Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bybit loses $1.5B in hack

tradingview.com

Post reply on HN
Print view View original

231–240 of 381 posts

Re: Bybit loses $1.5B in hack

#231

Post by veidr »

fresh_geezer wrote: post #184
rkagerer wrote: post #77

There's some info and speculation in these two (distinct) articles, but I'd love to know technical details of where the gaffs were. eg. Was client software compromised? Did the multisig keyholders succumb to social engineering? Were the signers using airgapped machines / hardware devices? https://archive.ph/YMZrq https://blockworks.co/news/bybit-hack-raises-security-questi...

Here is what the CEO wrote on X: "Bybit ETH multisig cold wallet just made a transfer to our warm wallet about 1 hr ago. It appears that this specific transaction was musked, all the signers saw the musked UI which showed the correct address and the URL was from @safe . However the signing message was to change the smart contract logic of our ETH cold wallet. This resulted Hacker took control of the specific ETH cold…

Are we sure he didn't mean the transaction got DOGEd?

Re: Bybit loses $1.5B in hack

#232

Post by skeeter2020 »

tonyhart7 wrote: post #219
killerstorm wrote: post #214

Earlier quoted context omitted.

How it it different from what banks do? (Except for a central regulator.)

FEDS can print money while Binance does not

not exactly true - Binance is indeed "printing money", just with no centralized regulation. When the Feds do it the expectation is that they are aware of the long-term impacts of doing so, and include in their calculation. For crypto it's the opposite: do it before you erode trust & goodwill to the point where it's no longer valuable. I see it more like it is very different than printing money in a economy that's perceived as stable and quite similar to printing money in one where the people have no faith in the value of sovereign currency. So the crypo-promoters are right about the use-case in certain jurisdictions, but the problem is that's not where the wealth is, so they target rich economies that tend to have stable government currencies & established banking, and do not need crypto for legitimate tasks.

Re: Bybit loses $1.5B in hack

#233

Post by gosub100 »

bryceneal wrote: post #79
gosub100 wrote: post #4

[flagged]

I see this quote repeated here often, but working in the industry I've never heard it said unironically by any of my peers or thought leaders in the space. Best I can tell it is a sort of lazy straw man repeated by skeptics. Does it have an origin?

The original idea with crypto was that the "code" was so strong, it removed the need for physical banks, tellers, FDIC, law enforcement, etc. The theory was, we can have everything the banking system has, but cheaper, because the only way to steal money was to break the crypto itself, hence "code is law".

The industry cannot appeal to the protections of law enforcement, civil tort, and other features of the regulated banking system, without simultaneously undermining the "crypto" part. If you're going to summon authorities when hackers hack, you're no better off than if you just acted like any other bank and stored the client's balance in an excel sheet.

Re: Bybit loses $1.5B in hack

#234

Post by skeeter2020 »

reisse wrote: post #174
plantain wrote: post #165

Earlier quoted context omitted.

Most of the trading is not done by retail traders but at much lower fees than that, if not being paid (market makers). I just can't make it add up.

I know! As I stated, > Even considering a huge part of that volume is coming from institutional players who enjoy significantly reduced commission rates... But the volume is huge. Even if we take the best publicly shared MM rates from Bybit (which is 1.5bp taker commission, 0.5bp maker rebate), and assume the whole volume is traded with these rates, it is still 1bp from 40B dollars, which is 4M dollars daily.

even if this is true, they'll use their entire cashflow for more than a year to cover a single loss? That's not how business works...

Re: Bybit loses $1.5B in hack

#235

Post by dboreham »

tumdum_ wrote: post #142
cypherpunks01 wrote: post #104

Earlier quoted context omitted.

A huge problem with signing EVM transactions using hardware wallets is that is common to be blind signing messages. The device has no knowledge of the SAFE EVM contract functions or any other context, it just asks you to sign an gobblygook opaque binary message so you may have no idea what's being signed, is my experience using multiple different vendor HW wallets. Not sure if that's what happened, but possible this…

> with turing-complete arbitrary computations in EVM this becomes very difficult. I have very limited knowledge about EVM, but those computations are bounded by gas, right? Evaluating them is a finite process.

What you suggest is possible (evaluate the side effects of the transaction and present that information to the prospective signer). But at present they don't do that. I'm not sure about this specific case but often it's just a supplied text string (that can say anything) that's displayed. Basically the system depends on trust in whatever came up with the transaction payload.

Re: Bybit loses $1.5B in hack

#236

Post by Gorkys »

plantain wrote: post #130

How on earth is it possible they can cover a 1.5B loss? Are they really sitting on that much profit, or is the goal to ponzi it out from here, MtGox style?

In crypto, there is the concept of the "fictional reserve" which can be used in situations such as this.

Re: Bybit loses $1.5B in hack

#237

Post by skeeter2020 »

rvz wrote: post #195
qqqult wrote: post #193

Earlier quoted context omitted.

bybit makes $100 million a month and has substantial excess reserves

A lot more money than the majority of AI startups and it is creating jobs rather than purposefully destroying them.

yes, great jobs: "I used to have to GO to the casino to play slots, and even without the one arm bandits, had to physically push the button. Now I work from anywhere!"

Re: Bybit loses $1.5B in hack

#239

Post by skeeter2020 »

grues-dinner wrote: post #127
huang_chung wrote: post #6

Society has devolved a bit when not long ago a heist like this would involve sieging Nakatomi Plaza, now it takes just finding a bug in someone's defective Python codes.

You don't even have to break into a wierd high-tech vault to get an unreasonably slow (or fast) billion-dollar progress bar with a snazzy custom UI toolkit these days. Not sure if technology or inflation is most to blame!

yes, this part won't play well in the movie: it takes just as long to transfer a billion as a dollar; the progress bar won't allow any time to build suspense... will they finish in time? cuts between parallel timelines...

Re: Bybit loses $1.5B in hack

#240

Post by ghfhghg »

wruza wrote: post #229
ghfhghg wrote: post #226

Earlier quoted context omitted.

What? It's my personal opinion which I explicitly pre-qualified. Why do you care what I think? Move on and live your life.

Just curious, how think.

I have enough money to live comfortably for the rest of my life working on interesting problems even if they don't make me a hundred-millionaire.
Post reply on HN