8 ms·

$256M in ETH stolen from cross-chain protocol Wormhole

62 points by dylkil 5y ago

donsupreme 5y ago
Wormhole mainly focused on bridging in/out of Solana. Solana isn't having a good year to say the least.
ilamont 5y ago
This comes less than a week after an $80 million exploit involving Qubit finance (https://web3isgoinggreat.com?id=2022-01-30-1 https://web3isgoinggreat.com?id=2022-01-30-1), which is now begging whoever did it to "be a white hat" (https://twitter.com/QubitFin/status/1488809058526064640 https://twitter.com/QubitFin/status/1488809058526064640) while telling customers its "willingness to compensate." (https://twitter.com/QubitFin/status/1488339036448391168 https://twitter.com/QubitFin/status/1488339036448391168) My questions are: Are the majority of victims in both exploits ordinary small-scale traders, investors in the companies that operate/promote these services and protocols, or other entities? Is there any realistic hope to make the victims whole without the cooperation of the people responsible for the exploits?
- skulk 5y ago
  > realistic hope to make the victims whole without the cooperation of the people responsible for the exploits? This is exactly the problem that hundreds of independent groups of humans had faced throughout tens of thousands of years of history and to which all came up with the same solution: central authority.
  - errcorrectcode 5y ago
    The ledger is a central authority but with decentralized distribution. Central authorities can tell users what they can and can't do with their money, count their money, monitor, violate privacy, and impose sanctions, taxes, or trade restrictions on them.
    - skulk 5y ago
      I should have said "central authority for arbitration of disputes."
spookthesunset 5y ago
How is it possible to steal ETH? In ethereum code is law. If the code is valid, whatever gets executed is the truth. All bugs, processor errors, and everything else about the environment are part of that code and are thus part of law. There is no higher power for ethereum beyond the code. The people that transferred this wealth to their account are not thieves. They are not villains. They are smart people who saw a code path that resulted in a desirable outcome for themselves. Given both parties agreed that code is law, there is absolutely nothing unethical or immoral about what they did. They simply were more clever than the original holders of the ETH. They should be cheered on and rewarded for their smarts. Code is law. As long as the original people were not physically harmed or coerced out of their funds, they never got robbed. Their ETH was simply transferred to another party in accordance with the laws both parties agreed to. If what I say is wrong and code is not the law, than what is the point of ethereum at all? Might as well run on AWS or something.
- JumpCrisscross 5y ago
  > In ethereum code is law This is far from agreed upon.
  - quantified 5y ago
    The law is buggy, and Wild West banks that issue their own currency are rampant without a sheriff to handle misconduct. I wonder how many $B it will take to put into stable shape. Took a long time to create solid central banks whose currency could be widely trusted.
- rvz 5y ago
  > In ethereum code is law The DAO hack says otherwise. Defeating the point of 'decentralization' and 'permissionless blockchains'. > If what I say is wrong and code is not the law, than what is the point of ethereum at all? Might as well run on AWS or something. Exactly. Even when 44% of Ethereum Nodes are running on AWS. Amazon's own announcement defeats the whole purpose of decentralization again and the idea of 'code is law'. [0] [0] https://coinful.net/amazon-managed-blockchain-supports-ethereum/ https://coinful.net/amazon-managed-blockchain-supports-ether...
okwubodu 5y ago
The future of finance btw. I do think the exploiter takes the $10M deal. As it stands, attempting to cash any amount out is somewhere between very dumb and life-threatening.
- djanogo 5y ago
  $10M is a LOT, I wonder how he will trust them to pay. Once they get their coins back people can change minds.
  - okwubodu 5y ago
    Probably a bad time to say blockchain solves this, but spinning up a (very) basic swap contract is trivial. He doesn’t need to trust them.
    - errcorrectcode 5y ago
      So it's "ETH escrow" where the trusted third-party conducting the atomic swap of assets is the blockchain in the form of executing a contract?
      - okwubodu 5y ago
        Correct.
  - errcorrectcode 5y ago
    4% net is a terrible money laundering rate. Better to keep it and mix it slow than take the first marshmallow immediately and lose way more.
- skulk 5y ago
  Why life-threatening? Is Wormhole going to whack them or something?
  - galosh 5y ago
cyanydeez 5y ago
just because you can value cryptocurrency doesnt make its value any more real
nikolay 5y ago
Can get finally ban crypto, please? Thanks!
- randomhodler84 5y ago
  Nah mate, sorry. We won’t be doing any banning today.
  - nikolay 5y ago
    Then please stop bothering us with these specific to your kind non-issues (to us, at least)! I don't want to hear about them all day long as I stay away from this stinky pile and none of the hundreds of technologist I know wants to touch this with a ten-foot pole even or much less so - get involved in these scams and thefts. You have your own communities, so, please, stick to them and don't' pitch these Ponzi schemes to us everywhere! Well, obviously, nobody falls for them anymore, and there's no utility to sell them elsewhere, but, yeah, as any other pyramid scheme, you need a stable supply of stupid people to buy into the scheme. So, that's why you should be banned - otherwise, I would care less, but cut on the noise as it's really annoying and does not serve your self-serving, filthy, greedy goals! Do something meaningful with your lives! I know, there's no other way to buy child porn online except by using cryptos, but for any other earthly need, there are legit, faster, and cheaper payment methods!
    - randomhodler84 5y ago
      I think you need to wake up and see what is happening in your lifetime. Is this not hacker news? Is this not of interest to technologists? I think you must know a bunch of not very interesting technologists, because I know countless technologists who are deeply passionate about decentralized monetary systems. They think the kind that reject all new technology as luddites. Which is what you and the nocoiner are. And we don’t like luddites on hacker news, because we are hackers. Savvy? The wrong function call was made in a program, exposing it to a vulnerability that allowed a cryptographic validation bypass. That had economic consequences as hundreds of millions of dollars worth of collateral was now worthless. This is definitely of interest to hackers. If you ignore it the whole living on Solana blockchain thing, this Would be front page news in any cryptographic context.

