14 ms·

Bybit loses $1.5B in hack

320 points by tuananh 2y ago

guluarte 2y ago
[flagged]
- kinakomochidayo 2y ago
  let’s not forget that Satoshi rolled back Bitcoin in 2010, whereas Ethereum was a surgical state change within a smart contract
  - adastra22 2y ago
    What are you talking about in 2010?
    - kinakomochidayo 2y ago
      https://en.bitcoin.it/wiki/Value_overflow_incident https://en.bitcoin.it/wiki/Value_overflow_incident Other transactions besides the one that created 184 billion BTC in that block was effectively “rolled back” on the working chain.
      - adastra22 2y ago
        Thank you.
- vessenes 2y ago
  So salty! And yet...How's ETH Classic doing? It was the right move at the time to fork. And pretty obviously would be the wrong move today. For context, guluarte is referring to a moderately contentious hardfork done by the Ethereum developers and mining community to reverse TheDAO Hack in 2016 or so. The stakes were much larger then -- Ethereum was newer, not yet battle tested, and TheDAO had something like 10% of all ETH in it. A fork was formed -- "ETH Classic" -- ticker ETC -- which did not reverse the DAO hack, and you can see from valuations that the public preferred the reversal.
  - 0cf8612b2e1e 2y ago
    I mean, the public comprised of the developers of Ethereum who had significant financial incentive to pretend the hack did not happen and to forever publicize their chain of history. Code is law, up until it costs me.
    - kinakomochidayo 2y ago
      it was actually up to the node operators to update their clients or not, which resulted in a contentious chain split. just like Bitcoin. decentralization worked as intended.
mvdtnz 2y ago
Remember the golden rule that when it comes to crypto it is a scam 100% of the time. Congrats to the Bybit CEO on his newfound wealth.
k__ 2y ago
Whelp, you better shorted $SAFE.
FabHK 2y ago
Crypto use case: Finance North Korea's nuclear missile program.
- tmpz22 2y ago
  I’m not worried we have entire federal agencies to regulate financial crime and nuclear operations don’t we?
  - lexicality 2y ago
    had
  - robotnikman 2y ago
    They can't really do anything when it comes to crypto in comparison to actual money. There's a reason why countries like Iran, North Korea, and Russia are resorting to stealing crypto by various means.
- deleted 2y ago
  [deleted]
- cyanydeez 2y ago
  Also financing russia, fascism and the worst cryptobros
m00dy 2y ago
We are in the middle of the bull market. fyi.
mdaniel 2y ago
a related blog from Trail of Bits about the opsec failure of this: https://news.ycombinator.com/item?id=43140754 https://news.ycombinator.com/item?id=43140754
- dang 2y ago
  Currently discussed here: The $1.5B Bybit Hack - https://news.ycombinator.com/item?id=43140754 https://news.ycombinator.com/item?id=43140754 Normally we'd merge that one hither but it looks like that article has more background and the thread is (therefore) better.
moanadavidson 2y ago
[dead]
jameson 2y ago
I found it funny that the idea of blockchain, which, the system trusts no single entity but trusts transaction consensus, yet one trusts a single entity who holds your wallet and risk of losing if they get hacked while there's no mediators/regulators to revert the transaction
karmakaze 2y ago
I have no idea how crypto exchanges work. Could someone ELI5 some of this? I have questions: Did the cold storage wallet contain users' ETH? That seems implied by "Can Cover Loss". If so, why does a crypto exchange hold users' ETH in a wallet that can execute transactions without said user's authorization/password for each transaction. Doesn't even Facebook require entering a password every time to change certain profile settings? Or maybe more generally, why does there need to be such a large cold-storage wallet to run an exchange? Also how or why would they have the assets to be able to cover this? There's some other seemingly conflicting info I found in searches for Bybit: - Bybit is not legal in Canada. Bybit is restricted in Canada and other jurisdictions, including the United States, the United Kingdom, and Singapore. - Bybit originates from Singapore, a global hub for cryptocurrency and blockchain technology. Singapore has a favorable regulatory environment for cryptocurrencies, which has attracted many exchanges to establish their headquarters there. - There's also a mix of results where some say Bybit is safe/secure and others saying they aren't (irrespective of this event). This story seems to indicate that they had measures to make it safe, but it didn't save them.
