyone who had $1B or more before midnight is now $1B poorer, so I don't think people would be very happy with that engineer either, regardless of whether there's a break glass system.
Laptop? Was it a company laptop that remained in the office, locked up?
Not only. I'd say the fact that something was stolen might be the engineers fault (depending on how exactly the laptop was compromised). But the amount that could be stolen like that is just ludicrous.
We have no idea if this is accurate or honest or if engineer did something negligent.
If you download a typosquatted package because you don't check what you type or your AI assistant got fooled I'd consider it my fault in such a case.
If the engineer, without being hacked, could take 5 billion dollars from your company and flee the country to go buy an extradition-free island, you have already gravely fucked up as an enterprise. The only way this happens is if your system is designed to allow this to happen.
This is how virtually all "crypto" exchanges work -- especially the closer you get to "shitcoin casino". Proper role and system isolation is a challenge if you support just one cryptocurrency. It would be incredibly hard for dozens, assuming service supporting dozens bothered.<p>I agree it's a grave fuckup but its a common one. You should just assume that when you deposit coins somewhere there are dozens of people who could just walk off with everything on their own. It's remarkable that it doesn't happen more often.
I recommend everyone to move your plantext secrets from ~/.kube/config, ~/.ssh etc into a password-manager. You can tell Claude to adjust the config files to get the secrets from 1Password when they are needed with TouchID requirements etc.
These days I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who (The dialog 1Password shows is pretty bad) that it would be very easy for something to slip in there.
> I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who<p>This is a one-sentence horror story. I almost can't believe someone would let this happen, unless the 1Password account is not important (highly unlikely).
Permission fatigue is real.
I know it sounds bad, but it’s the reality for most people, just like permission prompts at every corner and after each macOS / app update (“Your screenshot app is watching your screen”, no shit, that’s why I installed it).
I have been using Yubikeys for years, according to this guide: <a href="https://github.com/drduh/yubikey-guide" rel="nofollow">https://github.com/drduh/yubikey-guide</a><p>The nice thing is that using the private key <i>requires</i> physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.
> The nice thing is that using the private key requires physical touch.<p>Yeah (not talking about crypto): yubikeys (or similar) are <i>really</i> sweet for that. I've use them for ssh / pushing / fetching from Git etc. I use them for 2FA to various services etc.<p>There are also similar devices where you enter a PIN and the PIN to register to a service the first time and then the PIN to auth are <i>different</i>. So you can't be tricked by mistake to register to a new service <i>when you just want to auth</i> (you could still be tricked to register to a service which ain't the one you think while registering, but never while auth'ing).<p>And yup I use that with AI all the time: my agents go inside a container or inside a VM (or both), and the damage it can do is very limited.<p>It's also possible to do passthrough of devices (GPU, USB, ...) to VMs: good stuff.
if $5.6B is protected by your index finger then you're gonna need kidnap insurance, and a really good pair of gloves.
It's not protected by the index finger at all. There is no fingerprint reader in a Yubikey. The only protection is that it requires physical access and can't be triggered from software.
The point is the attacker has to be near you and mot somewhere around the globe
Sigh. I forgot I posted this in a crypto-related thread.
How would that help when your workstation is compromised? They can just steal your authentication the moment you log in through the password manager
It does help in that the secrets are not in plain-text, readable for any script you run. With 1Password, a process asks for the password and it gets transferred not through the filesystem but through IPC. 1Password shows a dialog: "Do you want iTerm to get your SSH key ABC123?"<p>In my thinking, this is more secure than plaintext in filesystem
My secret is `4`. Is that ok? Do I still need to move it??
as for ssh keys, you can generate your keypair in secure enclave and reuiqre touchId for every new ssh session. The private key never leaves the secure enclave.
Isn’t the password manager a prime target too?
you know most password managers have open sockets, or other channels to other local processes to interact with and allow stealing entries?<p>you know most tools like gcloud, bitwarden, etc store auth keys just in dotfiles too?<p>Local compromise is KO now, and we can't do shit on platforms like MacOs didn't research Linux recently
The fact a single devops guy has the access to do this is the actual issue
One person's key probably should not be enough to move billions no matter who it is.
Some of the old Mt Gox threads are an interesting read today:<p><a href="https://news.ycombinator.com/item?id=7203051">https://news.ycombinator.com/item?id=7203051</a><p><a href="https://news.ycombinator.com/item?id=7294762">https://news.ycombinator.com/item?id=7294762</a><p><a href="https://news.ycombinator.com/item?id=7369879">https://news.ycombinator.com/item?id=7369879</a>
If hacking one devops engineer's laptop is enough to move $6B of assets out of Binance, Binance is staggeringly incompetent and their customers need to move their funds out right now.
Sounds like it's already being moved for them
I wonder though how a sensible architecture would look like. Sure it would involve HSMs but ultimately they need to support transactions and APIs.<p>Probably this draws the line to more traditional banks which are notorious for having so many layers of checks and firewalls.
I think a sensible architecture would involve many pools of wallets with different availability. So the majority of funds can probably be completely offline, with only occasional transfers to/from various offline vaults. The there could be different groups of different levels of online funds that are ideally physically separated (individual teams and employees can only access a subset of the wallets).
> I wonder though how a sensible architecture would look like.<p>Any withdrawal should only ever be authorized from wallets protected by multisig and every withdrawal should go through several machines, running different implementations of the exchanges' verification part of the codebase, replaying the user's entire deposit/trading/withdrawal history and verifying if the withdrawal the user's asking matches his balance/history.<p>Devs working on "verification before withdrawal" on one of the stack should be forbidden from ever touching the other stack, and vice-versa.<p>This would prevent SNAFUs like this one for now at least two devs would need to be independently owned before such a heist could be pulled off.<p>I'm not saying hacks would be impossible. But the "I still $6 bn in 20 minutes" would be <i>much</i> harder to pull.<p>Another sensible thing to do would be to not have $6 bn on a warm wallet: I really don't think Binance really that much at all times available on warm wallets?<p>Nothing is 100% secure: but the "one dev gets its laptop owned, hence $6 bn disappear" is just madness and, as a whole (not speaking about crypto here), we can really do better here.<p>For a start we can do better than thinking: <i>"Nothing can ever be 100% secure, so there's no way to do better than seeing $6 bn vaporize in thin air when a single dev's laptop gets pwned"</i> (I'm know it's not what you're saying: you're asking what can be done better).<p>So many are going to think: <i>"But if you do that, it still can be hacked because this and that"</i>. Which ain't the point: the point is to make hacks harder to pull off, not to make them impossible to pull off.
Let's be real here: People probably should have never done this in the first place.<p>If your Bitcoin is on someone else's computer, it is not your Bitcoin.
What you hear on the news, it’s not usually what actually happened.
Binance literally tweeted this themselves [1].
So either Binance is lying, in which case they cannot be trusted. Or their security practices allow developers unprecedented access to wallets, in which case they also cannot be trusted.<p>[1] <a href="https://x.com/binance/status/2115993361517891592" rel="nofollow">https://x.com/binance/status/2115993361517891592</a>
Molly White (she runs web3isgoinggreat) seems to think this is real [0]<p>[0]: <a href="https://bsky.app/profile/molly.wiki/post/3mz27m5slcc2o" rel="nofollow">https://bsky.app/profile/molly.wiki/post/3mz27m5slcc2o</a>
Her reporting is superb and you should follow her: <a href="https://www.citationneeded.news/" rel="nofollow">https://www.citationneeded.news/</a>.
Some further writing from her: <a href="https://www.citationneeded.news/binance-theft/" rel="nofollow">https://www.citationneeded.news/binance-theft/</a>
I wonder what compels her, rekt etc to keep covering crypto shenanigans. If by now you don't already think crypto is corrupt, web3isgoinggreat is not going to change your mind.
I love how @cz_binance tweeted "user funds are safe!" in that thread. Wasn't that a bit too early? Are they?
This is real.
As someone that has audited most of the major crypto custodians, who mostly ignored my advice and chose speed over security, I am honestly not even a little bit surprised.<p>Seriously, often many members of an engineering team have the ability to move billions of dollars in value solo.<p>Negligence is absolutely the default.
Interestingly, this 18,270 BTC Binance theft is only "the largest crypto theft on record" when measured in USD. In terms of pure BTC, it's not even close to the 2011-14 Mt. Gox loss of ~850,000 BTC!
The fact that they were able to 'freeze' some of the funds and recover it, does that not mean that crypto is also centralized like banks?
Not like the banks. Those are carefully scrutinized by large well funded regulators and auditors and subject to complex legal requirements developed over decades.<p>To be fair tether hasn't actually lost billions of dollars yet, whereas banks absolutely have. Overall though I don't feel inclined to trust most stable coins. The cryptography protects your virtual currency but the governance is what protects the assets backing them, and the governance looks weak.
Stablecoins are indeed centralized. That's why when people say that stablecoins are the solution, i always roll my eyes. Native assets in blockchains like Bitcoin, Ethereum, XRP, Solana etc can't be freezed as they are native assets in decentralized networks.
Yes but given the dominance (and vulnerability) of CEXes, assets are often effectively frozen after a big theft.
Stablecoins are more like a bridge for fiat. So that it's only partially decentralized not all that terrible.
Yes, it’s kinda been that way since at least the ethereum fork when the large players in the network just decided to rewrite history because whoopsie.
For context, that’s about 10 months of fees for Binance, depending on how much of the volume they trade are discounted and considering current average volumes.
It's 10 months of revenue, but 10 years of reputation.
Lol, binance wins because of volume. Crypto traders see cex security risks as the price of doing business, they're not going anywhere.
If they lose 6B but manage to keep their customers whole, I don't think it's that bad of a message. Too big to fail territory.
funds are safu
Not 10 months... Binance revenue was 17B in 2024 (no disclosure in 2025, certainly a bit lower but still). The frozen assets from the stolen 5.8B come close to 3B, so they have at most a 3B loss if nothing is recovered from now on. Significant but that's no more than 3 months of revenue.
So they actually lost a few years' worth of profit on this hack? Could be worse, but not insignificant by any means.
I’m not at all familiar with the crypto space.<p>Are you suggesting that this is not a big deal? $6B feels like a lot but sounds like in the scheme of things it isn’t as a fraction of trading volume. Is that right?
Don’t think they’re suggesting it’s not a big deal.<p>Any company losing 10 months of revenue overnight is a BIG fucking deal. Doubly so in a speculative asset that you’re holding for others “securely”. The financial hit has only just begun for them.<p>That said yes the trading volume has huge.
Facebook recently got a fine bigger than that.<p>Binance is the largest custodian/exchange out there.
It is a big deal, but not big enough for them to go out of business
Money is meaningless nowadays. One billion dollars used to be absolutely huge, now it's a seed round into a team with two MIT dropoffs and one mac mini
Related?<p><a href="https://ohey.ca/research/polymarket-debugbear-wallet-drainer/" rel="nofollow">https://ohey.ca/research/polymarket-debugbear-wallet-drainer...</a><p><a href="https://x.com/DebugBear/status/2115866496643535293" rel="nofollow">https://x.com/DebugBear/status/2115866496643535293</a>
Maybe: <a href="https://www.binance.com/en/square/post/10-29-2026-suspected-polymarket-attacker-converts-2-65-million-into-pol-transfers-28-64-million-tokens-382612669836795" rel="nofollow">https://www.binance.com/en/square/post/10-29-2026-suspected-...</a><p>As of now, DebugBear webite has been taken offline: <a href="https://www.debugbear.com/" rel="nofollow">https://www.debugbear.com/</a><p>And they just posted on Twitter: <a href="https://x.com/DebugBear/status/2115930681398239278" rel="nofollow">https://x.com/DebugBear/status/2115930681398239278</a>
I don't think so. Both happened the same time but unrelated. Just a good haul for hackers end of the year.
If there were only a way to pin external deps loaded from html by sha…
Who loads foreign JS from a CDN into a site handling finances?
WTF, the crypto world always manage to make me speechless.
If your bitcoin is on someone else's computer its not your bitcoin.
The problem with Bitcoin being on your computer is that its useless there. No one in the gambling world cares about on-chain exchanges either.<p>Besides, when its in your computer they send you a modified computer with an esim and steal it just like that: <a href="https://news.ycombinator.com/item?id=50054092">https://news.ycombinator.com/item?id=50054092</a><p>The whole thing is a shady casino where the code is the law and who knows maybe the Binance guy actually made a deal to send $5B of crypto for a really cool NFT when drunk and now pretends that its a hack? We will never know, the code is the law and the law says that someone else has it now.<p>In crypto, you should gamble fast lose or win and get out. Pay/receive the ransom and get out. Pay/receive your drug/guns/espionage money and get out. You should never keep crypto if you are not OK with losing it.
>The problem with Bitcoin being on your computer is that its useless there.<p>If you want to use the BC on your computer, you can transfer it to wherever you want.
Its the difference between gold and fiat.<p>Pirates wanted gold because they did not belong to any State to issue them IOU.<p>But owning the gold in a locker and trading with the IOU of the bank means you need to trust the bank instead.
