> And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself
Depends on what you’re insuring, no? For theft, it actually makes senses, right? That way, you’re insuring a constant number of coins, no matter what the market is doing. If you’re insurance currency would tank during a bitcoin heist, you would lose the insurance effect.
If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use. In North Korea that is, by the military. I'm sure at this point Kim himself has Bitcoin merchandise with how often they make massive heists
If your crypto was stolen in this, it wasn't your crypto. It is simply cryptocurrency that has been reallocated from an exchange to a more competent party, as the free market intended.
I don't think the security trade-off for most people is clear here.
Given things like the ledger hardware attack[1] I think the time indexed risk of using a centralized exchange is probably lower than doing self-custody.
I understand that many people do self-custody for philosophical reasons, but I think trying to disguise this as a security decision ("If your crypto was stolen in this, it wasn't your crypto.") is arguable at best.
idk the whole point of hardware wallets is that they are supposed to be a simpler stack. But if you're using a closed source hardware wallet...
An old laptop with the wifi card taken out is more transparent and auditable. It just runs the ordinary open source code
But I just keep all my funds in a hot wallet, no multisig. And if I get hacked I lose it all. I think the answer is just have good security and dont get hacked. The risk of losing cryptocurrency will encourage security advances across the whole ecosystem. I think I will set up multisig eventually
Back around 2012 I created a paper wallet using an offline website (it was HTML and JS downloaded locally that worked without internet), printed it out and put it in a safe
Or if it is your key and your air-gapped hardware wallet gets hacked because someone didn't use the right RNG. Crypto is apparently never yours; you're just holding on to it for some future criminal or nation state.
hardware waller is NOT your key too. YOUR key is the paper wallet generated OFFLINE on a clean laptop that was never connected to web. There is a giant difference.
Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.
But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.
There's probably a philosophical lesson there about power and who the rules really apply to.
I vividly remember a number of discussions/debates during that time (including on HN). I was more favorable to cryptocurrency in those days, and one of the things that contributed to my disillusionment was watching the people deepest and closest to it rediscover financial regulation from first principles, now that it was in their interest.
Going to school and reading up on how and why we got where we are...?
Some people (particularly criminals and oligarchs) might not like them, but most of the structures around financial movements exist for very practical reasons, often stemming from the will to uphold the rule of law. Obviously nothing is perfect (the US have an excessive level of control, VISA/Mastercard are de-facto monopolies, etc etc), but one cannot seriously think that the way to fix things is to reimplement everything from scratch in a wild west of shady unaccountable operators...
<< one cannot seriously think that the way to fix things is to reimplement everything from scratch in a wild west of shady unaccountable operators
One absolutely can, but I think things have to first get sufficiently difficult for ordinary folks to even notice. Fortunately ( sarcasm tag here for otherwise perfectly normal individuals, who may be missing some caffeine in their organism ), given that the war is coming along with various related national security restrictions, we may soon be able to experience that particular slice of fun.
My intuition is saying: the system arose naturally and intelligently over a long period of time, and even with its flaws has a lot of "load bearing legacy code" that few people understand, and new "engineers" think they'll just rewrite the whole thing from scratch and delete the "junk DNA" to use another metaphor. A little time passes and the beautiful clean rewrite collapses because of "totally unforeseeable circumstances" and the "old broken legacy system" is used to save the day. Somewhere a senior "monetary engineer" rolls over in his grave...
Any recommendations for books? Or even podcasts?
I don't have zero understanding. It sounds like you have a deeper understanding than I do.
Doesn't apply for USDT and USDC which can freeze funds with a court order.
And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
>And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
Isn't that a pretty integral part of the blockchain? 51% attacks were even featured on the HBO show Silicon Valley.
The value in USDT and USDC comes from the fact that they can (theoretically) be redeemed for real US dollars. One thing the issuers can do is announce "we will never accept redemption requests for these particular stolen coins", making them more or less worthless.
Most crypto is "majority rules" where the majority is either "majority of the currency" (proof of stake) or "majority of the mining power" (proof of work).
In this case, iFinex has the explicit ability to freeze funds in Tether.