MAGDIE34YY 2y ago
[dead]
Gowtham_HN 2y ago
[dead]
likareg302 2y ago
[dead]
toomuchtodo 2y ago
https://www.web3isgoinggreat.com/ https://www.web3isgoinggreat.com/
philipwhiuk 2y ago
It's obviously not a cold wallet if it's connected to the exchange.
- abuani 2y ago
  It's also not reassuring that the CEO claims cold wallets are safe and secure, just after losing 1.46B
- Etheryte 2y ago
  Yeah this makes no sense whatsoever. > [The hacker] took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address. Did the hacker physically break into their office or what?
  - TimJRobinson 2y ago
    The wallet is a smart contract (specifically a gnosis safe), the malicious message they signed transferred ownership of that smart contract wallet to the attacker so they could then do whatever they want with it.
  - shawabawa3 2y ago
    Possibly yes Or some part of their system failed and the key was compromised without them realising it (like the Debian insecure keys debacle or whatever)
- gnabgib 2y ago
  It could still be cold. "took control of the specific ETH cold wallet" sounds like stealing the physical hardware. Like someone stealing the vault key, or the HDCP master key getting leaked.
  - hotsauceror 2y ago
    Yes. This sounds like a variant of “rubber hose decryption.” “We beat him with a sock full of doorknobs until he gave us the device.”
gosub100 2y ago
[flagged]
- drak0n1c 2y ago
  In this case yes - everything went by the design and law of the underlying code. There was no exploited bug or vulnerability flaw besides human laziness here. 1) Their multi-signature wallet signing employees lazily clicked through in unison to approve a new smart contract without examining the contents to see if it was unusual. 2) Bad security architecture to keep too much in a single wallet that wasn't properly kept cold. There should have been a few fully cold wallets, that only rarely transact with mostly-cold intermediary "airlock" wallets which are also separated from the exchange operations and wallets. The signers also need to be different combinations of people for each of those wallets - preferably some of those signers being additionally liable 3rd party technical experts.
  - fsckboy 2y ago
    >There was no bug or vulnerability flaw when code is law, there can't be any bugs or vulnerabilities, only features.
- yapyap 2y ago
  “skibidi is toilet” what r u talkin ab?
- unyttigfjelltol 2y ago
  Yes! A "cleverly masked exploit that altered the smart contract logic"[1] = congratulations!! the contract gives you $1.46B free money!! I anticipate that the defi community will celebrate the inexorable operation of their logical contracts. [1] https://cryptonews.com/news/bybit-crypto-exchange-faces-1-5-billion-suspicious-outflows-whats-going-on/ https://cryptonews.com/news/bybit-crypto-exchange-faces-1-5-...
- acc_297 2y ago
  ^Yep When you decentralize finance like this what becomes okay to do according to system rules is exactly what is possible to do according to system rules. We don't have humans in that loop anymore to enforce moral judgments about what constitutes unlawful theft (except for 1 or 2 rare "hard-forks" of various blockchains to reverse devastating transactions). I feel bad for people who lose large volumes of cryptocurrency to malicious actors in the same way I feel bad for people who lose large volumes of real money to a casino. It is 2025 now and we all know that anyone who can somehow get your private-key to whatever blockchain backed assets you have "owns" those assets just as much as you do and they are permitted to take them under the rules of the system so whatever you do do not lose that key. There is no higher arbiter of justice in this space so use it at your own risk.
huang_chung 2y ago
Society has devolved a bit when not long ago a heist like this would involve sieging Nakatomi Plaza, now it takes just finding a bug in someone's defective Python codes.
- Klaster_1 2y ago
  I wonder how many programmers resort to crime after they were laid off and couldn't find a job. Like soldiers after a war.
  - skeeter2020 2y ago
    not related to the current western market, but countries like Romania pre EU had a huge surplus of soviet-educated young people and no jobs. This definitely increased their involvement with "informal" economies for some time.
  - EVa5I7bHFq9mnYK 2y ago
    Most likely these programmers are serving in the DPRK Unit 180.
