13 ms·

$570M worth of Binance’s BNB token stolen

156 points by labarilem 4y ago

throwoutway 4y ago
What tech is a cross-chain bridge? Is it code running on the Ethereum chain or something else?
- helen___keller 4y ago
  cross chain bridges, from my understanding, are layer 2 protocols that live on 2 chains at once using validators. Basically, you have nodes staking coins on both chains and they attest that the coins coming out of one side of the bridge are matched by coins going in the other side of the bridge So for example you send some $FOO tokens to a contract on the ethereum side then get out $WFOO (wrapped foo) tokens from a contract on another chain. I've been interested in these protocols for a while as a possibility of making crypto actually scalable and not a pyramid scheme (basically, imagine a network of interoperable chains powered by stable tokens like USDC, and using inter-chain protocols to transfer USDC between them as needed for load balancing). That said, reality hasn't quite met my expectations, not yet anyways.
  - p4bl0 4y ago
    What makes a blockchain necessary is having both decentralization and generalized distrust as hard assumptions. How do you manage not having to trust the bridges in such scenarios?
    - helen___keller 4y ago
      the bridges operate on the same general principle as proof of stake (mutual distrust of nodes through a protocol that involves staking coins) The difference of course, is that if there's a flaw in proof of stake generally it means one person might control transaction flow and collect some transaction fees; if there's a flaw in a bridge then someone prints money and destroys bridge ecosystem
      - smoldesu 4y ago
        > the bridges operate on the same general principle as proof of stake Quick amendment here - most of the bridges operate on these principles. There are hundreds of cryptocurrencies, trading pairs and L2 chains that have zero accountability whatsoever. It's not written anywhere that these bridges have to operate without trust, and many of them straight-up don't.
      - p4bl0 4y ago
        Proof of stake comes with a number of issues but let's put that apart. PoW and PoS are means to achieve distributed consensus. It works for cryptocurrencies because writings to the blockchain are performative (what's written is true because the act of writing it makes it true). This can only work inside a given blockchain and only for its own cryptocurrency. Which means it cannot be used to ensure anything that happens outside that blockchain. In particular all blockchain usage for certifications, traceability, of NFT-like things are essentially nonsensical. Similarly, I don't see how it could work for writings that happens on other blockchains. Whatever is written on blockchain A cannot be considered true in blockchain B without breaking the security model of blockchain B by making blockchain A a trusted third-party. Where does a distributed consensus mechanism comes into play here? Maybe it would be clearer with an example? Let's say someone wants to move X tokens from blockchain A to blockchain B, and that at the time of the move, X A-tokens are equivalent to Y B-tokens (trusting the exchange rate in itself is all another problem, but let's put it aside). How would that go?
        helen___keller 4y ago
        > Whatever is written on blockchain A cannot be considered true in blockchain B without breaking the security model of blockchain B by making blockchain A a trusted third-party. To be more specific, when I said "like proof of stake", what I meant is that there's a trusted pool of validators but the individual validators are not assumed to be trustworthy (only the pool in aggregate), and the validators use a adversarial staking model to punish dishonesty. In the case of bridges, that pool is external to the chain. So yes, there is external trust happening. I'll try to address your example, but I've researched this a while ago so I'm sure I could be off the mark. For your example, lets say we're moving A-token in A-chain to wrapped A-tokens in B-chain, so we can easily assume it's a 1:1 exchange rate by construction. User moves 100 A-tokens in A-chain to a bridge smart contract and as data passes the address of their B-chain wallet. A subset of validators in the trusted pool (chosen via some distributed protocol) together sign a multi-sig transaction that authorizes the bridge contract in B-chain to mint 100 wrapped A-tokens and send 99.9 of them to the destination address that the bridging user, and collect 0.1 of them as fee. (If transaction were dishonest, a larger subset of validators would together sign a transaction purging those validators' stake in the pool; so the subset of validators chosen are honest out of desire to keep their staking capital and earn the 0.1 fee) That's at a high level how it works. If you want the full details I recommend finding a technical writeup for a popular trustless bridge.