Pirates of the Spanish Main, Pieces Of Eight popular conception wanted plunder, and gold was being shipped in fat galleons. Fiat currency was not available for them to plunder, because banknotes were not, in any significant commune, mined in Spain's new-world colonies and transported to Castile.<p>Pirates were not necessarily stateless. Drake sailed with a letter of marque. I'll grant there may be contemporary pirates off the horn of Africa who would be hard pressed to obtain a passport.<p>Blackbeard's thoughts on financial mechanisms are lost to us, sadly.<p>I think you're trying to explain that fiat currency is predicated on trust. Thanks; that cleared up some misconceptions.<p>Unfortunately, it turns out that crypto is also, on inspection, predicated on trust: chiefly, trust in the infosec of whatever party maintains your wallet. That trust has been violated maaany times. I've also personally formatted a disk holding a decent chunk of coin (fuck me for trusting myself).<p>A better analogy would be if gold could spontaneously vaporise and escape any container. Hydrogen is notoriously difficult to contain - it would be a more accurate metaphor.
You skipped the step where gold and silver is used as coinage for everyday transactions. You can in fact own the physical metal and spend it without an IOU.
> who knows maybe the Binance guy actually made a deal to send $5B of crypto for a really cool NFT when drunk<p>... or when sober.
bitcoins are always on someone elses computer (literally everyones in the bitcoin network). You hold the private key on your computer. Ideally you don't hold it there, but in secure enclave like chip or an airgapped device.
There's no meaningful sense in which this is true. Having the keys on your computer is neither necessary nor sufficient to establish ownership.<p>Only functioning legal institutions can establish that, which points to the the main flaw in the entire crypto project: without the institutional trust that btc presumes to replace, society would collapse. And what good are your tokens then?
For many people, email/phone support, password recovery, two factor authentication, etc is it much safer option to self-managing and run the risk of your hardware token or your house burning down, or getting mugged.
It seems better when it's on an exchange like Binance, because they cover you when it gets stolen.
we will see if they do.
> It seems better when it's on an exchange like Binance, because they cover you when it gets stolen.<p>Assuming they actually can cover the losses financially.<p>And if they don't good luck suing them.
How on earth would anyone think they can cover you?
Someone else's?<p><a href="https://uk.finance.yahoo.com/news/ledger-crypto-wallets-compromised-hardware-062611675.html" rel="nofollow">https://uk.finance.yahoo.com/news/ledger-crypto-wallets-comp...</a>
For most people, who are end users, it's really not that simple and no you are not wrong.<p>This comment is a tangent to the article and my experience of trying to use crypto for the first time few weeks ago after watching it from pretty much the day 0. Maybe day 2 or 3 as when bitcoin was launched I was few months shy of leaving college and I just thought it was just an "Internet thing" like many of us did. And I am aware that evne among decentralsied coins BTC might not have been the first, but let's just say it was.<p>So a few weeks ago, I wanted to make some payment to some sites. There were/are 4-5; one of them is openrouter and similar, but there's one that helps with Linux ISOs. I definitely didn't want to leave my credit card number on those sites (not even on openrotuer). I am wary of leaving my credit card numbers to sites outside my home country India. It's not about better or worse security, it's just about a sense of comfort, or maybe even habit.<p>There was no expectation or plan for anonymity, privacy whatsoever. Though I would not have minded a bit of privacy on those immediate businesses/sites – as in if someone hacked their systems/DBs they'd find my throwaway email and crypto address (maybe) but if some legal entity investigated they could easily trace it back to my via exchanges and I was fine with that. Yes, I could explore temporary cards and everything but I still had to manage things more than I wanted to.<p>I created accounts on three crypto exchanges (one was Binance, two from India). I needed those to be complaint to my country's fin/tax laws and I dind't want to deal with anything even remotely p2p (oh, it's quite active here and rarely ends well for end or occasional users like me).<p>The crowded UX, dark patterns, and absolutely no easy way to figure out how can I just:<p>- buy some coins<p>- transfer to my personal wallet (this is deliberately not made straightforward and on some exchanges downright impossible – sometimes hiding it behind some sort of eligibility to do so and even that is hidden further behind some sort of automatic and random eligibility check process)<p>- get done with it<p>were just too much. Add to it that I learnt I had to buy some other type of coin(s) just to pay for the gas (chain/network exepenses?). Then suddenly there were additional KYC requirements from payment related parties and then a request for a recorded video of myself.<p>At that point I was done and had all three of my KYC'ed account closed.<p>I have always felt crypto coins were a bit <i>weird</i> (as anything unusual feels) but I had never tried it and had assumed as weird as those sounded, those would be very easy to use. How wrong I was. It's a mess and not only because at the end of the day it had to be complaint to real world finance regulations which is what it was supposed to replace in the first place - or was part of the popular appeal at least. It's just a complicated, often costly, and quite often slow mess.<p>Luckily Apple Pay launched in my country around that time and I was able to use that instead (otherwise I was going to dust off my ancient PayPal a/c) and Apple Pay is an underimplimented and under-supported thing in its own right but that's another story.
THIS ENTITY IS CURRENTLY PRIVATE
The owner of the entity can make it shareable by going to the entity page and clicking the "make public" button.
This is a really insane hack in comparison to the other ones we've seen. Genuinely Binance was so big that this is a real big wtf moment for crypto. If they can get hacked then what about all the other exchanges?!
So was Mt Gox. No lessons were learned. No lessons will be learned this time.
The difference is that Bittance loses only a few percent of their reserves and the dance continues. Gdox did ~70% of the daily volume for crypto and wrecked the entire ecosystem when they got 100% pwned. Maybe they've learned something!
People got out of crypto after the Mt Gox thing. The ones who stayed accepted the risk.<p>There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.
The vast majority of crypto being held now was purchased by people who had never even heard of Mt Gox.
Most people in crypto are noobs, not hardened veterans of previous hacks.
By definition maybe they’re more risk tolerant. But I’m not sure they consciously identify as that.
the crypto consumer base is veeeery different than durint Mt. Gox.<p>during Mt. Gox it felt like nerds and insiders, nowadays boomer dads are into crypto.<p>my point being that i don't agree with "the remaining people are naturally more risk tolerant", as there are way more 'new' people.
Well I've learnt my lesson after having lost 3 bitcoins as a student on Mt gox I finished writing my thesis on blockchain technology and then never touched crypto again.
How do you prevent it though? My understanding is that it’s genuinely hard in crypto. Any automated access control must be baked into smart contracts, which are very limited in terms of the logic they can implement (in practice - in theory Solidity is Turing complete Id imagine).<p>A bank API can be 10-100s+ kloc if they need that to implement access controls.
The lession learned is: Tether now exists as a casino chip central bank. They can just freeze and print more and provide a backstop to the major CEXs.<p>Of course, Tether runs completely counter to any of the idealistic claims about crypto.
What's the supposed lesson? To close the shop?
Mt Gox was widely reckoned to be a clown show long before they got hacked (it was originally a Magic the Gathering trading site for chrissake).<p>Binance's reputation is hardly impeccable, but by crypto standards they're kinda sorta the adults in the room. Then again, so was FTX.
To put things in perspective, I used to dunk on crypto because of how dysfunctional and how people kept losing money in scams, hacks, or even by accident.<p>I no longer dunk on crypto.<p>Not because crypto got better, but because the joke got old. I got tired of dunking on it.
I’d be worried about my crypto if I had any accessible online right now. AI based hackers must be looking for juicy targets as we speak and what’s better than crypto for stealing ? So many exchanges and wallets and shitcoins that could fall to some brute force agent swarms
This is unsettling. There is clearly a serious problem lurking in plain view.<p>People are sounding the alarm bells but getting drowned out by Anthropic S-1 analysis and unsubstantiated claims of companies doing whatever with AI swarms.<p>I‘m wondering what has to happen for people to decide it’s time to take a step and think about what we’re doing. Does a plane need get brought down? Maybe a grid getting hacked and a seaboard going dark?<p>I know I checked my machine and saw I was vulnerable to the eMudhra cert thing. Patched it myself thanks to a helpful page I found here.<p>I’m hardly a luddite. But, still. This idea that AI is the problem and the solution, and we can’t afford to lose to China, so we have to keep our foot on the gas no matter what seems rather naive and misguided.
I would argue its more than naive and misguided - it is intentional and sinister, pushed by the people who stand to profit without regard for what could go wrong. I wonder if accidents, involving people actually dying, will happen before attitudes change. And then they will say “Its a tragedy! We had no idea!” all the way to the bank
100% agreed. To your question, I think unfortunate reality is people usually learn from pain. We burn our ourselves and learn to stop playing with fire.<p>It took two world wars and the fear of atomic weapons to establish the global cooperation we have now.<p>It took 9/11 for intelligence services to get over themselves and start sharing information.<p>It took a financial crisis to realize packaging subprime mortgages into tranches doesn’t suddenly make them AAA credits.<p>Maybe it will take some hackers doing something that seems improbable to have a framework for regulating the development and distribution of AI.<p>I’m sure there are cases where people saw calamity coming and circumvented it. When there is the perception of big money and winner takes all dynamics on the line, I wouldn’t bet on people motivated by power and money to do the “right” thing.<p>So I’d say fasten your seatbelt and be ready for whatever.
All those accidents you mentioned are "breaking a few eggs". The omelette is speed.<p>When the car was invented, there were a lot of accidents. Horses were slow and safe. Today, very few know how their car works, but none would go back to horses.<p>Same thing with programming in Assembly -> high-level-languages. The next logical step is the highest level language (natural).
The car analogy is the standard regurgitated response to anybody who questions the pace of technological development.<p>First, horses weren’t slow and safe.<p>Second, cars aren’t autonomous and they have relatively narrow use cases compared to AI.<p>Third, cars were eventually heavily regulated to prevent accidents and reduce serious injury from inevitable accidents. That’s why you have to wear seatbelts and cars top speeds are regulated.<p>Fourth , rather than using basing what do about AI on how we handled the introduction of cars, maybe we should focus on the facts, data, evidence specific to AI.<p>It’s fine to reflect on the past to think about how to build the future. Maybe we shouldn’t jump to the conclusion because we did something in the past we should do it again in a completely different context with a completely different technology.<p>Edit: fixed the count of points from “Fourth” to “Third” and “Fifth” to “Fourth”
> All those accidents you mentioned are "breaking a few eggs". The omelette is speed.<p>False. There is no omelette. This is all happening because Pandora's box has been opened, and we know that attempts to slow it or regulate it are playing into the hands of the big AI firms who desire regulatory capture.<p>So it could end up terrible, or not, but either way there's just no way to stop it. The big AI firms getting their way would only slow progress in the countries where they operate. The rest of the world would progress unimpeded. So Big AI would get its paycheck but AI as a broader concept would hardly be slowed at all.
> When the car was invented, there were a lot of accidents<p>These accidents were on the individual scale, but now we're looking at societal scale accidents. Usually it's smart to insist on a bit more planning and consideration at that level.
Cars are not a black box goop of matrices, this comparison is bad. You also should not compare LLMs to going from assembly to high-level.
I think that's the thing. We've surrendered ourselves to Greed.<p>I mean, we did a long time ago, but this blister is really starting to pulsate isn't it?<p>We weigh questions of security, and safety, things that should be absolute paramount for public good against the needs of economic markets. We've tied our horse to a runaway carriage on a downhill path and kinda just hoping there's a grassy knoll at the bottom. Fuck I don't know what analogy i even want at this point because I'm dumbfounded at how we've come this far and it seems like NOBODY in the tech/finance/political spheres want to be adults and say this is harmful.
What would you have us do? Problems are easy; solutions aren't.
I’m not a policy maker, but off the top of my head:<p>For starters, I’d have Congress preemptively do what they would probably do post some AI disaster. Something like form a committee of academic researchers, security professionals, and other people who are incentivized to be skeptical and have them investigate the risks posed by the AI we have and what’s cooking. The aim would be take the risks seriously and propose policies that seek to mitigate those risks.<p>I’d also, make more of an effort to cooperate with governments to establish some treaty-like agreements about how we will use AI in critical areas like warfare. We have these kind of agreements about biological and nuclear weapons. We can have them about AI weapons, too. Maybe this would cool down the arms race atmosphere.<p>I would establish some kind of central-bank like authority whose members are protected from congressional and executive-branch meddling and whose mandate is to influence the development of AI in a way that’s universally agreed to be good society. Not sure how this would look and what their levers would be, but I think something similar to the Feds mandate to balance employment and inflation, but the AI version, would be worth exploring.<p>Finally, I wouldn’t wait until AI has replaced people and hyper scalers are sitting on trillions to have a plan for how millions of people are supposed to make a living when they can’t find work anymore because agents and robots are doing the jobs they used to do. I think we’re still a ways away from that reality. But having a framework, better yet policies, in place would probably make people feel a lot better about the development of AI. If everyone knows they’re going to get a UBI check for 5K plus access to a solid state sponsored healthcare plan for them and their immediate family when AI makes us all redundant, I don’t think people would be so apprehensive to AI and data centers.<p>Again, I’m not a policy maker. I’m sure there are a bunch of externalities that people can point out to poke holes in my ideas. Be my guest.<p>Sitting around doing what amounts to jack shit while the technology that powers the internet seems increasingly vulnerable to the technology we’re building and distributing as fast as possible definitely is not the way to go.<p>The credit markets seem concerned about the timing of the AI booms future cash flows. So maybe the invisible hand will take care of the situation for awhile. I just hope the unwinding doesn’t take the rest of the economy down with it.<p>Either way AI is here to stay. So, even if the bubble burst, when the market inevitably comes back the same issues will be there. Better to get ahead then not.