  - adhamsalama 2y ago
    That's pretty much what ex-IDF members do, but they set it up as a company so it becomes legal somehow, I guess...
  - wyre 2y ago
    That might make for a good book or movie plot.
    - NetOpWibby 2y ago
      Starring Rami Malek, Tom Holland, Kyla Pratt, and George Clooney?
    - mablopoule 2y ago
      It was the basis of the plot of the first Jurassic Park movie. All shenanigans started because Dennis Nedry, the parc IT manager, disabled some security system at a bad time so he could sell some company secrets to concurrents. There are interesting character analysis to do between the book and the movie version, where the book version or Dennis Nedry is way more sympathetic (even if flawed), he's a extremely talented IT guy who was undersold the amount of work to do in the park, kinda stuck doing unpaid overwork in a remote island and generally been fleeced by a way more villainous book John Hammond.
faefox 2y ago
[flagged]
- tombert 2y ago
  The genius behind crypto is that it's not just the extremely gullible. I know a fair number of really smart people, academics even, that have bought into the cryptocurrency hype. It has this kind of veil of "high techness" to it that is appealing to smart-but-uninformed people (like me in 2021). I'm embarrassed that I fell for it, but on the bright side it does make me a bit more sympathetic for other people who also fell for it.
  - tdb7893 2y ago
    Being smart or academic does absolutely not mean these people aren't gullible.
    - tombert 2y ago
      I know, but it is inversely correlated. I don't think most academics would fall for the "Nigerian Prince" chain emails, or the "Romance Scams" you see on YouTube, which are things I usually associate with extremely gullible people.
  - hinkley 2y ago
    Crypto: where Kernighan’s Law meets con artistry.
  - akritrime 2y ago
    To be honest, a distributed logic execution engine is an interesting tech, it just isn't something to build any high value economy on top of.
    - tombert 2y ago
      Sure, I'll totally acknowledge that some of the distributed algorithms that have spun out of the blockchain are pretty cool, and I'll even go as far as to say that maybe someday we'll find some very cool high-value uses from them. Pretend money, at least in my opinion, is not one of those uses.
chabes 2y ago
From the article: > The wallet in question appears to have sent 401,346 ETH ($1.1 billion) as well as several other iterations of staked ether (stETH) to a fresh wallet, which is now liquidating mETH and stETH on decentralized exchanges, etherscan shows. The wallet has sold around $200 million worth of stETH so far. If you showed me a paragraph like this a decade ago and told me it was from 2025, I would have a difficult time believing you.
- netrap 2y ago
  Just crazy. Bank heists fully online...
  - yard2010 2y ago
    It's a cold wallet which means it should never be connected to the internet, so not entirely online, but yes - these are the wild wild west times of the internet. Imagine how easy it was to go into a bank shoot some people and get out with money, and doing it like, daily? monthly? Today it's not possible.
    - kzrdude 2y ago
      Apparently there was a path from the internet to the wallet anyway, that's what it sounds like.
      - aaronmdjones 2y ago
        So it was a lukewarm wallet?
        desumeku 2y ago
        What supposedly happened is that malware was installed on every multisig key signer's device and then the hacker showed them all a fake transaction that looked legit but actually changed the smart contract of the cold wallet to give him access.
- 2y ago
tw1984 2y ago
another "exchange was hacked" story, why I am not surprised.
- notfed 2y ago
  "Oops, we were hacked, hehe, guess we'll have to shutdown. Oh and our CEO will be moving to another country."
sleazebreeze 2y ago
What are the chances that a Bybit insider is behind this?
- hinkley 2y ago
  Or former insider. I spent several years pointing out to my last employer that every former employee could have walked off with secrets that allowed them access to our backends. The were already slowly working on hardening write access but read access was still being worked on a couple months before I left, when I got to write about half of the last mile code for the user facing bits. This is not a unique experience by any means. I’ve seen this sort of thing enough to pay attention when acquaintances bitch about it too.
  - Falimonda 2y ago
    Are these business-owned exchanges and managed wallets not fundamentally incompatible with making guarantees of security? Is anyone doing it the "right" way and what does the right way even look like?