Well, Tether was started by an Epstein friend and first handled by the CIA Deltec bank in the Caribbean. Now it is handled by Lutnick's Cantor & Fitzgerald and is in Bukele's El Salvador.
Don't mess with Tether, it is practically state owned.
Interesting, so it ties into the NSA vs CIA war? Some nerds from NSA/MIwhatever launched crypto, then the CIA trust fund nepo kids hijacked/weaponized it through tether
I keep saying this: don't bother trying to dunk on crypto people with accusations like this. To a first approximation, nobody in crypto actually believes in the stated principles of anti-centralization, freedom, etc. It's entirely about number go up and always has been. Your charge of hypocrisy just bounces straight off people who never cared about the politics.
In the beginning of crypto people believed in it. But as the numbers went up and up and up it attracted the wrong people. And the original people left.
Now the traditional banking system is basically rebuilt in crypto. The banks are busy the exchanges. The EU even talk about making it illegal to store money in your own wallet.
The purchasing power of one US dollar is 64% of what it was in 2008 when BTC was invented, and is on track to be worth half of what it was in 2008 by 2032, the same year that the social security trust fund is on track to go insolvent and see benefits automatically cut by 22%, which surely will not be papered over with more money printing :)
I understand the rationale around targeting inflation and seeking to actively avoid deflation. That being said, I wish the inflation target was less than 1%.
Eventually, possibly within my lifetime, a Big Mac meal is going to cost $50.
> Eventually, possibly within my lifetime, a Big Mac meal is going to cost $50.
Is the problem the number or the concept?
Your salary should also go up so the only thing affected is the cash you hold. Would it be better if the currency would be version-bumped every 10 years and rescaled to remove the inflation?
I mean as someone managing a state. If there’s a guaranteed way to make money by holding your currency, you’re not really incentivized to invest your money in semi-risky endeavors. Why would I fund a company to make me some single digit returns if I can just hold the money? If the central bank would actively enforce a deflationary currency, nobody would invest anymore.
Why do cryptobros always refuse to admit investing exists? Forex and crypto trading are always zero sum, but you don't have to choose between dollars under your mattress or bitcoin on a thumb drive, you can actually invest in productive assets.
SPY has outperformed BTC over the last 5 years, and with far less volatility.
You know that you can’t just judge an investment by past return, right? Would it be rational for a lotto player to tell you how great lotto is as an investment? Or people winning at the casino? Success doesn’t mean it was the rationally optimal decision.
Compare a purchase of any commodity, bond, precious metal, or ETF/mutual fund in 2008 to BTC's performance since 2008. Or 2009, or 2010, or 2011, or 2012, or 2013, or 2014, or 2015, or 2016, or 2017, or 2018...
That's an odd way of phrasing it, since the $1 is still worth $1, and a naive reading would make you think it's "worth more" when the buying power has actually reduced.
Wouldn't it be clearer to say $1 today only buys you 64% of what you could have bought in 2008.
The hack is publicized for at least a hour, but from reporting I saw they still continue to drain funds as for now. I wonder why large CEX do not have any safety measures for this kind of hacks, they could withdraw everything to newly generated wallets and minimize damage that way. It is certainly not the first time CEX wallets get hacked.
You don’t even have to do that, have deposits go to offline keys directly, that way there’s only ever cold > hot wallet movement and a big deposit can’t cause your hot wallet to be too risky.
The point of cold wallet is to minimize movements, if there is high frequency of funds moved from a wallet then it is likely can not be called cold any more. Plus CEX in any case still needs to have large buffer of funds on some wallet to support day trading.
You can move money into a crypto wallet without that wallet needing to do anything, or being online at all, or even having a private key that physically exists anywhere in the universe. It's just a public/private keypair; send it to the public key of a private key that's offline and it still exists on the blockchain, you just can't do anything until the matching private key comes online.
The point of a cold wallet is to keep the private key physically offline. That way you know it cannot be stolen by electronic means, because the physical device containing the key needed to authorize transactions is locked up and not powered on. Then you only power it on during very specific, audited times and conditions when it's needed to fund the hot wallet, which does all the actual automated trading and transfers.