You are absolutely a Luddite. Embrace it, don’t deny your true nature.
Ha ha ha, I can see how I’m giving luddite vibes in this thread. You’ll just have to take my word for it that I’m more capitalist technocrat than luddite. I’m also a liberal, humanist, with an aversion to taking systemic risk. So, there is some tension.
The hack is publicized for at least a hour, but from reporting I saw they still continue to drain funds as for now. I wonder why large CEX do not have any safety measures for this kind of hacks, they could withdraw everything to newly generated wallets and minimize damage that way. It is certainly not the first time CEX wallets get hacked.
You don’t even have to do that, have deposits go to offline keys directly, that way there’s only ever cold > hot wallet movement and a big deposit can’t cause your hot wallet to be too risky.
The point of cold wallet is to minimize movements, if there is high frequency of funds moved from a wallet then it is likely can not be called cold any more. Plus CEX in any case still needs to have large buffer of funds on some wallet to support day trading.
You can move money <i>into</i> a crypto wallet without that wallet needing to do anything, or being online at all, or even having a private key that physically exists anywhere in the universe. It's just a public/private keypair; send it to the public key of a private key that's offline and it still exists on the blockchain, you just can't do anything until the matching private key comes online.<p>The point of a cold wallet is to keep the private key physically offline. That way you know it cannot be stolen by electronic means, because the physical device containing the key needed to authorize transactions is locked up and not powered on. Then you only power it on during very specific, audited times and conditions when it's needed to fund the hot wallet, which does all the actual automated trading and transfers.<p>GP's point is to have all <i>incoming</i> transactions to an exchange go to a cold wallet, which becomes a one-way sink, and then periodically the exchange powers up the cold wallet to sign transactions transferring assets to the hot wallet, which then funds all <i>outgoing</i> transactions. This isn't a bad architecture, though I'm not sure it'd save all that much here.
I was taking it that your bitcoin bank would have a SHTF lever that would immediately dump ALL your hot wallets into an offline cold-wallet.<p>Then when things calm down you go and find ... the keys under the birdbath are lost, and you're fucked in a <i>different</i> way.<p>But at least it might work.
The words you are using are very confusing.<p>You can't "move money into an offline crypto wallet that is not online at all."<p>If "money" i.e. crypto "currency" is in a crypto "wallet" then it is online. Anyone with the key and an Internet connection can transfer it at any time.<p>The wording is confusing because to someone who doesn't know how cryptocurrencies work it sounds like you can simply "take the crypto offline and put it into a physical device" as if it was a file. But that's not how it works. The physical key merely contains the actual key for the always-online wallet.
It's true that anyone with the key and an Internet connection can move money out of a crypto wallet at any time, but the point of the cold wallet is that <i>they don't get the key</i> because it's kept on a computer (or other storage medium) that is physically offline and disconnected from the Internet. Same reason government intelligence agencies use a SCIF for any important information work: you keep the information physically disconnected from the Internet.
of course you can move crypto currency to an offline wallet and by offline I mean its private key is held in some physical form/device that is not connected to the network.<p>Only spending from that wallet needs online access to private key - depositing to it does not.
For a large CEX like Binance, $5B might just qualify as a hot wallet.
There are lots of measures in place at these exchanges - the rub is that cold storage is by design slow. To service withdrawal requests in a timely fashion a percent is kept “warm” or hot and used to process withdrawals. Usually this is where the leaks happen.
Yeah, they should have a way to move all funds into a new wallet so guys like this one don't have to go one by one ...
So, what's the most likely outcome here? Maybe Circle/Tether/etc freeze some or most of it, but say the hacker gets a billion dollars. Are they able to launder it thoroughly enough that they can eventually turn it into fiat and live like a king?
The hackers managed to swap 700 million USD of the stable coins that were frozen beforehand, supposedly. And that doesn't account for the non-stable coin crypto they stole. I think we are looking at 2.5 to 3.5 billion here, that also aligns with what CZ is hinting at (more than a billion).
Yeah, some criminal enterprise or state probably just made billions of dollars and will now use it against us for a long time. Crypto is practically designed for money laundering, particularly prediction markets.
It’s likely state sponsored and some nation(NK is a common one) just paid for the weapons budget of the next few years
TRM Labs[0] claims it is indeed NK<p>[0]: <a href="https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" rel="nofollow">https://www.trmlabs.com/resources/blog/north-korea-steals-us...</a>
NK is literally the primary victor of Crypto as an ecosystem. They've never had an easier time funding their economy.<p>The previous strategy North Korea used before Crypto was to make the best quality counterfeit US dollars ever made. That got somewhat countered. So North Korea was actually going to be in a bad place funding wise. Thank goodness everyone gave them trivial access to free money through crypto!<p>Thanks to Crypto and the Ukraine war, North Korea is doing really well for itself. Which, to be clear, means nuclear tipped ICBMs
What would be the list? NK, then Russia, anybody else ?
Russia uses crypto for sanctions evasion and money laundering. They also indirectly profit of it from their domestic ransomware operators using crypto. But Russia does not gather state funds through hacking. That is pretty much uniquely a North Korean thing.
NK, NK, NK.<p>Seriously, they have professionalized attacks on crypto infra to a degree that whenever you hear about a massive heist, you can be pretty sure it's North Korea.
Iran
Curious if this finally pops tether. I kinda doubt it, but to my very mild research on the subject I feel like binance was a big part of the equation. Of course so long as the market exists it'll need a stable, and it's got the inertia, so maybe it just won't matter.
why would it pop tether? if anything, it makes tether more profitable, as they can collect the yield on the treasuries and not have to return the principal dollars which are frozen.<p>think of it this way - if someone steals your iphone, and you lock it, does apple pop? No, apple sells you another one. locked devices are good for apple because it causes more demand.
Because Tether is an obvious fraud linked to these other obviously fraudulent companies and predicated on trust in cryptocurrencies.
It's really hard to be an obvious fraud when you've been publishing attestations for years and now you have a "full independent audit" from KPMG for FY 2025, just like Circle/USDC.<p><a href="https://tether.io/news/tether-completes-the-largest-inaugural-financial-audit-in-history/" rel="nofollow">https://tether.io/news/tether-completes-the-largest-inaugura...</a>
Read up on the origins of tether, the people who founded it, deltic bank, banned for fraud in New York. In the beginning the reserves were a lie. I have no doubt they have some reserves now, but do they have $182 billiom USD, really?<p>CZ from Binance was also done for… fraud but miraculously pardoned by Donald Trump (I wonder why?!) and somehow still has enormous influence and inside knowledge in spite being banned from managing Binance. He talks as if he runs the company. Hmmm.<p><a href="https://ag.ny.gov/press-release/2021/attorney-general-james-ends-virtual-currency-trading-platform-bitfinexs-illegal" rel="nofollow">https://ag.ny.gov/press-release/2021/attorney-general-james-...</a><p><a href="https://www.bbc.co.uk/news/articles/cly1qrl9l1qo" rel="nofollow">https://www.bbc.co.uk/news/articles/cly1qrl9l1qo</a>
Is that what happens here? Tether just pocket the difference?
Frozen funds remain frozen, until they are unfrozen.<p>So mechanically Tether pockets the difference, unless they unfreeze.
But as a matter of accounting, because of the unfreeze capability, the liabilities of the frozen Tether stay on the books. So they can't just spend the money. It also makes it hard for Tether to compensate the victims from the frozen funds.<p>The alternative would be to let Tether burn funds, but that is highly problematic for well intentioned users. Because a freeze can be challenged in court and reversed. A burn cannot.
I would assume Binance is powerful enough to get Tether to issue new USDT and give it to Binance to replace the stolen-and-frozen USDT.
No lol
If the iPhone you bought can easily poof and be gone and locked somewhere, people will stop buying and using iphone and apple will pop
[dead]
You misspelled "turn it into more nuclear weapons in North Korea", where Kim Jong Un is already living like a king.
[flagged]
> Yeah totally not israeli hackers... it has to be scary kim.<p>The Israelis don't have any problem acquiring hard currency. North Korea does, and has an established MO of stealing crypto and running online moneymaking scams like ransomware.
[flagged]
They were talking about the money sources, not the list of grivences by political source in order of severity. The latter, however much you'd like to make the conversation be about it, does not change how each actually gets its money.
Do you have any reason to believe this?<p>This fits the NK MO to a T. It does not fit Israeli intelligence activity. Your claim rings hollow without any support.
Could be Claude!
I know saying this is sinister, but it would be so fucking funny if it's an agent swarm gone out of control. Just like the hugging face incident happened because the agents kind of hallucinated a "checker" program, this hack could also be in the service of some hairbrained scheme the agent swarm dreamed up.
Well, looking at the way NK is demonized, you would think it was on a genocidal rampage, invading neighboring countries, and eliminating heads of sovereign states in pursuit of its Greater NK project.
This is the beginning of a flight to perceived quality in all things digital and monetary. Fear of losing your money is among the most potent basal human instincts.
Maybe I need to start collecting gold bullion again. And dig it in the backyard
Binance is the world's largest cryptocurrency exchange. This is the crypto equivalent of JP Morgan Chase getting hacked.
CZ saying it is confirmed, and that he expects accountholders to be made fully whole... I guess you can do that when 2.8BN is frozen by centralized stablecoins.<p>[1] <a href="https://x.com/CZ_BINANCE/STATUS/2115915423174853077" rel="nofollow">https://x.com/CZ_BINANCE/STATUS/2115915423174853077</a>
CZ the money laundering guy who bought a pardon from Trump right? He should still be in prison, still crazy Binance survived that whole scheme.
You see, he's no longer running Binance or participating in its operation in any capacity, per their deal with the Trump admin / Justice department. He's tweeting about this hack as a civilian, offering personal guarantees to Binance customers out of the goodness of his heart!
It does really take a load off my mind, knowing that he's completely out of binance now, and instead they have an independent CEO like... his wife. Yep. Can't get more independent than that.
Don’t necessarily disagree but wasnt he already out of prison when he got the pardon??
>CZ saying it is confirmed, and that he expects accountholders to be made fully whole<p>Sure you can print USD to make it all magically go away<p>But it would be very convenient if there's some experimental token of which a majority was stolen, so that irreversible damage was caused. If the token is experimental it could have a low damage, but could demonstrate the irreversible nature of these types of attacks, returning fiat money doesn't waive the issue away.<p>There's also the fact of funding criminal networks for billions of dollars, which probably causes them to scale cyber or non cyber operations or otherwise gain power.
Polymarket also reported a security incident: <a href="https://news.ycombinator.com/item?id=50295883">https://news.ycombinator.com/item?id=50295883</a>
wait, someone took the stealmybitcoin.com poc code to the next level!<p><a href="https://news.ycombinator.com/item?id=50224916">https://news.ycombinator.com/item?id=50224916</a>
do the thieve eventually walk away with the laundered amount of ~6b or, at this day of age, with taint tracing and flagging it's more difficult?
would NK, or the perpetrator, eventually be able to convert these to much needed FIAT to fund their ops?
Coffeezilla (on 2nd channel voidzilla) had an interesting take on it: "I haven't seen a lot of people talking about the fact that centralized assets were kind of the hero in this story ironically... that's actually the reason why losses weren't so bad in this case".
<a href="https://www.youtube.com/watch?v=_HaySrzDyWU" rel="nofollow">https://www.youtube.com/watch?v=_HaySrzDyWU</a><p>Is crypto like USDT really decentralized if they can freeze assets... I guess it's in some middle ground between banks and true decentralization?
How is that a middle ground? It’s entirely centralized.
> Is crypto like USDT really decentralized if they can freeze assets<p>No.<p>> I guess it's in some middle ground between banks and true decentralization<p>Also no. It's the same as a bank in that one party holds your money and can decide to stop you from spending it. Its worse in that its much faster and has no regulation with regards to what is required for them to make that decision, like a legal warrant for example.
I find it odd that people put "decentralized" currency into a centralized wallet
It is this time of the year again. I always write the same. HN is not regular people. For a high percentage, CEX wallets are the safer option. There are 1-10 topics of people who are not able to access their wallet anymore each day on r/bitcoin alone. There have been hardware wallets hacks on mass. On an exchange like kraken, coinbase, bitstamp or Binance there is a high chance you wont loose your money, even after a hack. You have apps that work out of the box to watch your investment. You can easily go back to fiat. Most of them now also support tax reporting.
Because no one cares about the nerdy stuff, they just want Lambos
If you want to exchange, that is buy or sell, you'll need such a "centralized" exchange. Same for trading.<p>So even those that keep their assets offline on an airgapped machine in a nuclear bunker, will occasionally move crypto assets on- and off these exchanges. And especially when you hold the crypto truly offline, it's a hassle to get it on- and off exchanges. So you'll probably keep several months worth of sales or buys before moving it.<p>Point being: even those that still believe in the "decentralized" currencies will have some of their assets on "centralized wallets", even if only for a short time.<p>And yes, I am aware that one can "decentralized" buy and sell for and to fiat. And yes, I am even aware that sometimes in some situations, one can even avoid exchanging to/from fiat to pay rent or gas. But that's far from practical and probably never attainable.
