9 ms·
Beanstalk Farms stablecoin project loses $182M to exploit
- nathanaldensr 4y agoJust another day in cryptoland.
- elektor 4y agoAnother day, another collapse of a cryptocurrency.
- hesdeadjim 4y agoYou know it’s bad when a loss this large isn’t surprising or interesting in the slightest.
- sparksparkapach 4y agoShould be the opposite, this is not even 1/10th of 1 percent of what's stored in defi. This shouldn't even be huge news. I don't even see any links to bug bounties on their site.
- _fizz_buzz_ 4y agoHa, imagine 0.1% of all USD got stolen in one swoop.
- MR4D 4y agoInteresting thought… Based on current US inflation rates, that’s about 4 days worth of inflation. So, you could probably blame the Fed for “stealing” that much in one swoop.
- imtringued 4y agoI don't know why people keep blaming the fed for everything. It is one of the least powerful and most irrelevant institutions on the planet.
- MR4D 4y ago> It is one of the least powerful and most irrelevant institutions on the planet. And how do you come to that conclusion?
- himinlomax 4y agoA loss of 0.1% of all the money NOT stored in crypto would be huge news.
- cinntaile 4y agoThis reminds me of the "If my grandma had wheels, she would be a bike." meme. Yes but that is irrelevant. It is unfortunate this happened of course, proper security audits of your smart contracts is very important in cases like these.
- cinntaile 4y agoI should know better than to comment in crypto threads, the "discussions" are rarely interesting. Here's the meme, you'll understand why it's so fitting. There's probably a more proper name for this type of fallacy but I don't know it. https://youtu.be/A-RfHC91Ewc https://youtu.be/A-RfHC91Ewc
- travisjungroth 4y agoIt’s not fitting. The comment you replied to is a pretty clear rebuttal.
- cinntaile 4y ago0.1% of all non crypto money stolen is not comparable to 0.1% stolen of defi locked up money. They're just too different. I think both are "huge" news, but the "rebuttal" does not add any weight to the argument because they're not comparable.
- travisjungroth 4y ago> they're not comparable. Yes, they are. Things don’t have to be the same to be comparable. People compare them all the time and very reasonably so. “Should I put my money into traditional finance or defi? What are the pros/cons?” An axis that should be compared when choosing a finance system is “how likely is my money to disappear?”. A single event where an amount of money that’s this fraction of the overall system and this much value is a newsworthy, meaningful, relevant, comparable event.
- stephencanon 4y agoA $182M bug bounty was just claimed.
- oliwarner 4y agoIt's news that a life-changing volume of cash can get hacked away from your wallet and just vanish. It's not better that there's actually a planet-changing volume elsewhere in similar jeopardy. We should be howling about the anti-features baked into these things that enable criminal enterprise.
- Eddy_Viscosity2 4y agoA loss to some, but a huge win for the ones who took the money. The crypto evangelists should start promoting this aspect of the space: "It isn't really stealing if the code was bad!"
- aaaaaaaaata 4y agoOnly 13,000 to go
- smrtinsert 4y agoGreat site. Bookmarking
- gizajob 4y agoUnstablecoin
- nullc 4y agoThe great ethereum meta-scam is continuing to perform exactly as designed.
- deleted 4y ago[deleted]
- onion2k 4y agoI wonder if this will turn out to be North Korea as well.
- deleted 4y ago[deleted]
- ohmanjjj 4y agoAnother “hack”
- formvoltron 4y ago"exploit"
- optimalsolver 4y agoExploit, or exit scam?
- px43 4y agoThe fact that this dude literally sold millions of dollars of magic beans, which made the beanstalk, which suddenly disappeared, has got to be at least a little suspicious. It was a super basic flash loan oracle manipulation, which could have been done by anyone, so it probably was just another Waterloo kid finding their fortune, but really, who are these people who dumped millions of dollars into magic beans?
- MisterSandman 4y agoAs someone from Waterloo, this is a very weird reputation our university is getting.
- js4ever 4y agoThe more I read news about crypto the more I believe they delivered none of the promises (high transaction fees, slow, burning a lot of resources for nearly nothing) and bringing more problems
- matheusmoreira 4y agoMonero is the closest to the original cryptocurrency dream. Enforced privacy, low transaction fees, fast transactions, mining viable on commodity hardware. I've gotten paid via XMR, it works great. Too bad nobody seems to care much about it because the numbers don't go up.
- criddell 4y agoDoes it beat Visa on transaction speed and fees?
