Bybit loses $1.5B in hack
tradingview.com
tradingview.com
The $1.5B Bybit Hack - https://news.ycombinator.com/item?id=43140754
Normally we'd merge that one hither but it looks like that article has more background and the thread is (therefore) better.
eg. Was client software compromised? Did the multisig keyholders succumb to social engineering? Were the signers using airgapped machines / hardware devices?
https://blockworks.co/news/bybit-hack-raises-security-questi...
You'd think they could at least show a blockie representing the contract, or reputational party who cryptographically vouched for it.
But there are better options with larger screens, which actually display contract parameters on the secure device.
I have very limited knowledge about EVM, but those computations are bounded by gas, right? Evaluating them is a finite process.
Ie. engineering work needs to happen in the UI they used to confirm the tx
HW wallet doesn't need to understand the contract logic, it just needs ABI, which is generally a simpler task. Also it can show the name of function you're calling as selector is a hash of a name.
Safe is a bit more complex as it also wraps it in EIP-712 message, but that can also be decoded in a systematic way.
"Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change the smart contract logic of our ETH cold wallet. This resulted Hacker took control of the specific ETH cold wallet we signed and transfered all ETH in the cold wallet to this unidentified address."
[yes, it says 'musked', assuming they meant masked. @safe is https://safe.global/wallet]
Unfortunately most hardware wallets can't interpret EVM smart contract transactions and asks you to sign a big binary blob that is supposed to match what you see on your computer screen (it's literally called blind signing). He said in the tweet and later on a live stream that they verified that the URL was correct, and there were several signers in different locations on different machines.
Logically the UI must have been manipulated for all of them, which I can think of a few different ways to do:
- The signing link was replaced somehow over whatever medium they sent it to each other, pointing to something that either looks like the original UI (perhaps IDN homograph domain) or is the actual site if it has some weakness that allows script injection to manipulate the page
- The server side was exploited to serve a manipulated page
- Client side malware that injects something in the browser to manipulate the page
- Some kind of network/DNS attack combined with mis-issued TLS certificate (or injected CA)
It points to some level of sophistication and long-term observation of their internal systems to know what the process looks like and devising an attack.
Will be interesting to read when/if they release a full analysis.
> According to crypto security firm Groom Lake, a Safe multisig wallet was deployed on Ethereum in 2019 and on the Base layer-2 in 2024 with identical transaction hashes. Ethereum’s alphanumeric transaction hashes are 64 characters long, so deploying the same smart contract transaction hash twice should be mathematically impossible.
> The same transaction hash appearing on both Ethereum and Base indicates an attacker could have found a way to make a single transaction valid on more than one network or could be reusing crypto wallet signatures or transaction data across networks, pseudonymous Groom Lake researcher Apollo said.
> [The hacker] took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address.
Did the hacker physically break into their office or what?
Or some part of their system failed and the key was compromised without them realising it (like the Debian insecure keys debacle or whatever)
Being a crypto exchange in current market is very profitable. If the crypto itself does not collapse, I think it's totally possible for them to repay that sum in a year or less.
> Even considering a huge part of that volume is coming from institutional players who enjoy significantly reduced commission rates...
But the volume is huge. Even if we take the best publicly shared MM rates from Bybit (which is 1.5bp taker commission, 0.5bp maker rebate), and assume the whole volume is traded with these rates, it is still 1bp from 40B dollars, which is 4M dollars daily.
</speculation>
Just last quarter, Coinbase had:
Revenue: $2.2B
Net Income: $1.3B
https://s27.q4cdn.com/397450999/files/doc_financials/2024/q4...
Yet another way crypto moves money from poor suckers to insiders.
What’s so wrong with that?
It’s the same reason why buying a single soda at a convenience store cost more (per unit) than buying a large pack at Costco.
This is like Coke ONLY giving discounts to Costco instead of anywhere else so that Costco can reap the rewards. Walmart, Target, they can all pay full price.
The convenience store spends more money to package individual items. A crypto transaction is the difference of a keystroke. They are not comparable on many fronts.
Tier Taker Fee Maker Fee
---------- --------- ---------
$0K-$10K 60bps 40bps
$10K-$50K 40bps 25bps
$50K-$100K 25bps 15bps
Only those transactions at the higher volume tier get the higher discount (and everyone is eligible for that same discount).
From a societal impact perspective, it adds transactions that may not have happened otherwise, but these are mostly isolated effects from what I can tell. This can spur the economy with spending, and be more efficient. Ultimately however, it ensures that those with more money and the ability to buy in bulk lose less money than the tired masses. This should lead to wealth inequality over time.
Without knowing what impact each of these individual variables has in isolation, it’s difficult to define metrics for “net benefit” to society with any real certainty, let alone begin to measure them.