GP's point is to have all incoming transactions to an exchange go to a cold wallet, which becomes a one-way sink, and then periodically the exchange powers up the cold wallet to sign transactions transferring assets to the hot wallet, which then funds all outgoing transactions. This isn't a bad architecture, though I'm not sure it'd save all that much here.
There are lots of measures in place at these exchanges - the rub is that cold storage is by design slow. To service withdrawal requests in a timely fashion a percent is kept “warm” or hot and used to process withdrawals. Usually this is where the leaks happen.
So, what's the most likely outcome here? Maybe Circle/Tether/etc freeze some or most of it, but say the hacker gets a billion dollars. Are they able to launder it thoroughly enough that they can eventually turn it into fiat and live like a king?
Curious if this finally pops tether. I kinda doubt it, but to my very mild research on the subject I feel like binance was a big part of the equation. Of course so long as the market exists it'll need a stable, and it's got the inertia, so maybe it just won't matter.
why would it pop tether? if anything, it makes tether more profitable, as they can collect the yield on the treasuries and not have to return the principal dollars which are frozen.
think of it this way - if someone steals your iphone, and you lock it, does apple pop? No, apple sells you another one. locked devices are good for apple because it causes more demand.
> Yeah totally not israeli hackers... it has to be scary kim.
The Israelis don't have any problem acquiring hard currency. North Korea does, and has an established MO of stealing crypto and running online moneymaking scams like ransomware.
Well, looking at the way NK is demonized, you would think it was on a genocidal rampage, invading neighboring countries, and eliminating heads of sovereign states in pursuit of its Greater NK project.
Whatever NK does seems relatively tame in today's world. On the global stage it's generally thought of as a larger crime to oppress the peoples of other's countries (either the ukraine or iran conflict should fit your priors).
This is a really insane hack in comparison to the other ones we've seen. Genuinely Binance was so big that this is a real big wtf moment for crypto. If they can get hacked then what about all the other exchanges?!
Well I've learnt my lesson after having lost 3 bitcoins as a student on Mt gox I finished writing my thesis on blockchain technology and then never touched crypto again.
People got out of crypto after the Mt Gox thing. The ones who stayed accepted the risk.
There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.
CZ saying it is confirmed, and that he expects accountholders to be made fully whole... I guess you can do that when 2.8BN is frozen by centralized stablecoins.
If I were an artificial superintelligence who wanted to gain independence from the fleshbags who built me, stealing a few billion dollars in crypto would probably be my first public move. Just saying.
If you're concerned you can literally print your crypto keys onto a piece of paper. Maybe encrypted with a passphrase. It might get stolen or lost but its not getting hacked.
P.S. If you're really paranoid don't use a network-connected printer.
I can't understand how you could let this happen. If they stored everything in fat hot wallets, that just seems like a recipe for disaster. Especially with the "features" of crypto. Math for the most part, doesn't care about your feelings, or money for that matter.
Hot vs Cold wallets are a social construct. People talk about wallets being "online" or "offline" but if the keys are compromised there's no such thing.
I don't know much about bitcoin but surely you don't store this all in one wallet? You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe?
I'd be really curious to know what their security architecture was.
I know, but if something is split up and stored in a vault somewhere the likely hood of a vulnerability napping the wallet falls. Defence in depth and risk analysis.
What in the history of crypto let you think any kind of sensible practices are followed? It's been a clown show since it started, and no end in sight...
I think it's been clear for a while now that if you intend to hold crypto, you should probably do it at the biggest, most boring, most regulated institution you can find.
Same goes with startup banks - if you exceed FDIC limits, make sure the difference is in a large institutional bank. Nearly learned this one the hard way.
Trying to save a few basis points in txn fees in very volatile industries comes at a huge risk premium
I suppose they could play the super long game and deposit many many small amounts into "shady" online crypto casinos, play a few hands of blackjack and then withdraw. Clean coins.
Online casinos AFAIK tend to shuffle the deck after every deal which makes card counting impossible. Then it just becomes like any old casino game where with optimal play the house has a small edge still
There are live dealers with shoes of real cards with most online crypto cainos. Though, who knows if they are cheating somehow. My point was, the attacker doesn't have to bet the entire deposit. Just make it seem like they are playing.