- charcircuit 4y agoVisa can take a few days to settle where with Monero you will typically want to wait for 10 confirmations which takes 20 minutes. Visa's fees are 1.4%-2.5% for the merchant where Monero's median fee over the last 100 transactions was $0.002.
- thawaya3113 4y agoHow much does it cost to convert that to US dollars? And what is the half life value before that money ends up disappearing because of a hack, wallet mismanagement, or a straight up scam, or ending up being seized by the FBI? Considering the ridiculously large percentage of Bitcoin that belongs either to the FBI or Mt Gox scammers, and the massive number of other scams in crypto, I bet once you adjust for those factors the value will be minuscule.
- capableweb 4y ago> How much does it cost to convert that to US dollars? Not sure how that's comparable to Visa, Visa doesn't handle conversations at all between different types of currencies (you can't convert USD to BTC with Visa for example). It all happens via 3rd parties, just like with cryptocurrencies, so it depends on the 3rd party more than anything else. > And what is the half life value before that money ends up disappearing because of a hack, wallet mismanagement, or a straight up scam, or ending up being seized by the FBI? Neither of those things have happened to Monero, and since the project is relatively old (for the cryptocurrency space at least), it seems safe to say that they generally know what they are doing, or we'd seen more hacks. I think the original claim still seems right. Monero both settles faster and has lower fees (depending on the amount for the Visa transaction obviously, as it's percentage based, while Monero as a "flat fee" [based on network activity]).
- louwrentius 4y agoAfter thirteen years this is what crypto gives us. A few people get rich at the cost of all the rest. From coins getting hacked/stolen to ransomware, to just cryto-gambling. But there is something positive to say about crypto too. The failings of crypto teach a lot of people about how and why societies work the way they do. And that no amount of tech can ever replace our institutions and human trust. I'm 100% with Stephen Diehl on this one: the entire 100% of crypto needs to be burned down to the ground. It needs to go because of the enormous harm it does to people and our larger society, for no gains at all.
- JacKTrocinskI 4y agoEvery investment has risks, stocks are not that different from crypto in that regard. Regulation, once it comes, will help better protect retail investors. Crypto is still in the early stages, the technology is revolutionary though and I think it's here to stay.
- 1270018080 4y agoThere is truly nothing revolutionary about an extremely inefficient write once read many linked list.
- josu 4y ago>After forty years this is what the internet gives us. A few people get rich at the cost of all the rest. Sure, if you want to focus on the negative you can focus on the negative.
- deleted 4y ago[deleted]
- tonguez 4y ago“100% of crypto needs to be burned down to the ground. It needs to go because of the enormous harm it does to people and our larger society, for no gains at all.” well you’ve convinced me
- 4y ago
- charcircuit 4y agoThis tweet thread explains what happened: https://twitter.com/FrankResearcher/status/1515693895887294466 https://twitter.com/FrankResearcher/status/15156938958872944... The key step was: "Further, they deployed and voted for a fake BIP-18 that moved all funds from the protocol contract to the exploiter."
- josu 4y agoWhat does "fake" mean in this context? Malicious? Or that the attacker made it look like a BIP so it would get executed? Or something completely unrelated? EDIT: More context here https://twitter.com/peckshield/status/1515692144190648322/photo/1 https://twitter.com/peckshield/status/1515692144190648322/ph...
- charcircuit 4y agoMy guess is that it just means it isn't from https://github.com/BeanstalkFarms/Beanstalk/tree/master/bips https://github.com/BeanstalkFarms/Beanstalk/tree/master/bips
- the_mitsuhiko 4y agoLovely that loan providers legally? benefit from criminals in the crypto world.
- charcircuit 4y agoSo do the people in the liquidity pools, so do the miners, and probably a few more groups of people.
- x86_64Ubuntu 4y ago>...However, they were later slightly more optimistic, writing, "it may also be the start of something good... there may be a path forward. We don't want to comment on next steps until that path is at least visible to us" How on earth can people just shake off a loss of $182MM? And is this one of those contracts? Have the courts ruled that code is law, and that a poorly implemented and exploitable contract is legal? There is so much wrong with this.
- JacKTrocinskI 4y agoThe same way Wallstreet does.
- thawaya3113 4y agoWall Street “shakes off” losses with massive Congressional investigations, new laws, people jumping out of skyscraper windows, new rules and regulations that greatly limit what they can do. None of that happens with crypto, which has lost more money in scams than Wall Street has in a decade, despite being a fraction of the size of Wall Street.
