3 ms·

Does the very nature of "cold storage" mean they are not monitoring for dramatic drops over SIX months? I mean they took their damn time emptying that thing ou

by ck2 11y ago

Does the very nature of "cold storage" mean they are not monitoring for dramatic drops over SIX months? I mean they took their damn time emptying that thing out. It's like robbing a physical bank one wheelbarrow load of cash at a time every day and no-one notices?

vidarh 11y ago
The very nature of cold storage would mean that if they'd actually implemented cold storage this hack wouldn't have been possible, because the key wouldn't have existed online in any form. It's like robbing a bank by hiding around the bank employees until overhearing the combination to the get you behind the tills (the "hot wallets" in a crypto exchange) only to find out that instead of just giving you access to the small amounts in the tills, it actually also gives you full access to the vault (the "cold storage") that should have been time-locked and require at least two separate physical keys to access. It's hard to secure crypto exchanges sufficiently because of the very nature of it, but it is not hard to come up with security schemes that would make this kind of breach far less costly, and cold storage is one of them. In other words, as the article writer pointed out: > Your cold storage should be actually cold. If you can get at your cold wallet's private keys without physically getting out of your chair and walking somewhere, it's not cold.
firethief 11y ago
I think the attackers didn't take anything until 6 months after providing the malicious wallet code. Apparently they were making use of the exploit during that time, probably gathering information on how to get to the important "cold" wallets. It may have taken them the whole 6 months to figure out how to do that, because I can't imagine them waiting once they had the info they needed; the risk of someone else stealing it first would have been very high. Cryptsy's always been sloppy. They had obvious race conditions in their trade execution, and people regularly complained about stuff like seeing their market orders matching against offers in the middle of the order book instead of the best price. It also used to be easy to end up with a negative balance in one currency (these are unleveraged spot trades mind you, we're not talking options or something). I really have no idea how they made it this long.

by ck2 11y ago

vidarh 11y ago

The very nature of cold storage would mean that if they'd actually implemented cold storage this hack wouldn't have been possible, because the key wouldn't have existed online in any form. It's like robbing a bank by hiding around the bank employees until overhearing the combination to the get you behind the tills (the "hot wallets" in a crypto exchange) only to find out that instead of just giving you access to the small amounts in the tills, it actually also gives you full access to the vault (the "cold storage") that should have been time-locked and require at least two separate physical keys to access. It's hard to secure crypto exchanges sufficiently because of the very nature of it, but it is not hard to come up with security schemes that would make this kind of breach far less costly, and cold storage is one of them. In other words, as the article writer pointed out: > Your cold storage should be actually cold. If you can get at your cold wallet's private keys without physically getting out of your chair and walking somewhere, it's not cold.

firethief 11y ago

I think the attackers didn't take anything until 6 months after providing the malicious wallet code. Apparently they were making use of the exploit during that time, probably gathering information on how to get to the important "cold" wallets. It may have taken them the whole 6 months to figure out how to do that, because I can't imagine them waiting once they had the info they needed; the risk of someone else stealing it first would have been very high. Cryptsy's always been sloppy. They had obvious race conditions in their trade execution, and people regularly complained about stuff like seeing their market orders matching against offers in the middle of the order book instead of the best price. It also used to be easy to end up with a negative balance in one currency (these are unleveraged spot trades mind you, we're not talking options or something). I really have no idea how they made it this long.