knrz 4y ago
samczun has a thorough Tweetthread explaining how this hack worked, if you’re looking to dive deep into the nerdy rabbit hole https://twitter.com/samczsun/status/1578167198203289600?s=46&t=5mWGgmZF7JY8JdrQy2f_iQ https://twitter.com/samczsun/status/1578167198203289600?s=46...
- beoberha 4y ago
  he is often the first person to debug hacks. Such an incredibly great mind.
  - deleted 4y ago
    [deleted]
- MuffinFlavored 4y ago
  I read the thread and I still don't get it. They had a bug in some Go code that a lot of people were running? Does anybody have a GitHub commit to the fix Binance is working on rolling on out? https://coinmarketcap.com/currencies/bnb/ https://coinmarketcap.com/currencies/bnb/ How did it not drop more?...
deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
yborg 4y ago
So how does one launder a half-billion dollar heist like this? Asking for a friend.
- ZiiS 4y ago
  In a non-fiat system why would you need to?
  - Railsify 4y ago
    To get a currency that you can pay taxes with, or buy traditional securities.
  - toss1 4y ago
    If it is totally non-fiat, where you can buy housing, food, fuel, devices, luxury items, etc., etc., etc., you would not need to cash out to fiat. But seriously, in the current world, if we have a half-billion dollars "worth" of legitimate (or laundered) cryptocurrency, what can you do with it in the real world, especially contrasted to what we can do easily if we have a $$half-billion in legit $, €, £, or ¥ deposits? I don't think we could even buy a Tesla or a pizza anymore. Maybe some things on Craigslist that take crypto?
    - maupin 4y ago
      A quick Google search finds that (it is claimed anyway) you can buy quite a few items from Amazon or Walmart at shopping.io
    - from 4y ago
      Go on Alibaba and you will find that a surprising number of companies take BTC or USDT. The next step in the laundering process is fairly obvious.
- intunderflow 4y ago
  I would assume they'll try and push as much value into a currency that's meant to be untraceable (such as Monero or Zcash), move the money around a few wallets for safety, then start drip feeding to exchanges and claiming they got into the currency early by mining and are cashing out. At least if I was going to risk a heist like this it's roughly what I would do.
lm28469 4y ago
This is good for bitcoin
cersa8 4y ago
These bridges seem to be the weakest links in crypto.
- jongjong 4y ago
  This is because such bridges rely on proofs derived from other blockchains over which validators have no visibility. These add a huge amount of complexity and increase the attack surface. Simpler bridges such as capitalisk-dex https://github.com/Capitalisk/capitalisk-dex https://github.com/Capitalisk/capitalisk-dex (written with only 5K lines of code including dependencies) have a lot smaller attack surface. The principle behind it is to rely on the security of underlying blockchains instead of adding a separate proof mechanism on top; DEX validator nodes have direct visibility over participating blockchains and work directly with on-chain data so they can verify everything directly using each blockchain's native cryptographic clients.
  - kirse 4y ago
    Isn't this the purpose behind tech like State Proofs on the Algorand network, i.e. trustless cross-chain activity is basically solved at this point + deprecates the need for any intermediary trusted bridges: https://medium.com/algorand/algorand-state-proofs-707d64038e35 https://medium.com/algorand/algorand-state-proofs-707d64038e... https://developer.algorand.org/docs/get-details/stateproofs/ https://developer.algorand.org/docs/get-details/stateproofs/
    - jongjong 4y ago
      There is no silver bullet, every approach has benefits and drawbacks. One of the drawbacks of the Algorand approach is that both participating blockchains involved a swap need to be aware of each other's block signers/validators in order to be able to verify each other's proofs. These validator lists need to be kept up to date on both blockchains and this adds performance costs (since block validators can change over time). A blockchain which serves as a hub for many other blockchains (such as the Algorand mainchain) would have to keep track of the state of validators on many different blockchains. Recurring fees need to be paid in order to keep track of validator lists. This is not suitable for low-volume markets with low fees since trading fees need to be sufficient to cover the ongoing blockchain fees. The Algorand approach is only suitable for certain blockchains where the block validator list is relatively stable and predictable, it's not