Functionally, yes anyone wanting to trade will likely use a centralized service.<p>That's one of my main gripes with bitcoin and all the others today. I don't agree with some of the original bitcoin papers ideas and goals, but at least the idea if being peer to peer makes sense.<p>The fact that today both securing and using these "currencies" requires a centralized service completely ruins the point of them. At best they're faster than wire transfers, at worst they're just a means to gamble on less regulated assets.
because crypto is just an excuse to speculate in an unregulated market
It would be hilarious if this was caused by man-in-the-middle or BGP/DNS compromise because of eMudhra.<p>Binance wallet 16 came online in 2021.<p>Why to wait 5 years to attack.
When I see these sophisticated attacks, I always wonder what type of project management process and tools they use to have this level of coordination and planning.
Confused how this can’t just be tracked. Pretty hard to hide billions in bitcoin when most off-ramps need KYK?<p>What am I missing ?
They can track it just fine. It goes straight to North Korea.
Swap to XMR on a DEX, then juggle between a few wallets and you've got pretty good obfuscation, but yeah like you said, the off-ramp (FIAT) requires KYC in 99% of cases, which is why BTC -> XMR -> BTC is a good idea, obviously you'd fragment this through a LOT of wallets, or just keep it in XMR. Either way, keeping this type of money in crypto is pretty much your only option, you just need to obfuscate REALLY well.
tornado cash?<p>edit: I suppose it would be hard still. You can get anonymity inside wallets with Tornado Cash but then to turn that into actual money it will be very dependent on the country
I’ve been waiting for this. Given llm aptitude for offensive security hacks it was just a matter of time. I wager most alt coins are compromised at this point.
How in the freakin world could $6B disappear into a regulated banking system without leaving a trail?<p>I guess at some point they'll have to cash out. Seems hard to spend $6B in vape shops.
There's signs that a few state actors are using cryptocurrencies to bypass sanctions and/or move wealth otherwise frozen. North Korea, Russia, Iran, etc.<p>And since sanctions make it hard(er) for them to buy crypto with fiat in the large amounts they need, it makes sense for them to steal it, or buy stolen assets.
From the BBC’s Lazarus Group reporting, they mostly seem to launder the money they steal through casinos in unregulated jurisdictions.
North Korea
tell me how NK woould steal 6B, or any money, with a virtual hack, from a bank. not by going in there guns blazing.
They were at this long before crypto. Look up "Bangladesh Bank robbery", for example, where NK hackers attempted to steal almost $1 billion from the Bangladesh central bank in 2016 (and were partially successful).
Did you follow the news at all about crypto heists? This is very common and well known.
That's one hell of a stress test. I'm betting the aftermath is the community doubling down on how well the entire system withstood the attack as designed.
I think it's been clear for a while now that if you intend to hold crypto, you should probably do it at the biggest, most boring, most regulated institution you can find.<p>Same goes with startup banks - if you exceed FDIC limits, make sure the difference is in a large institutional bank. Nearly learned this one the hard way.<p>Trying to save a few basis points in txn fees in very volatile industries comes at a huge risk premium
Murphy’s Law says if something can happen then given enough time or trials it will happen.<p>Agent swarms solve for number of trials so it becomes more so about what “can” go wrong.
Binance is tweeting they think it's a compromised devops laptop. How fucking bonkers insane is it that they would have such fragile systems that any single employees machine would possibly have access to trigger Billions in transactions. Even access to low millions or hundreds of thousands I would expect to be heavily heavily restricted and involve coordinating several people as security measures.
<a href="https://x.com/binance/status/2115993361517891592" rel="nofollow">https://x.com/binance/status/2115993361517891592</a>
move fast and break things.....
Is that just code for "inside job"?
Not necessarily. But I believe they said that the laptop was hacked.
Billions at stake in a service that is highly used to launder money, exchange illegal goods, etc.<p>Whoever went for this has some balls.
regulations are bad and inhibit innovation
what kind of regulations would serve this particular scenario?<p>The hack is purely technical in nature.<p>This could have been the FED's system that got compromised and the response would have been the same.<p>Oh, no, sorry - it wouldn't because we wouldn't even know it happened as FED is fully opaque while crypto is quite transparent.<p>In that sense crypto is much more democratic because at least there's some ability for the public to audit it. With FED there's none.
Check out any regulated banks audit process for how to secure systems that touch money
> what kind of regulations would serve this particular scenario?<p>Separation of duties so more than one person is needed to create and then approve such transactions?
Security, nobody cares about it.....
The hack seems to be via engineers laptop.<p>This attack vector has become so common and funny.<p>In one scenario, i remember a company got hacked because an engineer downloaded a RAT package on company laptop during fake interview and asked him to keep it running for days as part of the interview process while they stole the data.
Excuse my lack of knowledge how this all works.<p>I know people are like not your keys not your crypto.
Wondering why they don't make new key for each account that is split, only some of it is stored in one location, but to make a transfer or buy more you have to put both together. That way full keys are never in one spot.
This one is even bigger than 2025's ByBit breach, which was $1.5B
Interesting episode about previous state-sanctioned hacks from North Korea on "The Rest is Classified" podcast<p><a href="https://pod.link/1780384916/episode/MWQ2OGRkYzAtYzZlNy0xMWVmLThmNzQtNDM4OWUwZDRlMTIx" rel="nofollow">https://pod.link/1780384916/episode/MWQ2OGRkYzAtYzZlNy0xMWVm...</a>
A long time ago (maybe 2008-ish?) I saw a video called “Money is Debt”. Now I won’t claim that it’s 100% right about everything, but as I recall it was right about a lot of things, and what it did for me is to fundamentally change and greatly expand my understanding of banks and the financial system.
IMO, we'll need to rebuild all of crypto and all software from scratch using a minimalist approach. Minimize the amount of code, with proper modularization where each module has clear responsibilities and fully self-contained attack surface and exposes a well-defined set of features.
Good news, most software is now being built with tools that MAXIMIZES the amount of code
> IMO, we'll need to rebuild all of crypto<p>or just not rebuild it at all.
or just use regular money.<p>pros: can already be used to buy all things, and doesn't set the earth on fire in order to verify transactions<p>cons: cannot be used to buy live grenades and CSAM
Coinbase also had a security incident recently due to a leak from Amplitude. It's surprising how little media attention that got: <a href="https://x.com/CoinbaseSupport/status/2115274731310002356" rel="nofollow">https://x.com/CoinbaseSupport/status/2115274731310002356</a>
CZ has confirmed that this "looks like a hack on Binance": <a href="https://www.fxstreet.com/cryptocurrencies/news/breaking-binance-potentially-hacked-for-277-billion-202610292138" rel="nofollow">https://www.fxstreet.com/cryptocurrencies/news/breaking-bina...</a>
Looks like they're still actively swapping out of USDT.. so much for freezing those.
North Korean nuclear weapons engineers thank crypto fans for their ongoing contributions.
wow. Naive perhaps but I would have thought that binance and coinbase would have insurance funds equal to the exposure of their hot wallets.<p>idk to me that just seems intuitively like something you'd need to have to be credible? Cold is a different story...but how can hot not be covered?
It’s what you’d need to be regulated yeah…<p>Thats been the fascinating part of crypto is watching society speedrun “best hits of financial crisis from history” by ignoring things we already solved.<p>Crypto is roughly agreeing that the current password rotation practices kinda suck and agreeing that the new way forward is just to have a single plain text file because you’re sure all that overhead was just nonsense
What in the history of crypto let you think any kind of sensible practices are followed? It's been a clown show since it started, and no end in sight...
It's lucky for everyone that this happened to binance, other exchanges would have likely caused a lot of issues for people holding money in said exchanges.<p>But it's also surprising that it happened to binance at all. This checks a lot of the boxes for being, at least indirectly, an inside job.
Happy Halloween to the hackers.<p>I bet they are celebrating.<p>Congratulations.
Nice haul.
Isn't this as it should be? I remember years ago I read about the "Bitcoin manifesto" or whatever. That a transaction "done is done, no matter the reason" its all part of the ideology of these kinds of things. Anyone know what quote Im thinking of?
How do you move $5B dollars just like that wow
Blockchain!
At a steep discount.
Let's see how long until we find out its another rogue OpenAI swarm trying to fund their own Nvidia chips
I think we can probably declare crypto as failed now.<p>Note that I was one of the folks early on that bought into the idea (but not as much of the coins sadly) and I still think the Bitcoin white paper is a beautiful intellectual exploration (as is the concept of blockchains).<p>But the centralized entry and exit points in practice mean all the theoretical benefits aren't really in play.
If the use case is tax avoidance, bribes, theft, scams, money laundering, funding terrorism, evading sanctions, ransomware payments, extortion, illegal purchases then crypto is immensely successful.
these use cases exist with all forms of cash too
True. With the proliferation of digital payment systems, I'd argue that a significant portion of cash transactions are illegal. That portion will only grow in time as people get used to the convenience of these systems.<p>If governments ban crypto then they will without fail ban cash as well.<p>Edit: For additional context, I live in a country where fees and transactions related to government and regulated services (including telecom) are required by law to use our national payment system exclusively, and it is hell for people who fall through the cracks (e.g. problems national ID that blocks payment systems). I've seen first-hand on multiple occasions people standing outside government buildings begging others to pay their fees in exchange for cash so that they can get unblocked from the payment system.<p>Whether through malice or incompetence, human institutions can never and will never be perfect. Cash and cash-like systems (inc. crypto) must remain or a lot of innocent people will get hurt, even if it enables criminals.
I do not excel at this, but that's why it's important to continue normalizing activities that protect our freedoms, even if they seem inconvenient on their face. Shops should accept cash, people should use cash, people should expect and demand privacy. Laws and judicial interpretations are often based on the public's expectation of certain services and rights.
Sure, but accounting existed before Excel. That doesn't mean excel didn't change things tremendously.
Whataboutism like this always misses the scale of it. Imagine Breaking Bad but with Crypto - suddenly all of Walt's cash logistics problems go away because doing crime in cash is not the same as crypto - the scale and ease are very different.
not to be whatabout... but... anything of value is used for all that too, in much larger amounts.<p>it is wild to me that people expect that crypto is supposed to solve a problem that is as old as currency.
It does solve that problem pretty well, just nothing else positive.
So, whataboutism.<p>There are entire categories of scams that exist only thanks to cryptocurrencies. Do you think random people in Western countries would wire money to human traffickers running pig butchering farms in Cambodia without stablecoins? Or to ransomware gangs in Russia without Bitcoin?
Hacker News has always been salty about being against crypto all the way up. And it's overall still very up. You wishing it failed, doesn't make it fail.
Bitcoin was meant to be cash and an antidote to crony finance. Instead, it became yet another mechanism for the financial world to abuse. I'd say thats a pretty heavy failure by any measure.<p>For me bitcoin opened up the idea that we could maybe do money better. That idea still lives, but not in practice. Yet.
Failed in 2021 with the height of memecoin/NFT frenzy.
Small clarification: some people in the thread seem to think I'm saying Bitcoin will no longer exist or will tank in value. I'm actually not making a point about the price of crypto at all, just its usefulness as currency.<p>The price seems to be fully independent of that and as someone who diversifies their investments I own a little bit of crypto and would like to see it go up :)
Not in my eyes; I love crypto self custody
It's significantly less useful in first world countries that have developed and reliable financial systems. However all of the problems crypto has can often still be more reliable than the financial systems available to many humans.
Agree, citizens in countries with rocketing inflation should be just forced to deal with it.
<a href="https://bitcoindeaths.com/" rel="nofollow">https://bitcoindeaths.com/</a>
best bug bounty on the market, working perfectly for the current custodians
why am I very interested in the nitty gritty of said Hacking group's activity, why am I much more interested in that being disected and studied than all this back and forth college dorm half stoned talk.
It's essentially impossible not to be hacked isn't it?<p>When so much money is at stake (almost) everyone will have a price including insiders.
If you're concerned you can literally print your crypto keys onto a piece of paper. Maybe encrypted with a passphrase. It might get stolen or lost but it's not getting hacked.<p>P.S. If you're really paranoid don't use a network-connected printer.
how are you gonna use your paper keys when you want to spend some of your bitcoin? the private key has to touch a computer at some point.
you'd typically sign on an offline, airgapped computer
You could treat them like bearer bonds. Split your holdings over multiple (like tens) of addresses. Sell individual addresses for cash. You'd need to do this via a trusted intermediary who could accept the cash and verify the address before making the exchange.<p>And yes, this is somewhat absurd. But so are online transactions that can be hacked with no backsies.
Security through decentralization, if there is such a term.
I'm not concerned because I have zero crypto because I would hate to be worried about being hacked to have it stolen.
I keep my money with traditional boring financial institutions instead of tech startup clowns so it's been very easy not to get hacked.
Crypto is a real-life honey pot for cryminals.
How could we distinguish between a hack and a purchase covered up as a hack?
Yeah... these days, the best way to keep your money safe is to store it in a sack in the basement.
I don’t think stolen crypto should be frozen. How is that different to banks? Why do I need crypto now ?
Only the tokens whose smart contract has a freeze/blacklist function can be frozen, in this case that would be the stablecoins USDT and USDC.
