News for hackers. Stuff that matters.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by rasz on Thursday February 03, 2022 @06:14AM (#30191066)
>It's interesting that this commit was made ~9 hours ago and the exploit happened a few hours after that.

Where do you find employees, even $500K/year ones, you would trust not to pick up $300m just sitting there in the open for the taking?

Hey team we need to patch this bug allowing anyone to drain all the funds of our company, get right on it while I browse Taycan options to match my wristwatch color.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by astoor on Thursday February 03, 2022 @06:30AM (#30191167)
Do you even have any incentive to find employees that won't steal, if you've already made off with millions in pre-mine or up-front no-commitment investment? Cryptocurrency and DeFi is one giant moral hazard.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by gitfan86 on Thursday February 03, 2022 @06:42AM (#30191240)
But even in a world where everyone is a good actor, bugs and accidents will still exist. Then what happens when someone accidently sends money to a wallet where the owner is dead or unreachable?

Why would anyone want to put their life savings into that situation?

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by whywhywhywhy on Thursday February 03, 2022 @08:10AM (#30191935)
Because (they believe) the alternative is just as bad if not worse.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by yrro on Thursday February 03, 2022 @06:38AM (#30191216)
I guess you don't want the employees to steal from _you_?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by Tenoke on Thursday February 03, 2022 @07:40AM (#30191689)
Neither of those seem to apply to wormhole..
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by Taek on Thursday February 03, 2022 @07:03AM (#30191396)
I think you'd be surprised. People take a lot of pride in their work and in their professionalism. Crypto has many examples of people leaving $100m+ on the table so they can properly fix a vulnerability.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by throwhauser on Thursday February 03, 2022 @09:39AM (#30192950)
> Crypto has many examples of people leaving $100m+ on the table so they can properly fix a vulnerability.

It all comes back to trust.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by capableweb on Thursday February 03, 2022 @06:44AM (#30191255)
> Where do you find employees, even $500K/year ones, you would trust not to pick up $300m just sitting there in the open for the taking?

As with any crime, you rely on the risk (and potential punishment) being higher than the reward. In this case, because it's based on blockchains that are public, immutable and very easy to trace, it'll be hard to impossible for the one doing the drain to actually get away with it. They can try to go to a exchange to get actual money out of it, but the exchange will most likely have blacklisted the addresses involved. They can try to tumble it, but the exchanges will mostly likely blacklist your account if they see any tumbling involved as they can't fulfill the KYC/AML laws then. They can try to sit on it for the future, but eventually they are gonna want to cash out somehow, and then the two previous issues get in the way again.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by gzer0 on Thursday February 03, 2022 @06:59AM (#30191359)
How are "Coinjoined" transactions [1] able to be definitively traced to any one individual?

Every coin-mixing event can be interpreted 1,496 different ways. With each cycle increasing interpretations exponentially. "Every Whirlpool is structurally sound with 100% maximum entropy; Never cycling with yourself; Never cycling previously seen coins together; Never any deterministic links between inputs and outputs; And never any address reuse."

The authors of this coinjoin protocol use Boltzmann analysis to determine 1,496 possible linkages.

[1] https://kycp.org/#/323df21f0b0756f98336437aa3d2fb87e02b59f19...

[2] https://samouraiwallet.com/whirlpool

If everyone starts doing this, will all coins eventually become tainted? I don't see a way out of this problem.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by capableweb on Thursday February 03, 2022 @07:02AM (#30191386)
> If everyone starts doing this, will all coins eventually become tainted? I don't see a way out of this problem.

Indeed, if everyone started doing this (or everyone started using Zcash with z-addrs), then you might be able to get away with it. But that's not where we're at today.

Try signing up to Coinbase and funnel $320M worth of ETH via that account. They will 100% lock your account and ask for proof of where it comes from. If it comes from after doing a bunch of tumbling, they will go harder against you to prove where it comes from. Any big exchange will do the same diligence as otherwise they themselves will get into trouble with the law.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by logifail on Thursday February 03, 2022 @07:53AM (#30191807)
> Try signing up to Coinbase and funnel $320M worth of ETH via that account. They will 100% lock your account and ask for proof of where it comes from. If it comes from after doing a bunch of tumbling, they will go harder against you to prove where it comes from. Any big exchange will do the same diligence as otherwise they themselves will get into trouble with the law.

So cryptocurrencies are decentralized and free of regulation ... right until they aren't?