suitable for a broad range of consensus mechanisms including proof of work. With Algorand, the proof-generation Algorithm should ideally be baked into the blockchain consensus mechanism (this adds complexity and performance costs/fees to the blockchain). Aside from having the proof algorithm baked into the blockchain's code, the alternative approach is to have a separate federation of 'proof validators' on each chain which are distinct from block validators... This setup has essentially the same security characteristics as a standard multi-chain federated bridge (whose validators have visibility over both participating blockchains) except it has more complexity (risk/attack surface). The benefit of the Algorand approach (assuming that the proof-generation is baked directly into the blockchain logic) is that it offers the maximum degree of decentralization (which matches that of the underlying blockchains). Though this is at the cost of higher fees. Markets based on it would have to have good volume in order to make it viable. Finally, in practice, most smart contracts are controlled and can be updated by certain multisig wallets (and their members) so they're really just federations behind the scenes.
FabHK 4y ago
Who was the victim? Were additional BNB minted? So everyone (every holder of BNB, that is) suffered some loss through inflation in proportion to their holding, theoretically?
- yieldcrv 4y ago
  no victims just a slight supply inflation (binance smart chain deflation is greater than this over any month time span), about $80 million was successfully moved to censorship resistant blockchains but as they ran out of liquidity they had to move into censorable stablecoins, which were frozen for their addresses all validators on binance smart chain disabled all block production and have subsequently updated to freeze the minting function and also disable the hacker's address
glofish 4y ago
Crypto losses always remind me of Kramer and Jerry talking about losses. - Not a problem. It is a write-off for them. - How is it a write-off? - All these big companies do it - they just write it off! - Write what off? You don't even know what a write-off is! - Maybe I don't but they do. And they are the ones writing it off! https://www.youtube.com/watch?v=XEL65gywwHQ https://www.youtube.com/watch?v=XEL65gywwHQ
- masterof0 4y ago
  I missed Kramer. And yes, they will probably "write it off", I wonder if only BNB is going to be affected or if their stacking platform is also halted.
- eloff 4y ago
  Crypto really is a golden age of opportunity for hackers. When else in history could you rob a bank anonymously from your mom's basement for $570M. Cashing it out without getting caught is a little on the tricky side, but not impossible, especially if you live in, or cash it out in an untouchable jurisdiction like Russia.
  - masterof0 4y ago
    Cashing it out all at once , yeah, other wise is not too bad, you could use online casinos, coin mixers, fake businesses, NFTs, etc...
  - nostrademons 4y ago
    It's even better if in the future crypto becomes legitimate. Then you just have a pile of ill-gotten gains that you can use as ordinary money. Huge fortunes have been built this way, notably Gould and Kennedy.
    - lampshades 4y ago
      The Godfather movies showed this method of legitimatization well.
hamiltonians 4y ago
none of these people ever get arrested or caught. perfect crime
- datalopers 4y ago
  is it a crime or is it working as intended? code is law after all.
- avrionov 4y ago
  Some of them of caught and arrested: https://en.wikipedia.org/wiki/2016_Bitfinex_hack https://en.wikipedia.org/wiki/2016_Bitfinex_hack
matthewaveryusa 4y ago
Changpeng "there's also a few more votes regarding how the hacked funds should be handled will be voted by the community" Oh I see how this works now
NikolaNovak 4y ago
I have an ignorant question, which will demonstrate my ignorance of both crypto and fiat. Was money "Stolen", or "additional tokens generated"? What I mean by that is: If I have a chair, and you come and take my chair, you've stolen my chair. If I am carrying $200 in cash, and you take my $200 in cash, you've stolen my cash. (if I write a nice piece of music, and you copy it, you've performed "copyright infringement" and we can discuss whether that is "theft" or not in legal vs semantic / colloquial terms) In this particular case, were specific tokens/crypto/something taken out of someone's wallet, OR were additional seemingly-valid tokens generated "out of thin" air? Was it a transfer or generation issue? Was some entity directly negatively affected through a specific loss, or were many entities affected by subsequent inflation due to tokens being generated? Does my question make sense to anybody but me? :)
- deleted 4y ago
  [deleted]