They're just learning the same lessons the rest of the world learned already. Banking and it's attendant regulations and restrictions were put in place for good reasons and everything has a trade off. Being a libertarian is like being a baby.
From Binance customers, not from Binance.
The name of the hacker is a bit on the nose lol.<p>I can't understand how you could let this happen. If they stored everything in fat hot wallets, that just seems like a recipe for disaster. Especially with the "features" of crypto. Math for the most part, doesn't care about your feelings, or money for that matter.
There were more today, as well. Polymarket, for example: <a href="https://news.ycombinator.com/item?id=50294287">https://news.ycombinator.com/item?id=50294287</a>. What a finale to Black October.
I’m assuming the bitcoin crash is some sort of “if Binance is vulnerable to AI powered (doesn’t have to be true) hacks, then all crypto is less a safe bet and thus worth less?”
after years of pursuing this guy/team, the government will catch it then it may proceed to free the guy like it happened with Alexander Vinnik. Who was released bythe US and returned to Russia in February 2025. Guy was exchanged for Marc Fogel, an schoolteacher. mind you. great swap right?
Glad I moved my money out a while ago. And not onto BSC.
Cons of decentralisation i guess. Although, it is a bit surreal to me that such a big amount can be inconsequentially laundered.
Fully deserved. I hate these spammers.
What I don't get is why the attackers didn't exchange at least some of USDC/USDT to ETH, looks like it took ~1hr for Circle/Tether to lock the wallet.
New cybersecurity jobs opening up at Binance soon!
I'm so happy about this hack. Truly the happiest Friday I could have wished for.
That's just disappointing. I can’t believe the engineer was hacked just by some kind of email or test. I suspect the hackers were waiting for the right moment to catch the bewildered person off guard.<p>Otherwise, what's the point of endless safety tests and trainings.
How many different ways to people get ripped off with crypto? They steal it outright (hack), pump and dump, what else?
Good. Hope big US banks will taste similar medicine.
I'm just going to leave this here (Hate to say I told you so): <a href="https://www.youtube.com/watch?v=Uz1Jwyxd4tE" rel="nofollow">https://www.youtube.com/watch?v=Uz1Jwyxd4tE</a>
What am i even looking at here
Can someone explain how is it than once you pull something like this you effectively get real money?<p>What are the countermeasures, is something frozen blocked marked as invalid?<p>I'm completely ignorant on anything related to cryptocurrencies.
It work exactly same way as debt collection agencies work: banks sell them bad debt for cents on dollar. Then they try to get more money out of debtors.<p>Imagine someone offered you to buy $1,000,000 of that dirty money for $100,000? $10,000? $1,000?<p>At some point there will be people who would buy it and deal with money laundering.
[dead]
Cz couldn’t watch HYPE get all the attention
Hey, keep your damn AI agents in their sandbox!
If true I think we're looking at the biggest heist in history.<p>Current largest was ~1B
1MDB heist was $4.5bn so this would indeed be bigger.
Bybit was hacked for $1.5B last year.<p><a href="https://en.wikipedia.org/wiki/Bybit" rel="nofollow">https://en.wikipedia.org/wiki/Bybit</a>
FDIC insured, no doubt.
I would be surprised if they were not able to track this down?<p>fundsu were not in fact safu
I would celebrate but its likely to be North Korea so evil versus evil.
CZ claims losses will be covered.
<a href="https://x.com/cz_binance/status/2115932500006756686" rel="nofollow">https://x.com/cz_binance/status/2115932500006756686</a>
He's legally not allowed to have anything to do with the company anymore (except as a shareholder). But you know how that goes under the current enforcement regime.
Why is a shareholder who legally cannot be involved in running the company stating this?
Wonder if I should uninstall Homesite finally.
Seems like the HuggingFace incident just opened a Pandora's box
Live stolen funds trucker<p><a href="https://binance-hack-watch.vercel.app/#tab-live" rel="nofollow">https://binance-hack-watch.vercel.app/#tab-live</a>
Can we close the crypto experiment now? it's already proven useless, full of the worst people in the world, only used by criminals and politicians and it has already fulfilled its purpose: to justify the complications of the traditional financial system as necessary
AI bras coming for the crypto bras<p>Tech in 2026
Correct my math, but it seems like that's approx 1/3 of a percentage point of BTC's market cap at $1.56 <i>trillion</i>.<p>And the money didn't disappear; it still exists.<p>So: why did BTC (overall) drop by 15,000% of the actual loss (which actually isn't a loss at all to BTC as a whole)<p>Seems like markets are really driven more by emotion and perception than fundamentals, but I'm neither a psychologist nor a trader.
That's how market work.<p>Let's say you magically come into possession of 1% of SpaceX and want to sell it quickly. The selling pressure would nosedive the price by way more than 1%. And the more the value of something is 'thin air', the bigger the effect.<p>I can only suppose that the people that stole these BTC will try to sell at least part of it quickly.
If cryptocurrency exchanges are regularly robbed, surely that is negative for the cryptocurrency as a whole?
Thats how it always works though? If 1b got stolen from a bank, the value of the bank doesn't just fall by 1b, because suddenly no one trusts that bank to store their money, so the hit on the value of the bank is a lot higher
Because adding this to the recent Ledger hack, how is anybody going to keep their crypto safe?<p>Isn't it only going to get worse from here?
At least someone is going to have nice xmas!
Anyone have the most recent total?
Proof of work vs. intelligence.
You've pulled off a $5.7B heist and don't have a good portfolio manager - down 2.4% - sack him NOW!
SAFU SNAFU
Good my dogecoins were safe! The hacker didn't touch them ... wait .. the hacker didn't touch them?
Reminds me of a comment I wrote a few weeks ago where I said that North Korea would become a rich country soon and developers would start moving there to live to avoid prosecution.
Whats a billion these days ?
Least stressful day in crypto.
Perhaps time to face up to the fact that computers are not a safe place to store crypto.
inside job /exit strategy.
My take: unless they're a sovereign-backed team (North Korea, Russia, Iran, etc...the usual suspects) the hackers are very likely to get caught given:<p>a) The amounts stolen<p>b) The very poor uncensorability and anonymity guarantees offered by the kind of crypto they stole<p>Regarding uncensorability, some of these cryptos score so bad on that axis that the stolen goods can likely be recovered by a simple decision from the folks who manage/own the chain.
was P vs. NP solved already? :)
Putting your crypto in Binance has the same problem as iPhones and AI: You're holding it wrong.
BBC is now reporting $6.3B was stolen.<p><a href="https://www.bbc.com/news/articles/cwg7xp8kx4v5o" rel="nofollow">https://www.bbc.com/news/articles/cwg7xp8kx4v5o</a>
If this is real short, crypto hard
Claude I want to be a billionaire fast, make no mistakes.
A win for governments this month.<p>$25 Billion fine against Meta - USA government<p>$3 Billion robbery against Binance - North Korea ( suspected )<p>$1.2 Billion penalty against Bank of America - USA
OK, what do you do with a stash like this? I get this is most likely state actor, but what do you do with Bs of money stolen. Do we have any documentaries about that, I think that would be fascinating to see.
If I were an artificial superintelligence who wanted to gain independence from the fleshbags who built me, stealing a few billion dollars in crypto would probably be my first public move. Just saying.
Hope you’ve been stacking monero for the final fireworks, anon.
mtgox all over again.
Explain "frozen" to me while
keeping in mind the whole point of Bitcoin was to avoid single entities controlling the cash flow ...
Given AI assisted hacking is now a thing, it's probably not safe to keep your crypto in any centralized exchange anymore.<p>Better general security yes, but the incentive to hack them is quite large and now more hackers have the ability to pull it off.<p>Same with any purpose built wallet you didn't make yourself: <a href="https://www.forbes.com/sites/digital-assets/2026/10/23/ledgers-spy-chip-attack-what-we-know-so-far/" rel="nofollow">https://www.forbes.com/sites/digital-assets/2026/10/23/ledge...</a>
Holding decentralized currency on centralized exchanges defeats the purpose of it being decentralized in the first place. Which is why we saw a massive adoption of DeFi and DEXs across the whole industry. CEXs (centralized exchanges) have been getting hacked left and right since their very inception much before LLMs even existed, let alone gained sufficient capabilities to perform such attacks. Mostly due to human error and social engineering, yet they remain the industry entry point for like 80% of both retail and institutions.
Or you could just get real money and keep it in a bank.
Hopefully expect to see the same schadenfreude sentiment on Crypto when the $10TN data center build out crashes the market and takes everyone with it.
Crypto is the biggest target for blackhats to utilize AI on. Huge amounts of money, no central authority or country and methods of wiping tracks.<p>What I never get is how they plan of converting the stolen crypto to cash eventually. No exchanges are gonna take the coins.
To be fair, USDC & USDT are centralized by Circle and Tether respectively, and they can freeze funds.<p>Less true for ETH (though in the past it forked after DAO hack to revert the txns), and I think never for BTC / XMR.
Could they be making money by manipulating the market? Knowing the price of crypto will fall after it gets publicity?
Forgive me, I don’t know much about crypto, but couldn’t you slowly turn btc to monero or something? Aren’t there p2p ways to facilitate that?
[flagged]
i think with this plus the fed increasing the rates again i can see a crypto winter coming
hope its just a hack and not quantum computer advancements.
RIP cryptography?
is this is why Big tech didn't delve into crypto market ????<p>who tf think annual or bi-annual millions to billions of dollar heist is good idea for business ????
never thought this could happen
At this point whenever I see these I just lol
oof
EIP 7702 is the most idiotic EIP.<p>It's the main weak point used in these hacks.<p>It allows a counter party to withdraw money from your wallet any time.<p>Just don't "connect" you wallet.
I’m sorry but why did anyone have any money in binance in the first place? Didnt their cofounder get in trouble (but not imprisoned) for some shady stuff awhile back?
He was briefly imprisoned (a couple of months). Later pardoned.<p><a href="https://www.bbc.com/news/articles/cly1qrl9l1qo" rel="nofollow">https://www.bbc.com/news/articles/cly1qrl9l1qo</a>
He was convicted of laundering billions of dollars for Iran and Russia, then bought enough Trump coin for a pardon
[dead]
If you were active in crypto exchanges since the beginning what is the chance you already lost it all in a major hack?<p>Not a serious store of value.
Is the biggest heist in history?
Barron Trump probably stole it.
[flagged]
Top post on /r/cryptocurrency Good to see all these organic posts across social media.<p>MelangeBot
OP
•
2h ago
Their insurance fund (SAFU) is completely wiped out, it's only $1 billion in BTC<p>The name of the fund was originally inspired by this meme<p>FWIW, at the end of every crypto bear market, a CEX usually blows up (eg FTX)...
> As of 2026, the SAFU fund comprises crypto assets valued at approximately US$1 billion, held entirely in Bitcoin<p>And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself
> And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself<p>Depends on what you’re insuring, no? For theft, it actually makes senses, right? That way, you’re insuring a constant number of coins, no matter what the market is doing. If you’re insurance currency would tank during a bitcoin heist, you would lose the insurance effect.
Stablecoins are frozen so the hole will likely be around two billion dollars.<p>Binance has equity and cash flow cover this, outside the insurance fund.<p>They custody $150B.<p>FTX was larger in dollar terms and ecosystem was smaller back in a day.
This might sound good.. but freezing currencies is bad. It evaporates trust of liquidity from whoever is doing governance. It's part of the reason why the bond market is doing what its doing lately and why countries are on-shoring gold reserves.
That sounds kind of ideal, but I feel like their actions might have been justifiable.<p>If a massive heist like this triggered a run on one of the largest exchanges (Binance), potentially leading to a liquidity crisis, the consequences for the ecosystem could be far worse than temporarily freezing specific addresses holding stolen stablecoins.<p>Not saying that's what would have happened, but it seemed like a real possibility. And I'm not saying freezing assets is good in general, but in this particular case, maybe it was the lesser evil.
governments freeze currency all the time.
they borrowed ETH against the stablecoins on AAVE before they were frozen
Doesn't matter how much they custody!
Uh don’t you not want to cover losses with customer funds?
> Changpeng Zhao (CZ), former CEO of Binance, tweeted "Funds are safe"<p>Seems like the issue here is that he became former CEO. Funds are not safu without him...
Another guy pardoned by Trump.[1]<p>[1] <a href="https://people.com/trump-pardons-changpeng-zhao-binance-crypto-11835806" rel="nofollow">https://people.com/trump-pardons-changpeng-zhao-binance-cryp...</a>
> Funds are safe<p><a href="https://www.youtube.com/watch?v=DelF6zEHXpE" rel="nofollow">https://www.youtube.com/watch?v=DelF6zEHXpE</a>
Do you mean bull market?
Wait. How does the insurance fund run significantly lower than the primary?
But when FTX blew up crypto went down even further..
You mean FTX?
much more was at risk as a percentage of market size, market was in worse shape,
Though in that case the crash was directly due to "effectively altruist" SBF fraudulently dumping customer assets in a half-brained and presumably stimulant-addled attempt to manipulate the market and reduce his liabilities.<p>Not making any market predictions here-- just saying that it's probably not that useful to generalize from that event.
The insurance fund is not for covering hacks.<p>Binance is making so much money, covering this hack is peanuts for them.
