The Resolv hack: How one compromised key printed $23M
chainalysis.com
chainalysis.com
A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment
They used KMS to sign the minting operation, but they didn't "take" the key, AWS KMS doesn't let you extract keys.
There's no shortcut to MPC/multisig with 3+ keyholders.
Obviously.
> There's no shortcut to MPC/multisig with 3+ keyholders.
The whole concept of a stablecoin seems to be based on centralised trust. Ultimately there is some org that has the fiat bank account, that mints and redeems the coins.
Ok, but how was the AWS infrastructure compromised? This appears to be the crux of the entire article.
AWS is very hard to break if you are using the IAM roles properly and avoiding manual secret management. If the only thing that can even sign a JWT is a very specific blessed EC2 instance that has exclusive access to KMS, your attack surface is nearly zero by comparison to a similar setup where administrators use email or Discord to communicate API credentials.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-role...
The protocol around using an HSM is just as important as the machine itself. It seems like some of us are going to be speed running PCI-DSS the hard way.
They also had a smart contract which didn't do some proper checks, but the hack was only possible with the stolen private key. Whoever held the private key was able to mint a lot of money, unchecked.
So there was a traditional hack at the core of this heist, not just a smart contract exploit.
But for online armchair speculation, you have to admit it seems a likely explanation.
Why would I do this when I can already receive actual USD without any extra ceremony?
Stablecoins are a solution in search of a problem.
Waiting to hear what "most people outside the US" are supposed to need those stablecoins for.
If you fall into the middle bands of uses, or in the upper class that can just bend or make the rules, then the financial system is well oiled and it looks like the people questioning it are just cranks.
It's true that a lot of those in the outer bands are criminals but others are things like "buying a truck to build an orphanage for starving Iraqi children just outside of terrorist territory" or "wanted an investment visa in some corrupt island paradise and as it turns out no bank will open up account for purposes of 'international wires to the Comoros' "
Come on now, that's absurd. If this is your best use case for stablecoins - groping for concocted scenarios to rationalise their existence - I stand by what I said earlier: they're a solution in search of a problem.
The other example is somewhat concocted but rooted in the time I spent in Iraq and noting almost all transactions are performed outside the banking system, in part because banking is inaccessible and people often don't have access to KYC documents.
It's really not absurd. As soon as you start trying to do anything interesting the KYC/AML burdens get greater until eventually you realize the compliance officers are just trying to get you to go away (or just deny you outright), get interesting enough and then suddenly despite fully complying with the law you find the walls are closed around you. Most people never find out because they never have occasion to try, they do a bunch of boring domestic transactions plus maybe some international trade with a few well known entities, then they just shout people are making up absurdities.
I also don't entirely understand why you're even rationalising the purpose of the account to the bank. Can't you just open an account for any purpose? It takes me five minutes to open an account online, and I've never once been asked to explain or justify anything (in many decades). I use my accounts robustly, including for international transfers (I've lived on two continents in the last four years). I even once paid for a trip to North Korea out of an ordinary bank account. My bank never batted an eye.
Maybe you're just dealing with a bad bank, or an over-regulated banking system (Europe?). You realise you can walk into any US bank right now and they'll just open an account for you with nothing more than some accurate ID? And the same holds for much of the rest of the world? The problem you're trying to solve is already solved.
>> The other example is somewhat concocted but rooted in the time I spent in Iraq and noting almost all transactions are performed outside the banking system, in part because banking is inaccessible and people often don't have access to KYC documents.
Unsophisticated semi-literate farmers are the last demographic anyone is reasonably expecting to open their crypto brokerage accounts and start trading synthetic USD derivatives.
These are just not realistic scenarios. This is what people say when they rack their brains trying to come up with some reason stablecoins might be useful. I feel like you're just confirming that they're a solution in search of a problem.
There's an ocean in the way, not to mention how risky visiting looks right now. I changed my name recently and the one US bank that I managed to get an account with (so that US clients can pay me without weirdness) won't accept any kind of documentation without going there in person (and I'm not sure I can provide anything they'll accept even if I did go there in person). What now?
People in the middle bands of uses are just ignorantly bliss. And moving between "2 continents" in some vague most likely semi-developed white listed countries in most cases doesn't fall outside the middle bands of uses. So you end up with people shaking their fists at the sky crying that crypto exists, with their fingers in their ears and loudly proclaiming anyone using it are just making up absurd contrived scenarios.
Lol. Thanks, Mr Google Esq.