- MerelyMortal 4y ago
  I haven't read the article, so I don't know if it's out-right theft or theft due to inflation (devaluation of legitimate tokens). Traditionally, scarcity of digital music does not give it value, whereas scarcity of digital tokens does give it value. Are you asking at what point does inflation start to hurt others?
  - JumpCrisscross 4y ago
    > scarcity of digital music does not give it value, whereas scarcity of digital tokens does give it value They're both scarce in the same way.
    - MerelyMortal 4y ago
      > They're both scarce in the same way. No, they are not.
  - NikolaNovak 4y ago
    Thanks - no, my question was in this instance specifically, were existing tokens moved out of specific wallets thus immediatelly injuring specific entities, or were they generated and thus in a more diffused and deferred way hurt entire ecosystem.
darkteflon 4y ago
If memory serves, BNB itself was originally created and distributed to Binance customers as part of an attempt to make them whole for BTC losses from a hacking incident.
- jcpham2 4y ago
  ding ding ding
- hey2022 4y ago
  BNB2 incoming!
- mardifoufs 4y ago
  Wasn't that bitfinex? With the BFX token?
- yieldcrv 4y ago
  I don't think your memory serves correctly
TheKnack 4y ago
I got an email that is made to appear as if it's from Binance today, having never interacted with Binance in any way. The email looks like it could potentially be an actual Binance email someone has copied and modified. The actual sending domain for the email is sg.djamo.ci. Most of the links in the email are bit.ly redirects to https://bina-defi.net/markets/ https://bina-defi.net/markets/. Whois lookup for this domain only results in "Whois record is unavailable at this time." The server IP appears to be hosted in Germany at a hosting provider called Xsserver Gmbh. Links to "Binance.com", Unsubscribe, etc. in the email point to sg.djamo.ci and don't work (either that or my Pi-Hole is blocking them). Everything on the web site prompts the user to connect their wallet. I can't tell if this is an elaborate phishing attempt to drain people's wallets, or a legitimate site that's set up in a way that look suspicious. Edit: The footer of the email says the following, in spite of none of the links in the email going to the legitimate Binance.com site Kindly note: Please be aware of phishing sites and always make sure you are visiting the official Binance.com website when entering sensitive data.
- hey2022 4y ago
  This doesn't even look like an elaborate phishing attempt. It's a pretty standard tactic: 1. make an email look legitimate 2. point to an unrelated scammer-owned domain 3. steal user's financial details (be that a wallet, visa card, bank account, etc).
- lavezzi 4y ago
  For anyone else who isn't as familiar with Binance, they always send a pre-defined anti-phishing code in their emails: https://i.imgur.com/JCA3Pvk.png https://i.imgur.com/JCA3Pvk.png
scifibestfi 4y ago
I hate to say it, but it's looking more and more like the Bitcoin maximalists will end up being proven right in the end.
- rglover 4y ago
  Yeah baby https://www.youtube.com/watch?v=9RaAgI7eZMg https://www.youtube.com/watch?v=9RaAgI7eZMg
- yieldcrv 4y ago
  in what way? right about what in particular?
robertk 4y ago
https://www.reddit.com/r/wallstreetbets/comments/xxyaow/this_never_gets_old_south_park_banking_101/ https://www.reddit.com/r/wallstreetbets/comments/xxyaow/this...
jcpham2 4y ago
Is this stealing or double spending? The original concept was that double-spends were impossibru because proof of work. Then someone pointed out hilariously the origins of BNB "token" in the first place - because ETH 2.0 PoW edition (not Ethereum Classic (ETC) that's a whole different boondoggle) recently migrated to PoS... Nevermind this is dumb
- mgraczyk 4y ago
  It's not double spending, and BNB has nothing to do with ETH migrating to pos
sneak 4y ago
Binance’s BSC chain implementation is not open source, however - it would be relatively straightforward for them to make a new release that arbitrarily rewrites history (like ethereum did). It’s not like the people running the BSC daemon are critical about the code. It’s a blockchain run by a central dictatorial authority, if there is a “critical update release” then the nodes will upgrade.
- yieldcrv 4y ago
  yes already happened long before your post the upgrade disabled the bridge minting method, and also disabled transfers from the hacker's address now they figure out what was wrong with the bridge and preventative measures
mensetmanusman 4y ago
Imagine creating a financial system that incentivizes some of the smartest folks in the world to legally spend nights and weekends robbing those that are less intelligent.
- sxv 4y ago
  You mean like the entire history of "civilization"?

