Hacked Cryptocurrency Platform Begs Hacker to Please Return $119M

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by gruez on Tuesday December 07, 2021 @09:11AM (#29472603)

>If your use case involves being able to control user accounts centrally, why do you need blockchain for that?

AFAIK the accounts are not controlled centrally. How it works is that the project owners set up a site/webapp, which has javascript that interacts with wallet extensions installed on the user's browser. Members of the DAO uses the site to do various actions, for instance buying tokens or making votes. The site sends the request to the wallet extension to be signed, and then it gets broadcasted to the ethereum network. At the end of the day, the wallets are still controlled by the user, it's just that hijacking the site allows them to fool a massive number of users that don't pay close attention.

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by mushufasa on Tuesday December 07, 2021 @09:16AM (#29472664)

if a single point of failure impacts the actions of a large number of users, that would count as central control in my book

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by carlosdp on Tuesday December 07, 2021 @09:19AM (#29472695)

You don't have to use the frontend they host, it's not an actual single point of failure. Their frontend could go down, and as long as someone else is hosting one (or you download the source from github and host it locally) you can still use Badger.

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by mikeheaton on Tuesday December 07, 2021 @11:13AM (#29474197)

If the failure of this single point led to the loss of $114m, that counts as a SPoF in my book regardless of what the platonic ideal user “could” or “should” have done.

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by diveanon on Tuesday December 07, 2021 @02:34PM (#29477160)

You don’t even need the front end, you can interact with the contract directly.

It’s sad what happened to these users, but they did sign the contract giving the hackers permission to access wallet funds.

This is a failure of opsec.

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by toolz on Tuesday December 07, 2021 @09:20AM (#29472710)

presumably the code being distributed to users could then be redistributed by those users, making this not a SPoF

it just happened to be an overly trusted point of failure

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by carlosdp on Tuesday December 07, 2021 @09:18AM (#29472684)

^ this is correct, BadgerDAO has no control over user accounts, this is purely a frontend that was manipulated. You could redploy the frontend from source somewhere else without asking Badger and it would work just as well.

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by pjc50 on Tuesday December 07, 2021 @11:24AM (#29474376)

> wallet extensions installed on the user's browser

Absolute security nightmare in both directions, this.

[ Parent | on HN ]

Re:Hacked Cryptocurrency Platform Begs Hacker to Please Retu... by diveanon on Tuesday December 07, 2021 @02:35PM (#29477180)

This is why anyone who is serious in this space uses a hardware wallet.

I preach this in every forum I am active in, but if you are messing with more than play money you absolutely need a hardware wallet.

[ Parent | on HN ]