62 points by dylkil 5y ago

Wormhole mainly focused on bridging in/out of Solana. Solana isn't having a good year to say the least.

This comes less than a week after an $80 million exploit involving Qubit finance (https://web3isgoinggreat.com?id=2022-01-30-1 https://web3isgoinggreat.com?id=2022-01-30-1), which is now begging whoever did it to "be a white hat" (https://twitter.com/QubitFin/status/1488809058526064640 https://twitter.com/QubitFin/status/1488809058526064640) while telling customers its "willingness to compensate." (https://twitter.com/QubitFin/status/1488339036448391168 https://twitter.com/QubitFin/status/1488339036448391168) My questions are: Are the majority of victims in both exploits ordinary small-scale traders, investors in the companies that operate/promote these services and protocols, or other entities? Is there any realistic hope to make the victims whole without the cooperation of the people responsible for the exploits?

skulk 5y ago
> realistic hope to make the victims whole without the cooperation of the people responsible for the exploits? This is exactly the problem that hundreds of independent groups of humans had faced throughout tens of thousands of years of history and to which all came up with the same solution: central authority.
- errcorrectcode 5y ago
  The ledger is a central authority but with decentralized distribution. Central authorities can tell users what they can and can't do with their money, count their money, monitor, violate privacy, and impose sanctions, taxes, or trade restrictions on them.
  - skulk 5y ago
    I should have said "central authority for arbitration of disputes."

spookthesunset 5y ago

How is it possible to steal ETH? In ethereum code is law. If the code is valid, whatever gets executed is the truth. All bugs, processor errors, and everything else about the environment are part of that code and are thus part of law. There is no higher power for ethereum beyond the code. The people that transferred this wealth to their account are not thieves. They are not villains. They are smart people who saw a code path that resulted in a desirable outcome for themselves. Given both parties agreed that code is law, there is absolutely nothing unethical or immoral about what they did. They simply were more clever than the original holders of the ETH. They should be cheered on and rewarded for their smarts. Code is law. As long as the original people were not physically harmed or coerced out of their funds, they never got robbed. Their ETH was simply transferred to another party in accordance with the laws both parties agreed to. If what I say is wrong and code is not the law, than what is the point of ethereum at all? Might as well run on AWS or something.