So consumers are charged 40x. Nice business. TradFi has wet dreams of margins like that for simple exchange business.
Source: Their 2024 10K, pages 92 and 94, and my calculation.
For 2024, in $bn:
Transaction Volume Revenue Cut
Consumer 221 3.43 1.55%
Institutional 941 0.345 0.04%No, what is likely happening with all the convertible bond issues is that MicroStrategy prices the bonds in a manner to attract market neutral hedge fonds, meaning arbitrageurs. Saylor has briefly mentioned these firms, as opposed to firms seeking actual Bitcoin exposure. For issue after issue, they can be spotted as the largest bond holders by anyone with a Bloomberg terminal. By buying the bonds, even when conversion price is at a large premium, and by simultaneously shorting the shares, these arbitrage funds can lock in close to risk-free profits. Due to the convex nature of the value of the convertible bonds, the hedge funds attempt to profit no matter whether MicroStrategy shares rise or decline
Like, a broker profiting off PFOF in the stock market makes sense because there's an underlying asset generating real cashflow that people are buying into. But where is the money in crypto actually coming from? You have to pay miners, brokers, rugpulls/thefts/etc and there's barely any cashflow from the underlying assets (dApps?). But if it really is ~just a casino, with retail gamblers as the only real source of cash, it can still be profitable for smart money to pour billions in and use their PhDs to trade the vol. It goes up, it goes down, overall retail is bleeding huge amounts of cash on a sort of 5 dimensional pyramid scheme but enough gamblers go viral winning the slots/blackjack that the casino doesn't run out of customers.
Can this continue indefinitely? Maybe / probably? Seems similar to sports betting, Polymarket, retail now ~70% of options trading. The west and especially America becoming a gambling culture. The "bubble" may burst and reinflate over and over.
https://medium.com/@bdratings/all-your-models-are-destroyed-...
This sounds exactly like the rationale for the box spreads incident on WSB a couple years ago.
"literally cannot go tits up!"
Where does the valuation of a payment processor come from?
Or is the objection that no one is actually using them to process payments, only to gamble? If so I'd ask for citations regarding the exact market breakdown.
It's value is from speculation assuming future speculation will assume more future speculation
Otherwise, it is clear where the value comes from.
Since it was a profitable broker business, another bigger broker gave them the money to plug the loss in exchange for taking over the business.
It sucks if you're Bybit, but they're going to have plenty of lenders happy to provide them liquidity while they make it all back.
Easy! They give Binance an IOU in exchange for 1.5 billion BUSD which is just "minted" out of fresh new electrons. Neither of them has really lost anything. Everyone can carry on as if it never happened.
In the bizarro world of crypto, this is business as usual.
I often read this sort of comment from crypto-defenders, but is it what banks do?
I’m relatively naive about these things, but my impression is that a bank losing this proportion of their assets can’t just ‘pretend’ they have the money, or create ‘new’ money.
If someone stole a trillion dollars from JP Morgan, JP Morgan can't make themselves whole by creating a new trillion dollars.
The central authority might guarantee the customers of JP Morgan that their money is protected, but they won't print money to make the bank whole.
Another is modern monetary theory (MMT), and in that, commercial banks are indeed the primary creators of money, with the central bank playing a technically more passive role.
Still, in either model of money creation (i.e. classical "money multiplier" and MMT), governmental regulators (which can be the central bank or others) do ultimately control the rate of money creation via various mechanisms.
Your exception is the answer.
Only the central regulator can "mint" money and doing so has real world consequences. The central regulator has financial incentives to limit this sort of activity.
The bizarro world of crypto has no such regulation and as a result, it is inherently unstable.
The proof of this is right in front of you --- it is the fact that "stable coins" exist. The only way to bring stability to the bizarro world of crypto is by tying it to "fiat" --- which is the very thing crypto is supposedly working to eliminate.
Contradict and hypocrite much?
>Crypto is speedrunning the entire evolution of finance to end up at the same place
Those who don't learn from history are doomed to repeat it.
Individuals/banks minting their own money has been tried before. It didn't go well.
These people hear it and think "You mean we get to repeat history?!"
> The only way to bring stability to the bizarro world of crypto is by tying it to "fiat"
False. It's possible to make stable-coins using just price oracle and collateral. "Fiat" is not necessary. E.g. https://www.liquity.org/bold
You didn't even finish reading the first paragraph.
> Bank reserves are held as cash in the bank or as balances in the bank's account at the central bank
The collapse of svb shows how much the central regulator cares about making sure the entire banking system doesn't fall apart, too.