156 points by labarilem 4y ago

throwoutway 4y ago

What tech is a cross-chain bridge? Is it code running on the Ethereum chain or something else?

helen___keller 4y ago
cross chain bridges, from my understanding, are layer 2 protocols that live on 2 chains at once using validators. Basically, you have nodes staking coins on both chains and they attest that the coins coming out of one side of the bridge are matched by coins going in the other side of the bridge So for example you send some $FOO tokens to a contract on the ethereum side then get out $WFOO (wrapped foo) tokens from a contract on another chain. I've been interested in these protocols for a while as a possibility of making crypto actually scalable and not a pyramid scheme (basically, imagine a network of interoperable chains powered by stable tokens like USDC, and using inter-chain protocols to transfer USDC between them as needed for load balancing). That said, reality hasn't quite met my expectations, not yet anyways.
- p4bl0 4y ago
  What makes a blockchain necessary is having both decentralization and generalized distrust as hard assumptions. How do you manage not having to trust the bridges in such scenarios?
  - helen___keller 4y ago
    the bridges operate on the same general principle as proof of stake (mutual distrust of nodes through a protocol that involves staking coins) The difference of course, is that if there's a flaw in proof of stake generally it means one person might control transaction flow and collect some transaction fees; if there's a flaw in a bridge then someone prints money and destroys bridge ecosystem
    - smoldesu 4y ago
      > the bridges operate on the same general principle as proof of stake Quick amendment here - most of the bridges operate on these principles. There are hundreds of cryptocurrencies, trading pairs and L2 chains that have zero accountability whatsoever. It's not written anywhere that these bridges have to operate without trust, and many of them straight-up don't.
    - p4bl0 4y ago
      Proof of stake comes with a number of issues but let's put that apart. PoW and PoS are means to achieve distributed consensus. It works for cryptocurrencies because writings to the blockchain are performative (what's written is true because the act of writing it makes it true). This can only work inside a given blockchain and only for its own cryptocurrency. Which means it cannot be used to ensure anything that happens outside that blockchain. In particular all blockchain usage for certifications, traceability, of NFT-like things are essentially nonsensical. Similarly, I don't see how it could work for writings that happens on other blockchains. Whatever is written on blockchain A cannot be considered true in blockchain B without breaking the security model of blockchain B by making blockchain A a trusted third-party. Where does a distributed consensus mechanism comes into play here? Maybe it would be clearer with an example? Let's say someone wants to move X tokens from blockchain A to blockchain B, and that at the time of the move, X A-tokens are equivalent to Y B-tokens (trusting the exchange rate in itself is all another problem, but let's put it aside). How would that go?
      - helen___keller 4y ago
        > Whatever is written on blockchain A cannot be considered true in blockchain B without breaking the security model of blockchain B by making blockchain A a trusted third-party. To be more specific, when I said "like proof of stake", what I meant is that there's a trusted pool of validators but the individual validators are not assumed to be trustworthy (only the pool in aggregate), and the validators use a adversarial staking model to punish dishonesty. In the case of bridges, that pool is external to the chain. So yes, there is external trust happening. I'll try to address your example, but I've researched this a while ago so I'm sure I could be off the mark. For your example, lets say we're moving A-token in A-chain to wrapped A-tokens in B-chain, so we can easily assume it's a 1:1 exchange rate by construction. User moves 100 A-tokens in A-chain to a bridge smart contract and as data passes the address of their B-chain wallet. A subset of validators in the trusted pool (chosen via some distributed protocol) together sign a multi-sig transaction that authorizes the bridge contract in B-chain to mint 100 wrapped A-tokens and send 99.9 of them to the destination address that the bridging user, and collect 0.1 of them as fee. (If transaction were dishonest, a larger subset of validators would together sign a transaction purging those validators' stake in the pool; so the subset of validators chosen are honest out of desire to keep their staking capital and earn the 0.1 fee) That's at a high level how it works. If you want the full details I recommend finding a technical writeup for a popular trustless bridge.