    - hinkley 2y ago
      I don't know the answer to that, I only have guesses. But one mistake we make over and over is that we write code that just does its best to answer questions as quickly as possible. And when those questions show up 10x as quickly as they have any other time in our company history, they either just plug right along or maybe throw an error. Someone shouldn't be able to empty a billion dollars out of an exchange in 10 minutes, unless they do $250B in daily traffic. And I suspect most of them can be, and in even less time than that.
- mvdtnz 2y ago
  10000%. You would have to be soft in the head to not conclude that's the case.
tombert 2y ago
The entirety of the cryptocurrency world is so obviously a "Chesterton's Fence" situation. Every pseudo-intellectual thinks that the fiscal world is "too complicated" and they're going to "simplify" it by making some token, only for people to realize that the monetary world is just complicated, and they have to reinvent everything that already existed in the traditional banking system. I had to do some work on an ACH system a couple years ago [1], and I read through a large chunk of the ACH standard, which was about 800 pages. It's easy to see and hear that and think "that's way too complicated, what could possibly be so hard about money transfers that necessitates an 700 page specification??", but as I read it and saw how many edge cases it took into account, it was easy to see why it got so huge. It turns out that dealing with money is just a really hard problem at scale. I fell for the cryptocurrency hype of 2021, and I will fully acknowledge that that came out of a complete lack of understanding of how fiscal systems work. I wish everyone else would just grow up already. [1] Usually disclaimer: not hard to find my work history, it's not hidden, but I ask that you do not post anything about it (or at least any proper nouns about it) here.
- htrp 2y ago
  The crypto community continues to speed run the history of traditional finance. [1] https://news.ycombinator.com/item?id=31777761 https://news.ycombinator.com/item?id=31777761
  - a_tartaruga 2y ago
    It's only a matter of time until we get a railroad track laying network secured by proof of railroad track (PoRT) and recreate the panic of 1873.
- erikpukinskis 2y ago
  For what it’s worth, I’m a “crypto believer” and I have never considered ease of use to be one of its selling points. What you are describing are the systems of power which create a stable financial system. That is, one where you can put a nickel into a bank account and expect it to be there in a year or a hundred years. That indeed requires a complex web of power structures, because its top line goal is to be stable and dependable. And stability within a complex landscape requires an equally complex network of power. Crypto provides the exact opposite value: it cannot be controlled, no matter how robust your power structure is. It can be insured, at a significant cost, but not controlled. That means in the face of even totalitarian powers someone could still move crypto across any boundary that is permeable to information, which it turns out is a set that roughly approximates the set of all boundaries. This is a terrible way to pay for candy bars, because candy bars are not worth insuring. But what I think the crypto opponents miss is that there is a set of transactions—some criminal, some legal, some immoral, some righteous—which cannot be made in a state controlled financial systems. And that these transactions are what gives crypto value as a currency. To me, where I would like the debate to go is not “is crypto a scam?” but “how does society protect people from the violence facilitated by crypto?” Yes, financial “violence”, which can be insured against, but also real violence: human trafficking, extortion, etc. We anarchists sometimes like to pretend that without rulers we will be freed to care for each other. But in the shadow of a history of violence, there will be more violence too. And the “crypto is a scam” argument I fear is a red herring that distracts from this, the real issue.
fjjjrjj 2y ago
More like byebit. Unregulated asset exchanges. Haven't we been there before a loong time ago?
walterbell 2y ago
Bybit CEO Ben Zhou wrote on X that a hacker "took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address." "Control" has a specific meaning under UCC Article 12, which was ratified in 2022 and is slowly being adopted by U.S. states. It links some rights to control/possession of keys, even if a blockchain asset may have been stolen before being sold, https://www.clearygottlieb.com//news-and-insights/publication-listing/ucc-digital-asset-amendments-finalized https://www.clearygottlieb.com//news-and-insights/publicatio... > Article 12 – dealing directly with the acquisition and disposition of interests (including security interests) in “controllable electronic records,” which would include Bitcoin, Ether, and a variety of other digital assets ... a good faith purchaser for value who obtains control (a “qualifying purchaser”) takes its interest free of conflicting property claims... Control under Article 12 is designed to be a technology-neutral functional equivalent of “possession.” It generally encompasses circumstances when a party has the “private key”
- adastra22 2y ago
  What is the purpose of this comment?