With the way you remarked "false" at the OP, though, I don't expect you're here for an engaging and educational discussion, so I'll leave it here. lol
Most attempts at "algorithmic" stable coins have failed. See TerraDollar, Luna and Titan.
And you just know that the "collaterized" ones are? In most cases, their books aren't open. And they wouldn't lie about this would they?
In some strange way, the crypto brain has been programmed to ignore the obvious with a hand wave and just accept all the chicanery that is crypto.
Maker initially worked same way, but eventually they started accepting off-chain collateral.
https://www.federalreserve.gov/newsevents/pressreleases/mone...
>the Board has reduced reserve requirement ratios to zero percent effective on March 26, the beginning of the next reserve maintenance period. This action eliminates reserve requirements for thousands of depository institutions and will help to support lending to households and businesses.
The central regulator caveat is also a huge caveat to brush aside. During the last round of systemic stress, the banking system essentially got a guarantee that all uninsured deposits would be protected, and banks were allowed to post their collateral for liquidity at terms that no other business has access to.
What OP is referencing is the oft-seen practice in the crypto space where failed entities fill an asset hole with propped up tokens, essentially transforming their paper loss on the balance sheet into liquidity risk that doesn't show as readily.
The important point here is that in the latter case, the entity may be fully insolvent, even after accounting for future cashflows on loans. When it comes to banks, even the left tail cases like SVB, their "problem assets" are things like long term treasuries, which are way down the risk curve when compared to the ponzi-tokenonics style "stablecoins" that we've seen unwind over the past few years.
Both systems stink for those at the end of the chain, i.e. us; you can decide which one is worse.
It was approved by the New York State Department of Financial Services (NYDFS).
The Department has not authorized Binance-Peg BUSD on any blockchain, and Binance-Peg BUSD is not issued by Paxos.
As far as I know Binance ended the Binance-pegged BUSD (the BNB chain version bridged from ethereum) without any problem or holder loss?
It's not that crypto folks don't want some protection from hacks or fraud - the just think it should only be for the rich.
If this isn't enough, I'm sure that every crypto VC would line up to buy a single digit % of their equity to cover up the hole. Crypto hosts the most profitable businesses in the world.
Well, because the retail clients expect to get rich and don't mind paying 1% or so fees per exchange.
Similarly, the BTC future basis (the difference between the spot price and future price) on many exchanges around 10 to 5 years ago was easily 80% p.a. which you could realize by buying Bitcoin and selling the future. What happened there is that people going long Bitcoin with leverage essentially borrowed the money giving them that leverage at usurious rates (this implied rate is not usually displayed and thus invisible to your average retail client, but definitely very visible to the finance professionals moonlighting in crypto (such as Jane Street, Jump trading, and many others)).
Crypto use case: ripping off retail.
The neutral rate for perps is 10%, which is lower than the credit card borrowing rate in the USA. And nothing prevents retail investors to earn it by shorting while holding spot.
Last, Tether is crypto's most profitable business, and likely the world's most profitable if you account on $ of profit per employee, and is not an exchange.
Remarkable dereliction of responsibility. I don't understand why we let them get away with it.
And of course that stablecoin providers conduct AML and KYC when you redeem/mint them. It's like complaining that the gold foundries don't control the secondary market for ingots and gold coins.
This utility has always been at odds with the (relatively recent in comparison to Eurodollars, as far as I understand) desire to and ability of the US government to use USD financial rails as a political tool via sanctions.
Can we trust that? Suppose that ByBit couldn't cover the loss, and the CEO would honestly inform the world about it. What would happen? The crypto-equivalent of a bank run. So he would never say that.
Illicit addresses sending to thousands of random recipients and making them all marked by automated KYC systems.
> Both the sender and receiver need to sign after the first transaction has been mined
That makes no sense; miners don't mine transactions unless they're guaranteed to be valid. All signing must be done before transactions are even published. Otherwise one could DoD-attack the network by having it forward tons of invalid transactions.
Put differently, it’s been seventeen years of constant and escalating mayhem. What would finally be enough to shake your faith?
Bias. I expect believers to have earned a profit or still hold significant quantities of crypto assets.
But in their favor, trust in any currency is the foundation of its value. States create it by collecting taxes and paying employees. Crypto currencies generally lack that heavy weight central authority, so they kind of have to believe to the point where they get burned.
Crypto scams run by top government officials? Oh, wait...
It doesn’t even remotely compare and if you can’t acknowledge that, you’re willfully ignorant or a future mark yourself.
i've seen ponzi schemes and gift card scamming and those tend to make a decent amount, i'm not trying to say that crypto is not suck but just that money kind of is also suck, just buy gold, nobody's scamming you out of gold these days
Permanent and major market crashes is the only thing I can think of .
