3 ms·

Just to preempt the usual HN misconceptions. There are lots of crypto projects who have never been hacked - Compound, Balancer, AAVE - etc. Banks need top gra

Just to preempt the usual HN misconceptions. There are lots of crypto projects who have never been hacked - Compound, Balancer, AAVE - etc. Banks need top grade security, and making a bank in crypto is hard. Because of the absence of regulation, what you’re getting right now is a lot of DeFi projects that are poorly secured. You take the risk you’re willing to take really.

raesene9 5y ago
The problem with crypto users "taking the risk they're willing to take" is that there's very little reliable information about which projects have better security than others. Every project will say that they have great security, but without external validation or regulation, how do you know which of them are mistaken or outright lying.
- kranke155 5y ago
  There are audits that most projects do with crypto auditing software firms. These are usually announced publicly. That gives you some credibility in the space. IMO security just comes from time spent operating vs amount of hacks. If you've been operating for a couple of years with no known hacks then I trust the team behind the project.
  - raesene9 5y ago
    audits are a signal for sure, but can an end-user tell a good audit from a bad audit? Also as monox (who got hacked this week) shows 3 audits this year are no guarantee https://docs.monox.finance/library/audits https://docs.monox.finance/library/audits
    - awr 5y ago
      no audit's going to pick up every possible issue or potential exploit, but it does help weed out the obvious scams. The entry to creating your own token is so low that people with little to no coding experience are attempting to add/modify functionality. Community insistence to get audited is useful to pick up on these.
    - kranke155 5y ago
      I don't know those companies. There are only a few companies I'd trust with crypto audits.
- nraf 5y ago
  We're working on solving this problem. We've just launched our platform, starting with DeFi tokens (what you could call the Wild West of Crypto): https://app.agentsinu.com/bsc/tokens https://app.agentsinu.com/bsc/tokens If you're interested, here's an overview of the honeypot scam (common with DeFi tokens) and how we're helping alert users to it: https://agentsofinu.medium.com/the-honeypot-scam-what-is-it-and-how-to-avoid-6e089fed4cd2 https://agentsofinu.medium.com/the-honeypot-scam-what-is-it-...
ygjb 5y ago
I mean, it's been a minute (well, actually a bit more than a decade) since I worked in finance, but I don't think I would characterize banks as having top grade security. More like 'barely meets the threshold for compliance with regulations and laws if you glance sideways at it through a foggy pane of glass' security. While most do have adequate security, many banks are self-insuring for several classes of risk, including several that self-insure for cybersecurity issues. They depend heavily on support from LEOs, centralization of clearing operations, and established norms on how to interact with each other through ISACs and other industry associations - something that cryptocurrency and decentralized finance currently lack.
Tenoke 5y ago
This is true but COMP has had exploits and their CEO also begged its users to send funds back last time it happened while threatening to doxx them[0] so perhaps not the best example. Your overall point is valid though, and it's not like it happens just in crypto - e.g. this paypal auth hack is not too disimilar and that's a much bigger company[1]. 0. https://decrypt.co/82387/defi-community-blasts-compound-ceo-for-doxxed-comment https://decrypt.co/82387/defi-community-blasts-compound-ceo-... 1. https://www.consumeraffairs.com/news/paypal-hackers-are-targeting-users-log-in-information-to-access-their-accounts-022420.html https://www.consumeraffairs.com/news/paypal-hackers-are-targ...
- kranke155 5y ago
  Sounds like a rookie mistake, but haven't there been cases of banks sending people money they shouldn't have? This sounds like a bug, not an exploit.
kingaillas 5y ago
>There are lots of crypto projects who have never been hacked Cyclists have a saying: there are two kinds of cyclists, ones that have crashed, and ones that are going to crash. I think crypto exchanges can be similarly partitioned: there are two kinds of crypto exchanges, ones that have been hacked, and ones that are going to be hacked. It's just ideal conditions: lots of money, software, no regulation/oversight, anonymous criminals.
iszomer 5y ago
Orly? Rekt.news has some juicy details.. https://rekt.news https://rekt.news

raesene9 5y ago

The problem with crypto users "taking the risk they're willing to take" is that there's very little reliable information about which projects have better security than others. Every project will say that they have great security, but without external validation or regulation, how do you know which of them are mistaken or outright lying.

kranke155 5y ago
There are audits that most projects do with crypto auditing software firms. These are usually announced publicly. That gives you some credibility in the space. IMO security just comes from time spent operating vs amount of hacks. If you've been operating for a couple of years with no known hacks then I trust the team behind the project.
- raesene9 5y ago
  audits are a signal for sure, but can an end-user tell a good audit from a bad audit? Also as monox (who got hacked this week) shows 3 audits this year are no guarantee https://docs.monox.finance/library/audits https://docs.monox.finance/library/audits
  - awr 5y ago
    no audit's going to pick up every possible issue or potential exploit, but it does help weed out the obvious scams. The entry to creating your own token is so low that people with little to no coding experience are attempting to add/modify functionality. Community insistence to get audited is useful to pick up on these.
  - kranke155 5y ago
    I don't know those companies. There are only a few companies I'd trust with crypto audits.
nraf 5y ago
We're working on solving this problem. We've just launched our platform, starting with DeFi tokens (what you could call the Wild West of Crypto): https://app.agentsinu.com/bsc/tokens https://app.agentsinu.com/bsc/tokens If you're interested, here's an overview of the honeypot scam (common with DeFi tokens) and how we're helping alert users to it: https://agentsofinu.medium.com/the-honeypot-scam-what-is-it-and-how-to-avoid-6e089fed4cd2 https://agentsofinu.medium.com/the-honeypot-scam-what-is-it-...

ygjb 5y ago

I mean, it's been a minute (well, actually a bit more than a decade) since I worked in finance, but I don't think I would characterize banks as having top grade security. More like 'barely meets the threshold for compliance with regulations and laws if you glance sideways at it through a foggy pane of glass' security. While most do have adequate security, many banks are self-insuring for several classes of risk, including several that self-insure for cybersecurity issues. They depend heavily on support from LEOs, centralization of clearing operations, and established norms on how to interact with each other through ISACs and other industry associations - something that cryptocurrency and decentralized finance currently lack.

Tenoke 5y ago

This is true but COMP has had exploits and their CEO also begged its users to send funds back last time it happened while threatening to doxx them[0] so perhaps not the best example. Your overall point is valid though, and it's not like it happens just in crypto - e.g. this paypal auth hack is not too disimilar and that's a much bigger company[1]. 0. https://decrypt.co/82387/defi-community-blasts-compound-ceo-for-doxxed-comment https://decrypt.co/82387/defi-community-blasts-compound-ceo-... 1. https://www.consumeraffairs.com/news/paypal-hackers-are-targeting-users-log-in-information-to-access-their-accounts-022420.html https://www.consumeraffairs.com/news/paypal-hackers-are-targ...

kranke155 5y ago
Sounds like a rookie mistake, but haven't there been cases of banks sending people money they shouldn't have? This sounds like a bug, not an exploit.

kingaillas 5y ago

>There are lots of crypto projects who have never been hacked Cyclists have a saying: there are two kinds of cyclists, ones that have crashed, and ones that are going to crash. I think crypto exchanges can be similarly partitioned: there are two kinds of crypto exchanges, ones that have been hacked, and ones that are going to be hacked. It's just ideal conditions: lots of money, software, no regulation/oversight, anonymous criminals.

iszomer 5y ago

Orly? Rekt.news has some juicy details.. https://rekt.news https://rekt.news