Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Resolv hack: How one compromised key printed $23M

chainalysis.com

Post reply on HN
Print view View original

141–150 of 174 posts

Re: The Resolv hack: How one compromised key printed $23M

#141

Post by Saline9515 »

Ekaros wrote: post #119
Saline9515 wrote: post #61

Earlier quoted context omitted.

Stablecoins enable cash-like (instantly redeemable and verifiable) payments for large amounts, for almost free. In EU countries, you can't now buy a car with cash. You have to buy a bearer's check from your bank, which is expensive, requires that both parties have a brick and mortar bank, and doesn't work cross-border. Stablecoins solve this.

It was good while ago, but last time I bought a car I just did bank transfer. SEPA transfers are entirely free. Was kinda amazed that they just handed me keys when I showed them the receipt from my own online bank...

This requires trust, which, depending on where you live and who is the seller, may be a little bit risky or attract scammers.

Re: The Resolv hack: How one compromised key printed $23M

#142

Post by Saline9515 »

fc417fc802 wrote: post #127
Ekaros wrote: post #119

Earlier quoted context omitted.

It was good while ago, but last time I bought a car I just did bank transfer. SEPA transfers are entirely free. Was kinda amazed that they just handed me keys when I showed them the receipt from my own online bank...

It's a calculated risk. They know the VIN number and I assume made a copy of your photo ID.

If you get scammed, it requires you to sue, many EU countries have very long waiting times for those, so you'll be carless and money less for a long time. Cash or crypto solves this elegantly.

Re: The Resolv hack: How one compromised key printed $23M

#143

Post by Saline9515 »

amarant wrote: post #95
Saline9515 wrote: post #64

Earlier quoted context omitted.

Stablecoins present less frictions, have cheaper transaction costs and less intermediaries susceptible to block them. It greatly increases the velocity of money.

What utterly horrendous payment solutions are you using that have more friction than crypto? The ones I use are several orders of magnitude less friction and most are 100% free. The ones that do have a cost (for recipients outside Scandinavia basically) are still way, waay cheaper than crypto transactions.

Many banks from where I come from (France), will require, for larger payments:

- Print a paper form, fill it by hand, scan it and send it. A human will review it next week and agree (or not).

- If you receive money, you have to prove the origin. If you can't, or if the bank finds it unsatisfactory, they'll freeze it. Often, they'll freeze your account right away. You have little legal recourse.

For the record, I once wanted to buy a car in a foreign EU country. I had the contract, it was from a recognized dealership, etc etc. The bank refused to send it. I had to open a Wise account, wire the money there, and then sent it to the dealership.

Overall banks are nice, most of the time, but can create a lot of problems when you need them, especially now that the EU is having an AML inflation under the US and FATF pressure and everything is managed by AI with no human in the loop.

I understand that you couldn't care less about people who aren't having the exact same life as you, but maybe consider that one day it will change and you'll need a freer transaction infrastructure.

And crypto transactions are almost free nowadays, if you avoid Ethereum and Bitcoin. A transfer on Arbitrum L2 costs 0.002$[0]

[0]: https://arbiscan.io/tx/0x92122f1df5e8811f4d0cbf44f210074f5bb...

Re: The Resolv hack: How one compromised key printed $23M

#144

Post by stevage »

Saline9515 wrote: post #140
stevage wrote: post #63

Earlier quoted context omitted.

How do stablecoins fit in here? You can buy a car with crypto but not cash?

Many EU countries have limits on cash payments, and the EU will enforce a union-wide limit of 10,000€ in 2027. Of course, this limit won't be reevaluated over time, so the real value will decrease with inflation.

I'm just trying to imagine what kind of European vendor is willing to accept crypto for their car. The most obvious reasons seem a bit shady.

Re: The Resolv hack: How one compromised key printed $23M

#145

Post by Saline9515 »

JumpCrisscross wrote: post #84
Saline9515 wrote: post #66

Earlier quoted context omitted.

You are a decade late, nowadays stablecoins are commonly used in international trade. Most Alibaba sellers accept USDT nowadays, same for Indian ones.