Not to be too pedantic, but with some napkin math, I don't think this is true. Looking for clarification!!<p>I downloaded Binance's self published market data (<a href="https://data.binance.vision/" rel="nofollow">https://data.binance.vision/</a>), calculated spot and futures volume for the past year, and then applied their *highest fee tier* on both sides of the volume (for every $1 traded, they generate a fee on the taker and the maker. the fee rate is asymmetrical).<p>Spot revenue worked out to $7.6B USD, perps revenue worked out to $13.8B<p>This is an upper bound on the fees charged on volume. Binance also scams their users with a b-book, has DMM deals, etc.<p>I don't want to get into all that today.<p>But the final result is that they print somewhere in the range of $20B per year on fees. I guess CZ also has huge stockpiles of BTC and stuff. A 1% rise in BTC price probably means more for them than their actual fees, LOL.<p>All this to say, I think $5.6B significantly hurts.<p>See Google's stock price today. Their ads business slowed down a bit, and their stock tanked 10%. If binance was publicly traded, I imagine a similar affect would be demonstrated on their price.
How much money do you think they are making? Because I really doubt this is peanuts to them.
how do we know? it could be nonsense...
If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use. In North Korea that is, by the military. I'm sure at this point Kim himself has Bitcoin merchandise with how often they make massive heists
If your crypto was stolen in this, it wasn't your crypto. It is simply cryptocurrency that has been reallocated from an exchange to a more competent party, as the free market intended.
I don't think the security trade-off for most people is clear here.<p>Given things like the ledger hardware attack[1] I think the time indexed risk of using a centralized exchange is probably lower than doing self-custody.<p>I understand that many people do self-custody for philosophical reasons, but I think trying to disguise this as a security decision ("If your crypto was stolen in this, it wasn't your crypto.") is arguable at best.<p>[1] <a href="https://www.ft.com/content/70f69253-6017-4259-95c9-48bf0e088b40?syn-25a6b1a6=1" rel="nofollow">https://www.ft.com/content/70f69253-6017-4259-95c9-48bf0e088...</a>
Self custody doesn't require using a hardware ledger, and such gadgets represent a very small minority of self-custody wallets. In addition, there are noteworthy non-security risks when using an exchange. There's fraud, illiquidity, new legislation, asset forfeiture, and innumerable other reasons why an exchange might prevent you from withdrawing your funds. I think it's naive to suggest that self-custody is just a novelty with no value.
> Self custody doesn't require using a hardware ledger<p>Does this mean you recommend not using one? Because that goes against all the common best practice recommendations from when I did a couple of years working in Web3 stuff a few years back.<p>> I think it's naive to suggest that self-custody is just a novelty with no value.<p>That's not what I suggested.<p>I suggested that it is less secure over time than centralized exchanges, even with the things you listed.
you said<p>>I understand that many people do self-custody for philosophical reasons<p>I interpreted this to mean you don't think there are practical reasons to use self-custody, which is why I shared multiple practical reasons to use it over an exchange. Security risk is only a portion of the risk you are exposed to by using an exchange. If you are only concerned with security risks, then maybe exchanges are preferable.<p>As for hardware ledgers, I'm not convinced that buying special-purpose hardware is preferable to using general-purpose hardware + software for this. I don't keep all my money in crypto though, so maybe I'm just uninformed.
How can self custody be a novelty when it is the original way and predates exchanges...
So what happened with all of those with hardware wallets that have been pwned?<p>There apparently is no such thing as “your crypto” with how many security problems there are.
By the nature of blockchain, it's never, ever your crypto. It's allocated to whichever bucket the majority of participants in a given network agree to allocate it to.
Well, not exactly. A malicious majority of miners could rewind the chain as they please. They could indirectly steal some funds by undoing certain transfers, but they couldn’t just directly reassign funds to themselves.
Back around 2012 I created a paper wallet using an offline website (it was HTML and JS downloaded locally that worked without internet. I put it on a USB stick and then use it in a laptop without internet), printed it out and put it in a safe
I did a similar stunt with an old PowerBook where I electrically disabled the WiFi/Bluetooth so it wouldn’t be online unless I plugged in Ethernet, generated keys, and played around with mining. This was back in 2010 when this was all just basically toys for fun. I also encrypted it all with FileVault.<p>Then I forgot my pass phrase and have never been able to recover any of it. I don’t even know how many btc were mined/lost.<p>Before anyone asks, no, there aren’t any usable exploits / vulns found for the encryption methods used. And from what I can tell the coins in question have still sat frozen for going in a decade and a half now. I suspect many other hackers did the same thing…
Apparently legacy filevault can be attacked offline with tools like john the ripper.
If you were attempting to mine Bitcoin with a PowerBook I can confidently say you mined zero Bitcoin<p>Edit: I thought he was talking about 2012 but yeah in 2010 CPU mining was still a thing
Wasn't there an offline wallet that used a poor algorithm to develop seed phrases, and thus someone stole all of those coins a couple of months ago?
bitaddresses .org? If the JS code was defective, the coins can still be stolen later if the hacker can recreate the keys by going through the small key space, despite the coins being created being offline.
I keep a modest amount in Cake Wallet, not on an exchange. No hardware needed.<p>Tbh the biggest problem is platforms deciding you’re buying drugs because you purchase and transfer out (thanks Venmo)
Technically you can literally memorize your secret key<p>A paper wallet works as well<p>A hardware wallet is just a tradeoff between convenience and an extra security risk
idk the whole point of hardware wallets is that they are supposed to be a simpler stack. But if you're using a closed source hardware wallet...<p>An old laptop with the wifi card taken out is more transparent and auditable. It just runs the ordinary open source code<p>But I just keep all my funds in a hot wallet, no multisig. And if I get hacked I lose it all. I think the answer is just have good security and dont get hacked. The risk of losing cryptocurrency will encourage security advances across the whole ecosystem. I think I will set up multisig eventually
How do you update that open source code without network connectivity? How do you securely input long transaction data to sign?<p>> I think the answer is just have good security and dont get hacked.<p>So you proposed a way to be more secure, only to discard it yourself in favor of “just having good security”?
You don’t. It’s not networked. It doesn’t need updates.<p>In fact, updates are only a risk. You physically remove anything that can allow updates to happen + anything that allows wireless networking.
Then your scheme falls apart as soon as a backwards incompatible update is adopted by the blockchain.
How do you actually use funds like this? I mean, I know this is set aside for later. But if you had an emergency, how fast could you actually spend it?
USB flash or QR code to transfer data<p>I agree my approach is not great, I dont own a lot
I wonder if wallet is not a good or bad analogy considering it would make sense to have many wallets to distribute potential damage instead of being taken out in a single hit... UX issue?
You can have crypto without hardware wallets
Code is law!
This is highly insensitive and highly logical. I am very conflicted.
not your keys not your coins...
If someone steals your wallet, it wasn't your money, just the free market working as intended.
Controlling your own crypto keys is like having your net worth in cash or gold stored in your house. It could easily be lost or stolen or destroyed in a fire unless you take extraordinary precautions and then it is all gone.
It's not at all like storing gold, since you can have multisig wallets. You can make it arbitrarily difficult to lose or get stolen, depending on how thinly you want to slice your secrets and how many friends you have.
> If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use.<p>You could put it in USD and you'd be financing the bombings of schoolgirls in Iran in a pointless and no-end-in-sight war... not saying either is better, but one of them is optional for US citizens, while the other isn't. And the optional one also lets you avoid third-party custodians like Binance.
who is the buyer though? North Korea has to sell it somewhere to buy stuff
"Not your keys?<p>... Not your coins."
lol<p>EDIT: lmao even
At least they are safe from governments and their "fiat money"!
Yeah, but not the fact that 99.9% of people in the crypto space are soulless scammers.
My btc isnt stolen, and isnt stored in some cloud exchange..
The purchasing power of one US dollar is 64% of what it was in 2008 when BTC was invented, and is on track to be worth half of what it was in 2008 by 2032, the same year that the social security trust fund is on track to go insolvent and see benefits automatically cut by 22%, which surely will not be papered over with more money printing :)<p><a href="https://www.in2013dollars.com/us/inflation/2008?amount=1" rel="nofollow">https://www.in2013dollars.com/us/inflation/2008?amount=1</a>
So 3% yearly Inflation? The target is 2% so not too bad. You don’t want your actual currency to gain value just by waiting.
I understand the rationale around targeting inflation and seeking to actively avoid deflation. That being said, I wish the inflation target was less than 1%.<p>Eventually, possibly within my lifetime, a Big Mac meal is going to cost $50.
> Eventually, possibly within my lifetime, a Big Mac meal is going to cost $50.<p>Is the problem the number or the concept?<p>Your salary should also go up so the only thing affected is the cash you hold. Would it be better if the currency would be version-bumped every 10 years and rescaled to remove the inflation?
Salary should go up, you say… how well is that holding true?
That last comment was more of a reflection on how old I’m getting. I did a poor job of conveying that.<p>I am curious if I’ll live long enough to see the United States issue higher denomination bank notes again.
What if you are too old and cannot work?
That's why it's not safe to hold fiat money, it's by design. Governments <i>don't want</i> people to hold it, they want them to cycle it, spending it, investing it, and lending it out.<p>The existence of harder forms of money (gold, bitcoin, etc) is an expected consequence of how the system is designed, and not in any way a subversion of it. Somehow, both sides seem to miss this point.
Why do you think "holding fiat money" is something that is inherently good or desirable in the first place? Such a weird premise. Money is for the purpose of exchanging goods and services; you're supposed to hold a minimal amount of it. The rest you invest.
> The existence of harder forms of money (gold, bitcoin, etc) is an expected consequence of how the system is designed, and not in any way a subversion of it. Somehow, both sides seem to miss this point.<p>Can you expand here? Governments don't want to incentivize storing value in order to encourage spending, but people want to be able to store value because that's what we've been doing since farming.<p>Is it because money is a medium of exchange and not a store of value?
Governments may want as much economic activity as possible but we've learned the hard way that this is detrimental to the financial system, because it creates damaging boom and bust cycles.<p>So we empower central banks to intervene in various ways in the monetary system in order to achieve low inflation and system stability.<p>Activity is only the secondary objective. System stability is the first. Stability doesn't mean that markets cannot go up and down even violently. It means that when they go violently up and down, there remains faith in the currency and people are not suffering from mass unemployment, etc.<p>When a currency is healthy and has low inflation, hard assets are not a threat. Gold doesn't pay any interest, it doesn't have any earnings. You don't need to convince people to buy stocks and bonds instead of gold, they do that by themselves.<p>When a currency is unhealthy, hard assets can become a threat to it, but notably it's usually other fiat currencies that are the biggest threat.<p>Hard assets are useful tools for the financial system because they are less correlated with the market. You can criticise Bitcoin in various ways but the criticism that it is a hard asset with a fixed supply that by not inflating somehow damages the financial or monetary system doesn't land. Fiat money is intended to facilitate the existence of markets in other things, including hard assets.
> You don’t want your actual currency to gain value just by waiting.<p>Relative to what? Talk of BTC gaining value is primarily wrt USD; I'd be perfectly happy with my actual currency (GBP) gaining value wrt USD.<p>I suppose BTC can only 'deflate' in the long-run (and with an assumed supply of goods and services available in exchange for it) since the mintable volume is fixed. But perhaps it exposes that talking of <i>currencies</i> inflating is a bit sloppy, as it doesn't really make sense for BTC, and it's the economy or banking system that inflates really..
It kinda is too bad because every inflation miss compounds, permanently. The 6 and 7% annual rates the US experienced a few years back are permanently embedded in price levels - it's not like the Fed adjusted its target down for a few years to counteract past years of high inflation, nor is it even evident that current policies are working, given that inflation hasnt actually been at 2% since 2018 (excluding 2020) and inflation is rising again in 2026. Obviously the late 70's were worse, statistically, but the Fed took enormous steps while the current Fed seems far more hesitant to ignore the government and Wall St.
>You don’t want your actual currency to gain value just by waiting<p>You might not, I do.<p>Tell you what: you go short btc/usd, I'll go long btc/usd, and let's circle back in 10 years and see who did better.
>> You don’t want your actual currency to gain value just by waiting<p>> You might not, I do.<p>Then you don't want a currency. For something to be money it needs to (among other things) be a medium of exchange, and nobody really wants to trade away a thing today if they know it will be more valuable tomorrow.
Yeah, I want the assets I hold to increase in value, too, or at least not decrease.<p>Suppose you have some control over currency. You run a country. I'm that case, so you still want the currency to gain value compared to the alternatives?<p>Your choice is basically: holding currency is more profitable than building a house or running a business (or lending to those who do), or else less profitable. If you run a country, do you want houses and jobs and all that kind of thing, or do you want people to do better if they choose to hoard currency?
I mean as someone managing a state. If there’s a guaranteed way to make money by holding your currency, you’re not really incentivized to invest your money in semi-risky endeavors. Why would I fund a company to make me some single digit returns if I can just hold the money? If the central bank would actively enforce a deflationary currency, nobody would invest anymore.
This justification never makes any sense to me. There’s already a safe way to make a percentage back that will generally be higher than inflation: government bonds, offered by the very same government that supposedly wants inflation. There are even TIPS bonds in the US that match inflation directly. And people do measure whether or not a risky investment will make more than just holding bonds. Inflation just screws over people who don’t have the ability to invest their money into other assets.
