Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Binance's Trust Wallet extension hacked; users lose $7M

web3isgoinggreat.com

Post reply on HN
Print view View original

1–10 of 35 posts

Re: Binance's Trust Wallet extension hacked; users lose $7M

#5

Post by wyldfire »

I love the concept of cryptocoins. But in practice, there are some enormous hazards that make it not worthwhile IMO. This is just one such hazard, but by now we've seen several flavors of "this custody/storage mechanism failed to securely store some wealth." If securing it yourself, it's so easy to mishandle and either destroy your wealth or have it stolen. If delegating it to an "expert" you risk the custodial agent falling victim to theft/exit scam/ineptitude. Does any third party insure these agents?

Having a government-insured bank deposit means that I've never had to think about this in my lifetime. It's a problem that I don't need.

Re: Binance's Trust Wallet extension hacked; users lose $7M

#6

Post by sunshine-o »

I believe the Achilles' heel of Web3 is really that is was built on Web1&2.

Whatever opinion you might have about this industry, the core work is done by the Bitcoin and Ethereum teams and it is pretty admirable. They have been progressing for 10 years in a system where any mistake can collapse the entire system.

But ultimately those wallets and Web3 apps are built with web technologies and run in a browser and this is just not made for this.

This hack was targeting seed phases or private key because the keys have to be stored in the browser extension. How insane is that? But there isn't really any other ways to do it within the framework of a web browser.

Ultimately if the extension or web app is compromised an hardware wallet cannot really ultimately protect you (at least you would only be compromised when interacting with it).

Ethereum also now built in the secp256r1 signature checker so passkey/yubikey can be used but, same problem the "web" is the weak link.

Bottom line if they want that thing to succeed they will have to create a way to interact with smart contracts outside of the web browser. Maybe it will take building a simpler "dapp browser". Their apps are pretty basic in the end, a TUI would be enough to swap a token and approve a transaction...

Re: Binance's Trust Wallet extension hacked; users lose $7M

#7

Post by sunshine-o »

wyldfire wrote: post #5

I love the concept of cryptocoins. But in practice, there are some enormous hazards that make it not worthwhile IMO. This is just one such hazard, but by now we've seen several flavors of "this custody/storage mechanism failed to securely store some wealth." If securing it yourself, it's so easy to mishandle and either destroy your wealth or have it stolen. If delegating it to an "expert" you risk the custodial agent…

> Having a government-insured bank deposit means that I've never had to think about this in my lifetime. It's a problem that I don't need.

Government-insured bank deposits are mostly BS, the fine prints say they have about 10 years to reimburse you and in case of a systemic failure good luck.

In case the bank app, their "system" or your computer is compromised most banks will not reimburse you. It is very easy for them to say you were ultimately responsible for the hack. Very few banks have the policy of taking the loss and it is hard to know which one still do that unless you know someone in their fraud department.

Re: Binance's Trust Wallet extension hacked; users lose $7M

#10

Post by citiguy »

sunshine-o wrote: post #7
wyldfire wrote: post #5

I love the concept of cryptocoins. But in practice, there are some enormous hazards that make it not worthwhile IMO. This is just one such hazard, but by now we've seen several flavors of "this custody/storage mechanism failed to securely store some wealth." If securing it yourself, it's so easy to mishandle and either destroy your wealth or have it stolen. If delegating it to an "expert" you risk the custodial agent…

> Having a government-insured bank deposit means that I've never had to think about this in my lifetime. It's a problem that I don't need. Government-insured bank deposits are mostly BS, the fine prints say they have about 10 years to reimburse you and in case of a systemic failure good luck. In case the bank app, their "system" or your computer is compromised most banks will not reimburse you. It is very easy for th…

I was a victim of bank fraud a couple of years ago. My bank was totally at fault (I caught it, not them) and they reimbursed me in full.

From what I understand, government insurance goes more towards bank failure, not fraud.

Post reply on HN