18 ms·

$600M taken in largest DeFi hack to date

324 points by carlgreene 5y ago

thewarrior 5y ago
Thankfully centralized things ljke laws, courts and police exist to bail out the code is law jungle of “decentralized” finance. It’s becoming apparent to me that the main innovation of crypto is a form of regulatory arbitrage. You or me cannot sell derivatives like Goldman Sachs but in crypto land you totally can from your home with a laptop. You can start a gambling casino on ethereum and get away with not following any of the laws regarding gambling as long as you couch it in financial and blockchain buzzwords. Some people will make a lot of money doing legitimate work and some scamming others until all of this becomes big enough to become mainstream and regulated.
- luma 5y ago
  It's endlessly amusing to watch a group of (mostly) finance "outsider" engineering teams rediscover all the reasons the current financial system works like it does.
  - toomuchtodo 5y ago
    This is what happens when you try to solve people problems with code.
    - starfallg 5y ago
      It's like people watch and read all these Cyberpunk stories and say that nah, it's all fake, can't happen here, tech can solve everything.
  - Gatsky 5y ago
    https://www.cnn.com/2021/02/16/business/citibank-revlon-lawsuit-ruling/index.html https://www.cnn.com/2021/02/16/business/citibank-revlon-laws... Just sayin…
    - xadhominemx 5y ago
      This story is only notable because mistaken transactions get reversed all the time. This scenario was the result of a strange but intentional quirk in the law.
    - JackFr 5y ago
      Of course the big difference is Citi actually owed that money.
    - pb7 5y ago
      Did you read your own link past the headline? Citi accidentally repaid the loan in its entirety earlier than necessary. No money was lost or stolen. The lender decided to keep the early repayment of its money which is legally allowed.
      - Gatsky 5y ago
        Yes, I did. Did you read the comment I was replying to? Isn’t it ‘endlessly amusing’ to observe one of the biggest banks in the world discover why the finance system works the way it does? And if it was ‘no big deal’ then why did Citibank sue to get the money returned? I don’t use or advocate for DeFi, but the weird smugness of random people defending the existing financial system is quite off putting and frankly hard to understand given the last few decades.
  - londons_explore 5y ago
    In the process of that rediscovery, plenty of people will become rich. That's an incentive to not be too quick remaking those discoveries...
    - cynusx 5y ago
      You are forgetting the multi-millions of people that lost money on crypto so far. They are just written off as sore losers... Confirmation bias plays a big role in the popularity of crypto, in unsettingly the same way as it does with people dreaming to become a famous soccer player... mostly through confirmation bias and very little value-add.
  - elevenoh 5y ago
    It's also endlessly amusing to watch traditional finance types take every crypto 'bump in the road' as an opportunity to justify their careers + justify their delusions about the status-quo & future of finance.
    - IfOnlyYouKnew 5y ago
      It can only be "endlessly amusing" because there are "endless" of these bumps, so far. But, as with cryptocurrencies, it just doesn't make any sense. Maybe a boxer taking it on the chin round after round can derive some satisfaction from still being conscious. But they aren't making any progress and would be rather stupid to continue considering it a winning strategy. Oh, wait.. maybe it does make sense.
  - steveBK123 5y ago
    Yes, it's main innovation is "not doing KYC" For those with a longer history on Wall St, it was essentially a new asset class with all the easy money arbitrage opportunities that went away in equities 20+ years ago back again.
    - xadhominemx 5y ago
      Strategies that haven’t worked in regulated markets in 25-30 years are still minting cash in crypto.
    - steveBK123 5y ago
      Arguably "not doing KYC" was also Robinhood's secret sauce..
  - leephillips 5y ago
    It’s like the NoSQL of finance.
- SilasX 5y ago
  Or, like in the case of Ethereum’s DAO hack, they can hyper-narrowly renege on “code is law” for this one case, where the logic error affects politically connected leaders, which is soooo much better than the corrupt legal system it’s replacing.
  - _jal 5y ago
    That's the thing that kills it for me. Always look for the chump at the table. If you can't spot them, you're the chump.
    - mgarfias 5y ago
      This is why I don’t play.
    - cyberge99 5y ago
      I’ve always heard it as: “Never play a game where you don’t know what the patsy is. Because you’re the patsy.”
- wmf 5y ago
  Have any crypto hackers even been found, let alone punished by the law?
  - smt88 5y ago
    I don't know about punishment, but the recovery rate for stolen/extorted crypto is much higher than for fiat cash. This is likely an issue of sophistication -- crypto hackers don't have decades of "best practices" knowledge to draw from, and may also feel a false sense of security.
    - londons_explore 5y ago
      > recovery rate for stolen/extorted crypto is much higher than for fiat cash. Citation needed for such an extraordinary claim.
      - smt88 5y ago
        I can't find it for the life of me, but I remembered reading that recovery of stolen crypto was both faster and more successful. I'll retract that claim for now. In the meantime, this article explains how and why that would be the case: https://www.nytimes.com/2021/06/09/technology/bitcoin-untraceable-pipeline-ransomware.html https://www.nytimes.com/2021/06/09/technology/bitcoin-untrac... Basically the openness of the ledger allows law enforcement to skip some slow and difficult tracing and requesting of warrants. On top of that, cybercriminals seem to make exploitable mistakes that have enabled stealing their private keys.
  - zitterbewegung 5y ago
    MtGOX comes to mind. A bunch of the ICOs were simple frauds so they would practically have a Wordpress website with a Bitcoin wallet address.
    - redisman 5y ago
      They still are. There are more coins released than ever
- deleted 5y ago
  [deleted]
- rmah 5y ago
  You most certainly can buy and sell derivatives. Many (most?) discount brokers offer at least equity options, and many offer commodity futures.
  - thewarrior 5y ago
    I don't need a license or a lawyer or anything ? I'm talking about creating and selling new types of contracts not trading what brokers already offer.
- diamond559 5y ago
  There's a large difference in capex required to start and operate a lending/borrowing protocol on Ethereum vs starting a bank/credit union that has nothing to do with regulation.
  - thewarrior 5y ago
    Where do the capex differences come from ?
    - diamond559 5y ago
      Look at the size of a dev team for Uniswap or Aave, then look at the number of employees for Wells Fargo. Then look at the physical assets of a bank like their branches and office space.
- hcarvalhoalves 5y ago
  You're right, but is this news? I understand the whole point of crypto is the future bet that centralisation/regulation by state actors will eventually be _less_ trustable. This one hack means $600MM lost, but how much has been routinely lost to bad governance, inflation or corruption? How much value has been destroyed in the 2008 housing crisis? In the long run, the crypto market can professionalize enough while remaining decentralised, such that the risk/reward is attractive compared to holding 100% fiat – this seems to be people's bet, not that crypto is inherently safe.
  - IfOnlyYouKnew 5y ago
    While I understand how inflation may, in theory, be something that could change with some breakthrough in economics (even though I don't buy that inflation is actually a problem, or that cryptocurrencies represent such a breakthrough), I have no idea how they would be of help fighting "corruption and bad governance". Which is the problem with that community: they seem to have these extremely naive yet cynical view of politicians just being "stupid", money being wasted, everyone being corrupt etc. And that, somehow, their funny little hashes are the silver bullet to solve these issues.
    - diamond559 5y ago
      I think the Bitcoin community give the rest of the space a bad name. There are too many people with fringe libertarian views in that space that dominate the narrative. Ethereum, I've found is a much more interesting space. It's valuable because you can actually use the blockchain for things more complicated than just sending coins around. As stupid as many of the NFTs are right now, they have the potential to completely change how the art, music and gaming industries are monetized. Defi has a huge potential to make banking more efficient and provide banking services to underserved areas as long as they have an internet connection.
  - lottin 5y ago
    Bitcoin is an attempt to redesign the international monetary system by people who are clueless about economics. The result speaks for itself. A payment system that doesn't work and can't work, and a currency that would sink any country adopting it into a deep depression. Defi is to finance what bitcoin is to currency. A bunch of kids who wanted to "do finance" without actually knowing anything about finance. They still haven't figured out that you can't do finance with unconfiscatable assets. The main problem isn't lack of professionalism, but the fact that it's broken by design.
tracedddd 5y ago
Currently looks like the attacker had legitimate access to the required keys, so perhaps more of a traditional compromise rather than a cryptocurrency/contract centric one.
- edf13 5y ago
  Nope... https://twitter.com/PolyNetwork2/status/1425130017546149891 https://twitter.com/PolyNetwork2/status/1425130017546149891
  - tracedddd 5y ago