knrz 4y ago

samczun has a thorough Tweetthread explaining how this hack worked, if you’re looking to dive deep into the nerdy rabbit hole https://twitter.com/samczsun/status/1578167198203289600?s=46&t=5mWGgmZF7JY8JdrQy2f_iQ https://twitter.com/samczsun/status/1578167198203289600?s=46...

beoberha 4y ago
he is often the first person to debug hacks. Such an incredibly great mind.
- deleted 4y ago
  [deleted]
MuffinFlavored 4y ago
I read the thread and I still don't get it. They had a bug in some Go code that a lot of people were running? Does anybody have a GitHub commit to the fix Binance is working on rolling on out? https://coinmarketcap.com/currencies/bnb/ https://coinmarketcap.com/currencies/bnb/ How did it not drop more?...

deleted 4y ago

[deleted]

deleted 4y ago
[deleted]

yborg 4y ago

So how does one launder a half-billion dollar heist like this? Asking for a friend.

ZiiS 4y ago
In a non-fiat system why would you need to?
- Railsify 4y ago
  To get a currency that you can pay taxes with, or buy traditional securities.
- toss1 4y ago
  If it is totally non-fiat, where you can buy housing, food, fuel, devices, luxury items, etc., etc., etc., you would not need to cash out to fiat. But seriously, in the current world, if we have a half-billion dollars "worth" of legitimate (or laundered) cryptocurrency, what can you do with it in the real world, especially contrasted to what we can do easily if we have a $$half-billion in legit $, €, £, or ¥ deposits? I don't think we could even buy a Tesla or a pizza anymore. Maybe some things on Craigslist that take crypto?
  - maupin 4y ago
    A quick Google search finds that (it is claimed anyway) you can buy quite a few items from Amazon or Walmart at shopping.io
  - from 4y ago
    Go on Alibaba and you will find that a surprising number of companies take BTC or USDT. The next step in the laundering process is fairly obvious.
intunderflow 4y ago
I would assume they'll try and push as much value into a currency that's meant to be untraceable (such as Monero or Zcash), move the money around a few wallets for safety, then start drip feeding to exchanges and claiming they got into the currency early by mining and are cashing out. At least if I was going to risk a heist like this it's roughly what I would do.

lm28469 4y ago

This is good for bitcoin

cersa8 4y ago

These bridges seem to be the weakest links in crypto.

jongjong 4y ago
This is because such bridges rely on proofs derived from other blockchains over which validators have no visibility. These add a huge amount of complexity and increase the attack surface. Simpler bridges such as capitalisk-dex https://github.com/Capitalisk/capitalisk-dex https://github.com/Capitalisk/capitalisk-dex (written with only 5K lines of code including dependencies) have a lot smaller attack surface. The principle behind it is to rely on the security of underlying blockchains instead of adding a separate proof mechanism on top; DEX validator nodes have direct visibility over participating blockchains and work directly with on-chain data so they can verify everything directly using each blockchain's native cryptographic clients.
- kirse 4y ago
  Isn't this the purpose behind tech like State Proofs on the Algorand network, i.e. trustless cross-chain activity is basically solved at this point + deprecates the need for any intermediary trusted bridges: https://medium.com/algorand/algorand-state-proofs-707d64038e35 https://medium.com/algorand/algorand-state-proofs-707d64038e... https://developer.algorand.org/docs/get-details/stateproofs/ https://developer.algorand.org/docs/get-details/stateproofs/
  - jongjong 4y ago
    There is no silver bullet, every approach has benefits and drawbacks. One of the drawbacks of the Algorand approach is that both participating blockchains involved a swap need to be aware of each other's block signers/validators in order to be able to verify each other's proofs. These validator lists need to be kept up to date on both blockchains and this adds performance costs (since block validators can change over time). A blockchain which serves as a hub for many other blockchains (such as the Algorand mainchain) would have to keep track of the state of validators on many different blockchains. Recurring fees need to be paid in order to keep track of validator lists. This is not suitable for low-volume markets with low fees since trading fees need to be sufficient to cover the ongoing blockchain fees. The Algorand approach is only suitable for certain blockchains where the block validator list is relatively stable and predictable, it's not suitable for a broad range of consensus mechanisms including proof of work. With Algorand, the proof-generation Algorithm should ideally be baked into the blockchain consensus mechanism (this adds complexity and performance costs/fees to the blockchain). Aside from having the proof algorithm baked into the blockchain's code, the alternative approach is to have a separate federation of 'proof validators' on each chain which are distinct from block validators... This setup has essentially the same security characteristics as a standard multi-chain federated bridge (whose validators have visibility over both participating blockchains) except it has more complexity (risk/attack surface). The benefit of the Algorand approach (assuming that the proof-generation is baked directly into the blockchain logic) is that it offers the maximum degree of decentralization (which matches that of the underlying blockchains). Though this is at the cost of higher fees. Markets based on it would have to have good volume in order to make it viable. Finally, in practice, most smart contracts are controlled and can be updated by certain multisig wallets (and their members) so they're really just federations behind the scenes.