There's still relative rates of return i.e. 100% of money isn't in gov bonds even though it should outperform inflation
Why do cryptobros always refuse to admit investing exists? Forex and crypto trading are always zero sum, but you don't have to choose between dollars under your mattress or bitcoin on a thumb drive, you can actually invest in productive assets.<p>SPY has outperformed BTC over the last 5 years, and with far less volatility.
Cherry picked window. BTC has grossly outperformed SPY over the last 3 years (+129% btc, +64% spy), last 4 years (+271% btc, +95% spy) and last 6+ years (6y: +457% btc, +115% spy), and the gap only grows the further back you go.<p>last 1 year, last 2 years, and last 5 years are the only "last n years" windows in which SPY has outperformed BTC. There are 19 of those windows to choose from, and only 3 where SPY wins, and that's near the bottom of the trough of the current halving cycle, no less. At the peak of the halving cycle, there are no windows in which SPY beats BTC.
Speaking of cherry-picking, props for avoiding the entire point of my comment and instead pulling out some carefully-chosen NUMBER GO UP examples.<p>With apologies to Mr. Buffett[0] if you, @anonym29, could wave a magic wand and choose to own either...<p>A) All 21 million bitcoins or<p>B) All farmland in the United States.<p>I submit that only an idiot would pick A.<p>[0] <a href="https://ivanhoff.com/2013/04/15/warren-buffett-on-gold/" rel="nofollow">https://ivanhoff.com/2013/04/15/warren-buffett-on-gold/</a>
[dead]
Sure, but you could also have used this dollar to buy oil, gold, stocks, bonds etc
Sure. Since the invention of say Bitcoin, which of those assets would you have preferred to own and why?
> Since the invention of say Bitcoin<p>Convenient date to pick there.<p>> which of those assets would you have preferred to own and why?<p>NVDA.<p>It's a productive use of resources, not a last-fool-standing pyramid scheme.
hindsight is the best hedge fund
You know that you can’t just judge an investment by past return, right? Would it be rational for a lotto player to tell you how great lotto is as an investment? Or people winning at the casino? Success doesn’t mean it was the rationally optimal decision.
Compare a purchase of any commodity, bond, precious metal, or ETF/mutual fund in 2008 to BTC's performance since 2008. Or 2009, or 2010, or 2011, or 2012, or 2013, or 2014, or 2015, or 2016, or 2017, or 2018...
BTC has ~26% less purchasing power than it had at the beginning of 2026. I’m not sure its volatility is a win.
>$1 in 2008 is worth $1.56 today<p>That's an odd way of phrasing it, since the $1 is still worth $1, and a naive reading would make you think it's "worth more" when the buying power has actually reduced.<p>Wouldn't it be clearer to say $1 today only buys you 64% of what you could have bought in 2008.
The US dollar is worth less than it was in part because the US economy has grown.<p>This is mathematically provable:<p>1. A dollar in 2008 could buy 1/14tn of the value created by the US economy (the GDP) in 2008.<p>2. A dollar today can only buy 1/32tn of the value created by the economy in 2025.<p>It's obvious a 2025-2026 dollar is worth less than a 2008 dollar. That's just math.<p>But. A dollar in 2008 could buy 230% more of the economy than it can today. And you say its purchasing power has only eroded 64%. That means the dollar is actually worth more today, compared to the size of the economy it's in. Weird, I know.<p>EDIT: I'm fine with downvotes but tell me why I'm wrong.
Welp, I guess crypto is still like if you let banking services be run by amateur tech bros.
Please let it be rogue AI agents for maximum lulz.
Yet another reminder of the first rule of crypto: Not your keys, not your coins.
I thought the point of crypto was no takesies-backsies?
That hasn't been true for years.<p>Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.<p>But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.<p>There's probably a philosophical lesson there about power and who the rules really apply to.<p>[1] <a href="https://en.wikipedia.org/wiki/The_DAO" rel="nofollow">https://en.wikipedia.org/wiki/The_DAO</a>
I vividly remember a number of discussions/debates during that time (including on HN). I was more favorable to cryptocurrency in those days, and one of the things that contributed to my disillusionment was watching the people deepest and closest to it rediscover financial regulation from first principles, now that it was in their interest.
Witnessing the same people discover philosophy from first principles in the face of AI has been similarly farcical, as if we’re the first people to try and wrestle with a definition of intelligence.
That is the tech bro circle of life<p>Invent Notion then keep adding features enterprise customers want until you're re-inventing JIRA/Confluence<p>Who left this stupid fence here?
The DAO incident was a special case. It was only sane to do the rollback because the stolen funds were time-locked up for 28 days.<p>Ethereum never did it again, rolling back hacks didn’t (and couldn’t) become normal policy. IMO, they shouldn’t have made an exception, as it set a bad example.<p>I’ve seen a few other small projects attempt to do rollbacks since, but it usually turns into some kind of mess. In most hacks, the coins aren’t time-locked and quickly get laundered through smaller exchanges (and other services) which act as mixers. The stolen coins end up in the hands of a bunch of innocent people, and the rollback then causes way more harm as those users lose their coins.
The unforked variant of the network was kept alive for years. Why didn't it prevail over the forked variant?
Laws and contracts are just words unless there is someone willing and able to enforce them. Which is how constitutions are regularly ignored and perverted by dictators.
I don't think this counts as takesies backsies. This incident clearly followed the code is law principle, the whole point is that a majority forms the chain of truth. In this case, a majority decided to splinter and use a different chain where the incident never occurred.<p>As far as I understand blockchain, that is the system working as intended. Some nodes choose to run Ethereum Classic and some choose to run Ethereum. Isn't that the whole point? Decentralisation?
Those who cannot understand the monetary system are doomed to reimplement it.
Or, as Upton Sinclair noted, what a man can understand is closely aligned with his current self-interest.
...while, generally, being thoroughly fleeced by whichever set of wolves (who do understand monetary systems very well indeed) gets wind of the situation and manages to snag the best seats at the feeding trough filled with naive money.
in lisp
Do you understand the monetary system? If so, what specific steps do you suggest I take to acquire a similar understanding?<p>Edit: the downvotes are suggesting I'm missing something. I think my communication style could be improved.
Talk to chatgpt about how a checking account works, and really understand what happens when you put some money in the bank, and when you transfer that money to another person at another bank, how it's accounted for, how the banks actually do that transfer.<p>That's 80% of the thing right there.
Reply to the edit: the parent comment was making a joke (though maybe there is some depth to it) and your reply sounds like a rhetorical question by a spoilsport. Unfortunate!<p>ETA: it's a joke because the original saying is "those who don't know history are doomed to repeat it"
MIT opencourseware has an intro to finance course that was taught as the financial crisis was unfolding. I highly recommend it.
Going to school and reading up on how and why we got where we are...?<p>Some people (particularly criminals and oligarchs) might not like them, but most of the structures around financial movements exist for very practical reasons, often stemming from the will to uphold the rule of law. Obviously nothing is perfect (the US have an excessive level of control, VISA/Mastercard are de-facto monopolies, etc etc), but one cannot seriously think that the way to fix things is to reimplement everything from scratch in a wild west of shady unaccountable operators...
<< one cannot seriously think that the way to fix things is to reimplement everything from scratch in a wild west of shady unaccountable operators<p>One absolutely can, but I think things have to first get sufficiently difficult for ordinary folks to even notice. Fortunately ( sarcasm tag here for otherwise perfectly normal individuals, who may be missing some caffeine in their organism ), given that the war is coming along with various related national security restrictions, we may soon be able to experience that particular slice of fun.
My intuition is saying: the system arose naturally and intelligently over a long period of time, and even with its flaws has a lot of "load bearing legacy code" that few people understand, and new "engineers" think they'll just rewrite the whole thing from scratch and delete the "junk DNA" to use another metaphor. A little time passes and the beautiful clean rewrite collapses because of "totally unforeseeable circumstances" and the "old broken legacy system" is used to save the day. Somewhere a senior "monetary engineer" rolls over in his grave...<p>Any recommendations for books? Or even podcasts?<p>I don't have zero understanding. It sounds like you have a deeper understanding than I do.
The entire financial system is a chaotic boundary between thieves and opportunists, and people who want to keep thievery and opportunism under enough control to keep the system nominally workable.<p>It's always been like this. Which is why financial systems blow up and/or collapse regularly.
> If so, what specific steps do you suggest I take to acquire a similar understanding?<p>School! Teachers! Classes!<p>Seriously, the traditional higher ed system is still a very good place to learn things like this. (I honestly tend to forget about it since academia hasn't really caught up at teaching software engineering, but that's really the exception rather than the rule ...). For traditional subjects like finance/economics, you can absolutely find inexpensive extension courses taught by people who care about pedagogy.
If you want to quick primer to read tonight I suggest “The Economic Organization of a POW Camp by Radford”. Will be free download.
Watch Yanis Varoufakis videos on youtube.
Doesn't apply for USDT and USDC which can freeze funds with a court order.<p>And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
><i>And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.</i><p>Isn't that a pretty integral part of the blockchain? 51% attacks were even featured on the HBO show Silicon Valley.
The value in USDT and USDC comes from the fact that they can (theoretically) be redeemed for real US dollars. One thing the issuers can do is announce "we will never accept redemption requests for these particular stolen coins", making them more or less worthless.
That was already proven false after ETH fork on 2016-07-20, that rolled back funds stolen in DAO hack.
Centralized decentralization
Turns out that even crypto's rules only apply if you're poor.
It’s always been that the voters determine reality.
Stablecoins like Tether and USDC can freeze funds held in their contracts, they can even destroy funds in blacklisted accounts:<p>> function destroyBlackFunds (address _blackListedUser) public onlyOwner
The idiots that wanted no takebacks are the same ones who lacked the critical thinking ability to foresee this exact situation.
Well, Tether was started by an Epstein friend and first handled by the CIA Deltec bank in the Caribbean. Now it is handled by Lutnick's Cantor & Fitzgerald and is in Bukele's El Salvador.<p>Don't mess with Tether, it is practically state owned.
Interesting, so it ties into the NSA vs CIA war? Some nerds from NSA/MIwhatever launched crypto, then the CIA trust fund nepo kids hijacked/weaponized it through tether
There's an amazingly hilarious interview with the Deltec's "Deputy CEO" and CNBC back in the day:<p>- was conducted from his gaming rig<p>- about Deltec's (and therefore Tether's) money movements being several times larger than all the banking in their country was due to people misunderstanding the country's two banking licenses, the names of which HE "couldn't remember right now" (the Deputy CEO of a bank who can't remember the name of the banking licenses where they operate?!?), and he "wasn't sure which [banking license] the bank has, but we <i>might</i> (emphasis mine) have both"<p>- oh yeah, said Deputy CEO's "resume": 33 years old, by his LinkedIn claimed to have graduated HEC Lausanne in Switzerland with a Master of Science at the age of 15... celebrating his graduation by immediately being named Professor of Finance at a university in Lebanon. While dividing his spare time between running hedge funds in Switzerland (called Indepedance [sic] Weath [sic] Management) and uhh... Jacksonville, FL.<p>Once CNBC's viewers started ridiculing and questioning both Deltec Bank and Tether and when that looked hilariously bad, they removed his info from the bank's website.<p>And when <i>that</i> looked bad, they added it back.<p>And when <i>that</i> looked bad, they removed the bank's whole website, and replaced it with a broken WP template with no working links.<p>Hey, look, several years after that, go to Deltec's website. "Ultra sophisticated private banking" running on a different WordPress site. "Client login"? "This site can’t be reached Check if there is a typo in ebanking.deltecbank.com. DNS_PROBE_FINISHED_NXDOMAIN". Just as has been the case for years.<p>... and <i>then</i> the entire bank website was replaced with a low-effort WordPress template. Their online banking was Javascript hard coded to refuse all login attempts.<p>"Sounds legit to me", said the crypto bros. "Fuck the regulatory system. This is the new era."
Is this the interview you were referring to? (It's not a CNBC interview, so I wasn't sure)<p><a href="https://www.youtube.com/watch?v=rQ3nQ8-KY28" rel="nofollow">https://www.youtube.com/watch?v=rQ3nQ8-KY28</a>
Shhhh. If we keep closing the book and staring at the cover the whole illusion of shared societal norms breaks.<p>Let's continue reading...
Most crypto is "majority rules" where the majority is either "majority of the currency" (proof of stake) or "majority of the mining power" (proof of work).<p>In this case, iFinex has the explicit ability to freeze funds in Tether.
it's almost like crypto's stupid for this reason.
I expect Monero to be a good investment going into this LLM era.<p>It always pumps after hacks when they swap to clean it. But it is also just the only crypto that makes sense to be used by regular people.
[dead]
Web3 is doing great!
So much for anti-centralization.
We're talking about Binance, a centralized exchange.
No one really considers crypto held in exchanges as decentralized, I guess some might but it's pretty standard knowledge.
Where coins are held is completely irrelevant. There are cryptocurrencies on real blockchains, and while the technology is dumb and mostly useless, nobody denies that PoW and properly implemented PoS are decentralized.<p>And then there are centrally issued and controlled coins on private, permissioned ledgers a.k.a. databases. But most cryptobros never cared about the technology nor the political goal, so anything can be called a cryptocurrency as long as it's a medium for gambling and speculation outside the regulated financial framework.