    Still early, but looks like damage control to me. https://twitter.com/mudit__gupta/status/1425150994778787841?s=21 https://twitter.com/mudit__gupta/status/1425150994778787841?... https://blocksecteam.medium.com/the-initial-analysis-of-the-polynetwork-hack-270ac6072e2a https://blocksecteam.medium.com/the-initial-analysis-of-the-...
- danielvf 5y ago
  Or the attacker had stolen the private key. But either way, I'm quite skeptical of Polychain's denial that a key was involved. We'll know for sure over the next few days at any rate.
  - tracedddd 5y ago
    Yes, by legitimate I meant genuine rather than authorized.
mensetmanusman 5y ago
Aha, again, the monicker that all crypto is a gradually growing bug bounty remains true.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- throw1547 5y ago
  How could not all Bitcoin end up "lost" (keys lost) or stolen (by hackers)?
  - wyager 5y ago
    Because Bitcoin is much better designed and implemented than 99% of altcoins/shitcoins/tokens/etc.
    - Tepix 5y ago
      It's lacking features. You could argue that paper money lacks the features of bitcoins so it's easier to lose your funds inadvertently with bitcoin.
    - lottin 5y ago
      Shitcoins use literally the same source code as bitcoin.
      - andy81 5y ago
        Not completely true. Dogecoin for example has some config changes to block size that make transactions cheaper. It's factually "better" as far as code goes.
  - wmf 5y ago
    Presumably the hackers will recirculate their stolen Bitcoin by spending/cashing out. Likewise Bitcoin seized by law enforcement is auctioned.
vmception 5y ago
This one is actually hilarious because of the messages onchain. People, including the hacker, are adding plain text to their transactions' metadata field to communicate. But also, insurance products exist, they pay out pretty reliably. Are there any DeFi insurance products that would be able to cover $600M yet? edit: some people seem to misunderstand, DeFi insurance products exist, the policies are not too expensive and they pay out reliably and quickly. The math is easy because of the transparency of "semi-untraceable internet money" and the Defi sector being much larger than any of the hacks. There are a lot of competitors in the insurance space. It is easy to make and rely on a claim because the damage is easily seen and verified for the policy holder. There are several sectors in the Defi space, such as AMMs, oracles, lenders, and some of those sectors are driving sentiment and attention more than others. Insurance is one of those sectors. My question was whether any of the insurance systems would be able to cover $600M, right now, it wasn't to entertain out of touch people's pre-existing skepticism.
- koolba 5y ago
  Given the rampant fraud in the tangible asset insurance business, imagine the premiums and due diligence to deal with semi-untraceable internet money. I’d consider anyone selling it to be either a fraud or an idiot.
  - mikeyouse 5y ago
    Our boring non-crypto services business just saw a 100% increase in our cyber premiums due to all the rampant theft and ransomware this wonderful little corner of the internet has given birth to. Great work DeFi world!
    - jjoonathan 5y ago
      > cyber premiums Truly, we live in the future.
      - deleted 5y ago
        [deleted]
mbesto 5y ago
> The team behind the protocol also promised legal action and requested that hackers return stolen assets. Legal action? By who? A central authority!? No way...
- Proven 5y ago
  They may try to sue exchanges that let the funds be transferred out, as the addresses where the thieves sent the stolen funds have been published. There's absolutely no need for a central authority, but as always we need local courts and law can be different in different places where those exchanges are registered. Screw globalism and screw central authorities. Having said that, this DeFi stuff is laughable. As if the main use case is to find greater fools or scam people.
- miohtama 5y ago
  Because the project was not very well known, or known at all, outside China and it looks like an insider job, I would say in China by Chinese authority.
  - mbesto 5y ago
    So you're advocating for decentralize financial systems but a centralize legal system? How do you reconcile that?
    - miohtama 5y ago
      I am not advocating, I am speculating what could likely happen. The Poly project seems to be obscure, low quality, so maybe it’s better for investors and users to lose what they had, so they can be smarter next time? Also it seems the project was not very decentralised if everything was stolen with a single private key.
      - RF_Savage 5y ago
        A project worth 600million usd is obscure?
    - 5y ago
artursapek 5y ago
https://blocksecteam.medium.com/the-initial-analysis-of-the-polynetwork-hack-270ac6072e2a https://blocksecteam.medium.com/the-initial-analysis-of-the-...
vmception 5y ago
> The user told the hackers to try depositing the stolen tokens without Tether, which the hackers did successfully and they deposited all the addresses into Curve. The hackers then sent the anonymous user about $45,000 worth of ethereum for their help. The hacker can earn a bunch of Curve and treat this more like a larger flash loan. The market values Curve and this would either mint new Curve or distribute more Curve from the Curve organization's existing treasury.
villgax 5y ago
Lol
villgax 5y ago
Costly bug-bounty is all
rvz 5y ago
Feels good just to sit back, relax and watch the chaos and carnage around the cryptocurrency market as I wait for the inevitable dive. Coming soon.
vishnugupta 5y ago
I know what Bitcoin is, have read the paper and I totally get their value proposition. But now a days it's hard for me to understand what's going on in crypto world. For example I couldn't even parse their statement: "#PolyNetwork was attacked on @BinanceChain @ethereum and @0xPolygon Assets had been transferred to hacker's following addresses:" Source: https://twitter.com/PolyNetwork2/status/1425073987164381196 https://twitter.com/PolyNetwork2/status/1425073987164381196
- fossuser 5y ago
  I found this to be a pretty good list: https://danromero.org/crypto-reading/ https://danromero.org/crypto-reading/ Some more details here if you're curious: https://news.ycombinator.com/item?id=27812093 https://news.ycombinator.com/item?id=27812093
- bombcar 5y ago
  It was too hard to fork the bitcoin codebase to make things like dogecoin so people figured out how to use ethereum smart contracts to make coins based on ethereum and then they did that again to make entire chains of coins based on chains on ethereum or something.
  - vishnugupta 5y ago
    > use ethereum smart contracts....on ethereum.... to make entire chains....on ethereum I'm getting CDO, CDO^2, Synthetic CDO vibes reading this.
- csomar 5y ago
  PolyNetwork (whatever it is, first time I heard of them) has tokens (its own) and apparently some ETH, and USDC on the Ethereum and BinanceChain. These "assets" are locked with a smart contract (instead of a private key), so anyone figuring out the smart contract can move the money (which they did) and they posted the address to where they moved the money.
- jcpham2 5y ago
  Same boat. I read this and the key take away is a bunch of buzzwords and smart contracts are still stupid. eth peeps get rugpulled again! lest we not forget ETC ethereum classic is actually the real eth chain except they forked it to salvage the DAO debacle - except the internet has a short memory and no one remembers this any more. inb4 ETH3 fork
er4hn 5y ago
> The user told the hackers to try depositing the stolen tokens without Tether, which the hackers did successfully and they deposited all the addresses into Curve. The hackers then sent the anonymous user about $45,000 worth of ethereum for their help. Best part of the article is how an anonymous person helped the hackers launder their money and got a tip for it.
- rhizome 5y ago
  Can they cash it out without getting busted?
  - l-lousy 5y ago
    They can do the same thing the hackers did and launder it before withdrawing to a new wallet
  - colinmhayes 5y ago
    Yes, you can use mixers and coinjoins to launder non centralized crypto. The tip was in etherium, so it shouldn't be an issue to swap to monero, mix, and deposit to an exchange.
    - sp332 5y ago
      I think swapping to monero would be the weak link there. If they do it on a "legit" exchange, it at least makes an attempt to get the client's identity. If they do it directly with someone who has monero to sell, that person gets stuck with "tainted" ethereum.
      - colinmhayes 5y ago
        There are defi(lol) swappers you can use. The hacker was using curve.fi, the tipster was actually telling the hacker why his transaction to curve wasn't going through.
  - antondd 5y ago
    Yes, anonymous blockchains like Monero allow you to ‘obfuscate’ the movement of your crypto.
joosters 5y ago
Poly Network has asked digital asset exchanges and miners to block any tokens coming from the above addresses [...] Tether froze more than $30 million in response to the hack Decentralized finance at its best - so decentralized that individuals and centralized companies can decide to block transactions by themselves.
- PretzelPirate 5y ago
  Decentralization doesn’t mean everything is decentralized, it’s a range of decentralization from fully decentralized to fully centralized. You can use DeFi without ever touching centrally-controlled assets like USDC or Tether. The key thing is that you get that choice.
  - m3kw9 5y ago
    All I’m seeing is “decentralized” figures making some very centralized moves when they see fit.
    - zionic 5y ago
      Tether is famously centralized, you’re attacking a straw man.
      - valzam 5y ago
        And I think you arefalling for the "true scotsman" fallacy. Tether backs 70%+ of daily BTC trading volumne, saying criticism against Tether is invalid because Tether isn't real crypto is a cop-out given how important it is in the ecosystem.