I was indeed in North Korea. It was not particularly hard to get to before COVID (I'm told it's harder now). You have no idea what the laws of my jurisdiction are were at the time I went, or the purpose of my visit and whether sanctions even extend to it, whether I sought any exemptions from my government, etc - but please tell me more about all these alleged serious crimes you've just discovered on Wikipedia.
>> So you end up with people shaking their fists at the sky crying that crypto exists, with their fingers in their ears and loudly proclaiming anyone using it are just making up absurd contrived scenarios.
See, the problem with all your posts is that you're just spinning one tale after another. You need crypto for all the orphanages you're building in war zones. You need crypto for illiterate Iraqi farmers. You need crypto for your Comoros citizenship purchases. Never mind that none of that makes any sense - it's everyone else who's not listening to you! And all your super legitimate, not at all made up, not at all tax fraud related use cases for stable coins!
Get real.
Suddenly when it comes to your North Korea escapades (while proclaiming about mr. "everyman", lmao) I just don't have all the facts and nuance, but you just handwave away any of the uses I point to. Get real.
It's relatively trivial to visit North Korea, and there are many reasons one might do so that may not fall afoul of any sanctions (journalism, research, aid, and so on). It's ludicrous to proclaim you're building orphanages in Iraq for which you require crypto stablecoins. These are not even remotely comparable claims.
Seems as if you don't like it when your own logic is used on you. Which seems like a bit of a pattern with your posts, to be frank.
Your claimed use cases for stablecoins are utterly fantastical and I think your posts speak for themselves.
there are like 50 (many YC) startups fixing this today trying to offer your the best and cheapest service
In EU countries, you can't now buy a car with cash. You have to buy a bearer's check from your bank, which is expensive, requires that both parties have a brick and mortar bank, and doesn't work cross-border. Stablecoins solve this.
The fact that it's not widespread doesn't mean that there isn't a usecase.
From a legal standpoint, the bank transfer speed is anyway irrelevant - you first sign a sale contract that makes the car yours and the money theirs, before anything actually exchanges hands. If one party fails to deliver the money or the other fails to deliver the good, they are anyway liable. With instant transfers, the buyer is more likely to get scammed; with delayed transfers, both the buyer and the seller are equally as likely to get scammed - that is the only difference.
DAI is decentralized and stable
> an attacker was able to mint tens of millions of Resolv’s unbacked stablecoins (USR) and extract roughly $23 million in value
It's not like I forgo a lock on my front door just because my windows are made of glass.
Blockchain with central authority is the worst of both worlds.
Of course n can be smaller and the specific people less trustworthy, but that's quite a different thing.
With decentralised money, you get the safety of a globally distributed attestation backed by cryptography without a single authority controlling the supply of money or your funds.
There is no halfway option. You either have a single authority that can exercise control or you do not; number of delegates for exercise of control is almost irrelevant since you can change banks.
FDIC deposit insurance does not protect against losses due to theft or fraud, which are addressed by other laws.
[] https://www.fdic.gov/news/fact-sheets/crypto-fact-sheet-7-28...
I guess Hollywood has mislead us yet again in pretty much every bank robbery scene with dialog like "Nobody panic. We're not stealing your money, we are stealing the bank's money".
At least when I report fraud to credit card or my bank, they can stop or undo/chargeback a transaction.
As long as you burn as much electricity as Andorra does in a week just to make a transaction, you're probably a cryptocurrency. And that's their sole benefit it seems.
Absolutely not. Cryptocurrently exclusively refers to permissionless, decentralized, cryptographically secured, irreversible, fungible monetary system with a disinflationary or non-inflationary supply, following a voluntary, collectivized governance model.
A vast majority of tokens colloquially referred to as "cryptocurrency" couldn't be further from these principles. There are no stablecoins that are cryptocurrency. Ethereum is not cryptocurrency. Any coin issued by a corporation (e.g. Ripple) is not a cryptocurrency.
We need different words for these fundamentally different things, because conflating them causes real confusion, as this very hack demonstrates. People are surprised that an admin can lock transactions precisely because the word "cryptocurrency" led them to assume properties that don't exist in stablecoins.
Idk, it's been a while and my memory is fuzzy.
Your money is safe with us. We promise. With lot less oversight than most other solutions for holding money...
"Only" ?!!! Poor thing.
Yeah $25m is only little but could still be useful
.
Yes, it's a pain to operate, but if the alternative is "the bad guys get all of our money", then it can be worth it.
It’s as if one of the things your root certificate authority signed got compromised. It doesn’t help that your root key is safe if attackers still managed to impersonate you before you revoked that cert.
> privileged private key to sign off on how much USR could be created. Unfortunately, the smart contract itself did not enforce any maximum limit on minting – it only checked that a valid signature existed.