To be fair, if I walked into my local bank with $320M in cash I'd face the same problem.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by mlac on Thursday February 03, 2022 @08:18AM (#30192014)
Yeah but you could take cash to the grocery store, gas station, mall, and restaurant.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by solveit on Thursday February 03, 2022 @11:50AM (#30194849)
Cryptocurrencies[1] are trying to be decentralized and free of regulation. But it turns out the world is run by people who like regulation.

[1]: There are so many people in crypto with such diverse views that it doesn't really make sense to say cryptocurrencies are X for any non-tautological value of X. Some people are 'code-is-law' crypto-anarchists, and some people are actually sane and can't wait for the law to get its shit together so they can build their cool decentralised prediction market without accidentally losing the ability to take international flights or something.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by logifail on Thursday February 03, 2022 @12:26PM (#30195454)
> Cryptocurrencies[1] are trying to be decentralized and free of regulation

Without wishing to be seen as unnecessarily snarky, so was Napster.

> it turns out the world is run by people who like regulation

Indeed ... and Napster found that out fairly quickly, too. Although: it was good while it lasted (speaking as an ex-Napster user...)

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by gzer0 on Thursday February 03, 2022 @07:09AM (#30191426)
Since 1 wallet != 1 unique individual; it could be done. The points you bring up are fair, yes. But I'd also imagine if you were able to pull off a $350 million heist, you'd have some sense about obfuscating your withdrawls.

Not to mention, converting your initial crypto tokens into another currency, and then another currency, and eventually making it to Fiat. For example, converting to Monero and back to BTC would be near impossible to trace.

On top of this, there is Paxful which you can utilize for cash payments.

There are many, many ways if you are determined. I don't think anyone would be silly enough to attempt a $350 million withdrawal from Coinbase.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by vageli on Thursday February 03, 2022 @10:13AM (#30193422)
Where can you swap BTC for monero while avoiding KYC? Via wrapped versions of both coins on the eth blockcain or something?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by gzer0 on Friday February 04, 2022 @03:17AM (#30204152)
I have heard of people doing very unorthodox things, such as, buying virtual currency via BTC in an online MMORPG and then selling that virtual "gold" for a slight loss to a different vendor who pays out in Monero.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by 323 on Thursday February 03, 2022 @09:50AM (#30193118)
> For example, converting to Monero and back to BTC would be near impossible to trace.

You still have the problem of justifying where you got the initial crypto if anyone audits you. "I just remembered about some crypto I mined in 2010" will not cut it.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by vageli on Thursday February 03, 2022 @10:14AM (#30193448)
With that much at stake, it seems easier to try a public spectacle like the guy who is digging up a landfill to find an old hard drive with a btc wallet.

https://www.cbsnews.com/news/hard-drive-lost-bitcoin-landfil...

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by paulpauper on Thursday February 03, 2022 @11:07AM (#30194183)
create a phony company, hire yourself , and then pay yourself for consulting work. there are tons of ways of doing it
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by sillysaurusx on Thursday February 03, 2022 @07:13AM (#30191460)
Localbitcoins won’t.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by paulpauper on Thursday February 03, 2022 @11:06AM (#30194159)
then break it up into $300k chunks. anyone smart enough to steal so much in such a sophisticated manner is smart enough to launder it
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by mrep on Thursday February 03, 2022 @09:38AM (#30192943)
Actually, I think it is easier than ever. You can move your stolen crypto to tornado.cash which pools your crypto together with everyone else's and then allows you to anonymously pull it out from the pool in .1/1/10... increments allowing you to effectively wash it. From there, you just need to launder it to legitimize it which you could do by creating some BS coin or NFTs with your real name attached to it which just so happens to get a bunch of "investors" (really just you investing the coins you stole).
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by PinguTS on Thursday February 03, 2022 @07:08AM (#30191422)
I thought it is all decentralized. I thought that it the whole point of Web3. Dou you want to tell me it is not. That there are central instances, which I can control? Wow.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by capableweb on Thursday February 03, 2022 @07:09AM (#30191427)
https://news.ycombinator.com/item?id=30191268

I made no arguments for/against decentralization, I didn't mention web3 nor that there is no central instances or that no one controls nothing in the cryptocurrency world. What are you even doing here on HN if you can't actually reply with a good faith argument? Please save that for Reddit or wherever that happens normally.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by moron4hire on Thursday February 03, 2022 @08:38AM (#30192202)
As a user, you don't get equal access to the Blockchain. You can't make any transactions unless someone wins the mining/staking lottery and then writes a block for you, an operation that is incredibly expensive to achieve. While the Blockchain itself is a distributed ledger, your access to it is not decentralized.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by JaimeThompson on Thursday February 03, 2022 @08:15AM (#30191999)
Modern crypto is all about being the new middle men while claiming to be decentralized.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by unreal37 on Thursday February 03, 2022 @07:17AM (#30191491)
Transferring tokens to dollars is not decentralized. International (fiat) banking is tightly controlled.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by PinguTS on Thursday February 03, 2022 @07:23AM (#30191548)
What if I don't need fiat, because many things can be payed in some form of crypto like in Metaverse?