        phatfish 5y ago
        Bitcoin (and therefore the whole crypto space) should be valued in Tether-Dollars not USD. I wonder how much Tether-Dollars are really worth...
        5y ago
leesec 5y ago
Someone tipped off this hacker on the blockchain to stop using USDT tokens because he was blacklisted, and the hacker tipped him back 47k lol
- rincebrain 5y ago
  I knew someone once who, in the very early days of BTC (before it was worth more than $10 or something), helped someone with a technical issue and, unbidden, was sent something like 80 BTC as a thank you. The running joke, before all the nightmares cryptocurrency has spawned since it took off, was that he'd helped some drug lord fix their metaphorical printer, but not so funny now...
- optimalsolver 5y ago
  With 600 million, I'd be feeling pretty generous.
- MisterBiggs 5y ago
  More interesting than the value in USD is that it was 13.37 ETH
  - deleted 5y ago
    [deleted]
  - GWN1234 5y ago
    They thank him by titling him "Elite" (1337). He is the Elite / What he did is elite (for us). https://en.wikipedia.org/wiki/Leet https://en.wikipedia.org/wiki/Leet
intro-b 5y ago
> The user told the hackers to try depositing the stolen tokens without Tether, which the hackers did successfully and they deposited all the addresses into Curve. The hackers then sent the anonymous user about $45,000 worth of ethereum for their help. This is pretty amusing, if anything.
- qeternity 5y ago
  13.37 ETH at that, even more amusing.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
  - GWN1234 5y ago
    They thank him by titling him "Elite" (1337). He is the Elite / What he did is elite (for us). https://en.wikipedia.org/wiki/Leet https://en.wikipedia.org/wiki/Leet
    - qeternity 5y ago
      Yes, I know, that’s why I said it’s amusing.
miohtama 5y ago
Note that it really cannot be counted as a DeFi hack if a single custodian private key was compromised https://mobile.twitter.com/Mudit__Gupta/status/1425150994778787841 https://mobile.twitter.com/Mudit__Gupta/status/1425150994778...
dinonotdefi 5y ago
Decentralized In Name Only DINO, not defi
reilly3000 5y ago
It looks like they were able to write themselves a check using or spoofing a legit signature. A traditional bank would put a hold on any amount over a certain threshold to prevent this kind of fraud. I wonder if DeFi has some kind of option for an Oracle to a human verification step over a set amount. An attacker could flood transactions to avoid that limit, but maybe network delay and/or some kind of throttling would buy enough time to ensure some safety. I’m still bullish on defi but there is a lot of incidents like this that need to happen before these systems become resilient.
- ineptech 5y ago
  > I wonder if DeFi has some kind of option for an Oracle to a human verification step... "For safety, all transactions have to go through Dave" == "Free money to anyone who manages to hack/bribe/kidnap/etc Dave"
  - l-lousy 5y ago
    Very unlikely to succeed if you choose someone with enough vested interest in the company. Also “Dave is the only one that could have approved this, he’s who we sue”
    - sobellian 5y ago
      If Dave owes you $600K, Dave's got a problem. If Dave owes you $600MM, you have a problem.
    - ineptech 5y ago
      I phrased this glibly for comedy value, but this is not a silly problem; it is part of the "Oracle problem" and it imperils the entire fundamental value prop of defi. If it's not clear why, consider: what keeps defi from implementing gambling (or as it's known in the financial world, "options trading") on real-world data outcomes, like stock prices? Answer: that data isn't programmatically available on the blockchain. You can make a smart contract that depends on the closing price of ETH, but not AAPL. So, what if it were? What if someone decided to publish AAPL's closing price to a ledger somewhere? Then people could make a smart contract that effectively implements options trading against AAPL stock, right? In theory, yes. But in practice, the people that trade options will say, "How can we trust that you won't screw up, get hacked, get bribed, go out of business, etc? Every dollar we entrust to a smart contract that relies on your data is a prize to be won by the first person to find a way to subvert your service's data integrity." And they'll be right. There are lots of people trying to find fancy solutions to this problem, but to my knowledge we're no closer to a real solution than we were the day Ethereum went live.
muttantt 5y ago
"hacked"...
carlgreene 5y ago
I purposefully didn't put "Stolen" in the title because who's to say that this contract was not executed as intended. Who defines what is the intended use of functions that reside on the blockchain?
- unyttigfjelltol 5y ago
  +1 The article would have benefitted from an explanation of how operation of this code in a 'Code is Law' scenario can result in 'stolen' ledger entries. It's like complaining about an 'illegal' court judgment, after the appealing court says it wasn't illegal.
- danielvf 5y ago
  If I have a bank vault that can only be opened by one key, an attacker comes to my house, steals the key, opens the bank vault, and takes everything valuable inside, I think that it would count as stealing in every sense of the word, regardless of the correct behavior of the bank vault in only opening for the right key. I know there's a fun semantic debate about smart contracts hacks, but at the moment this theft does not appear to be in that category.
fouric 5y ago
I'm eagerly awaiting the https://www.rekt.news/ https://www.rekt.news/ writeup, which as of this moment is still missing. They have decent technical analysis, and certainly far more than the linked article.
- xtracto 5y ago
  Was going to post about rekt.news . I was surprised that I didn't learn about this hack from them. That site is golden, and reminds me to the early 90s era of the internet: Where you had tens of "defaced" web pages (private and government) every day.
- jalino23 5y ago
  bookedmarked ty
- nadahalli 5y ago
  SlowMist has a non-humorous writeup. https://slowmist.medium.com/the-root-cause-of-poly-network-being-hacked-ec2ee1b0c68f https://slowmist.medium.com/the-root-cause-of-poly-network-b... I am still waiting for Rekt to cover this one.
TekMol 5y ago
Interesting that everybody accepts that this was a "hack". Initially the idea of crypto was that "Code is Law". The code sent the funds somewhere, correct? So by the "Code is Law" standards, this would have been just a legit transaction. Now it is like in the old world. Whoever has the highest reputation is right.
- meowkit 5y ago
  And the code was flawed, doing something that was unintended, therefore the law was flawed. This happens all the time in traditional written law. Legalese exists for this very reason.
  - TekMol 5y ago
    How do you know it was unintended? Just because one side says so? Because that side has a big brand name? That is exactly what I mean with "Whoever has the highest reputation is right". The initial promise of crypto was the opposite: That the little Joe has the same rights as the big guys. Because code is law. And code does not care about the budget of your legal department and your marketing department.
    - leppr 5y ago
      "Code is law" is either nonsensical or redundant when applied to a complex Turing complete language such as Solidity. If you can't accurately predict the implications of the lines of code in a smart contract, then it's as good as saying "The laws of physics are laws. That ball ended in my garden following the laws of gravity and thermodynamics, asking for me to return it to you is breaching the initial promise of the physical world". This may change with better smart contract languages that can reconcile intent with effect[1], but while talking about complex Ethereum smart contracts, the "Code is law" argument has no value. Furthermore, as long as you keep within the bounds of trustless cryptocurrency (unfortunately not a tautology these days), code is indeed law. The ETH this person acquired cannot be confiscated. [1] e.g. https://scilla.readthedocs.io/en/latest/ https://scilla.readthedocs.io/en/latest/
m3kw9 5y ago
Defi can sometimes unknowingly expose your money to the whelms of single contract error or stolen key that you don’t even own.
- lottin 5y ago
  Sometimes? Defi runs on smart contracts so you're permanently exposed.
d--b 5y ago
> The market remains stable, despite the news This is what I don’t understand... There is nothing that prevents something 10 times bigger to happen and cause many people to quit crypto en masse leavingg others holding the bag... this is going to embolden other hackers. It’s an awful lot of money!!
- paulpauper 5y ago
  Because stolen crypto effectively lowers the supply.imagine if binance were hacked and everything stolen. 50 billion taken out of circulation because its not like a hacker can cash out to fiat or sell their loot on an exchange.rather it must be sold very slowly or on the street. A major hack is sorta like a bunch of ppl at once losing their keys
- schemescape 5y ago
  The article has a quote speculating on the market’s (lack of) reaction (a quote I find rather horrifying): > DeFi has survived so many individual hacks and exploits that people are less scared of their assets going to zero as a result.
guardiangod 5y ago
https://twitter.com/HsakaTrades/status/1425093301691195407 https://twitter.com/HsakaTrades/status/1425093301691195407
JulianMorrison 5y ago
lol, got to love the helpful but amoral technical assistance
asasidh 5y ago
Its fun to read all the comments in HN on anything related to "crypto"
- MitPitt 5y ago
  Man I feel you, I wonder if it's even the same people
  - asasidh 5y ago
    Its almost like they all bet on the Blockchain not bitcoin narrative and got burned.
yawaworht1978 5y ago
Wow, now would would one go on to locate the thieves in a case like this? Is this another "smart" contract exploit? If yes, any word of Buterin on this?