The offline idea simply doesn’t work because this particular key has to be online
You can criticize their design, but you can't have a dude burning a CD-ROM every time someone wants some coins.
It seems to me that their initial value is 1usd per token (or some other fiat I guess) and that's also the roof of their value: they kinda guarantee that they won't become more valuable than that.
They are less usable than fiat: more businesses accept fiat than crypto, especially weird and small coins like all stable coins are.
There isn't really a floor to their value, as demonstrated here.
I see plenty of downsides of owning one of these coins, but not a single upside?
Yet people apparently do buy them, so what is the upside? There must surely be something that's good about them?
For a rounding error value of "commonly," sure. (Catering to a financially-constrained market is good business. But it, by definition, will never be an important one in the grand scheme of things.)
As always, things are certain until they aren't. Technological innovation always starts with fringe use cases, before becoming more widespread.
The main use is just having something dollar-like that you can move around easily. That’s useful outside the US, but also for plenty of people inside the US depending on what they’re doing; especially businesses that have a hard time getting or keeping normal banking (cough gambling, porn, weed cough).
They’re handy inside crypto since you can move in/out of other assets without touching a bank. And sometimes you can earn yield on them, which is part of the appeal (with the usual “this can blow up” caveats).
Also, there’s a reason every company wants to launch one: if you control the stablecoin, you get the float and the rails. That’s a pretty nice business if people actually use it.
If you already have solid access to USD and don’t care about that flexibility, they’re less compelling.
But yeah, not risk-free at all (depegs, issuer risk, etc). And honestly there probably isn’t much real need for dozens of slightly different stables beyond the business incentives.
That... Actually makes sense.. Which is a rare feat for crypto!
The ones I use are several orders of magnitude less friction and most are 100% free. The ones that do have a cost (for recipients outside Scandinavia basically) are still way, waay cheaper than crypto transactions.
No sign-up fee, no recurring fee, and no transaction fee. I guess it's a loss leader for banks? But if one bank stopped supporting it, they would find themselves without customers in less than 24 hours, so it's a worthwhile loss I guess
- Print a paper form, fill it by hand, scan it and send it. A human will review it next week and agree (or not).
- If you receive money, you have to prove the origin. If you can't, or if the bank finds it unsatisfactory, they'll freeze it. Often, they'll freeze your account right away. You have little legal recourse.
For the record, I once wanted to buy a car in a foreign EU country. I had the contract, it was from a recognized dealership, etc etc. The bank refused to send it. I had to open a Wise account, wire the money there, and then sent it to the dealership.
Overall banks are nice, most of the time, but can create a lot of problems when you need them, especially now that the EU is having an AML inflation under the US and FATF pressure and everything is managed by AI with no human in the loop.
I understand that you couldn't care less about people who aren't having the exact same life as you, but maybe consider that one day it will change and you'll need a freer transaction infrastructure.
And crypto transactions are almost free nowadays, if you avoid Ethereum and Bitcoin. A transfer on Arbitrum L2 costs 0.002$[0]
[0]: https://arbiscan.io/tx/0x92122f1df5e8811f4d0cbf44f210074f5bb...
But obviously...things happen. Just like cash is usually relatively non-volatile, but financial crashes happen.
So why use stablecoins and not use cash? When you want to quickly convert to/from a token (60 second not 6 days), but for a short period have a stable value. Or you want to avoid banks.
I.e. trading, gambling, drug deals, money laundering, etc.
then probably mix them via different methods
then sell them via OTC-style swap platforms like fixedfloat / changelly etc
> Trump Administration Likely to Un-ban Bitcoin Mixers, Dept. of Treasury Says They are “Not Unlawful”
I also dont mind the whole chain coming together to vote to reverse the transaction.
I also dont mind a bunch of people being unhappy with that and forking.
In a western legal framework you might argue promissory estoppel if the foundation made certain statements about it, but if you take the libertarian code-is-law stance and you want to be consistent then you probably should have researched exactly what was possible at that level before investing.
So all-in-all, seems fine to me.
While I am happy to celebrate dumb crypto stuff, this isn't a situation where someone's code was "exploited." Their code was stupid, relying only on an off-chain private key to allow the minting of tokens. Their security was just also bad.
Now, as to why the SEC hasn’t regulated crypto out of existence.. I refer you to dementia Don
The contract relied on the key to mint new tokens. The hacker gained access to the key (through AWS) and with it minted as much as they'd like. It is certainly a valid take that a contract that only required the private key to mint an unlimited amount of the token isn't a good one, but you don't exploit someone's front door lock by grabbing the key from under the welcome mat.