What if round-trip those through many different cryptos?

What if round-trip those through funny NFTs and with that even inflate NFTs?

What if a combine many of those steps?

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by fallat on Thursday February 03, 2022 @07:39AM (#30191687)
There are things more valuable than money.

Not only are there a lot of legal problems with stealing that money, there are a lot of social problems too.

This is where philosophy comes in and helps the situation. You find the employees who wouldn't steal because they believe that money isn't everything.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by rasz on Thursday February 03, 2022 @08:02AM (#30191872)
>This is where philosophy comes in and helps the situation. You find the employees who wouldn't steal because they believe that money isn't everything.

Yes, those mythical spherical virgin monks in a vacuum. Apple has been very vocal about their moral and just employees superiority.

Apple paid millions to woman after repair workers stole nude images of her from her phone and posted them on her Facebook https://www.businessinsider.com/apple-settled-lawsuit-womans...

Authorized repair caught using knockoff screens in customers phones https://www.youtube.com/watch?v=ETVJDUfZ5TM

And the end of the day we are all humans.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by CryptoPunk on Thursday February 03, 2022 @08:27AM (#30192091)
The vast majority of people, if they are already financial comfortable, would forego opportunities to steal and rob, even when the sums that doing so could garner them are astronomical. Those who lack this moral constitution are generally not entrusted with the kind of responsibility that would allow them to do grievous harm to society.

If this wasn't the case, society would fall apart very quickly.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by raziel2p on Thursday February 03, 2022 @10:27AM (#30193613)
I think the fact society hasn't "fallen apart very quickly" has more to do with us building economical and organizational systems to prevent morally dubious people from doing whatever they want, not the fact that most people wouldn't.

How much of our moral inclination to not rob or steal would still be there if we didn't grow up quickly learning that it's illegal? Especially if we're not even stealing from a fellow human, but some anonymous corporation.

Furthermore, you only need a few people to break the rules to do damage and potentially erode trust in the system, and if that trust is gone, the social contract to behave well to each other is even more at risk.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by 300bps on Thursday February 03, 2022 @08:44AM (#30192270)
The vast majority of people...would forego opportunities to steal and rob

I agree with you 100%. The scary thing though is that if 99% of people wouldn't steal, just imagine how much damage those 3.3 million people in the U.S. can do. (That's 1% of the U.S. Population)

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by toss1 on Thursday February 03, 2022 @11:48AM (#30194805)
Yup, considering that the proportion of psychopaths in the general population is above 1%, and in organizations over 12% [0]...

[0] https://sapienjournal.org/latest-estimate-of-psychopathy-in-...

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by lmc on Thursday February 03, 2022 @08:04AM (#30191895)
I'm gonna go out on a limb and say you don't get into cryptocurrency work to make the world a better place. Or rather, those that do should not be trusted around secure code. /snark
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by ejb999 on Thursday February 03, 2022 @08:41AM (#30192245)
>>You find the employees who wouldn't steal because they believe that money isn't everything.

Or just the ones that want to be able to sleep at night without worrying about that knock on the door by the feds in a midnight raid. Some people could live with that stress - I know I couldn't.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by oblio on Thursday February 03, 2022 @07:54AM (#30191814)
Good luck with that! Plenty of honest people would blink when hearing about that kind of money, let alone all the dishonest ones that would try to persuade you that they're honest.

It's life-changing money.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by fallat on Thursday February 03, 2022 @08:18AM (#30192017)
No need for luck. There are already a surplus of examples of this. Look at the massive amount of extremely high impact open source projects that don't have malware embedded in them.

Yeah it's life-changing if money is your reason for living. I recommend you read a bit from Seneca the Young to understand where I'm coming from.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by romeros on Thursday February 03, 2022 @08:44AM (#30192271)
>> I recommend you read a bit from Seneca the Young to understand where I'm coming from.

A better recommendation is to actually close down the computer and put away the mobile phone and actually go out from the bedroom and interact with real people.

This way, one gets an idea about how the real world works and see the true nature of human traits and behaviors.