jnwatson 5y ago
Does anyone have a good suggestion how to get up to speed on the DeFi space starting with understanding how cryptocurrency works?
- w4llstr33t 5y ago
  I think it would be worth understanding how Bitcoin works first. It's designed to be more robust. It doesn't change as often (some criticize it due to that), however, it could also be seen as a strength. You could read the Bitcoin white paper [1]. If you wanted to learn more about programming Bitcoin, you could also check out Mastering Bitcoin 2nd Edition - Programming the Open Blockchain by Andreas M. Antonopoulos [2]. Ethereum was created after Bitcoin. It was designed to be more of an open programming platform. It was designed to be Turing Complete and enabled the use of "smart contracts". The DeFi space runs on smart contracts and Ethereum kicked off DeFi. This is the Ethereum white paper [3]. Mastering Ethereum by Andreas M. Antonopoulos & Gavin Wood is another book you could check out [4]. Here are a couple of introductions to DeFi, as well [5][6]. The hack that everyone is discussing here was on Poly Network, which a layer 2 solution for Ethereum [7]. Layer 2 solutions were created due to lower the high gas fees on Ethereum, as well as increase transaction throughput. Ethereum itself is also working on moving to Ethereum 2.0 which would help address the issues that layer 2 solutions are trying to solve [7]. Edit: Poly Network actually appears to be more of a bridge between different networks (Ethereum, Polygon and Binance Smart Chain) [9], so it's worth noting that this wasn't a direct hack on Polygon, which is a layer 2 solution for Ethereum. [1] https://bitcoin.org/bitcoin.pdf https://bitcoin.org/bitcoin.pdf [2] https://github.com/bitcoinbook/bitcoinbook https://github.com/bitcoinbook/bitcoinbook [3] https://ethereum.org/en/whitepaper/ https://ethereum.org/en/whitepaper/ [4] https://github.com/ethereumbook/ethereumbook https://github.com/ethereumbook/ethereumbook [5] https://ethereum.org/en/defi/ https://ethereum.org/en/defi/ [6] https://blog.coinbase.com/a-beginners-guide-to-decentralized-finance-defi-574c68ff43c4 https://blog.coinbase.com/a-beginners-guide-to-decentralized... [7] https://www.gemini.com/cryptopedia/polygon-crypto-matic-network-dapps-erc20-token#section-polygon-crypto-network-basics https://www.gemini.com/cryptopedia/polygon-crypto-matic-netw... [8] https://ethereum.org/en/eth2/ https://ethereum.org/en/eth2/ [9] https://www.reddit.com/r/CryptoCurrency/comments/p1qfdo/psa_poly_network_is_not_the_same_thing_as_polygon/ https://www.reddit.com/r/CryptoCurrency/comments/p1qfdo/psa_...
paulpauper 5y ago
This effectively removes 600 million from circulation so this can explain why price has not fallen. Way harder and slower to spend dirty money than clean money
- Tepix 5y ago
  No, the 600 million can re-enter circulation at any time.
  - paulpauper 5y ago
    U can't cash out 550 million stolen into fiat easily if at all. It will languish in the stolen wallets for years as the thief devises a way to launder it slowly and wait for the heat to die down
    - colinmhayes 5y ago
      The hacker already swapped hundreds of millions. They'll coinjoin it next and then it's ready to be deposited on exchanges.
      - paulpauper 5y ago
        U can't just deposit 500 million and then cash out into greenbacks. Coinjoin does not work that well for so much. Even the biggest mixers only processed a fraction of that. Major alarm bells would be going off for even just a tiny fraction of that if someone even tried to deposit that much legit crypto
        colinmhayes 5y ago
        I don't see why exchanges would reject say $1 million in clean crypto.Maybe not coinbase, but the offshore exchanges would probably be fine.
        paulpauper 5y ago
wly_cdgr 5y ago
If I was a government trying to bolster support for regulation, I could do worse than feeding two birds withbone roll by pulling off a hack like this
thepasswordis 5y ago
Has anybody ever stolen money like this in the traditional finance space?
- kej 5y ago
  This story comes to mind: https://fin.plaid.com/articles/anatomy-of-a-bank-heist/ https://fin.plaid.com/articles/anatomy-of-a-bank-heist/
- Johnie 5y ago
  There's probably many. Here is the 2015 Swift Network Hack resulting in $101M stolen from banks. https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_banking_hack https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_bankin... Here is a catalog of financial cyber incidents: https://carnegieendowment.org/specialprojects/protectingfinancialstability/timeline https://carnegieendowment.org/specialprojects/protectingfina...
BTCOG 5y ago
"Fool me once, shame on you. Fool me twice, shame on me. Fool me 156x in Ethereum and uh..." Good ol' totally centralized inept Ethereum platform strikes again! Always good for some belly laughs.
leppr 5y ago
First line of the article: > Hackers exploited Poly Network on DeFi exchanges Polygon, Ethereum and Binance Smart Chain When even a website supposedly specializing on blockchain can't get their basic terminology right.
glofish 5y ago
I am unable to find a satisfactory answer for the following: Whose money was stolen? PolyNet's? Random user? Someone "betting/buying" on a contract? What is Curve.fi and why is transferring the proceeds there advantageous for the hacker?
- 22c 5y ago
  Scant details in the article and I suggest waiting for a better write-up, I'm just a punter. I've never heard of poly.network but based on what I can see here, it seems likely that this was related to a cross-chain bridge. ie. they run their own network and the assets on that network were "bridged" in from other networks. Bridged assets are really held in custody at the bridge while a "copy" of that asset goes off to the other networks and does things, eventually that "copy" comes back to the bridge and gets destroyed, then custody of the asset you bridged is released back to the original network. In this case it seems like someone was essentially able to provide forged "custody papers" of bridged assets that came in from BSC and ETH mainnet and were floating around on Polygon and then was able to "unbridge" assets back to BSC and ETH mainnet. The people affected are presumably anyone who had used poly.network bridge to bridge assets from either ETH mainnet or BSC over to Polygon. curve.fi can basically be thought of as a bank (or really a provider of interest earning bonds). The really bizarre thing here is that the "hacker" doesn't even try to cover their tracks before putting money straight in the bank. The funds are dirty, we can only speculate that curve may not want to touch these coins and is possibly figuring out how to "quarantine" them as there's every possibility that other "big boys" may follow Tether on blocking redemption. There are well-known methods of washing funds, so it's possible the "hacker" wasn't really all that experienced but somehow "stumbled" upon the keys to the vault, so to speak.
Pxtl 5y ago
I've said it before, I'll say it again: Crypto currency is about tearing down the old rules and institutions of banking and finding out one failure at a time why each rule and institution exists.
- dumbfoundded 5y ago
  In a larger sense, that's a general trend of "innovation". Social media is just advertising that avoided regulation by being on the internet. Now it's rediscovering why public broadcasting laws are necessary. The whole gig economy is rediscovering why workers' rights & protections were invented. AirBnB is rediscovering why zoning and safety standards were created for hotels. Nothing has really changed at all. Innovation seems more about inventing a way to do an old thing that feels new enough to avoid legal scrutiny until a company gets large enough and the public angry enough that laws create regulatory capture.
  - jaytaylor 5y ago
    > Regulatory capture is an economic theory that regulatory agencies may come to be dominated by the interests they regulate and not by the public interest. The result is that the agency instead acts in ways that benefit the interests it is supposed to be regulating. I'm not sure if I am reading your comment correctly. Regulatory capture doesn't sound like a desirable thing, and wouldn't do the desired regulating. What did/do you believe the definition is?
    - jjkaczor 5y ago
      >Regulatory capture doesn't sound like a desirable thing It's not a desirable thing for the public - plenty desirable for industry... It worked out pretty well with Ajit Patel and the FCC... Or the CRTC and it's board members and adhoc meetings in bars/pubs with the telecom industry.
      - arcticbull 5y ago
        Ajit Pai right? Mr. Reese's Pieces Cup.
mdoms 5y ago
Is this the same clowns who got hacked a month ago? https://news.ycombinator.com/item?id=27664911 https://news.ycombinator.com/item?id=27664911
jl2718 5y ago
The contract is designed to execute arbitrary transactions with a valid signature. Hacker/insider got the private key. Simple as that.
- jl2718 5y ago
  Correction: it was a 3/4 multisig and it took 3 signatures to switch over to single-key. Who had those keys? No idea. Their white paper says nothing about key management, just a bunch of nonsense pseudo-notation about blockchain basics.
Clewza313 5y ago
Blocking tokens on exchanges, blacklisting addresses and threats of legal action? And silly old me thought that decentralized cryptocurrency was supposed to be the path of Freedom(tm) beyond all those centralized, coercive, fiat-like restrictions.
ineedasername 5y ago
The team behind Poly has "requested that hackers return stolen assets" I guess is doesn't hurt to ask? Not usually how doing a crime works though.
ourcat 5y ago
The funds are in the process of being returned: https://www.theblockcrypto.com/post/114189/poly-hack-attacker-return-funds-id-slowmist https://www.theblockcrypto.com/post/114189/poly-hack-attacke...
deleted 5y ago
[deleted]