  - walterbell 2y ago
    It describes the legal status of stolen cryptocurrency changing after the first sale. This HN story is about stolen cryptocurrency. In particular: > The wallet has sold around $200 million worth of stETH so far If some of those sales took place within jurisdiction of a U.S. state that has ratified UCC Article 12, then the buyer of the stolen cryptocurrency is now the new legal owner.
    - adastra22 2y ago
      The hacked coins are not "free of conflicting property claims."
      - walterbell 2y ago
        > The hacked coins are not "free of conflicting property claims." 2023, American Bar Association, https://www.americanbar.org/groups/business_law/resources/business-law-today/2023-june/how-to-create-a-floating-lien-on-digital-assets/ https://www.americanbar.org/groups/business_law/resources/bu... .. “take free” regime introduced by the 2022 UCC Amendments for these assets. Under these rules, a person who acquires a CER for value, in good faith and without notice of any conflicting property claims, is deemed a “qualifying purchaser” and, as such, takes it free from any preexisting property claims. The 2022 UCC Amendments draw heavily from the UCC Article 3 provisions for negotiable instruments, and these provisions have the effect of making CERs negotiable. It follows that if a secured creditor obtained a security interest in CER inventory and only perfected by filing, that creditor would be at risk of the debtor disposing of the collateral and transferring control to a qualifying purchaser that would take it free from any competing claim.
scrlk 2y ago
I wouldn't be surprised if Bybit cuts a deal with the hacker to return the funds. There's no way that $1.46 billion of marked ETH can be liquidated and off-ramped to fiat.
- adastra22 2y ago
  That’s well within the daily trading volume.
  - scrlk 2y ago
    Exchanges will blacklist the addresses that hold the hacked ETH. They won't be able to deposit, or if they can deposit, the ETH will be frozen by the exchange.
    - cherryteastain 2y ago
      Tornado cash and similar exist
      - theamk 2y ago
        So? Taint entire mixer output if any of the inputs is tainted. After a few instances, no one wpuld want to participate. If someone complains, remind them that Tornado is illegal in US.
    - theamk 2y ago
      I am sure there are still plenty of suckers who believe the whole "cryptocurrencies are fungible" narrative, and would get those ETHs with a discount.
    - medellin 2y ago
      It is on eth and they can use decentralized exchanges.
      - scrlk 2y ago
ArtTimeInvestor 2y ago
When even professional companies that have billions of dollars under management can't securely manage their crypto assets, how likely is it that individuals can?
- kangda123 2y ago
  It's a different ball game. The resources that went into executing this kind of hack were probably far higher than most wallets are worth anyway.
  - acc_297 2y ago
    Maybe not - a number of high-value past hacks have been very low effort I have yet to see a thorough explanation of what specifically was hacked here anyhow
- deleted 2y ago
  [deleted]
UncleMeat 2y ago
"Please rest assured that all other cold wallets are secure." Unreal.
- otabdeveloper4 2y ago
  He means "...secure. (For now.)" He just left off the implied part.
mkagenius 2y ago
A crypto exchange WazirX was hacked for ~$300M, roughly 50% of the users fund gone. There is no action on the CEO since the hack in July 2024. He sits in Dubai. He just got a nod from Supreme Court of SG to just average out the funds and distribute it among the users. No action has been initiated against the company/ceo for losing the fund. He is geared up to launch another company/exchange.
- EVa5I7bHFq9mnYK 2y ago
  Atomic Wallet users lost $100M in June 2023 hack, the company continues to operate as if nothing happened, no word of any restitution to the users.
- ycombinatrix 2y ago
  What action can be taken? There's no law against getting hacked or being a moron.
  - ghhrjfkt4k 2y ago
    There is a law against gross negligence. Holding client money comes with other obligations too.
    - joshstrange 2y ago
      It’s not money though. It’s property at best. It doesn’t get held to the same standards. CryptoBros are all about “no laws, do whatever” right up until the, inevitable, point at which /they/ are getting swindled and then they want to cry foul and run to the authorities. It’s just like the whole DAO situation which showed “Crypto is immutable and we want to live and die by the code unless of course someone finds a flaw in the code and steals our money, then we will roll back the immutable chain to recover it” what a farce.