If you just sit at home and read Arthur Schopenhauer, Marcus Aurelius and Plato you will build a mental model of reality that doesn't exist in the real world. Your naivety would show and you will be taken advantage of without even you knowing it.

Do both. Philosophy to improve yourself but also step outside the home to understand how real life works. Best of both worlds!

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by fallat on Thursday February 03, 2022 @10:03AM (#30193282)
I said that in the most sincerity. I find of all the stoics, Seneca is by far the most based in the real world.

All I feel is your comment degrading me.

I recommend Seneca exactly because I interact with real people and feel his written thoughts express very well why there are many people who can work on a project worth millions and not steal anything.

Sorry if it came off any other way, really.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by enkid on Thursday February 03, 2022 @08:28AM (#30192095)
The problem the above posters are referring is not that they feel life is about money or even that most people feel life is about money. The problem is reliably telling the difference between people that feel that way from those that don't. There's no recruitment process that can possibly determine whether someone, when faced with the prospect of walking away with $300M or not would make the right choice. It's just too extreme to be able to simulate. And you have to get it right 100% of the time. If you have 100 employees and get it wrong 1% of the time, you still have a problem.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by fddhjjj on Thursday February 03, 2022 @08:33AM (#30192147)
Does the current evidence noted by fallat — the massive amount of extremely high impact open source projects that don't have malware embedded in them — suggest the error rate is much much lower that 1%?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by enkid on Thursday February 03, 2022 @08:38AM (#30192190)
Open source projects are not a good point of reference because by their very nature they invite external validation. If you are trying to steal $300M, you don't tell people before hand that you are going to do it. There also a difference between the money being right there, only one step away from being yours and infecting open source software with the possibility of maybe stealing something in some company that may or may not use your software in a way that would allow theft months or years after you submitted an update.

Edit: After doing some research, it appears that claims that open source doesn't fall victim to this problem are factually incorrect. [0]

[0] https://blog.sonatype.com/open-source-attacks-on-the-rise-to...

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by fddhjjj on Thursday February 03, 2022 @08:50AM (#30192327)
No one made the claim that open source universally don’t fall victim to dishonesty. We were discussing the rate.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by pfooti on Thursday February 03, 2022 @10:19AM (#30193518)
The problem at hand, though, is that the only reason I can see people working on crypto is precisely for the money. I mean sure, there's some small number of purists out there, but I get DeFi recruiter emails all the time. The only thing they have going for them is compensation.

I would suspect that a large number of engineers working in crypto are heavily motivated by money above all.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by moron4hire on Thursday February 03, 2022 @08:30AM (#30192112)
> find the employees who wouldn't steal because they believe that money isn't everything.

Rarer than gold plated unicorns in the crypto sphere

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by malermeister on Friday February 04, 2022 @01:25AM (#30203502)
The employees who think money isn't everything... and decide to join a company that is about money and money only?
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by api on Thursday February 03, 2022 @08:33AM (#30192140)
It's going to be harder in the cryptocurrency ecosystem where everything is a scam anyway.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by pmlnr on Thursday February 03, 2022 @07:54AM (#30191816)
"money"

We're still talking magical beans here.

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by danuker on Thursday February 03, 2022 @08:02AM (#30191864)
Magical beans or not, the market pays for them.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by boringg on Thursday February 03, 2022 @09:39AM (#30192960)
I think the other part of the equation, that is far uglier, is when you have that excess amount of returns why would you not expect criminal organizations to apply leverage on staff. I'm not saying that this happens but it is certainly a considerable security flaw - manageable but risky.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by dcolkitt on Thursday February 03, 2022 @08:16AM (#30192000)
9 hours ago? The original pull request identifying the problem with the Solana syscall was made back in October:

https://github.com/solana-labs/solana/pull/20790

Re:In second largest DeFi hack, Blockchain Bridge loses $320... by raziel2p on Thursday February 03, 2022 @10:32AM (#30193683)
Bad actors probably don't have the capacity to check every pull request. Yikes, though. Wonder what the outcome would've been if this was exploited before a patch was available in trunk and ready to be rolled out.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by Yanu-3452 on Thursday February 03, 2022 @07:43AM (#30191721)
If I had to guess between "Inside job" and "Their CI system was owned", it may be neither, of course, but of the two I'd bet on the latter.
Re:In second largest DeFi hack, Blockchain Bridge loses $320... by danielvf on Thursday February 03, 2022 @07:59AM (#30191842)
In this case they had publicly posted the bug fix on GitHub hours before the attack.