324 points by carlgreene 5y ago

Thankfully centralized things ljke laws, courts and police exist to bail out the code is law jungle of “decentralized” finance. It’s becoming apparent to me that the main innovation of crypto is a form of regulatory arbitrage. You or me cannot sell derivatives like Goldman Sachs but in crypto land you totally can from your home with a laptop. You can start a gambling casino on ethereum and get away with not following any of the laws regarding gambling as long as you couch it in financial and blockchain buzzwords. Some people will make a lot of money doing legitimate work and some scamming others until all of this becomes big enough to become mainstream and regulated.

luma 5y ago
It's endlessly amusing to watch a group of (mostly) finance "outsider" engineering teams rediscover all the reasons the current financial system works like it does.
- toomuchtodo 5y ago
  This is what happens when you try to solve people problems with code.
  - starfallg 5y ago
    It's like people watch and read all these Cyberpunk stories and say that nah, it's all fake, can't happen here, tech can solve everything.
- Gatsky 5y ago
  https://www.cnn.com/2021/02/16/business/citibank-revlon-lawsuit-ruling/index.html https://www.cnn.com/2021/02/16/business/citibank-revlon-laws... Just sayin…
  - xadhominemx 5y ago
    This story is only notable because mistaken transactions get reversed all the time. This scenario was the result of a strange but intentional quirk in the law.
  - JackFr 5y ago
    Of course the big difference is Citi actually owed that money.
  - pb7 5y ago
    Did you read your own link past the headline? Citi accidentally repaid the loan in its entirety earlier than necessary. No money was lost or stolen. The lender decided to keep the early repayment of its money which is legally allowed.
    - Gatsky 5y ago
      Yes, I did. Did you read the comment I was replying to? Isn’t it ‘endlessly amusing’ to observe one of the biggest banks in the world discover why the finance system works the way it does? And if it was ‘no big deal’ then why did Citibank sue to get the money returned? I don’t use or advocate for DeFi, but the weird smugness of random people defending the existing financial system is quite off putting and frankly hard to understand given the last few decades.
- londons_explore 5y ago
  In the process of that rediscovery, plenty of people will become rich. That's an incentive to not be too quick remaking those discoveries...
  - cynusx 5y ago
    You are forgetting the multi-millions of people that lost money on crypto so far. They are just written off as sore losers... Confirmation bias plays a big role in the popularity of crypto, in unsettingly the same way as it does with people dreaming to become a famous soccer player... mostly through confirmation bias and very little value-add.
- elevenoh 5y ago
  It's also endlessly amusing to watch traditional finance types take every crypto 'bump in the road' as an opportunity to justify their careers + justify their delusions about the status-quo & future of finance.
  - IfOnlyYouKnew 5y ago
    It can only be "endlessly amusing" because there are "endless" of these bumps, so far. But, as with cryptocurrencies, it just doesn't make any sense. Maybe a boxer taking it on the chin round after round can derive some satisfaction from still being conscious. But they aren't making any progress and would be rather stupid to continue considering it a winning strategy. Oh, wait.. maybe it does make sense.
- steveBK123 5y ago
  Yes, it's main innovation is "not doing KYC" For those with a longer history on Wall St, it was essentially a new asset class with all the easy money arbitrage opportunities that went away in equities 20+ years ago back again.
  - xadhominemx 5y ago
    Strategies that haven’t worked in regulated markets in 25-30 years are still minting cash in crypto.
  - steveBK123 5y ago
    Arguably "not doing KYC" was also Robinhood's secret sauce..
- leephillips 5y ago
  It’s like the NoSQL of finance.
SilasX 5y ago
Or, like in the case of Ethereum’s DAO hack, they can hyper-narrowly renege on “code is law” for this one case, where the logic error affects politically connected leaders, which is soooo much better than the corrupt legal system it’s replacing.
- _jal 5y ago
  That's the thing that kills it for me. Always look for the chump at the table. If you can't spot them, you're the chump.
  - mgarfias 5y ago
    This is why I don’t play.
  - cyberge99 5y ago
    I’ve always heard it as: “Never play a game where you don’t know what the patsy is. Because you’re the patsy.”
wmf 5y ago
Have any crypto hackers even been found, let alone punished by the law?
- smt88 5y ago
  I don't know about punishment, but the recovery rate for stolen/extorted crypto is much higher than for fiat cash. This is likely an issue of sophistication -- crypto hackers don't have decades of "best practices" knowledge to draw from, and may also feel a false sense of security.
  - londons_explore 5y ago
    > recovery rate for stolen/extorted crypto is much higher than for fiat cash. Citation needed for such an extraordinary claim.
    - smt88 5y ago
      I can't find it for the life of me, but I remembered reading that recovery of stolen crypto was both faster and more successful. I'll retract that claim for now. In the meantime, this article explains how and why that would be the case: https://www.nytimes.com/2021/06/09/technology/bitcoin-untraceable-pipeline-ransomware.html https://www.nytimes.com/2021/06/09/technology/bitcoin-untrac... Basically the openness of the ledger allows law enforcement to skip some slow and difficult tracing and requesting of warrants. On top of that, cybercriminals seem to make exploitable mistakes that have enabled stealing their private keys.
- zitterbewegung 5y ago
  MtGOX comes to mind. A bunch of the ICOs were simple frauds so they would practically have a Wordpress website with a Bitcoin wallet address.
  - redisman 5y ago
    They still are. There are more coins released than ever
deleted 5y ago
[deleted]
rmah 5y ago
You most certainly can buy and sell derivatives. Many (most?) discount brokers offer at least equity options, and many offer commodity futures.
- thewarrior 5y ago
  I don't need a license or a lawyer or anything ? I'm talking about creating and selling new types of contracts not trading what brokers already offer.
diamond559 5y ago
There's a large difference in capex required to start and operate a lending/borrowing protocol on Ethereum vs starting a bank/credit union that has nothing to do with regulation.
- thewarrior 5y ago
  Where do the capex differences come from ?
  - diamond559 5y ago
    Look at the size of a dev team for Uniswap or Aave, then look at the number of employees for Wells Fargo. Then look at the physical assets of a bank like their branches and office space.
hcarvalhoalves 5y ago
You're right, but is this news? I understand the whole point of crypto is the future bet that centralisation/regulation by state actors will eventually be _less_ trustable. This one hack means $600MM lost, but how much has been routinely lost to bad governance, inflation or corruption? How much value has been destroyed in the 2008 housing crisis? In the long run, the crypto market can professionalize enough while remaining decentralised, such that the risk/reward is attractive compared to holding 100% fiat – this seems to be people's bet, not that crypto is inherently safe.
- IfOnlyYouKnew 5y ago
  While I understand how inflation may, in theory, be something that could change with some breakthrough in economics (even though I don't buy that inflation is actually a problem, or that cryptocurrencies represent such a breakthrough), I have no idea how they would be of help fighting "corruption and bad governance". Which is the problem with that community: they seem to have these extremely naive yet cynical view of politicians just being "stupid", money being wasted, everyone being corrupt etc. And that, somehow, their funny little hashes are the silver bullet to solve these issues.
  - diamond559 5y ago
    I think the Bitcoin community give the rest of the space a bad name. There are too many people with fringe libertarian views in that space that dominate the narrative. Ethereum, I've found is a much more interesting space. It's valuable because you can actually use the blockchain for things more complicated than just sending coins around. As stupid as many of the NFTs are right now, they have the potential to completely change how the art, music and gaming industries are monetized. Defi has a huge potential to make banking more efficient and provide banking services to underserved areas as long as they have an internet connection.
- lottin 5y ago
  Bitcoin is an attempt to redesign the international monetary system by people who are clueless about economics. The result speaks for itself. A payment system that doesn't work and can't work, and a currency that would sink any country adopting it into a deep depression. Defi is to finance what bitcoin is to currency. A bunch of kids who wanted to "do finance" without actually knowing anything about finance. They still haven't figured out that you can't do finance with unconfiscatable assets. The main problem isn't lack of professionalism, but the fact that it's broken by design.

tracedddd 5y ago

Currently looks like the attacker had legitimate access to the required keys, so perhaps more of a traditional compromise rather than a cryptocurrency/contract centric one.

edf13 5y ago
Nope... https://twitter.com/PolyNetwork2/status/1425130017546149891 https://twitter.com/PolyNetwork2/status/1425130017546149891
- tracedddd 5y ago
  Still early, but looks like damage control to me. https://twitter.com/mudit__gupta/status/1425150994778787841?s=21 https://twitter.com/mudit__gupta/status/1425150994778787841?... https://blocksecteam.medium.com/the-initial-analysis-of-the-polynetwork-hack-270ac6072e2a https://blocksecteam.medium.com/the-initial-analysis-of-the-...
danielvf 5y ago
Or the attacker had stolen the private key. But either way, I'm quite skeptical of Polychain's denial that a key was involved. We'll know for sure over the next few days at any rate.
- tracedddd 5y ago
  Yes, by legitimate I meant genuine rather than authorized.

mensetmanusman 5y ago

Aha, again, the monicker that all crypto is a gradually growing bug bounty remains true.