FabHK 4y ago

Who was the victim? Were additional BNB minted? So everyone (every holder of BNB, that is) suffered some loss through inflation in proportion to their holding, theoretically?

yieldcrv 4y ago
no victims just a slight supply inflation (binance smart chain deflation is greater than this over any month time span), about $80 million was successfully moved to censorship resistant blockchains but as they ran out of liquidity they had to move into censorable stablecoins, which were frozen for their addresses all validators on binance smart chain disabled all block production and have subsequently updated to freeze the minting function and also disable the hacker's address

glofish 4y ago

Crypto losses always remind me of Kramer and Jerry talking about losses. - Not a problem. It is a write-off for them. - How is it a write-off? - All these big companies do it - they just write it off! - Write what off? You don't even know what a write-off is! - Maybe I don't but they do. And they are the ones writing it off! https://www.youtube.com/watch?v=XEL65gywwHQ https://www.youtube.com/watch?v=XEL65gywwHQ

masterof0 4y ago
I missed Kramer. And yes, they will probably "write it off", I wonder if only BNB is going to be affected or if their stacking platform is also halted.
eloff 4y ago
Crypto really is a golden age of opportunity for hackers. When else in history could you rob a bank anonymously from your mom's basement for $570M. Cashing it out without getting caught is a little on the tricky side, but not impossible, especially if you live in, or cash it out in an untouchable jurisdiction like Russia.
- masterof0 4y ago
  Cashing it out all at once , yeah, other wise is not too bad, you could use online casinos, coin mixers, fake businesses, NFTs, etc...
- nostrademons 4y ago
  It's even better if in the future crypto becomes legitimate. Then you just have a pile of ill-gotten gains that you can use as ordinary money. Huge fortunes have been built this way, notably Gould and Kennedy.
  - lampshades 4y ago
    The Godfather movies showed this method of legitimatization well.

hamiltonians 4y ago

none of these people ever get arrested or caught. perfect crime

datalopers 4y ago
is it a crime or is it working as intended? code is law after all.
avrionov 4y ago
Some of them of caught and arrested: https://en.wikipedia.org/wiki/2016_Bitfinex_hack https://en.wikipedia.org/wiki/2016_Bitfinex_hack

matthewaveryusa 4y ago

Changpeng "there's also a few more votes regarding how the hacked funds should be handled will be voted by the community" Oh I see how this works now

NikolaNovak 4y ago

I have an ignorant question, which will demonstrate my ignorance of both crypto and fiat. Was money "Stolen", or "additional tokens generated"? What I mean by that is: If I have a chair, and you come and take my chair, you've stolen my chair. If I am carrying $200 in cash, and you take my $200 in cash, you've stolen my cash. (if I write a nice piece of music, and you copy it, you've performed "copyright infringement" and we can discuss whether that is "theft" or not in legal vs semantic / colloquial terms) In this particular case, were specific tokens/crypto/something taken out of someone's wallet, OR were additional seemingly-valid tokens generated "out of thin" air? Was it a transfer or generation issue? Was some entity directly negatively affected through a specific loss, or were many entities affected by subsequent inflation due to tokens being generated? Does my question make sense to anybody but me? :)

deleted 4y ago
[deleted]
MerelyMortal 4y ago
I haven't read the article, so I don't know if it's out-right theft or theft due to inflation (devaluation of legitimate tokens). Traditionally, scarcity of digital music does not give it value, whereas scarcity of digital tokens does give it value. Are you asking at what point does inflation start to hurt others?
- JumpCrisscross 4y ago
  > scarcity of digital music does not give it value, whereas scarcity of digital tokens does give it value They're both scarce in the same way.
  - MerelyMortal 4y ago
    > They're both scarce in the same way. No, they are not.
- NikolaNovak 4y ago
  Thanks - no, my question was in this instance specifically, were existing tokens moved out of specific wallets thus immediatelly injuring specific entities, or were they generated and thus in a more diffused and deferred way hurt entire ecosystem.

