Technical Analysis of the Poly Network Hack
1–10 of 35 posts
Re: Technical Analysis of the Poly Network Hack
#2Great write up.
I wonder if Coinbase has flagged the USDC that was stolen. Are those currently less-fungible USDCs?
Re: Technical Analysis of the Poly Network Hack
#3It will never cease to amaze me that someone with the technical chops to pull off an attack worth this much hasn't done the minimum pre-work necessary to get away with the cash or at least some non-trivial amount of it.
Re: Technical Analysis of the Poly Network Hack
#4It will never cease to amaze me that someone with the technical chops to pull off an attack worth this much hasn't done the minimum pre-work necessary to get away with the cash or at least some non-trivial amount of it.
Money laundering, especially when hundreds of millions of dollars in value are on the line (meaning it's not your sleepy local police office dealing with it, but the best the federal government can offer), is hard in itself - and cashing out in actual physical dollars is even harder.
The potential for messing up on the way is simply enormous. Remember Silk Road? Guy got v& because of a stackoverflow post.
Re: Technical Analysis of the Poly Network Hack
#5It will never cease to amaze me that someone with the technical chops to pull off an attack worth this much hasn't done the minimum pre-work necessary to get away with the cash or at least some non-trivial amount of it.
Money laundering, especially when hundreds of millions of dollars in value are on the line (meaning it's not your sleepy local police office dealing with it, but the best the federal government can offer), is hard in itself - and cashing out in actual physical dollars is even harder . The potential for messing up on the way is simply enormous. Remember Silk Road? Guy got v& because of a stackoverflow post.
Not really. Ethereum has anonymous transfers through zkSnarks in the same spirit as other anon cryptos, except as a contract:
All the hacker would have had to do was do the hack from a secure connection (ie cantenna to free wifi + proxy chaining ..etc.)
https://tornado-cash.medium.com/how-to-stay-anonymous-with-t...
Re: Technical Analysis of the Poly Network Hack
#6It will never cease to amaze me that someone with the technical chops to pull off an attack worth this much hasn't done the minimum pre-work necessary to get away with the cash or at least some non-trivial amount of it.
Money laundering, especially when hundreds of millions of dollars in value are on the line (meaning it's not your sleepy local police office dealing with it, but the best the federal government can offer), is hard in itself - and cashing out in actual physical dollars is even harder . The potential for messing up on the way is simply enormous. Remember Silk Road? Guy got v& because of a stackoverflow post.
>The potential for messing up on the way is simply enormous. Remember Silk Road? Guy got v& because of a stackoverflow post.
Ulbricht messed up in a lot of different ways. That was just one of the many. It wasn't just one little slip-up; he had truly awful OPSEC. (And pretty poor technical skills in general, it seems, based on his SO question [1] and various other things.) Even if the SO question potentially may have been found through parallel construction (no way to ever know), there were so many different parallel paths investigators could've taken that his downfall was almost certainly inevitable.
But your overall point is definitely correct. The oft-quoted attacker's advantage in information (and other) security is that the defenders need to "win" every time and the attackers only need to "win" once. Try 100 different exploit attempts; if the defenders prevent 99 of them, they lose.
This gets flipped when it comes to OPSEC. The attacker needs to "win" every OPSEC battle and the investigators often only need to "win" once. If they find a single mistake, they may be able to tug on a thread that leads to the attacker's likely affiliation and identity. And the more sophisticated and complex the attack, the more surface area there is for mistakes, just like how more complex systems/organizations have larger surface areas for attackers to target.
[1] https://stackoverflow.com/questions/15445285/how-can-i-conne...
Re: Technical Analysis of the Poly Network Hack
#7What was missing for me in the article is the fact that they don't call a function by name AND by validation of hash.
Instead, only by hash( + "(bytes,bytes,uint64)").slice(0,10) which is brute-force-able.
Still, this sounds just like one of my worst nightmares. A code in production having bugs that will lose all my money to an untraceable environment (the tornado chain).
Re: Technical Analysis of the Poly Network Hack
#8It will never cease to amaze me that someone with the technical chops to pull off an attack worth this much hasn't done the minimum pre-work necessary to get away with the cash or at least some non-trivial amount of it.
They're claiming to be white hat and have given back 250m.
Re: Technical Analysis of the Poly Network Hack
#9Earlier quoted context omitted.
Money laundering, especially when hundreds of millions of dollars in value are on the line (meaning it's not your sleepy local police office dealing with it, but the best the federal government can offer), is hard in itself - and cashing out in actual physical dollars is even harder . The potential for messing up on the way is simply enormous. Remember Silk Road? Guy got v& because of a stackoverflow post.
Not really. Ethereum has anonymous transfers through zkSnarks in the same spirit as other anon cryptos, except as a contract: https://tornado.cash/ All the hacker would have had to do was do the hack from a secure connection (ie cantenna to free wifi + proxy chaining ..etc.) https://tornado-cash.medium.com/how-to-stay-anonymous-with-t...
The problem with these is that similar to TOR, you need enough legitimate transactions to mask your traffic... because otherwise you can easily be spotted, which is why the TC website explicitly warns:
> After depositing, users should wait some amount of time before withdrawing to improve their privacy.
If you have 600 million dollars to launder, the probability of being caught is still massive. It simply is an enormous sum of money.
Re: Technical Analysis of the Poly Network Hack
#10It will never cease to amaze me that someone with the technical chops to pull off an attack worth this much hasn't done the minimum pre-work necessary to get away with the cash or at least some non-trivial amount of it.
They're claiming to be white hat and have given back 250m.
But 1) in the context of the article (which only knows about $4.7m being returned), this was only something they did after they failed to get away with the money; and 2) if you were a "white hat" you would give back all of the money, not 40% of it ;P.