JumpCrisscross 5y ago
> In ethereum code is law This is far from agreed upon.
- quantified 5y ago
  The law is buggy, and Wild West banks that issue their own currency are rampant without a sheriff to handle misconduct. I wonder how many $B it will take to put into stable shape. Took a long time to create solid central banks whose currency could be widely trusted.
rvz 5y ago
> In ethereum code is law The DAO hack says otherwise. Defeating the point of 'decentralization' and 'permissionless blockchains'. > If what I say is wrong and code is not the law, than what is the point of ethereum at all? Might as well run on AWS or something. Exactly. Even when 44% of Ethereum Nodes are running on AWS. Amazon's own announcement defeats the whole purpose of decentralization again and the idea of 'code is law'. [0] [0] https://coinful.net/amazon-managed-blockchain-supports-ethereum/ https://coinful.net/amazon-managed-blockchain-supports-ether...

okwubodu 5y ago

The future of finance btw. I do think the exploiter takes the $10M deal. As it stands, attempting to cash any amount out is somewhere between very dumb and life-threatening.

djanogo 5y ago
$10M is a LOT, I wonder how he will trust them to pay. Once they get their coins back people can change minds.
- okwubodu 5y ago
  Probably a bad time to say blockchain solves this, but spinning up a (very) basic swap contract is trivial. He doesn’t need to trust them.
  - errcorrectcode 5y ago
    So it's "ETH escrow" where the trusted third-party conducting the atomic swap of assets is the blockchain in the form of executing a contract?
    - okwubodu 5y ago
      Correct.
- errcorrectcode 5y ago
  4% net is a terrible money laundering rate. Better to keep it and mix it slow than take the first marshmallow immediately and lose way more.
skulk 5y ago
Why life-threatening? Is Wormhole going to whack them or something?
- galosh 5y ago

cyanydeez 5y ago

just because you can value cryptocurrency doesnt make its value any more real

nikolay 5y ago

Can get finally ban crypto, please? Thanks!

randomhodler84 5y ago
Nah mate, sorry. We won’t be doing any banning today.
- nikolay 5y ago
  Then please stop bothering us with these specific to your kind non-issues (to us, at least)! I don't want to hear about them all day long as I stay away from this stinky pile and none of the hundreds of technologist I know wants to touch this with a ten-foot pole even or much less so - get involved in these scams and thefts. You have your own communities, so, please, stick to them and don't' pitch these Ponzi schemes to us everywhere! Well, obviously, nobody falls for them anymore, and there's no utility to sell them elsewhere, but, yeah, as any other pyramid scheme, you need a stable supply of stupid people to buy into the scheme. So, that's why you should be banned - otherwise, I would care less, but cut on the noise as it's really annoying and does not serve your self-serving, filthy, greedy goals! Do something meaningful with your lives! I know, there's no other way to buy child porn online except by using cryptos, but for any other earthly need, there are legit, faster, and cheaper payment methods!
  - randomhodler84 5y ago
    I think you need to wake up and see what is happening in your lifetime. Is this not hacker news? Is this not of interest to technologists? I think you must know a bunch of not very interesting technologists, because I know countless technologists who are deeply passionate about decentralized monetary systems. They think the kind that reject all new technology as luddites. Which is what you and the nocoiner are. And we don’t like luddites on hacker news, because we are hackers. Savvy? The wrong function call was made in a program, exposing it to a vulnerability that allowed a cryptographic validation bypass. That had economic consequences as hundreds of millions of dollars worth of collateral was now worthless. This is definitely of interest to hackers. If you ignore it the whole living on Solana blockchain thing, this Would be front page news in any cryptographic context.