After the last crash a lot of fraud and incompetence got out because they couldn’t stay solvent, stuff like Celsius or FTX etc got exposed only because of the crash we had in 21/22.
It will take a few crashes, like that, until then scams or incompetence like this incident will not make people loose their money.
Few crashes, then most believers will loose their savings then the faith will shatter not until then.
Most people are after all investing in crypto because it goes up and not because they believe in decentralized currencies. As long as they hear how someone is making money on crypto they will keep believing no matter how many meme coins pull the rug, or exchanges fail or pig butchering or myriad of other scams come to light
I don't really engage in the ponzibucks part and don't touch exchanges except to on and off-ramp, and use crypto to pay for things like hosting, seedboxes, or other services I might not necessarily want my debit card directly attached to.
I like sending vendors $100 and spending $0.00005 in transaction fees and knowing that they'll get $100 (or $99 with some 3rd party integration like Coinbase Commerce) versus spending $100, of which Stripe gets $5 of and the vendor only sees ~$95 if I don't feel like I need the protections of a card, which is frequent but not all the time.
Crypto fits a niche in my life well, despite the wider crypto world having dumb controversies. Just like my HSBC bank account fits a niche well, despite HSBC's wikipedia page being ~50% controversy section by word count.
Coinbase is 10,200x more than you stated ($0.51 to send $100) BUT that’s only if I send directly on Coinbase. Coinbase Commerce takes 1% so it would actually be 20,000x more than you listed.
Stripe is 64% of what you stated ($3.20), and that’s with no processing fee discounts like you can get with higher volume.
Now, obviously, $3.20 > $1 but it’s not apples to apples. You can claw back your money with a card for one. there are many cases where I would prefer to pay the extra $2.20.
By the way, I specifically mentioned Coinbase commerce takes about a dollar: > $100 (or $99 with some 3rd party integration like Coinbase Commerce)
Stripe fees vary, but in a frequent case where a user is using an international card in a foreign currency it’ll very easily get close to 5%.
For me, yeah $2.2 is relatively immaterial. For a provider who’s doing $1MM in crypto transactions? Somehow I suspect that a few percentage points are quite meaningful, and I get the benefit of not having to explain what a seedbox is to my bank if they ever call me.
Again, crypto as a payment method is not for everything. But it’s quite nice to have the option.
> In the United States, the fee averages approximately 2% of transaction value. In the EU, interchange fees are capped to 0.3% of the transaction for credit cards and to 0.2% for debit cards, while there is no cap for corporate cards.
Sensible regulation can make a big difference.
FWIW, I can pay bills by initiating a transfer both in HK and the EU instantaneously and for free.
Note also in your comparison of costs that most people still use fiat, and then pay the enormous fees of exchanges like Coinbase or Bybit that (for retail investors) are ridiculously high. So, a fiat-crypto-transfer-crypto-fiat round trip has another 2% or so on top (plus volatility).
It goes to rewards which go straight back to the consumer.
My main credit card gives me 2% back on all purchases. In cash. Zero annual fee. And it's a card anyone with a normal credit score can get. Nothing special about it.
It really only makes sense to compare interchange fees after subtracting the proportion of them that get paid back to consumers.
Sure, HSBC facilitated money laundering and drug trafficking in Mexico. And when it came out, the fiat response was a huge outcry and putting a stop to it.
The crypto response is to say "screw the laws, let's go all in with money laundering and drug trafficking".
It's like noticing that kitchen knives are occasionally used for murder, and then concluding that it's a good idea to sell machine guns at every corner.
Fiat is indispensable, and (due to regulation) better for legitimate purposes than for crime.
Crypto is entirely dispensable, and (due to its inherent limitations (inefficient, slow, cumbersome)) better for crime than legitimate purposes.
Alternative currencies offer competition and access. Why is that such a problem?
Yet another crypto collapse is in the news every week.
I didn’t risk losing everything to scams. When I forgot my password my brokerage was able to restore my access. When I made a mistake in a transaction I was able to call them and sort it out.
Meanwhile, despite the incredible runup of BTC I know precisely zero Bitcoin billionaires. I know people who have theoretical fortunes on hard drives that have died. I know people who mistimed purchases and sales and who’ve perhaps turned a small profit. I know people who turned a large profit and then lost it all to malware or exchange failure.
So yeah, I do know what happened to the BTC holders.
And USD is in the much better shape than most other world fiat currencies, look at Zimbabwe, Argentina, Turkey or Russia.
The difference is that crypto hacks are rare, random and fixable (Bitcoin ETFs have the same brokerage protections), but fiat money hack is universal, systemic and legalized.
