3 ms·

No monitoring whatsoever over $600M of funds stored in your system is crazy negligent.

UncleMeat 5y ago
It isn't like monitoring would have done anything. Once the transaction goes out it is gone. The core problem here is the massive private-key bounty being created by a ton of organizations that don't have world-class security teams.
- parkingrift 5y ago
  True, but you would think they’d notice $650,000,000 missing before a user reported an issue withdrawing $5,000 (edit - 5k ETH). It’s honestly so impossible to believe that I’d wager the real story is they knew and were actively trying to recover the funds.
  - zkldi 5y ago
    just a poke: it was 5K Eth ($16,924,050), not 5K USD, but i agree with your wager.
    - parkingrift 5y ago
      Ah right you are. Misread the article.
    - mrep 5y ago
      God damn, 17 million stolen forever from 1 person and there is nothing they can do about it.
      - cowvin 5y ago
        Even more shocking, is why someone would hand 17 million dollars worth of assets to a random company that has no security apparently.
- weare138 5y ago
  But the attacker used 2 transactions. The first one should have been flagged immediately. Plus the servers themselves were compromised. Four of them. The attacker was able to take control of 4 different servers without even being noticed. This is just one massive secops fail.
- hotpotamus 5y ago
  Yeah, I'm just picturing a Graphana chart going from $625M to $0. And then admins sitting around like, OK, now what?
tomatowurst 5y ago
Or malicious...similar to the DAO hack from 2017 suspected of being an inside job (with evidence pointing to the insider who lawyered up to refute it with code-is-law argument), somebody was accountable for security and they deemed it not worth it to secure it. Axie Infinity was already struggling, and this happens a day or two away from scheduled distribution of rewards & update release. Cui bono? Who could've known they were carrying funds in a hot wallet other than the people directly involved with the project? Unless there was a way to discover this from the outside? Somebody at Axie Infinity could have been asking whether they want to get paid 0.025% of that hot wallet yearly or have it all up front, today. After all it isn't cash sitting at a bank they have to rob.
- jazzyjackson 5y ago
  Agreed, the system was designed to say "oops, we lost all of your money, how could this have happened"

It isn't like monitoring would have done anything. Once the transaction goes out it is gone. The core problem here is the massive private-key bounty being created by a ton of organizations that don't have world-class security teams.

parkingrift 5y ago
True, but you would think they’d notice $650,000,000 missing before a user reported an issue withdrawing $5,000 (edit - 5k ETH). It’s honestly so impossible to believe that I’d wager the real story is they knew and were actively trying to recover the funds.
- zkldi 5y ago
  just a poke: it was 5K Eth ($16,924,050), not 5K USD, but i agree with your wager.
  - parkingrift 5y ago
    Ah right you are. Misread the article.
  - mrep 5y ago
    God damn, 17 million stolen forever from 1 person and there is nothing they can do about it.
    - cowvin 5y ago
      Even more shocking, is why someone would hand 17 million dollars worth of assets to a random company that has no security apparently.
weare138 5y ago
But the attacker used 2 transactions. The first one should have been flagged immediately. Plus the servers themselves were compromised. Four of them. The attacker was able to take control of 4 different servers without even being noticed. This is just one massive secops fail.
hotpotamus 5y ago
Yeah, I'm just picturing a Graphana chart going from $625M to $0. And then admins sitting around like, OK, now what?

tomatowurst 5y ago

Or malicious...similar to the DAO hack from 2017 suspected of being an inside job (with evidence pointing to the insider who lawyered up to refute it with code-is-law argument), somebody was accountable for security and they deemed it not worth it to secure it. Axie Infinity was already struggling, and this happens a day or two away from scheduled distribution of rewards & update release. Cui bono? Who could've known they were carrying funds in a hot wallet other than the people directly involved with the project? Unless there was a way to discover this from the outside? Somebody at Axie Infinity could have been asking whether they want to get paid 0.025% of that hot wallet yearly or have it all up front, today. After all it isn't cash sitting at a bank they have to rob.

jazzyjackson 5y ago
Agreed, the system was designed to say "oops, we lost all of your money, how could this have happened"