Crypto exchange Bybit says a hacker took control of one of its cold Ethereum wallets, resulting in what analysts estimate was the loss of ~$1.5B worth of tokens (www.bloomberg.com)
from Mazdak@lemmy.org to technology@lemmy.world on 22 Feb 16:40
https://lemmy.org/post/33499

#technology

threaded - newest

Darkcoffee@sh.itjust.works on 22 Feb 16:51 next collapse

I’m so glad I have no crypto of any kind. It’s the wild west with no savings insurance, so once it’s gone, it’s gone.

FaceDeer@fedia.io on 22 Feb 18:31 collapse

Depends which exchange you're using.

shortwavesurfer@lemmy.zip on 23 Feb 12:07 collapse

Anybody who keeps their money on an exchange any longer than necessary is just asking for trouble. An exchange is like a public toilet. You get in, you shit, and you get the fuck out. You don’t hang around in a public toilet.

Self custody or GTFO.

FaceDeer@fedia.io on 23 Feb 14:31 collapse

That's not what the question was about.

shortwavesurfer@lemmy.zip on 23 Feb 21:33 collapse

There was no question. There was a statement.

FaceDeer@fedia.io on 23 Feb 21:48 collapse

Alright, that's not what the statement was about.

muntedcrocodile@lemm.ee on 22 Feb 17:06 next collapse

How does one get ones hands on a cold wallet?

Zachariah@lemmy.world on 22 Feb 17:09 next collapse

I recommend gloves.

Transform2942@lemmy.ml on 22 Feb 17:18 next collapse

My speculations:

  • “insecure from the start” - as in , the wallet was never that “cold”

  • with that amount of money, it’s easy to imagine an “insider threat”

  • the hackers could have gotten lucky and struck right when the company was doing legitimate operations on the wallet

  • but probably it’s a towering mountain of incompetence, composed of the elements above and more

Evotech@lemmy.world on 22 Feb 18:11 collapse

Room temperature wallet

muntedcrocodile@lemm.ee on 23 Feb 02:45 collapse

Right next to their iq

dhork@lemmy.world on 22 Feb 17:20 next collapse

Well, either it wasn’t as offline as they all thought, or someone pulled off an epic inside job.

MintyFresh@lemmy.world on 22 Feb 17:20 next collapse

With steely determination

golli@lemm.ee on 22 Feb 18:13 next collapse

What I don’t quite understand is how there is 1.5 billion in a single wallet. Or how are these things structured?

This article puts their total assets under management at $15.7b, which are held in different cryptocurrencies with ethereum at just above $5b.

So I am wondering how they have more than 1/6 of their Ethereum in a single wallet or were these multiple that were connected and got compromised through the same vulnerability? How expensive is it to have more individual wallets? Would it not be feasible to have it split in something like $100m chunks? Or any other more moderate size.

FaceDeer@fedia.io on 22 Feb 18:30 next collapse

It's a common misconception that a "cold wallet" is offline. It's still on the blockchain like any other wallet, it's just the keys that aren't on any network-connected computer.

It appears that in this case hackers managed to trick Bybit employees into entering the keys into a fake UI that gave the hackers access to them.

Kualk@lemm.ee on 22 Feb 19:20 next collapse

Tricked or “tricked”.

Kualk@lemm.ee on 22 Feb 19:28 collapse

That’s room temperature wallet. It was used while claiming asset unused.

It is not cold storage anymore.

x00z@lemmy.world on 22 Feb 19:47 collapse

<img alt="" src="https://lemmy.world/pictrs/image/0bdfb099-cb3d-4e44-8532-51221467cd7a.png">

dhork@lemmy.world on 22 Feb 20:46 collapse

Do I understand this correctly, then, that this was some sort of MITM attack where valid requests to the multisig parties were replaced by malicious code while still appearing to be valid to the signers? That must be an inside job.

And this is the first time I have heard the word “musked” in this context…

x00z@lemmy.world on 22 Feb 22:11 collapse

Do I understand this correctly, then, that this was some sort of MITM attack where valid requests to the multisig parties were replaced by malicious code while still appearing to be valid to the signers? That must be an inside job.

I have no idea. I guess they’ll release a lot more info regarding this in the next few days.

And this is the first time I have heard the word “musked” in this context…

I think his English isn’t good looking at the rest of the message. Might be “masked” instead.

ryan213@lemmy.ca on 22 Feb 17:08 next collapse

More like bye-bit, am I right??

Viri4thus@feddit.org on 22 Feb 17:24 next collapse

Angry upvote you horrible genius.

Limonene@lemmy.world on 22 Feb 18:02 collapse

They’ll just roll back the blockchain. Ethereum is a centrally controlled cryptocurrency, though its fans claim otherwise. It’s been rolled back before.

nectar@lemmy.world on 22 Feb 18:46 collapse

This is either a person who hasn’t followed ETH since 2016 or is intentionally spreading misinformation.

It HAS been rolled back once, when the blockchain was in its infancy. But to say that it is still “centrally controlled” suggests having no idea what has happened in the 9 years since.

nick@midwest.social on 22 Feb 18:55 next collapse

lol good

cupcakezealot@lemmy.blahaj.zone on 22 Feb 19:23 next collapse

how is $1.5 billion in worth calculated because no way bitcoin tokens are worth more than $20.

x00z@lemmy.world on 22 Feb 19:44 next collapse

401,347 ETH

cupcakezealot@lemmy.blahaj.zone on 22 Feb 23:43 collapse

<img alt="" src="https://lemmy.blahaj.zone/pictrs/image/a786f13e-f8f1-485d-8266-c75927b32361.webp">

x00z@lemmy.world on 23 Feb 22:27 collapse

You wanted to know how it’s calculated.

That was the supposed amount of ETH that was stolen. 1 ETH is currently around $2800. The value it has is because people are buying ETH for that price. So you take $2800 and multiply it by 400000. Carry the 5, etc. That’s $1 120 000 000.

There was some other stuff stolen too I think. I haven’t really looked into it.

Treczoks@lemmy.world on 23 Feb 22:43 collapse

That someone can just make off with that amount of digital “currency” sure inspires trust in that system, so the $2800 price tag might be a bit optimistic.

ThrowawayPermanente@sh.itjust.works on 23 Feb 13:00 next collapse

They’re worth what you can sell them for. The US dollars they’re priced in don’t exactly inspire confidence these days, either.

prole@lemmy.blahaj.zone on 23 Feb 13:23 collapse

I’m not sure I understand the question… Do you think the market value of these coins is made up (as in not directly related to demand), and you can’t actually go onto an exchange and trade it for actual USD? Because of course you can.

1 Bitcoin (not a token) is currently worth over $95,000

GreenKnight23@lemmy.world on 22 Feb 19:47 next collapse

<img alt="lolfomo" src="https://c.tenor.com/Dbq_im3MkUAAAAAd/tenor.gif">

Treczoks@lemmy.world on 23 Feb 00:09 next collapse

The money is not gone, is just that someone else has it.

MedicPigBabySaver@lemmy.world on 23 Feb 01:29 next collapse

Oh no!

SplashJackson@lemmy.ca on 23 Feb 01:46 next collapse

I gotta get in on this hacking gig. Anyone know if any hacker groups are hiring?

/s for CSIS

[deleted] on 23 Feb 04:19 next collapse

.

Picasso@thelemmy.club on 23 Feb 04:30 collapse

ELI5 why we cannot “rollback” Ethereum

xcancel.com/TimBeiko/status/1893412457567383559#m