1. Upgrade protocol to include protections for well known cold wallets held by exchanges (ex: API call has to be made to the exchange's security endpoint to validate each transaction out of the wallet. Exchange staff would need to manually allowlist large transactions before they are transmitted).
2. Decentralized voting on reversal of transactions (90-95%+ vote needed to reverse to avoid 51% attacks)
People who control or take advantage of cryptocurrency don't want this to happen.
Couldn't you technically just 'git checkout' a previous commit from before the fraudulent transaction occurred and pretend it never happened? Isn't the real problem that you'd have to convince a majority of users to do the same?
Something like that would probably be overkill for individuals, but most people would definitely benefit from some added on chain bureaucracy regarding how their accounts are managed. And yes, for many this would lead to a system that isn't notably less centralized than the traditional banking system. But people would at least have a choice as to where their wallets gets to sit on the bureaucracy <> complete freedom spectrum. And even if they end up closer to the bureaucracy end, they'd have a lot more flexibility and lower administrative fees than what they currently have.
Unreal.
He just left off the implied part.
I spent several years pointing out to my last employer that every former employee could have walked off with secrets that allowed them access to our backends. The were already slowly working on hardening write access but read access was still being worked on a couple months before I left, when I got to write about half of the last mile code for the user facing bits.
This is not a unique experience by any means. I’ve seen this sort of thing enough to pay attention when acquaintances bitch about it too.
But one mistake we make over and over is that we write code that just does its best to answer questions as quickly as possible. And when those questions show up 10x as quickly as they have any other time in our company history, they either just plug right along or maybe throw an error.
Someone shouldn't be able to empty a billion dollars out of an exchange in 10 minutes, unless they do $250B in daily traffic. And I suspect most of them can be, and in even less time than that.
There is no action on the CEO since the hack in July 2024. He sits in Dubai. He just got a nod from Supreme Court of SG to just average out the funds and distribute it among the users.
No action has been initiated against the company/ceo for losing the fund. He is geared up to launch another company/exchange.
CryptoBros are all about “no laws, do whatever” right up until the, inevitable, point at which /they/ are getting swindled and then they want to cry foul and run to the authorities.
It’s just like the whole DAO situation which showed “Crypto is immutable and we want to live and die by the code unless of course someone finds a flaw in the code and steals our money, then we will roll back the immutable chain to recover it” what a farce.
This explains strategically erratic behavior in communities like loot crate gambling. The low end and high end can rely on state protection. The center of the curve needs to look like a problematic target, and maybe draw attention to their competitors.
This isn't your run-of-the-mill Coinbase style exchange, right?
Bybit CEO Ben Zhou wrote on X that a hacker "took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address."
> Article 12 – dealing directly with the acquisition and disposition of interests (including security interests) in “controllable electronic records,” which would include Bitcoin, Ether, and a variety of other digital assets ... a good faith purchaser for value who obtains control (a “qualifying purchaser”) takes its interest free of conflicting property claims... Control under Article 12 is designed to be a technology-neutral functional equivalent of “possession.” It generally encompasses circumstances when a party has the “private key”
> The wallet has sold around $200 million worth of stETH so far
If some of those sales took place within jurisdiction of a U.S. state that has ratified UCC Article 12, then the buyer of the stolen cryptocurrency is now the new legal owner.
2023, American Bar Association, https://www.americanbar.org/groups/business_law/resources/bu...
.. “take free” regime introduced by the 2022 UCC Amendments for these assets. Under these rules, a person who acquires a CER for value, in good faith and without notice of any conflicting property claims, is deemed a “qualifying purchaser” and, as such, takes it free from any preexisting property claims.
The 2022 UCC Amendments draw heavily from the UCC Article 3 provisions for negotiable instruments, and these provisions have the effect of making CERs negotiable. It follows that if a secured creditor obtained a security interest in CER inventory and only perfected by filing, that creditor would be at risk of the debtor disposing of the collateral and transferring control to a qualifying purchaser that would take it free from any competing claim.As in: "The hacker gained access to" "The hacker took charge of" "The hacker assumed authority over"
Did the cold storage wallet contain users' ETH? That seems implied by "Can Cover Loss".
If so, why does a crypto exchange hold users' ETH in a wallet that can execute transactions without said user's authorization/password for each transaction. Doesn't even Facebook require entering a password every time to change certain profile settings?
Or maybe more generally, why does there need to be such a large cold-storage wallet to run an exchange?
Also how or why would they have the assets to be able to cover this?
There's some other seemingly conflicting info I found in searches for Bybit:
- Bybit is not legal in Canada. Bybit is restricted in Canada and other jurisdictions, including the United States, the United Kingdom, and Singapore.