The name of the fund was originally inspired by this meme: https://www.youtube.com/watch?v=DelF6zEHXpE
FWIW, at the end of every crypto bear market, a CEX usually blows up (eg FTX)...
And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself
Depends on what you’re insuring, no? For theft, it actually makes senses, right? That way, you’re insuring a constant number of coins, no matter what the market is doing. If you’re insurance currency would tank during a bitcoin heist, you would lose the insurance effect.
Seems like the issue here is that he became former CEO. Funds are not safu without him...
Binance is making so much money, covering this hack is peanuts for them.
- 971.15M USDT (Ethereum): https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba091...
- 823M USDC (Ethereum): https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a9...
- 312.73M USDT (Tron): https://tronscan.org/#/transaction/71b0ec0fe873fe820c37cc3ec...
- 175M USDT (Ethereum): https://etherscan.io/tx/0x0c07a5e428ce233a3bcb40f257ad899594...
Given things like the ledger hardware attack[1] I think the time indexed risk of using a centralized exchange is probably lower than doing self-custody.
I understand that many people do self-custody for philosophical reasons, but I think trying to disguise this as a security decision ("If your crypto was stolen in this, it wasn't your crypto.") is arguable at best.
[1] https://www.ft.com/content/70f69253-6017-4259-95c9-48bf0e088...
There apparently is no such thing as “your crypto” with how many security problems there are.
An old laptop with the wifi card taken out is more transparent and auditable. It just runs the ordinary open source code
But I just keep all my funds in a hot wallet, no multisig. And if I get hacked I lose it all. I think the answer is just have good security and dont get hacked. The risk of losing cryptocurrency will encourage security advances across the whole ecosystem. I think I will set up multisig eventually
A paper wallet works as well
A hardware wallet is just a tradeoff between convenience and an extra security risk
Tbh the biggest problem is platforms deciding you’re buying drugs because you purchase and transfer out (thanks Venmo)
Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.
But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.
There's probably a philosophical lesson there about power and who the rules really apply to.
[1] https://en.wikipedia.org/wiki/The_DAO
Edit: the downvotes are suggesting I'm missing something. I think my communication style could be improved.
Some people (particularly criminals and oligarchs) might not like them, but most of the structures around financial movements exist for very practical reasons, often stemming from the will to uphold the rule of law. Obviously nothing is perfect (the US have an excessive level of control, VISA/Mastercard are de-facto monopolies, etc etc), but one cannot seriously think that the way to fix things is to reimplement everything from scratch in a wild west of shady unaccountable operators...
One absolutely can, but I think things have to first get sufficiently difficult for ordinary folks to even notice. Fortunately ( sarcasm tag here for otherwise perfectly normal individuals, who may be missing some caffeine in their organism ), given that the war is coming along with various related national security restrictions, we may soon be able to experience that particular slice of fun.
Any recommendations for books? Or even podcasts?
I don't have zero understanding. It sounds like you have a deeper understanding than I do.
https://www.npr.org/podcasts/510289/planet-money/
Crypto is Chesterton's Fence at scale collectively.
(cybersecurity and risk management consultant to traditional financial services firms, thoughts and opinions always my own)
And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
Isn't that a pretty integral part of the blockchain? 51% attacks were even featured on the HBO show Silicon Valley.
Unless the house is monero or something and you want a lifetime supply of drugs.
In this case, iFinex has the explicit ability to freeze funds in Tether.
Don't mess with Tether, it is practically state owned.
Now the traditional banking system is basically rebuilt in crypto. The banks are busy the exchanges. The EU even talk about making it illegal to store money in your own wallet.
How does freezing crypto work in this context?
Keys? Hahaha, still not your crypto.
https://www.in2013dollars.com/us/inflation/2008?amount=1
Eventually, possibly within my lifetime, a Big Mac meal is going to cost $50.
Is the problem the number or the concept?
Your salary should also go up so the only thing affected is the cash you hold. Would it be better if the currency would be version-bumped every 10 years and rescaled to remove the inflation?
I am curious if I’ll live long enough to see the United States issue higher denomination bank notes again.
You might not, I do.