- cyanydeez 4y agoWealth inequality
- deleted 4y ago[deleted]
- grumpymouse 4y agoIt would be interesting to create a cryptocurrency where transactions take an additional time to settle based on amount from the time the transaction is requested. $20k? No delay other than getting the transaction through the mining pools or whatever. $500k? Maybe an hour to settle. $1m+? That’s going to take a day (in which time big red warning lights can flash on your defi project wall boards).
- Georgelemental 4y agoInstead of one large transaction, l33t haxx0r can just make plenty of small ones
- nullc 4y agoIt's not hard to set in delays yourself if you want them. You're missing the point though: these defi systems are mostly scams right out of the gate. They're designed to be exploitable by their creators. They're also designed so that the exploits are plausibly denyable-- so while we can look at the long long list of anonymous created defi ponzis that vanish with everyone's funds via similar attacks we can conclude that many were intentionally designed that way-- attributing it for any specific one is challenging.
- EL_Loco 4y agoMaybe your money is pretty safe in your bank. My dad worked for 40+ years and paid every month his pension fund dues. When his company (a very big and old company in our country) went bankrupt, it was found that the pension fund was broke. They had been using money from the pension fund to cover whatever they had to cover due to corruption, bad administration, etc (it was illegally done so, by the way). Not only that, but the government knew about this, since it was a really, really big pension fund, and had stepped in as pension administrator for the past six or seven years. Didn't matter. The pension broke, the company broke, my dad and thousands of others were left without their retirement pay. This is not some outrageous story over here. It was so normal that it didn't make any headlines. Two years ago postal workers have started to take a pay cut to cover a hole in their pension fund. The mail here is state owned, by the way, and it didn't matter. The directors took their money, the workers had to pay up. I did my research, I wouldn't put money in Beanstalk Farms, or 99% of cryptocurrencies, but there are couple, two or three, crypto projects that I know are legitimate and secure, and I trust them more than the banks I have access to.
- verall 4y agoThere is an interesting false equivalence here between pension funds and banks. But it's a personal annecdote, so really it's up to you what made you lose faith in "the system".
- EL_Loco 4y agoI know they're not equivalent. But banks have broken here too, and people lost a lot of their money. By the way, credit card interest here is over 300% annually. Can get up to 800 depending on the bank.
- x-complexity 4y ago> There is an interesting false equivalence here between pension funds and banks. The dissimilarity of pension funds & banks is present, and so there's no opposition to that objection. > But it's a personal annecdote, so really it's up to you what made you lose faith in "the system". I'll admit my pro-crypto stances upfront, but the anti-crypto stance of "Oh it's just your opinion that 'the system' messed up" is highly non-conducive when it comes to getting people out of crypto & trusting the current financial system once again. To those people, their rightfully legitimate concerns of corruption, non-transparency, & failure to even partially repay the funds lost are dismissed as 'anecdotal', much like the concerns of every privacy-concerned individual before Snowden's leaks were made public. To that end, verall, your dismissal of the parent's experiences as anecdotal will sour the opinions of the concerned & cause them to dig in their heels even further. It does not help alleviate their concerns, nor does it help in re-establishing trust. With regards to the actual improvements that I would like to see implemented in the current financial system, the creation of a triple-ledger accounting system [1] where transactions are anonymized-but-traceable would help a long way in re-establishing trust in the current financial system. The 3rd party in this picture wouldn't even need to be a blockchain: It would just need to be a neutral 3rd party that would make transactions on the aforementioned ledger transparent to the general public. [1] https://www.simpleaccounts.io/tag/tripleentrysystem/ https://www.simpleaccounts.io/tag/tripleentrysystem/
- technonerd 4y agoThe anonymity set of tornado cant be that good can it? With all these major hacks dumping their eth into it.
- capableweb 4y agoSeems "good enough" to me. Currently it's 123430 deposits in total that are inside tornado. The risk is that exchanges will "taint" any ETH that has been passes through there, even if you could prove it's legal income.
- capableweb 4y agoTechnical description of what happened instead of the (current submissions) focus on monetary losses: https://medium.com/@omniscia.io/beanstalk-farms-post-mortem-analysis-a0667ee0ca9d https://medium.com/@omniscia.io/beanstalk-farms-post-mortem-... Summary: > flash-loan attack due to a flaw in its newly introduced Curve LP Silos that compromised the protocol’s governance mechanism, ultimately permitting the attacker to conduct an emergency execution of a malicious proposal siphoning project funds