- Bybit originates from Singapore, a global hub for cryptocurrency and blockchain technology. Singapore has a favorable regulatory environment for cryptocurrencies, which has attracted many exchanges to establish their headquarters there.
- There's also a mix of results where some say Bybit is safe/secure and others saying they aren't (irrespective of this event). This story seems to indicate that they had measures to make it safe, but it didn't save them.
I have yet to see a thorough explanation of what specifically was hacked here anyhow
Surely you'd allocate a new wallet/1m roughly and always keep it spread.
In any case, since this hack was performed by a nation state actor (Lazarus Group/North Korea), being caught is effectively meaningless.
If someone complains, remind them that Tornado is illegal in US.
https://www.forbes.com/sites/javierpaz/2022/08/26/more-than-...
The current deletion is for reasons that include lack of NCORP (Notability (organizations and companies)). And they back that in turn by saying that the sources are weak.
I understand on one side that they don’t want every company in the world to have a Wikipedia page. Because the point of Wikipedia is not to promote or legitimise every company in the world.
But you’d think that at the point where widely covered news of a hack leading to a loss of a billion dollars and a half, would be reason to have a Wikipedia article about it.
And instead they went and deleted the article today.
There’s probably additional editing of the page itself that you can dig into the history of if you want to see what happened during the past couple of days leading up to the page being deleted again.
For me, I’ll file this under Wikipedia Editors gonna Edit. They have all kinds of edit wars and page deletions going on all the time in the background that the rest of us mostly don’t even notice most of the time. And all over I’m still happy with Wikipedia for all of the information it has collected within.
https://en.wikipedia.org/wiki/Wikipedia:Speedy_deletion#G4
Here's the discussion from the second time it was deleted:
https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletio...
They're basically saying "nah, that's spam". So when it was recreated yet again, of course it was speedily terminated with prejudice because it just looks like another spam attempt.
Not sure if there's a rule against covering news stories. Seems like we wouldn't want an article on every news event (I'm pretty sure there is a rule against that), but Crowdstrike got an article.
I suppose that over time the article might grow. Either way it’s nice that someone put in the work to make a new article that records this hack.
Just like I would expect Wikipedia to have an article on Enron and their shenanigans, or the Norwegian language version of Wikipedia to have an article about the NOKAS robbery, I think it makes sense that Wikipedia has a record in its articles about the largest crypto hack so far. And that this hack is mentioned in an article about the exchange itself.
Bybit claims to be regulated by the Virtual Assets Regulatory Authority of Dubai.[1] But the lookup page at VARA says they only have "In-principle approval", not a full license. "Applicants holding an IPA are strictly prohibited from initiating operations, conducting any virtual asset activities, or servicing clients until they have obtained their full VASP licence from VARA."
Uh oh.
[1] https://www.vara.ae/en/licenses-and-register/public-register...
CEO on X
What possible motivation would he have to not tell the truth, the whole truth, and nothing but the truth?
Harumph!!!
Gentleman, please, rest your sphincters!
If you have a balance in ByBit, get it out NOW.
Unregulated asset exchanges. Haven't we been there before a loong time ago?
There are no American infidels in Baghdad. Never!
The second they have to pause withdrawals and look weak, it could be game over from the (additional) reputational damage.
Um how tf does a cold wallet get hacked?
They used a gnosis safe which is a smart contract multi-sig wallet that is pretty much the gold standard for Ethereum.
They believed that all of the signers' pcs were hacked and that the UI for signing was staged with a fake element to make it appear like a normal transfer.
They were signing with hardware wallets, but it's hard to verify what you're signing from a ledger typically.
What they ended up signing instead was an upgrade to the smart contract giving control of the gnosis safe to the hacker who then drained it.
1) Their multi-signature wallet signing employees lazily clicked through in unison to approve a new smart contract without examining the contents to see if it was unusual.
2) Bad security architecture to keep too much in a single wallet that wasn't properly kept cold. There should have been a few fully cold wallets, that only rarely transact with mostly-cold intermediary "airlock" wallets which are also separated from the exchange operations and wallets. The signers also need to be different combinations of people for each of those wallets - preferably some of those signers being additionally liable 3rd party technical experts.
when code is law, there can't be any bugs or vulnerabilities, only features.
what r u talkin ab?
A "cleverly masked exploit that altered the smart contract logic"[1] = congratulations!! the contract gives you $1.46B free money!!
I anticipate that the defi community will celebrate the inexorable operation of their logical contracts.
[1] https://cryptonews.com/news/bybit-crypto-exchange-faces-1-5-...
When you decentralize finance like this what becomes okay to do according to system rules is exactly what is possible to do according to system rules. We don't have humans in that loop anymore to enforce moral judgments about what constitutes unlawful theft (except for 1 or 2 rare "hard-forks" of various blockchains to reverse devastating transactions).