darkteflon 4y ago

If memory serves, BNB itself was originally created and distributed to Binance customers as part of an attempt to make them whole for BTC losses from a hacking incident.

jcpham2 4y ago
ding ding ding
hey2022 4y ago
BNB2 incoming!
mardifoufs 4y ago
Wasn't that bitfinex? With the BFX token?
yieldcrv 4y ago
I don't think your memory serves correctly

TheKnack 4y ago

I got an email that is made to appear as if it's from Binance today, having never interacted with Binance in any way. The email looks like it could potentially be an actual Binance email someone has copied and modified. The actual sending domain for the email is sg.djamo.ci. Most of the links in the email are bit.ly redirects to https://bina-defi.net/markets/ https://bina-defi.net/markets/. Whois lookup for this domain only results in "Whois record is unavailable at this time." The server IP appears to be hosted in Germany at a hosting provider called Xsserver Gmbh. Links to "Binance.com", Unsubscribe, etc. in the email point to sg.djamo.ci and don't work (either that or my Pi-Hole is blocking them). Everything on the web site prompts the user to connect their wallet. I can't tell if this is an elaborate phishing attempt to drain people's wallets, or a legitimate site that's set up in a way that look suspicious. Edit: The footer of the email says the following, in spite of none of the links in the email going to the legitimate Binance.com site Kindly note: Please be aware of phishing sites and always make sure you are visiting the official Binance.com website when entering sensitive data.

hey2022 4y ago
This doesn't even look like an elaborate phishing attempt. It's a pretty standard tactic: 1. make an email look legitimate 2. point to an unrelated scammer-owned domain 3. steal user's financial details (be that a wallet, visa card, bank account, etc).
lavezzi 4y ago
For anyone else who isn't as familiar with Binance, they always send a pre-defined anti-phishing code in their emails: https://i.imgur.com/JCA3Pvk.png https://i.imgur.com/JCA3Pvk.png

scifibestfi 4y ago

I hate to say it, but it's looking more and more like the Bitcoin maximalists will end up being proven right in the end.

rglover 4y ago
Yeah baby https://www.youtube.com/watch?v=9RaAgI7eZMg https://www.youtube.com/watch?v=9RaAgI7eZMg
yieldcrv 4y ago
in what way? right about what in particular?

robertk 4y ago

https://www.reddit.com/r/wallstreetbets/comments/xxyaow/this_never_gets_old_south_park_banking_101/ https://www.reddit.com/r/wallstreetbets/comments/xxyaow/this...

jcpham2 4y ago

Is this stealing or double spending? The original concept was that double-spends were impossibru because proof of work. Then someone pointed out hilariously the origins of BNB "token" in the first place - because ETH 2.0 PoW edition (not Ethereum Classic (ETC) that's a whole different boondoggle) recently migrated to PoS... Nevermind this is dumb

mgraczyk 4y ago
It's not double spending, and BNB has nothing to do with ETH migrating to pos

sneak 4y ago

Binance’s BSC chain implementation is not open source, however - it would be relatively straightforward for them to make a new release that arbitrarily rewrites history (like ethereum did). It’s not like the people running the BSC daemon are critical about the code. It’s a blockchain run by a central dictatorial authority, if there is a “critical update release” then the nodes will upgrade.

yieldcrv 4y ago
yes already happened long before your post the upgrade disabled the bridge minting method, and also disabled transfers from the hacker's address now they figure out what was wrong with the bridge and preventative measures

mensetmanusman 4y ago

Imagine creating a financial system that incentivizes some of the smartest folks in the world to legally spend nights and weekends robbing those that are less intelligent.

sxv 4y ago
You mean like the entire history of "civilization"?