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
throw1547 5y ago
How could not all Bitcoin end up "lost" (keys lost) or stolen (by hackers)?
- wyager 5y ago
  Because Bitcoin is much better designed and implemented than 99% of altcoins/shitcoins/tokens/etc.
  - Tepix 5y ago
    It's lacking features. You could argue that paper money lacks the features of bitcoins so it's easier to lose your funds inadvertently with bitcoin.
  - lottin 5y ago
    Shitcoins use literally the same source code as bitcoin.
    - andy81 5y ago
      Not completely true. Dogecoin for example has some config changes to block size that make transactions cheaper. It's factually "better" as far as code goes.
- wmf 5y ago
  Presumably the hackers will recirculate their stolen Bitcoin by spending/cashing out. Likewise Bitcoin seized by law enforcement is auctioned.

vmception 5y ago

This one is actually hilarious because of the messages onchain. People, including the hacker, are adding plain text to their transactions' metadata field to communicate. But also, insurance products exist, they pay out pretty reliably. Are there any DeFi insurance products that would be able to cover $600M yet? edit: some people seem to misunderstand, DeFi insurance products exist, the policies are not too expensive and they pay out reliably and quickly. The math is easy because of the transparency of "semi-untraceable internet money" and the Defi sector being much larger than any of the hacks. There are a lot of competitors in the insurance space. It is easy to make and rely on a claim because the damage is easily seen and verified for the policy holder. There are several sectors in the Defi space, such as AMMs, oracles, lenders, and some of those sectors are driving sentiment and attention more than others. Insurance is one of those sectors. My question was whether any of the insurance systems would be able to cover $600M, right now, it wasn't to entertain out of touch people's pre-existing skepticism.

koolba 5y ago
Given the rampant fraud in the tangible asset insurance business, imagine the premiums and due diligence to deal with semi-untraceable internet money. I’d consider anyone selling it to be either a fraud or an idiot.
- mikeyouse 5y ago
  Our boring non-crypto services business just saw a 100% increase in our cyber premiums due to all the rampant theft and ransomware this wonderful little corner of the internet has given birth to. Great work DeFi world!
  - jjoonathan 5y ago
    > cyber premiums Truly, we live in the future.
    - deleted 5y ago
      [deleted]

mbesto 5y ago

> The team behind the protocol also promised legal action and requested that hackers return stolen assets. Legal action? By who? A central authority!? No way...

Proven 5y ago
They may try to sue exchanges that let the funds be transferred out, as the addresses where the thieves sent the stolen funds have been published. There's absolutely no need for a central authority, but as always we need local courts and law can be different in different places where those exchanges are registered. Screw globalism and screw central authorities. Having said that, this DeFi stuff is laughable. As if the main use case is to find greater fools or scam people.
miohtama 5y ago
Because the project was not very well known, or known at all, outside China and it looks like an insider job, I would say in China by Chinese authority.
- mbesto 5y ago
  So you're advocating for decentralize financial systems but a centralize legal system? How do you reconcile that?
  - miohtama 5y ago
    I am not advocating, I am speculating what could likely happen. The Poly project seems to be obscure, low quality, so maybe it’s better for investors and users to lose what they had, so they can be smarter next time? Also it seems the project was not very decentralised if everything was stolen with a single private key.
    - RF_Savage 5y ago
      A project worth 600million usd is obscure?
  - 5y ago

artursapek 5y ago

https://blocksecteam.medium.com/the-initial-analysis-of-the-polynetwork-hack-270ac6072e2a https://blocksecteam.medium.com/the-initial-analysis-of-the-...

vmception 5y ago

> The user told the hackers to try depositing the stolen tokens without Tether, which the hackers did successfully and they deposited all the addresses into Curve. The hackers then sent the anonymous user about $45,000 worth of ethereum for their help. The hacker can earn a bunch of Curve and treat this more like a larger flash loan. The market values Curve and this would either mint new Curve or distribute more Curve from the Curve organization's existing treasury.

villgax 5y ago

Lol

villgax 5y ago

Costly bug-bounty is all

rvz 5y ago

Feels good just to sit back, relax and watch the chaos and carnage around the cryptocurrency market as I wait for the inevitable dive. Coming soon.

vishnugupta 5y ago

I know what Bitcoin is, have read the paper and I totally get their value proposition. But now a days it's hard for me to understand what's going on in crypto world. For example I couldn't even parse their statement: "#PolyNetwork was attacked on @BinanceChain @ethereum and @0xPolygon Assets had been transferred to hacker's following addresses:" Source: https://twitter.com/PolyNetwork2/status/1425073987164381196 https://twitter.com/PolyNetwork2/status/1425073987164381196

fossuser 5y ago
I found this to be a pretty good list: https://danromero.org/crypto-reading/ https://danromero.org/crypto-reading/ Some more details here if you're curious: https://news.ycombinator.com/item?id=27812093 https://news.ycombinator.com/item?id=27812093
bombcar 5y ago
It was too hard to fork the bitcoin codebase to make things like dogecoin so people figured out how to use ethereum smart contracts to make coins based on ethereum and then they did that again to make entire chains of coins based on chains on ethereum or something.
- vishnugupta 5y ago
  > use ethereum smart contracts....on ethereum.... to make entire chains....on ethereum I'm getting CDO, CDO^2, Synthetic CDO vibes reading this.
csomar 5y ago
PolyNetwork (whatever it is, first time I heard of them) has tokens (its own) and apparently some ETH, and USDC on the Ethereum and BinanceChain. These "assets" are locked with a smart contract (instead of a private key), so anyone figuring out the smart contract can move the money (which they did) and they posted the address to where they moved the money.
jcpham2 5y ago
Same boat. I read this and the key take away is a bunch of buzzwords and smart contracts are still stupid. eth peeps get rugpulled again! lest we not forget ETC ethereum classic is actually the real eth chain except they forked it to salvage the DAO debacle - except the internet has a short memory and no one remembers this any more. inb4 ETH3 fork

er4hn 5y ago

> The user told the hackers to try depositing the stolen tokens without Tether, which the hackers did successfully and they deposited all the addresses into Curve. The hackers then sent the anonymous user about $45,000 worth of ethereum for their help. Best part of the article is how an anonymous person helped the hackers launder their money and got a tip for it.

rhizome 5y ago
Can they cash it out without getting busted?
- l-lousy 5y ago
  They can do the same thing the hackers did and launder it before withdrawing to a new wallet
- colinmhayes 5y ago
  Yes, you can use mixers and coinjoins to launder non centralized crypto. The tip was in etherium, so it shouldn't be an issue to swap to monero, mix, and deposit to an exchange.
  - sp332 5y ago
    I think swapping to monero would be the weak link there. If they do it on a "legit" exchange, it at least makes an attempt to get the client's identity. If they do it directly with someone who has monero to sell, that person gets stuck with "tainted" ethereum.
    - colinmhayes 5y ago
      There are defi(lol) swappers you can use. The hacker was using curve.fi, the tipster was actually telling the hacker why his transaction to curve wasn't going through.
- antondd 5y ago
  Yes, anonymous blockchains like Monero allow you to ‘obfuscate’ the movement of your crypto.

joosters 5y ago

Poly Network has asked digital asset exchanges and miners to block any tokens coming from the above addresses [...] Tether froze more than $30 million in response to the hack Decentralized finance at its best - so decentralized that individuals and centralized companies can decide to block transactions by themselves.