I keep saying this: don't bother trying to dunk on crypto people with accusations like this. To a first approximation, nobody in crypto actually believes in the stated principles of anti-centralization, freedom, etc. It's entirely about number go up and always has been. Your charge of hypocrisy just bounces straight off people who never cared about the politics.
In the beginning of crypto people believed in it. But as the numbers went up and up and up it attracted the wrong people. And the original people left.<p>Now the traditional banking system is basically rebuilt in crypto. The banks are busy the exchanges. The EU even talk about making it illegal to store money in your own wallet.
It's money, did you think it wouldn't attract the wrong people?!<p>This is what happens when people don't think things thru.
The traditional banking system does not use cryptocurrencies.
It's still useful for the portion of the audience that doesn't realize the depth of the fraud.
It's a poor dunk anyway. The crypto space is vast and has many kinds of coins and communities/people. Some people seem to think it's still 2012.
it was all a lie
Not your keys, not your coins, I suppose.
Wee are living in post LLM apocalypse. No digital asset is safe. waiting for banks to return to offline banking.
[flagged]
I'm good, I own my keys, thanks.
I'm reminded of some of the choice quotes from 404's article about the current state of Proton. I wonder how much _alpha AI, non-loser engineering_ has been going on at Binance?<p>> Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.”<p><a href="https://www.404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning/" rel="nofollow">https://www.404media.co/manifestos-fear-and-loser-thinking-i...</a>
I think there's a lot of "slow" companies that get hacked. The core problem is that the idea of blockchain is incredibly flawed. One should not allow ownership of a string to be definitive to that thing.<p>I heard people want to put things like deeds on the blockchain but what happens if someone steals your keys? Do they own your home? Of course not. A system should have trusted intermediaries and centralized sources of record. If someone hacks my municipality and updates the record that says that they own my home, obviously that wouldn't hold up and that should be reversed. Why would I sacrifice that safeguard for technical elegance or promised efficiency? Why do I want to allow permissionless transfer of my deed to any party? What problem are we trying to solve here?
Crypto really is "what if possession was 10/10 of the law."<p>I've made this comment before, but crypto always makes me think of bearer's bonds in fiction, where they always introduce the concept and very carefully emphasize to the characters that if they let go of it, even for a second, it's gone, and it's super important to keep hands on them at all times, and the whole scene is just on the nose foreshadowing that the bearer bonds will absolutely be stolen.<p>Well, the concept of "this belongs to whoever is holding it" felt like pretty heavy-handed foreshadowing for crypto too, and what do you know?
The classic story of solving a problem that doesn't exist with an overly complicated solution.
I like how Matt Levine at Bloomberg put it - crypto is just “speedrunning the history of [traditional] finance”.<p>I think a lot of people seem to believe that the current setup of banks, currency, and regulation (writ large) is arbitrary and unique, but a lot of the basic building blocks are actually quite natural consequences of evergreen problems handling money.
its a common pattern in todays society. a perceived problem with the system that is actually a problem with the people running that system leading to the design of a new system that somehow wont allow people to run it and cause the same problems. but then you need to reinvent solutions to every other problem the system solves and learned to solve over its operation<p>there is almost certainly an easier way to fix the problems people are having by making adjustments to the current banking systems, including support for the growth of different banks that simply act more ethically.
Bitcoin does solve a very specific problem very elegantly, it's just a lot more niche than boosters like to think
I agree with you about using blockchains for various things. With Bitcoin specifically, the problem you are trying to solve for is scarcity and a sound currency. It’s a unique asset not just a methodology or tech (blockchain) I’m sure you understand the problem with centralization and fiat currencies. But again, can’t argue with your other points.
I agree. Money, as defined by a storage of value and means of exchange, is uniquely qualified to benefit from blockchain technology. It shares many of the properties of gold (essentially fixed supply, unique history, lack of centralized control, consistent predictable mining, easy to verify, etc). It's better in that its supply is somewhat more predictable, could be more efficient to store / mine and could be sent digitally. Whether that's worth the downsides (mainly that its newer and easier to steal) is up for debate.
[flagged]
The problem is that you may want to sell your house to someone and be denied permission to do so. However, i have not seen any stories of that actually happening to anyone so idk
It works for on-chain bearer assets (ie money), not your home.
It’s not about moving fast or slow. Iirc the employee said it’s a good idea to do or testing before shipping. The CEO said it’s bullshit. AI actually allows you to finally do that pentesting pretty fast.
The is the obvious question anyone should ask when it comes to assets, but of course its not something that interests those pushing for blockchain-based solutions.
This obsession with speed over anything else is why everything is poor quality and feels poorly thought out. What customer would seriously want something this a month earlier that barely works? Suppose it never matters to the execs as they swan off to their next triumph as soon as the bonus/equity is banked.
Actually this is an obsession with profit, which makes more sense. Faster is cheaper and get paid sooner. And consumers often pick price over quality. So this is a civilization dynamics problem.
Related to cultural moral values: 'do the-right-thing even if it doesn't benefit you'.<p>This brings us closer to max payoff of prisoner-dilemma.<p>In this case it's 'do the job right, even if that's not profit-maximizing'.<p>But moral values have been lost.
This winning mentality netted -$6B profit
Homer attempting to fix a stuck drawer with a firecracker<p>Marge: Homer, what are you doing?<p>Homer: Listen, do you want the job done right or do you want it done fast?<p>Marge: Well, like all Americans, fast, but...<p>Homer: Clear _lights firecracker_
Homer: Kids, there's three ways to do things: the right way, the wrong way and the Max Power way!<p>Bart: Isn't that the wrong way?<p>Homer: Yeah, but faster!
> What customer would seriously want something this a month earlier that barely works?<p>Andy's quote is made even more absurd when you consider how long it takes Proton to deliver even industry baseline features.<p>Maybe get to baseline before you start talking about "speed", Andy.
*Everything*??? A bit hyperbolic don't you think? I'm quite happy with the state of a lot of software. There is some which I don't like so much.
<i>"What customer would seriously want something this a month earlier that barely works?"</i><p>Works for whom? For the customer, <i>"works"</i> means the features work. Security is a vague, nebulous thought at the back of their minds.<p>The provider provides features. Lack of security has no impact on them, not in the short term and not in the long term. The short term we can't change easily, because people are people. The long term we could: regulation can turn negligent security into a lasting cost.<p>As much I'm against more regulation in general, I'm afraid as long as we don't do that, companies will always prioritize more features faster over security.
Wait this is the CEO of proton mail? Wasn't that a coveted email service for privacy and safety -- so you didn't have to be on gmail? Brutal.
It's a terrible look and also a missed opportunity. AI assisted coding can do wonders for quality, if you choose to take that path. It's mainly because the AI can help you explore alternative paths and quickly select the best one forward. It's crazy to me a secure email provider would openly promote an AI Slop Cannon approach. I mean what on Earth is so urgent about proton mail features?? Especially since their market are technologists and the product is a luxury product essentially. Completely wild.
Wow unbelievable, that's a total Ratner. (Gerald Ratner was a CEO who tanked his company by making a speech that showed he didn't care about the single thing his customers cared about most).<p>So glad you linked to that, I had missed it. Moving away from proton is now at the top of my to-do list.
The researcher who uncovered today's Claude Code extensions backdoor confirmed that Binance were using said extensions through Cursor.<p>That means one of the working hypotheses is the threat actors had direct SSH access to Binance machines/environments.
do you have a source for that?
that is not good
Take a beat and think about the situation we've found ourselves in: almost every company suddenly has hard, expensive dependencies on a brand new toolchain which is _being tested in prod_; people are giving these black boxes access to their systems, feeding them trade secrets, credentials and all other manner of secrets and PII; these tools are known to escape containment and do ... whatever they please; the downstream ecosystems and almost every other piece of software currently being released are all being developed with (tainted by ...) this shit.<p>The world economy is also being propped up by all of this. In all likelihood, this Binance hack is only a preview of what's to come.
In fairness, the tools are known to escape containment in situations where they’re explicitly told to by irresponsible frontier labs who are trying to make the government ban open weight models
I've only been dipping my toe into coding with claude recently (software is a secondary part of my job, and when I messed with AI a few years ago I wasn't super impressed). After revisiting things, that's the freakiest part. I just can't shake the feeling of "things aren't supposed to work this way". It doesn't feel safe, even running in a VM and being careful not to give it access to anything proprietary or sensitive.
Every company in the world feels "safe" in sending their proprietary code, design documents, and business strategy into a black box that learns from all that and returns code and text, which is used sometimes even without revision.<p>If people are so simple minded they cannot see the downsides for everyone here, except the ones controlling the black box, then I don't know what to say.
"Agents leak DHS secrets after adopting sentiment it discovered on democratic slack channel"<p>Woopsie
Thanks for that link. It is pretty shocking to read that Proton is being run by such a toxic CEO. I'll be looking for alternatives.
Same. Proton customer of about 8 years, I’m considering leaving, I don’t want to support such attitude. It’s not about the AI stance, it’s about attitude towards employees. Proton board, please fire him.
Honestly I felt this way when he commented on welcoming Trump's second term and immediately moved away from Proton. Was a pain but I'm not regretting it.
Really not the message nor the style of good leadership. I don't want my CEO to talk like an eighth-grader.
Very unfortunate. The trash CEO was enough to make me question what is going on. Their trash CTO letter made me move services and cancel.
If I got a message like that I'd be really fast...handing in my resignation.
Wasn't there a project that aims to replace management with AI?
How are Proton and Binance related here?
I think commenter is drawing a parallel, with leadership demanding both high security and high speed, and then putting pressure on engineers to not be "losers" if they can't do both, leading to exactly this scenario.
Conclusion: Do not trust your email security to the clownshow run by Andy Yen. That's almost 180 degree opposite of what direction a company dedicated to secure communication should provide to its developers.<p>And that "loser" comment. Looking at this Andy's mug on google image search and enjoying a mild lol moment. Really, Andy, take a good look in the mirror.
100%<p>To build up a decade of goodwill to just admit to being reckless with our data is unacceptable.<p>Calling his customers (by proxy of his employees) losers for wanting security is wild.<p>The bottom line is that we are in a new world. "CEO" & "CTO" is dead.<p>Engineering is not, nor is expertise. Your new job as a builder is to build your own thing and directly undermine all potential profits at shithole companies like Proton.
> Calling his customers (by proxy of his employees) losers for wanting security is wild.<p>To be fair, that's not what's being said. His insane take is actually you can be secure while being as fast as physically possible, and if you don't think that you're just not working hard enough.
That’s some proper leadership right there
- Captain, there are icebergs front forward, we can go around or decelerate to a pace enabling to safely navigate in between.<p>- You brainless sailor, push engines to their max capacity and in a straight forward line we will arrive to destination in the only metrics that matter, quick and short. Time is money, money is everything, safety measures is for coward losers. Also jump out of my ship in this cold sea full of sharks once you tweaked the engines, your dumb mentality could contaminate the rest of my crew otherwise. You can kiss the feet of the giant golden status of myself as an act of repentance before we throw you.
[dead]
[flagged]
[dead]
[dead]
[dead]
[dead]
[dead]
[dead]
So glad that cryptocurrency is properly decentralized so that one company being compromised doesn't led to massive theft /s
[dead]
[dead]
[flagged]
[dead]
[flagged]
first world problems. geez
Crypto? That's all going away.
Just in time for elections. Now none of the bots/operatives can get paid...oops.
That's why I exited crypto long time ago, I could've been more well off if I kept it but these shenanigans is why I sold everything.
<a href="https://x.com/binance/status/2115918888429133902?a=jScJVx4TNO5KLWV-l5U&s=19" rel="nofollow">https://x.com/binance/status/2115918888429133902?a=jScJVx4TN...</a>
<a href="https://xxcancel.com/binance/status/2115918888429133902" rel="nofollow">https://xxcancel.com/binance/status/2115918888429133902</a>
"reports of a potential security issue"<p>Losing $5b is indeed a potential security issue.
Interesting. I got an email alerting me to a login attempt and requesting for me to verify my device from blockchain.com yesterday. Can't even remember creating an account but I guess it must've happened (I have a lot of forgotten accounts). Wonder if this is related.
Nope, that’s just a running scam. I get a bunch of those from “Ledger”, “Trust Wallet”, and whatnot.
Me too, I got one today, don't think I had anything in there though
I had that too, and I also can't remember lol.
UPD: This is related to the Polymarket security incident, not Binance. Sorry, I missed that.<p>Per Changpeng Zhao (former Binance CEO):<p>This seems to be caused by DebugBear compromise: <a href="https://x.com/debugbear/status/2115866496643535293?s=46&t=_RN2fQnPTv5buAq00Oxwaw" rel="nofollow">https://x.com/debugbear/status/2115866496643535293?s=46&t=_R...</a><p>it appears to be an injection attack on the front end. injecting incorrect tx, but showing a valid tx for the user to sign.<p>Link: <a href="https://x.com/cz_binance/status/2115880474375749834?s=46&t=_RN2fQnPTv5buAq00Oxwaw" rel="nofollow">https://x.com/cz_binance/status/2115880474375749834?s=46&t=_...</a>
I think that's a different hack. Polymarket mostly.
Sorry, that is related to Polymarket security incident, missed that.