I feel bad for people who lose large volumes of cryptocurrency to malicious actors in the same way I feel bad for people who lose large volumes of real money to a casino.
It is 2025 now and we all know that anyone who can somehow get your private-key to whatever blockchain backed assets you have "owns" those assets just as much as you do and they are permitted to take them under the rules of the system so whatever you do do not lose that key.
There is no higher arbiter of justice in this space so use it at your own risk.
https://en.wikipedia.org/wiki/Bitcoin_buried_in_Newport_land...
I wouldn’t call it justice, it’s more like falling down and instead of being helped up you’re just kicked some more. It feels like a cruel set of circumstances. It does feel like trying to find the drive is also living in denial, given the odds.
https://ethereumclassic.org/blog/2024-04-03-ethereum-classic...
Are those appropriate sources?
This would be like finding a quote from some old poorly maintained Linux distribution and attributing quotes from the maintainers as being representative of all kernel developers.
While I must admit that I have some anti-cryptocurrency biases, I am also not that familiar with the cryptocurrency world. I really appreciate you sharing your knowledge.
The industry cannot appeal to the protections of law enforcement, civil tort, and other features of the regulated banking system, without simultaneously undermining the "crypto" part. If you're going to summon authorities when hackers hack, you're no better off than if you just acted like any other bank and stored the client's balance in an excel sheet.
Is this really an accurate characterization of "the original idea"? And according to whom?
I personally know of at least one person who was able to escape Russia at the very beginning of the Ukraine war because cryptocurrency was a viable way for his brother in America to fund his escape despite sanctions and other hurdles.
Every pseudo-intellectual thinks that the fiscal world is "too complicated" and they're going to "simplify" it by making some token, only for people to realize that the monetary world is just complicated, and they have to reinvent everything that already existed in the traditional banking system.
I had to do some work on an ACH system a couple years ago [1], and I read through a large chunk of the ACH standard, which was about 800 pages. It's easy to see and hear that and think "that's way too complicated, what could possibly be so hard about money transfers that necessitates an 700 page specification??", but as I read it and saw how many edge cases it took into account, it was easy to see why it got so huge. It turns out that dealing with money is just a really hard problem at scale.
I fell for the cryptocurrency hype of 2021, and I will fully acknowledge that that came out of a complete lack of understanding of how fiscal systems work. I wish everyone else would just grow up already.
[1] Usually disclaimer: not hard to find my work history, it's not hidden, but I ask that you do not post anything about it (or at least any proper nouns about it) here.
What you are describing are the systems of power which create a stable financial system. That is, one where you can put a nickel into a bank account and expect it to be there in a year or a hundred years.
That indeed requires a complex web of power structures, because its top line goal is to be stable and dependable. And stability within a complex landscape requires an equally complex network of power.
Crypto provides the exact opposite value: it cannot be controlled, no matter how robust your power structure is. It can be insured, at a significant cost, but not controlled.
That means in the face of even totalitarian powers someone could still move crypto across any boundary that is permeable to information, which it turns out is a set that roughly approximates the set of all boundaries.
This is a terrible way to pay for candy bars, because candy bars are not worth insuring.
But what I think the crypto opponents miss is that there is a set of transactions—some criminal, some legal, some immoral, some righteous—which cannot be made in a state controlled financial systems.
And that these transactions are what gives crypto value as a currency.
To me, where I would like the debate to go is not “is crypto a scam?” but “how does society protect people from the violence facilitated by crypto?”
Yes, financial “violence”, which can be insured against, but also real violence: human trafficking, extortion, etc.
We anarchists sometimes like to pretend that without rulers we will be freed to care for each other. But in the shadow of a history of violence, there will be more violence too.
And the “crypto is a scam” argument I fear is a red herring that distracts from this, the real issue.
Or if government is smarter, they can slowly gain control over it. Allow trading traceable currencies via official channels, but with good KYC measures. Do not allow fully anonymous systems. Go after mixers. Prosecute exchanges which do not verify their customers. Once there are plenty of government-sanctioned exchanges in the country, there will be little incentive to create unsanctioned ones, and someone with coins that were marked "North Korean-originated" won't be able to spend them in the country.
This is such a naive claim parroted by crypto enthusiasts. Lots of criminal things can't be 'controlled' (e.g. stopping people murdering, stealing, etc.), but there are consequences if you do them.
Crypto could easily be controlled by laws or punitive taxes. KYC is a step in that direction. But still this claim keeps coming out. All they need to do is control the off-ramps.
It's like the one "but, but, there will only ever be a fixed amount of BTC, so it's valuable!". There will only ever be a fixed amount of my turds, but I don't see them up for auction. It also doesn't explain why BTC is the valuable one but not all the clones (spoiler: it's the brand name).