      - Saline9515 2y ago
        Ethereum wasn't rolled back after TheDao hack, they simply forked. Also crypto is about uncensorable transactions, not lawlessness.
insane_dreamer 2y ago
Given how many of these exchanges have been hacked (or were fraudulent), how is it that people still use them?
jauntywundrkind 2y ago
Terrifying to imagine how much funding terrorist states might be getting by hacks like this.
- a_tartaruga 2y ago
  One in particular gets about 1 billion dollars a year. Already hit their quota in February
deleted 2y ago
[deleted]
rkagerer 2y ago
There's some info and speculation in these two (distinct) articles, but I'd love to know technical details of where the gaffs were. eg. Was client software compromised? Did the multisig keyholders succumb to social engineering? Were the signers using airgapped machines / hardware devices? https://archive.ph/YMZrq https://archive.ph/YMZrq https://blockworks.co/news/bybit-hack-raises-security-questions https://blockworks.co/news/bybit-hack-raises-security-questi...
- cypherpunks01 2y ago
  A huge problem with signing EVM transactions using hardware wallets is that is common to be blind signing messages. The device has no knowledge of the SAFE EVM contract functions or any other context, it just asks you to sign an gobblygook opaque binary message so you may have no idea what's being signed, is my experience using multiple different vendor HW wallets. Not sure if that's what happened, but possible this type of problem contributed to the exploit. BTC TXs are simple enough that all HW wallets can basically display what's happening, but with turing-complete arbitrary computations in EVM this becomes very difficult.
  - killerstorm 2y ago
    In almost all cases EVM smart contract interaction looks like a function call which can be easily decoded into JSON if you know ABI. HW wallet doesn't need to understand the contract logic, it just needs ABI, which is generally a simpler task. Also it can show the name of function you're calling as selector is a hash of a name. Safe is a bit more complex as it also wraps it in EIP-712 message, but that can also be decoded in a systematic way.
  - deleted 2y ago
    [deleted]
  - rkagerer 2y ago
    Thanks for spelling this out, the explanation makes a lot of sense. You'd think they could at least show a blockie representing the contract, or reputational party who cryptographically vouched for it.
medellin 2y ago
Old man yells at cloud vibes every time a crypto post comes on HN. No interesting discussions ever. Just axes being sharpened and people who dislike it taking the opportunity to gloat. I would characterize the pro crypto people but I don’t see any. Which is said because over the last 5 years I have found crypto, bitcoin, and stable coins to be extremely useful when helping family members in emerging markets. But hey it’s all trash, the west doesn’t need it so let’s all dance on its grave.. i guess we will keep dancing for another 15 years.
- ddorian43 2y ago
  There's no interesting discussion to be had. That's the simple reason you always miss.
throwaway_v 2y ago
woops
zer0x4d 2y ago
I'm a huge crypto believer but I can admit that we don't have a serious system if a person can just transfer over $1.5B from a well known crypto cold wallet to different accounts with nothing flagging it and no way to reverse it.
- stouset 2y ago
  In the face of the never-ending list of these kinds of events, the laughably impossible task of average nontechnical individuals protecting their own assets (and the consequence of total financial ruin when they fail to do so), the overwhelming number of and size of scams, rug pulls, fraud, outright Ponzi schemes, and on and on and on… what exactly is left to keep anyone a “huge believer”? Put differently, it’s been seventeen years of constant and escalating mayhem. What would finally be enough to shake your faith?
  - desumeku 2y ago
    Maybe when it stops escalating and getting bigger and bigger and continually growing over time?
  - EVa5I7bHFq9mnYK 2y ago
    In 17 years, USD holders got hacked for 65% of their money (based on gold, or eggs, prices). At the same time, btc holders ... you know.