PretzelPirate 5y ago
Decentralization doesn’t mean everything is decentralized, it’s a range of decentralization from fully decentralized to fully centralized. You can use DeFi without ever touching centrally-controlled assets like USDC or Tether. The key thing is that you get that choice.
- m3kw9 5y ago
  All I’m seeing is “decentralized” figures making some very centralized moves when they see fit.
  - zionic 5y ago
    Tether is famously centralized, you’re attacking a straw man.
    - valzam 5y ago
      And I think you arefalling for the "true scotsman" fallacy. Tether backs 70%+ of daily BTC trading volumne, saying criticism against Tether is invalid because Tether isn't real crypto is a cop-out given how important it is in the ecosystem.
      - phatfish 5y ago
        Bitcoin (and therefore the whole crypto space) should be valued in Tether-Dollars not USD. I wonder how much Tether-Dollars are really worth...
      - 5y ago

leesec 5y ago

Someone tipped off this hacker on the blockchain to stop using USDT tokens because he was blacklisted, and the hacker tipped him back 47k lol

rincebrain 5y ago
I knew someone once who, in the very early days of BTC (before it was worth more than $10 or something), helped someone with a technical issue and, unbidden, was sent something like 80 BTC as a thank you. The running joke, before all the nightmares cryptocurrency has spawned since it took off, was that he'd helped some drug lord fix their metaphorical printer, but not so funny now...
optimalsolver 5y ago
With 600 million, I'd be feeling pretty generous.
MisterBiggs 5y ago
More interesting than the value in USD is that it was 13.37 ETH
- deleted 5y ago
  [deleted]
- GWN1234 5y ago
  They thank him by titling him "Elite" (1337). He is the Elite / What he did is elite (for us). https://en.wikipedia.org/wiki/Leet https://en.wikipedia.org/wiki/Leet

intro-b 5y ago

qeternity 5y ago
13.37 ETH at that, even more amusing.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- GWN1234 5y ago
  They thank him by titling him "Elite" (1337). He is the Elite / What he did is elite (for us). https://en.wikipedia.org/wiki/Leet https://en.wikipedia.org/wiki/Leet
  - qeternity 5y ago
    Yes, I know, that’s why I said it’s amusing.

miohtama 5y ago

Note that it really cannot be counted as a DeFi hack if a single custodian private key was compromised https://mobile.twitter.com/Mudit__Gupta/status/1425150994778787841 https://mobile.twitter.com/Mudit__Gupta/status/1425150994778...

dinonotdefi 5y ago

Decentralized In Name Only DINO, not defi

reilly3000 5y ago

It looks like they were able to write themselves a check using or spoofing a legit signature. A traditional bank would put a hold on any amount over a certain threshold to prevent this kind of fraud. I wonder if DeFi has some kind of option for an Oracle to a human verification step over a set amount. An attacker could flood transactions to avoid that limit, but maybe network delay and/or some kind of throttling would buy enough time to ensure some safety. I’m still bullish on defi but there is a lot of incidents like this that need to happen before these systems become resilient.

ineptech 5y ago
> I wonder if DeFi has some kind of option for an Oracle to a human verification step... "For safety, all transactions have to go through Dave" == "Free money to anyone who manages to hack/bribe/kidnap/etc Dave"
- l-lousy 5y ago
  Very unlikely to succeed if you choose someone with enough vested interest in the company. Also “Dave is the only one that could have approved this, he’s who we sue”
  - sobellian 5y ago
    If Dave owes you $600K, Dave's got a problem. If Dave owes you $600MM, you have a problem.
  - ineptech 5y ago
    I phrased this glibly for comedy value, but this is not a silly problem; it is part of the "Oracle problem" and it imperils the entire fundamental value prop of defi. If it's not clear why, consider: what keeps defi from implementing gambling (or as it's known in the financial world, "options trading") on real-world data outcomes, like stock prices? Answer: that data isn't programmatically available on the blockchain. You can make a smart contract that depends on the closing price of ETH, but not AAPL. So, what if it were? What if someone decided to publish AAPL's closing price to a ledger somewhere? Then people could make a smart contract that effectively implements options trading against AAPL stock, right? In theory, yes. But in practice, the people that trade options will say, "How can we trust that you won't screw up, get hacked, get bribed, go out of business, etc? Every dollar we entrust to a smart contract that relies on your data is a prize to be won by the first person to find a way to subvert your service's data integrity." And they'll be right. There are lots of people trying to find fancy solutions to this problem, but to my knowledge we're no closer to a real solution than we were the day Ethereum went live.

muttantt 5y ago

"hacked"...

carlgreene 5y ago

I purposefully didn't put "Stolen" in the title because who's to say that this contract was not executed as intended. Who defines what is the intended use of functions that reside on the blockchain?

unyttigfjelltol 5y ago
+1 The article would have benefitted from an explanation of how operation of this code in a 'Code is Law' scenario can result in 'stolen' ledger entries. It's like complaining about an 'illegal' court judgment, after the appealing court says it wasn't illegal.
danielvf 5y ago
If I have a bank vault that can only be opened by one key, an attacker comes to my house, steals the key, opens the bank vault, and takes everything valuable inside, I think that it would count as stealing in every sense of the word, regardless of the correct behavior of the bank vault in only opening for the right key. I know there's a fun semantic debate about smart contracts hacks, but at the moment this theft does not appear to be in that category.

fouric 5y ago

I'm eagerly awaiting the https://www.rekt.news/ https://www.rekt.news/ writeup, which as of this moment is still missing. They have decent technical analysis, and certainly far more than the linked article.

xtracto 5y ago
Was going to post about rekt.news . I was surprised that I didn't learn about this hack from them. That site is golden, and reminds me to the early 90s era of the internet: Where you had tens of "defaced" web pages (private and government) every day.
jalino23 5y ago
bookedmarked ty
nadahalli 5y ago
SlowMist has a non-humorous writeup. https://slowmist.medium.com/the-root-cause-of-poly-network-being-hacked-ec2ee1b0c68f https://slowmist.medium.com/the-root-cause-of-poly-network-b... I am still waiting for Rekt to cover this one.

TekMol 5y ago

Interesting that everybody accepts that this was a "hack". Initially the idea of crypto was that "Code is Law". The code sent the funds somewhere, correct? So by the "Code is Law" standards, this would have been just a legit transaction. Now it is like in the old world. Whoever has the highest reputation is right.

meowkit 5y ago
And the code was flawed, doing something that was unintended, therefore the law was flawed. This happens all the time in traditional written law. Legalese exists for this very reason.
- TekMol 5y ago
  How do you know it was unintended? Just because one side says so? Because that side has a big brand name? That is exactly what I mean with "Whoever has the highest reputation is right". The initial promise of crypto was the opposite: That the little Joe has the same rights as the big guys. Because code is law. And code does not care about the budget of your legal department and your marketing department.
  - leppr 5y ago
    "Code is law" is either nonsensical or redundant when applied to a complex Turing complete language such as Solidity. If you can't accurately predict the implications of the lines of code in a smart contract, then it's as good as saying "The laws of physics are laws. That ball ended in my garden following the laws of gravity and thermodynamics, asking for me to return it to you is breaching the initial promise of the physical world". This may change with better smart contract languages that can reconcile intent with effect[1], but while talking about complex Ethereum smart contracts, the "Code is law" argument has no value. Furthermore, as long as you keep within the bounds of trustless cryptocurrency (unfortunately not a tautology these days), code is indeed law. The ETH this person acquired cannot be confiscated. [1] e.g. https://scilla.readthedocs.io/en/latest/ https://scilla.readthedocs.io/en/latest/

m3kw9 5y ago

Defi can sometimes unknowingly expose your money to the whelms of single contract error or stolen key that you don’t even own.

lottin 5y ago
Sometimes? Defi runs on smart contracts so you're permanently exposed.

d--b 5y ago

> The market remains stable, despite the news This is what I don’t understand... There is nothing that prevents something 10 times bigger to happen and cause many people to quit crypto en masse leavingg others holding the bag... this is going to embolden other hackers. It’s an awful lot of money!!

paulpauper 5y ago
Because stolen crypto effectively lowers the supply.imagine if binance were hacked and everything stolen. 50 billion taken out of circulation because its not like a hacker can cash out to fiat or sell their loot on an exchange.rather it must be sold very slowly or on the street. A major hack is sorta like a bunch of ppl at once losing their keys
schemescape 5y ago
The article has a quote speculating on the market’s (lack of) reaction (a quote I find rather horrifying): > DeFi has survived so many individual hacks and exploits that people are less scared of their assets going to zero as a result.

guardiangod 5y ago

https://twitter.com/HsakaTrades/status/1425093301691195407 https://twitter.com/HsakaTrades/status/1425093301691195407

JulianMorrison 5y ago

lol, got to love the helpful but amoral technical assistance

asasidh 5y ago

Its fun to read all the comments in HN on anything related to "crypto"

MitPitt 5y ago
Man I feel you, I wonder if it's even the same people
- asasidh 5y ago
  Its almost like they all bet on the Blockchain not bitcoin narrative and got burned.

yawaworht1978 5y ago

Wow, now would would one go on to locate the thieves in a case like this? Is this another "smart" contract exploit? If yes, any word of Buterin on this?

jnwatson 5y ago

Does anyone have a good suggestion how to get up to speed on the DeFi space starting with understanding how cryptocurrency works?