It's easier to just parrot some grifter's justifications than actually thinking for yourself I guess.
Some people even brand their own turds with their own name, and drop a $TRUMP and dump.
I will admit I used a bit of shorthand, but the paper is providing a “simple” solution to a “complex” problem.
There are interesting character analysis to do between the book and the movie version, where the book version or Dennis Nedry is way more sympathetic (even if flawed), he's a extremely talented IT guy who was undersold the amount of work to do in the park, kinda stuck doing unpaid overwork in a remote island and generally been fleeced by a way more villainous book John Hammond.
Don’t forget FTX willingly hired the Ultimate Bet “god mode” guy.
> The wallet in question appears to have sent 401,346 ETH ($1.1 billion) as well as several other iterations of staked ether (stETH) to a fresh wallet, which is now liquidating mETH and stETH on decentralized exchanges, etherscan shows. The wallet has sold around $200 million worth of stETH so far.
If you showed me a paragraph like this a decade ago and told me it was from 2025, I would have a difficult time believing you.
It has this kind of veil of "high techness" to it that is appealing to smart-but-uninformed people (like me in 2021). I'm embarrassed that I fell for it, but on the bright side it does make me a bit more sympathetic for other people who also fell for it.
I don't think most academics would fall for the "Nigerian Prince" chain emails, or the "Romance Scams" you see on YouTube, which are things I usually associate with extremely gullible people.
Pretend money, at least in my opinion, is not one of those uses.
These things can take time; it might be thirty years or more before someone does anything actually useful with the stuff learned from the crypto world.
I don't know about you, but I barely follow cryptocurrency news, and I've still been hearing about major players getting "hacked" several times a year for over a decade.
Either it's Mt Gox or FTX or The DAO or Bitfinex or QuadrigaCX or Terra/Luna or rug-pull meme coins or dollar-backed coins that actually aren't or any of a dozen other things.
Anyone who isn't being extremely careful to avoid scams, given the constant drumbeat of reports about how you have to be extremely careful to avoid scams when dealing with cryptocurrency, is pretty gullible.
My parents, both smart people but neither of which know much about distributed systems or concurrent computing or cryptocurrency, see the news reports about Mt Gox or BitConnect and think "that sounds like a scam", avoid it, and put money into a Vanguard or something.
On the other hand, you have people like me (and probably a not-insignificant percentage of people on HN), who have learned a fair amount of distributed and concurrent programming, and see the "neatness" factor of cryptocurrency, and since the crypto is laundered through interesting tech, we fall for it.
I haven't touched any cryptocurrency since I fell for the unregistered security calling itself Gemini Earn [1] (so almost three years now), but I did think that stuff like Filecoin was pretty cool. Hell, I'll still acknowledge the coolness factor of stuff like Filecoin and Storj and Sia. I just think that the currency itself is wishful-thinking-at-best, and fraudulent at worst (probably somewhere in between).
I don't think I'm an especially gullible person, but no one thinks that they're gullible, so I'll acknowledge that I probably am, but I think a lot of the educated people who got into crypto got into it because they kind of had horse-blinders on when looking at the interesting tech.
[1] Not my opinion, but the SEC's for what it's worth: https://www.sec.gov/newsroom/press-releases/2023-7
Crypto is the same thing. You put money in and you may cash out quickly with a big number, but someone who knows can swoop in and steal your money in a way that is much easier than if you used more traditional investment and banking vehicles.
¯\_(ツ)_/¯
My thought was it will some day either be worth a lot or be worth 0 and I'm OK with both of those possibilities. I don't really think I was gullible about anything and yes I thought about it as a risky investment that turned out to pay off quite well.
For context, guluarte is referring to a moderately contentious hardfork done by the Ethereum developers and mining community to reverse TheDAO Hack in 2016 or so. The stakes were much larger then -- Ethereum was newer, not yet battle tested, and TheDAO had something like 10% of all ETH in it.
A fork was formed -- "ETH Classic" -- ticker ETC -- which did not reverse the DAO hack, and you can see from valuations that the public preferred the reversal.
Code is law, up until it costs me.
Other transactions besides the one that created 184 billion BTC in that block was effectively “rolled back” on the working chain.
No interesting discussions ever. Just axes being sharpened and people who dislike it taking the opportunity to gloat. I would characterize the pro crypto people but I don’t see any. Which is said because over the last 5 years I have found crypto, bitcoin, and stable coins to be extremely useful when helping family members in emerging markets.
But hey it’s all trash, the west doesn’t need it so let’s all dance on its grave.. i guess we will keep dancing for another 15 years.