101–110 of 174 posts
Missing from the article - the hacker first compromised Resolv Lab's AWS account, took a private key from KMS that was used to control minting, then managed to extract $25 million into ETH before all protocol functions were suspended.
They used KMS to sign the minting operation, but they didn't "take" the key, AWS KMS doesn't let you extract keys.
Earlier quoted context omitted.
you can send them around easily without having to deal with bullshit payment systems
But you do have to deal with bullshit payment systems. I can't receive stablecoins in my regular bank account, I'd have to set up some crypto nonsense on DankRocketBets or whatever for it to even work. Why would I do this when I can already receive actual USD without any extra ceremony? Stablecoins are a solution in search of a problem.
You shouldn't have a key that controls millions/billions of dollars on a cloud service. It should be on an airgapped laptop that was purchased anonymously, has never been connected to the Internet, and only runs software that has been vetted and loaded onto it via a CD-ROM or some other comparable method.
Have you actually tried to run a business this way?
.
And what happened next? He mixed those coins? Transformed them into monero?
You shouldn't have a key that controls millions/billions of dollars on a cloud service. It should be on an airgapped laptop that was purchased anonymously, has never been connected to the Internet, and only runs software that has been vetted and loaded onto it via a CD-ROM or some other comparable method.
Have you actually tried to run a business this way?
Yes, it's a pain to operate, but if the alternative is "the bad guys get all of our money", then it can be worth it.
You shouldn't have a key that controls millions/billions of dollars on a cloud service. It should be on an airgapped laptop that was purchased anonymously, has never been connected to the Internet, and only runs software that has been vetted and loaded onto it via a CD-ROM or some other comparable method.
Have you actually tried to run a business this way?
If the admins can "lock all transactions", what's the point of it being a crypto?
I don't know how this specific thing works, but I don't really see any fundamental problem with mixing and matching. If you believe in the benefits of crypto, then 50% crypto is still possibly better than 0%. It's not like I forgo a lock on my front door just because my windows are made of glass.
Missing from the article - the hacker first compromised Resolv Lab's AWS account, took a private key from KMS that was used to control minting, then managed to extract $25 million into ETH before all protocol functions were suspended.
> took a private key from KMS They used KMS to sign the minting operation, but they didn't "take" the key, AWS KMS doesn't let you extract keys.
There's no shortcut to MPC/multisig with 3+ keyholders.