w4llstr33t 5y ago
I think it would be worth understanding how Bitcoin works first. It's designed to be more robust. It doesn't change as often (some criticize it due to that), however, it could also be seen as a strength. You could read the Bitcoin white paper [1]. If you wanted to learn more about programming Bitcoin, you could also check out Mastering Bitcoin 2nd Edition - Programming the Open Blockchain by Andreas M. Antonopoulos [2]. Ethereum was created after Bitcoin. It was designed to be more of an open programming platform. It was designed to be Turing Complete and enabled the use of "smart contracts". The DeFi space runs on smart contracts and Ethereum kicked off DeFi. This is the Ethereum white paper [3]. Mastering Ethereum by Andreas M. Antonopoulos & Gavin Wood is another book you could check out [4]. Here are a couple of introductions to DeFi, as well [5][6]. The hack that everyone is discussing here was on Poly Network, which a layer 2 solution for Ethereum [7]. Layer 2 solutions were created due to lower the high gas fees on Ethereum, as well as increase transaction throughput. Ethereum itself is also working on moving to Ethereum 2.0 which would help address the issues that layer 2 solutions are trying to solve [7]. Edit: Poly Network actually appears to be more of a bridge between different networks (Ethereum, Polygon and Binance Smart Chain) [9], so it's worth noting that this wasn't a direct hack on Polygon, which is a layer 2 solution for Ethereum. [1] https://bitcoin.org/bitcoin.pdf https://bitcoin.org/bitcoin.pdf [2] https://github.com/bitcoinbook/bitcoinbook https://github.com/bitcoinbook/bitcoinbook [3] https://ethereum.org/en/whitepaper/ https://ethereum.org/en/whitepaper/ [4] https://github.com/ethereumbook/ethereumbook https://github.com/ethereumbook/ethereumbook [5] https://ethereum.org/en/defi/ https://ethereum.org/en/defi/ [6] https://blog.coinbase.com/a-beginners-guide-to-decentralized-finance-defi-574c68ff43c4 https://blog.coinbase.com/a-beginners-guide-to-decentralized... [7] https://www.gemini.com/cryptopedia/polygon-crypto-matic-network-dapps-erc20-token#section-polygon-crypto-network-basics https://www.gemini.com/cryptopedia/polygon-crypto-matic-netw... [8] https://ethereum.org/en/eth2/ https://ethereum.org/en/eth2/ [9] https://www.reddit.com/r/CryptoCurrency/comments/p1qfdo/psa_poly_network_is_not_the_same_thing_as_polygon/ https://www.reddit.com/r/CryptoCurrency/comments/p1qfdo/psa_...

paulpauper 5y ago

This effectively removes 600 million from circulation so this can explain why price has not fallen. Way harder and slower to spend dirty money than clean money

Tepix 5y ago
No, the 600 million can re-enter circulation at any time.
- paulpauper 5y ago
  U can't cash out 550 million stolen into fiat easily if at all. It will languish in the stolen wallets for years as the thief devises a way to launder it slowly and wait for the heat to die down
  - colinmhayes 5y ago
    The hacker already swapped hundreds of millions. They'll coinjoin it next and then it's ready to be deposited on exchanges.
    - paulpauper 5y ago
      U can't just deposit 500 million and then cash out into greenbacks. Coinjoin does not work that well for so much. Even the biggest mixers only processed a fraction of that. Major alarm bells would be going off for even just a tiny fraction of that if someone even tried to deposit that much legit crypto
      - colinmhayes 5y ago
        I don't see why exchanges would reject say $1 million in clean crypto.Maybe not coinbase, but the offshore exchanges would probably be fine.
        paulpauper 5y ago

wly_cdgr 5y ago

If I was a government trying to bolster support for regulation, I could do worse than feeding two birds withbone roll by pulling off a hack like this

thepasswordis 5y ago

Has anybody ever stolen money like this in the traditional finance space?

kej 5y ago
This story comes to mind: https://fin.plaid.com/articles/anatomy-of-a-bank-heist/ https://fin.plaid.com/articles/anatomy-of-a-bank-heist/
Johnie 5y ago
There's probably many. Here is the 2015 Swift Network Hack resulting in $101M stolen from banks. https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_banking_hack https://en.wikipedia.org/wiki/2015%E2%80%932016_SWIFT_bankin... Here is a catalog of financial cyber incidents: https://carnegieendowment.org/specialprojects/protectingfinancialstability/timeline https://carnegieendowment.org/specialprojects/protectingfina...

BTCOG 5y ago

"Fool me once, shame on you. Fool me twice, shame on me. Fool me 156x in Ethereum and uh..." Good ol' totally centralized inept Ethereum platform strikes again! Always good for some belly laughs.

leppr 5y ago

First line of the article: > Hackers exploited Poly Network on DeFi exchanges Polygon, Ethereum and Binance Smart Chain When even a website supposedly specializing on blockchain can't get their basic terminology right.

glofish 5y ago

I am unable to find a satisfactory answer for the following: Whose money was stolen? PolyNet's? Random user? Someone "betting/buying" on a contract? What is Curve.fi and why is transferring the proceeds there advantageous for the hacker?

22c 5y ago
Scant details in the article and I suggest waiting for a better write-up, I'm just a punter. I've never heard of poly.network but based on what I can see here, it seems likely that this was related to a cross-chain bridge. ie. they run their own network and the assets on that network were "bridged" in from other networks. Bridged assets are really held in custody at the bridge while a "copy" of that asset goes off to the other networks and does things, eventually that "copy" comes back to the bridge and gets destroyed, then custody of the asset you bridged is released back to the original network. In this case it seems like someone was essentially able to provide forged "custody papers" of bridged assets that came in from BSC and ETH mainnet and were floating around on Polygon and then was able to "unbridge" assets back to BSC and ETH mainnet. The people affected are presumably anyone who had used poly.network bridge to bridge assets from either ETH mainnet or BSC over to Polygon. curve.fi can basically be thought of as a bank (or really a provider of interest earning bonds). The really bizarre thing here is that the "hacker" doesn't even try to cover their tracks before putting money straight in the bank. The funds are dirty, we can only speculate that curve may not want to touch these coins and is possibly figuring out how to "quarantine" them as there's every possibility that other "big boys" may follow Tether on blocking redemption. There are well-known methods of washing funds, so it's possible the "hacker" wasn't really all that experienced but somehow "stumbled" upon the keys to the vault, so to speak.

Pxtl 5y ago

I've said it before, I'll say it again: Crypto currency is about tearing down the old rules and institutions of banking and finding out one failure at a time why each rule and institution exists.

dumbfoundded 5y ago
In a larger sense, that's a general trend of "innovation". Social media is just advertising that avoided regulation by being on the internet. Now it's rediscovering why public broadcasting laws are necessary. The whole gig economy is rediscovering why workers' rights & protections were invented. AirBnB is rediscovering why zoning and safety standards were created for hotels. Nothing has really changed at all. Innovation seems more about inventing a way to do an old thing that feels new enough to avoid legal scrutiny until a company gets large enough and the public angry enough that laws create regulatory capture.
- jaytaylor 5y ago
  > Regulatory capture is an economic theory that regulatory agencies may come to be dominated by the interests they regulate and not by the public interest. The result is that the agency instead acts in ways that benefit the interests it is supposed to be regulating. I'm not sure if I am reading your comment correctly. Regulatory capture doesn't sound like a desirable thing, and wouldn't do the desired regulating. What did/do you believe the definition is?
  - jjkaczor 5y ago
    >Regulatory capture doesn't sound like a desirable thing It's not a desirable thing for the public - plenty desirable for industry... It worked out pretty well with Ajit Patel and the FCC... Or the CRTC and it's board members and adhoc meetings in bars/pubs with the telecom industry.
    - arcticbull 5y ago
      Ajit Pai right? Mr. Reese's Pieces Cup.

mdoms 5y ago

Is this the same clowns who got hacked a month ago? https://news.ycombinator.com/item?id=27664911 https://news.ycombinator.com/item?id=27664911

jl2718 5y ago

The contract is designed to execute arbitrary transactions with a valid signature. Hacker/insider got the private key. Simple as that.

jl2718 5y ago
Correction: it was a 3/4 multisig and it took 3 signatures to switch over to single-key. Who had those keys? No idea. Their white paper says nothing about key management, just a bunch of nonsense pseudo-notation about blockchain basics.

Clewza313 5y ago

Blocking tokens on exchanges, blacklisting addresses and threats of legal action? And silly old me thought that decentralized cryptocurrency was supposed to be the path of Freedom(tm) beyond all those centralized, coercive, fiat-like restrictions.

ineedasername 5y ago

The team behind Poly has "requested that hackers return stolen assets" I guess is doesn't hurt to ask? Not usually how doing a crime works though.

ourcat 5y ago

The funds are in the process of being returned: https://www.theblockcrypto.com/post/114189/poly-hack-attacker-return-funds-id-slowmist https://www.theblockcrypto.com/post/114189/poly-hack-attacke...

deleted 5y ago

[deleted]