I really do not understand why they do not separate these into multiple separate wallets
They did. This was a multisig - meaning M out of N signatures from different signing devices were needed to sign a transaction. The attacker infected enough signer devices to go unnoticed and the signers failed to verify what they were signing on air-gapped devices
> the signers failed to verify what they were signing on air-gapped devices
This is the part that really surprises me given the amount of money involved.
Yea, how is it that multiple people signed a transaction for over a billion dollars of assets without due diligence? If you did this for non crypto there would be lawyers, bankers, etc involved in the transaction. Root certificate authorities have already solved this problem with signing rituals which take place in person in an air gapped vault on specialized hardware and multiple parties as witness.
Given that the UI they saw was compromised, they likely believed they were signing some routine 1M rebalancing transaction.
Odd that you wouldn't use separate keys for that given the wildly different levels of risk involved.
Reversibility is a trade-off. It's great if you are on the sending end of a transaction. It can be a nightmare on the receiving end. Irreversibility is the other way around. And both approaches have different costs and assumptions.
I think it’s less about reversibility itself and more the larger system within which it works. Banking works because the companies agree to follow rules so there’s a social context where if I make a mistake you will help fix it because the odds are fair that you will make a mistake at some point, too. In contrast, cryptocurrency is a political movement so the ideological “trust less” purity test matters more than whe…
A settlement period wouldn't even run against the ideology, only the convenience factor (and implementation complexity, and perhaps transaction fees). More generally, I think a number of the issues with crypto are rooted in things happening immediately.
The online security world is so wild. In pretty much any other field of engineering, foreign nation states explicitly targeting the thing you built is just kinda out of scope. There's no skyscraper in existence that is designed to withstand sustained artillery shelling, and your car is not going to withstand a tank shell either. Neither do they have to be designed to that specification. If North Korea killed someone…
Your logic is backwards. Factories are not designed to withstand sustained aerial bombardment because the chance of sustained aerial bombardment is small to non-existent due to effective (geopolitical) mitigations. But, if you are in a active war and being actively bombed, then you absolutely design your factories to be resistant to sustained aerial bombardment. You do not just throw your hands up in the air and say:…
No one said "they didn't need to defend", or at least that's not how I read OP. The observation is merely that the situation is so wildly different from the physically local world. It's remarkable.
According to that page, the global reaction was to block most ($850M) of the fraudulent payments, recover a third of the remainder, add additional security to the SWIFT network and raise standards for banks, and push for penalties for the criminals who participated. That seems like more than a shrug.
Say what you want about CBDCs, but they would fix this specific failure mode of digital assets where an enemy nation-state can steal $1.5 billion worth of the token.
I’d also add the number of cases where people holding Bitcoin are being threatened/tortured into transferring it. One less appreciated benefit of a system with reversible transactions is that it makes it significantly harder to do something like that.
I think it’s less about reversibility itself and more the larger system within which it works. Banking works because the companies agree to follow rules so there’s a social context where if I make a mistake you will help fix it because the odds are fair that you will make a mistake at some point, too. In contrast, cryptocurrency is a political movement so the ideological “trust less” purity test matters more than whe…
A settlement period wouldn't even run against the ideology, only the convenience factor (and implementation complexity, and perhaps transaction fees). More generally, I think a number of the issues with crypto are rooted in things happening immediately.
The ideology I was referring to was more of the trust-less design and “be your own bank” philosophy: many of these problems become easier if you have a third party who can do things like reverse transactions, but then you’re not getting rid of banks and are acknowledging that governments have power over the system. They do anyway, but there’s been a lot of desire to say otherwise.
A settlement period wouldn't even run against the ideology, only the convenience factor (and implementation complexity, and perhaps transaction fees). More generally, I think a number of the issues with crypto are rooted in things happening immediately.
The ideology I was referring to was more of the trust-less design and “be your own bank” philosophy: many of these problems become easier if you have a third party who can do things like reverse transactions, but then you’re not getting rid of banks and are acknowledging that governments have power over the system. They do anyway, but there’s been a lot of desire to say otherwise.
An algorithmically enforced settlement period where the final result of the entire transaction is visible on the chain but reversible by either party doesn't seem like it would run against that ideology.
Odd that you wouldn't use separate keys for that given the wildly different levels of risk involved.
Separate keys for what? They believed they were signing a routine transaction. That’s the whole idea of the hack. Splitting funds over 100 wallets would’ve helped. A 100x lower amount would be lost. And/Or having separate hardened devices used only for signing.
Separate keys (ie wallets) for routine small transactions versus the cold wallets used for huge sums. Perhaps I've misunderstood but it sounded like they performed a rare transaction while being led to believe it was a routine one. I'm wondering why you wouldn't split the infrastructure given the differences in risk.
Taking a step back from this attack, it looks like the new crypto-reality is far far far immature security-wise & compliance-wise ("compliance to what??" you can ask me). While it is nearly impossible to steal $100mn from one of the mega-banks, those crypto bros, a bunch of failed morons (self-proven by all these hacks), manage to lose people's money. Now.. I am not defending the banking system (and its ethics/morals…
The difference is that conventional banks can roll back transactions. The normal banking system is essentially a consensus mechanism "A: I owe you this amount. A: I just transferred you this amount, ok? B: Yup, accepted, thanks." If something goes wrong, A can say "A: Woops, I made a mistake. Reverse please, here are the laws stating in this case I have the right. B: Alright, I must comply.". In cryptocurrencies, by design, "the code is law". And this law does not predict reversing transactions. So you can lose any amount of currency due to an illegal act or even some simple error, like transferring to a dead address.