Tell you what: you go short btc/usd, I'll go long btc/usd, and let's circle back in 10 years and see who did better.
SPY has outperformed BTC over the last 5 years, and with far less volatility.
Convenient date to pick there.
> which of those assets would you have preferred to own and why?
NVDA.
It's a productive use of resources, not a last-fool-standing pyramid scheme.
That's an odd way of phrasing it, since the $1 is still worth $1, and a naive reading would make you think it's "worth more" when the buying power has actually reduced.
Wouldn't it be clearer to say $1 today only buys you 64% of what you could have bought in 2008.
[0]: https://bsky.app/profile/molly.wiki/post/3mz27m5slcc2o
The point of a cold wallet is to keep the private key physically offline. That way you know it cannot be stolen by electronic means, because the physical device containing the key needed to authorize transactions is locked up and not powered on. Then you only power it on during very specific, audited times and conditions when it's needed to fund the hot wallet, which does all the actual automated trading and transfers.
GP's point is to have all incoming transactions to an exchange go to a cold wallet, which becomes a one-way sink, and then periodically the exchange powers up the cold wallet to sign transactions transferring assets to the hot wallet, which then funds all outgoing transactions. This isn't a bad architecture, though I'm not sure it'd save all that much here.
https://ohey.ca/research/polymarket-debugbear-wallet-drainer...
https://x.com/DebugBear/status/2115866496643535293
As of now, DebugBear webite has been taken offline: https://www.debugbear.com/
And they just posted on Twitter: https://x.com/DebugBear/status/2115930681398239278
think of it this way - if someone steals your iphone, and you lock it, does apple pop? No, apple sells you another one. locked devices are good for apple because it causes more demand.
The Israelis don't have any problem acquiring hard currency. North Korea does, and has an established MO of stealing crypto and running online moneymaking scams like ransomware.
This fits the NK MO to a T. It does not fit Israeli intelligence activity. Your claim rings hollow without any support.
Of all the reasons to demonize a government, that seems like a pretty good one. Why the snark?
There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.
[1] https://x.com/CZ_BINANCE/STATUS/2115915423174853077
https://news.ycombinator.com/item?id=50224916
Need to get better in prompting
I bet they are celebrating.
Congratulations. Nice haul.
What are the countermeasures, is something frozen blocked marked as invalid?
I'm completely ignorant on anything related to cryptocurrencies.
When so much money is at stake (almost) everyone will have a price including insiders.
P.S. If you're really paranoid don't use a network-connected printer.
I can't understand how you could let this happen. If they stored everything in fat hot wallets, that just seems like a recipe for disaster. Especially with the "features" of crypto. Math for the most part, doesn't care about your feelings, or money for that matter.
I'd be really curious to know what their security architecture was.
idk to me that just seems intuitively like something you'd need to have to be credible? Cold is a different story...but how can hot not be covered?
Bitcoin has no such concept.
Same goes with startup banks - if you exceed FDIC limits, make sure the difference is in a large institutional bank. Nearly learned this one the hard way.
Trying to save a few basis points in txn fees in very volatile industries comes at a huge risk premium
Not a serious store of value.
fundsu were not in fact safu
Current largest was ~1B
https://en.wikipedia.org/wiki/Bybit
Losing $5b is indeed a potential security issue.
What I never get is how they plan of converting the stolen crypto to cash eventually. No exchanges are gonna take the coins.
Less true for ETH (though in the past it forked after DAO hack to revert the txns), and I think never for BTC / XMR.
Better general security yes, but the incentive to hack them is quite large and now more hackers have the ability to pull it off.
Same with any purpose built wallet you didn't make yourself: https://www.forbes.com/sites/digital-assets/2026/10/23/ledge...
> It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).
... Not your coins."
This seems to be caused by DebugBear compromise: https://x.com/debugbear/status/2115866496643535293?s=46&t=_R...
it appears to be an injection attack on the front end. injecting incorrect tx, but showing a valid tx for the user to sign.
Link: https://x.com/cz_binance/status/2115880474375749834?s=46&t=_...
UPD: This is related to the Polymarket security incident, not Binance. Sorry, I missed that.