Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

theregister.com

Post reply on HN
Print view View original

31–40 of 85 posts

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#31

Post by siftrics »

lxgr wrote: post #20
siftrics wrote: post #17

Earlier quoted context omitted.

Why? Why do you speculate? The answer is easily accessible information. Smart contracts can be made immutable.

So are they? Not everybody here is an expert in smart contracts.

The purpose of Hacker News is insightful discussion; it is not a place to pipe your stream of consciousness into the comment box. Refrain from speculating about things to which we know the answer. Just look it up and post the answer, instead.

This is easily accessible information. Google it or ask an LLM. Don't just spew speculation into the void. You don't need to be a "smart contract expert" to use Google.

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#32

Post by phire »

xur17 wrote: post #2

> Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm. > Mixin, which is a decentralized exchange, These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?

Because most decentralised exchanges are "fake".

Realistically, a decentralised exchange can only operate within a single blockchain, only trading tokens on that blockchain. Works fine for trading between (for example) eth and its various tokens, but you can't do proper eth to bitcoin trades. [1]

The single-blockchain decentralised exchanges are typically real [2], but every multi-blockchain "decentralised" exchange platform cheats.

Some are literally just centralised exchanges that pretend to be decentralised with a slick software interface. The more common technique is to run their own blockchain and have valid decentralised trading on that. But you are only actually trading tokens that represent real coins. They then run a centralised holding entity that holds the real coins and implements deposits and withdrawals just like a decentralised exchange.

There are so many flaws with this scheme.

The holding company could literally run away with your funds. Bugs and exploits (and even normal blockchain behaviour like re0orgs) can result in the three seperate sources of truth (the real blockchains, the holding entity's internal database and the trading blockchain) ending up out of sync.

And just because the trading blockchain is a blockchain doesn't mean the company that controls it doesn't have the keys and power to rollback trades and otherwise change the contents.

[1] Yes, atomic swaps are a thing. But they are resource intensive and slow. I'm not aware of much decentralised trading that uses them.

[2] Though, the topic of wrapped coins complicates things.

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#33

Post by IshKebab »

thriftwy wrote: post #30
mschuster91 wrote: post #28

Earlier quoted context omitted.

The dude who's been hunting for his hard drive with his wallet keys on a dumpster yard would like to speak a word with you. Or those who had their disks seized by the government and the coins auctioned off. Or those where someone placed malware on their PCs or phones and exfiltrated keys.

Your bank account can sure ve seized by the government and even not auctioned off.

That's far less likely in most Western countries. Whether or not bitcoin is safer than a bank depends on where you live. But in the West it definitely isn't.

If you live in the third world, sure.

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#34

Post by 37638894breeze »

triyambakam wrote: post #21

> on the social media platform formerly known as Twitter Do they not like the new name? I don't either, though. I've seen a lot of "on X (formerly Twitter)" around and that's why I don't like the new name. If it were a good and memorable name we wouldn't need to qualify it like that.

I like the "X, [the platform] formerly known as X" its evolution. Latest in the wild sighting was "X, formerly Twitter".

What I like about it is that it lifts the skirt on the superficial divides. Good soldiers of the information regime all toe the line here and dutifully help Elon with his illadvised brand name destruction. I mean, I go to geopolitical websites run by people who like Putin, for example, and even there, the resistance blogger/propagandists dutifully remind us the "X, formerly Twitter" just in case we forget or haven't heard the news. We know things are bad if even North Korean output is using the "formerly Twitter" insert. Anyone checked?

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#35

Post by siftrics »

lxgr wrote: post #18
dboreham wrote: post #14

Earlier quoted context omitted.

Ethereum contracts are generally immutable so there is no facility to "upload code".

Except that almost all of them seem to be using an update mechanism anyway... Here's USDC on Ethereum, for example: https://etherscan.io/address/0xa0b86991c6218b36c1d19d4a2e9eb... – you can clearly see the upgrade mechanism that will allow anyone that knows the admin key to swap out the contract for anything they like. The cryptocurrency ecosystem's idea of decentralization in a nutshell.

Of course USDC is upgradeable; it's run by an entity that is attempting to comply with the laws and regulations of many different jurisdictions. No power-hungry regulator would allow them to deploy USDC without the capability to arbitrarily intervene, freeze, and blacklist.

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#36

Post by woah »

dotnet00 wrote: post #13
nico wrote: post #6

Earlier quoted context omitted.

> they do not have the risk of someone stealing passwords from their server and walking away with the money So if they get hacked and the credentials to upload code get stolen, what happens? Wouldn’t the hackers be able to deploy code that steals users crypto?

Probably requires some sort of consensus to accept newly uploaded code.

It depends. More reputable contracts such as Uniswap and Compound use immutable contracts. This is how Ethereum was designed to be used. Unfortunately, many others use the "proxy pattern" which is a weird hack allowing the code to be replaced by an admin account. This makes sense for development, because it allows code to be deployed iteratively, but IMO it needs to stop.

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#37

Post by throwawaycities »

triyambakam wrote: post #21

> on the social media platform formerly known as Twitter Do they not like the new name? I don't either, though. I've seen a lot of "on X (formerly Twitter)" around and that's why I don't like the new name. If it were a good and memorable name we wouldn't need to qualify it like that.

Not many global brands with multibillion dollar IP willfully rebrand.

Funny enough though, not only did Twitter do it with X recently, but Facebook rebranded recently to Meta and it’s still common Meta is referred to as “Meta formerly Facebook”, even in the wiki article that is included in opening sentence.

I don’t think it’s so much a reflection on the new brands it mor a reflection on the value of the old brands which still carry a lot of value for SEO purposes which is likely was articles/blogs probably tend to include the former brands.

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#38

Post by johngladtj »

IshKebab wrote: post #33
thriftwy wrote: post #30

Earlier quoted context omitted.

Your bank account can sure ve seized by the government and even not auctioned off.

That's far less likely in most Western countries. Whether or not bitcoin is safer than a bank depends on where you live. But in the West it definitely isn't. If you live in the third world, sure.

Tell that to all those Russian oligarchs that got their assets frozen

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#39

Post by woah »

lxgr wrote: post #18
dboreham wrote: post #14

Earlier quoted context omitted.

Ethereum contracts are generally immutable so there is no facility to "upload code".

Except that almost all of them seem to be using an update mechanism anyway... Here's USDC on Ethereum, for example: https://etherscan.io/address/0xa0b86991c6218b36c1d19d4a2e9eb... – you can clearly see the upgrade mechanism that will allow anyone that knows the admin key to swap out the contract for anything they like. The cryptocurrency ecosystem's idea of decentralization in a nutshell.

I'm generally opposed to these types of upgrade backdoors, but USDC might be the one project where it is acceptable. You are already trusting them to hold the actual dollars in a bank account.

Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

#40

Post by katbyte »

thriftwy wrote: post #30
mschuster91 wrote: post #28

Earlier quoted context omitted.

The dude who's been hunting for his hard drive with his wallet keys on a dumpster yard would like to speak a word with you. Or those who had their disks seized by the government and the coins auctioned off. Or those where someone placed malware on their PCs or phones and exfiltrated keys.

Your bank account can sure ve seized by the government and even not auctioned off.

You can also be put in jail for contempt until you cough up your bitcoins

If those in power want something, they tend to get it

Post reply on HN