> stablecoins are commonly used in international trade For a rounding error value of "commonly," sure. (Catering to a financially-constrained market is good business. But it, by definition, will never be an important one in the grand scheme of things.)

Something can be common, while not representing a large volume. And given the current aggressive policy of the US administration, you may soon have to find new payment rails for your international trading, depending on where you live.

As always, things are certain until they aren't. Technological innovation always starts with fringe use cases, before becoming more widespread.

Re: The Resolv hack: How one compromised key printed $23M

#146

Post by Saline9515 »

stevage wrote: post #144
Saline9515 wrote: post #140

Earlier quoted context omitted.

Many EU countries have limits on cash payments, and the EU will enforce a union-wide limit of 10,000€ in 2027. Of course, this limit won't be reevaluated over time, so the real value will decrease with inflation.

I'm just trying to imagine what kind of European vendor is willing to accept crypto for their car. The most obvious reasons seem a bit shady.

The use case would be for transactions between individuals. A friend working at a large industrial firm told me recently that crypto would solve a problem that they have in Asia: orders are often done during auctions from the producer, and require instant payments; however the payment rails take two weeks to clear a transaction. Crypto would fix this.

The fact that it's not widespread doesn't mean that there isn't a usecase.

Re: The Resolv hack: How one compromised key printed $23M

#147

Post by mothballed »

lmm wrote: post #117
troad wrote: post #80

Earlier quoted context omitted.

Clearly your situation of trying to obtain residency in the Comoros by investment would raise eyebrows at banks whose job it is to monitor tax compliance. I don't think you're describing an everyman kind of scenario. I also don't entirely understand why you're even rationalising the purpose of the account to the bank. Can't you just open an account for any purpose? It takes me five minutes to open an account online,…

> You realise you can walk into any US bank right now and they'll just open an account for you with nothing more than some accurate ID? There's an ocean in the way, not to mention how risky visiting looks right now. I changed my name recently and the one US bank that I managed to get an account with (so that US clients can pay me without weirdness) won't accept any kind of documentation without going there in person…

Well no matter what you say it's always nuh uh, doesn't count or some variation of why can't you just be an "everyman." It's hard to argue with a dogmatic position that is based on feelings. You can tell such person what's actually happened to me when I tried to open an account with only "accurate ID" (a US passport) and they literally won't do it while you are homeless because they require a proof of address for KYC even if you have none. Almost everything they have asserted is plainly false. They also claim to have used their bank account to pay for trade in North Korea, a comprehensively sanctioned entity, which seems to be a public written confession of committing a serious crime just to own the crypto use crowd for internet points lol.

People in the middle bands of uses are just ignorantly bliss. And moving between "2 continents" in some vague most likely semi-developed white listed countries in most cases doesn't fall outside the middle bands of uses. So you end up with people shaking their fists at the sky crying that crypto exists, with their fingers in their ears and loudly proclaiming anyone using it are just making up absurd contrived scenarios.

Re: The Resolv hack: How one compromised key printed $23M

#148

Post by nailer »

bob1029 wrote: post #129

> The attacker compromised Resolv’s cloud infrastructure to gain access to Resolv’s AWS Key Management Service (KMS) environment where the protocol’s privileged signing key was stored. Ok, but how was the AWS infrastructure compromised? This appears to be the crux of the entire article. AWS is very hard to break if you are using the IAM roles properly and avoiding manual secret management. If the only thing that can…

Just guessing: invite an engineer to a lucrative job interview and get them to install a “secure video conferencing” app (maybe call it Zoom Enterprise”) then use the screen viewing or filesystem permission to get access.

Re: The Resolv hack: How one compromised key printed $23M

#149

Post by killerstorm »

Hendrikto wrote: post #137
idiotsecant wrote: post #133

Earlier quoted context omitted.

Nope, that is the foundation of bad stablecoin. Trustless decentralized stablecoin like DAI exist. People just largely don't do their homework and prefer scams that lure them in with promises of 'yield'

DAI and SKY are backed in large part by USDC, so they are not truly decentralized. It is possible in theory, but nobody has successfully done it so far.

It's possible in practice: that's how DAI worked originally. It's just not very competitive where the main customer -- traders -- want a lot of liquidity and razor thin spread.
Post reply on HN