The article actually covers that it required 5 out of 9 people to sign off. They got 4 via PDF attacks and 1 via legacy access that was never properly terminated.

My understanding of the article was that only 1 person was compromised and that the exploit installed on their computer was then used to access the validator nodes themselves. FWIW, I have no idea what a validator node is but I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up).

> I'm assuming that by compromising one employee's workstation they somehow got access to multiple other machines (which if true is itself a bit of a f* up)

Q: If you assume the bad guys have already compromised your workstation, how sure are you that they won't be able to compromise other machines you connect to?

because the workstation was compromised by opening a corrupted pdf, but that vector wouldn't compromise the other machines unless users on them could be induced to open the same pdf.

not to say it can't be done, but it was unexplained

It doesn't have to be the same pdf, it could have been an attachments from compromised machine via email/slack. "Hey, can you help me figure this unusual log/transaction summary". How many wouldn't open such an attachment from a "colleague"?

Yep, internal security is brittle. The initial pdf vector would be only the start of a long sequence of hacks, including social engineering. e.g. sending email from managers -- or slack messages as you mention.

How do you defend against getting email from internal people, especially from people you expect email from?

Don't keep your security keys capable of root access on anything that's not a hardware token locked in a safe.

Of course if you can access the software running the blockchain and get everyone to install an update, that works too

You can call your colleague on the phone to confirm they sent the email asking you to open an attachment.

It does not have to be via the same method; what the attackers discover from the first compromised machine may give them access to other machines. It seems clear this is what happened here:

Employees are under constant advanced spear-phishing attacks on various social channels and one employee was compromised... The attacker managed to leverage that access to penetrate Sky Mavis IT infrastructure and gain access to the validator nodes.

You can't which is why one person shouldn't have access to more than one.

What the hell is a system that is 1 out of 9 partial crypto key signers for huge amounts of money doing with even a GUI or a PDF reader on it in the first place. Sounds like people using their personal workstation.

The compromised employee had access to that 5th factor it was just not as direct as as him having a 5th private key.

I think it's worth noting that the people did not sign off, only the keys did.

The system does not require people to sign off, but for the keys to sign off.

I don't think it's worth calling this a hack, the keys are what owned the moneies, and it's the keys that decided what to do with it. People have access to keys, they don't own them

Ok. So by your logic, my house keys owns my house?

But don’t I own my house keys too?

Your keychain owns your house keys.

It should be paying your mortgage, by the way.

This is a preposterous position. It's clearly a hack. Keys cannot legally own anything. People and organizations own things and in this case the people were hacked and the funds stolen.

But that is one of the underlying features of crypto, the ability to transfer coins without accountability.

There is always that person.