    - stouset 2y ago
      In 17 years, the value of my traditionally-invested assets (VTSAX) went up 700%. I didn’t risk losing everything to scams. When I forgot my password my brokerage was able to restore my access. When I made a mistake in a transaction I was able to call them and sort it out. Meanwhile, despite the incredible runup of BTC I know precisely zero Bitcoin billionaires. I know people who have theoretical fortunes on hard drives that have died. I know people who mistimed purchases and sales and who’ve perhaps turned a small profit. I know people who turned a large profit and then lost it all to malware or exchange failure. So yeah, I do know what happened to the BTC holders.
qingcharles 2y ago
Can someone even explain what Bybit is actually about? I searched around when the hack was announced, but I'm very confused. Mostly what I saw said "scam" on it. This isn't your run-of-the-mill Coinbase style exchange, right?
- cypherpunks01 2y ago
  It's the second largest crypto exchange by volume globally, behind Binance. Specialized in derivatives but they have lots of regular retail products that you might find at Coinbase. Basically like a bigger version of Coinbase from Asia.
- billfruit 2y ago
  Also a major sponsor of Red bull Racing in Formula 1.
rNULLED 2y ago
> have a wallet, work at bybit > understand backdoor > steal money from your account, some from others > bybit pays you back > still have money you stole
thesumofall 2y ago
In case of a state actor just imagine the weapons that could be bought with this kind of money and the potential lives lost due to this mess
Geee 2y ago
There should be something like a "finalizing transaction", which both the sender and receiver need to sign after the first transaction has been mined, i.e. like an in-built escrow. If it's not signed by both, then funds are returned. This wouldn't protect against key leakage, but in this case, the tx was signed by accident. This would also protect against sending to wrong address.
- Mengkudulangsat 2y ago
  This would also protect againts dusting attacks. Illicit addresses sending to thousands of random recipients and making them all marked by automated KYC systems.
- tromp 2y ago
  There are cryptocurrencies in which transactions must be signed by both sender and receiver, such as those implementing the pure Mimblewimble protocol. > Both the sender and receiver need to sign after the first transaction has been mined That makes no sense; miners don't mine transactions unless they're guaranteed to be valid. All signing must be done before transactions are even published. Otherwise one could DoD-attack the network by having it forward tons of invalid transactions.
  - vlovich123 2y ago
    You’d mine the first transaction which is a nominal value but the rest of the transaction won’t get mined until that first transaction is signed by both parties indicating acceptance. You could even break it down into an arbitrarily multi-stage process where the next stage is exponentially larger more money (i.e. transfer $100, then transfer $1000, then $1000, etc). This would make the accident “hit a button and lose a B right away” much harder to pull off. Of course, in this case I don’t know that it would help as I believe the attacked party signed approval to change the contract itself.
  - dcow 2y ago
    What does DoD stand for, in this context?
Animats 2y ago
Who says ByBit can cover the loss? The article title says that but the article quotes do not. The CEO only said that their other cold wallets are intact and that withdrawals remain normal. Bybit claims to be regulated by the Virtual Assets Regulatory Authority of Dubai.[1] But the lookup page at VARA says they only have "In-principle approval", not a full license. "Applicants holding an IPA are strictly prohibited from initiating operations, conducting any virtual asset activities, or servicing clients until they have obtained their full VASP licence from VARA." Uh oh. [1] https://www.vara.ae/en/licenses-and-register/public-register/ https://www.vara.ae/en/licenses-and-register/public-register...
- nprateem 2y ago
  They're probably just saying that to avoid a run.
- zaphodias 2y ago
  > Who says ByBit can cover the loss? CEO on X
  - Animats 2y ago
    Right. If you have a balance in ByBit, get it out NOW.
  - deleted 2y ago
    [deleted]
  - DonHopkins 2y ago
    When has the CEO of a cryptocurrency exchange ever lied before? What possible motivation would he have to not tell the truth, the whole truth, and nothing but the truth? Harumph!!! Gentleman, please, rest your sphincters! https://www.youtube.com/watch?v=g2Bp8SqYrnE https://www.youtube.com/watch?v=g2Bp8SqYrnE
plantain 2y ago
How on earth is it possible they can cover a 1.5B loss? Are they really sitting on that much profit, or is the goal to ponzi it out from here, MtGox style?
- jqpabc123 2y ago
  How on earth is it possible they can cover a 1.5B loss? Easy! They give Binance an IOU in exchange for 1.5 billion BUSD which is just "minted" out of fresh new electrons. Neither of them has really lost anything. Everyone can carry on as if it never happened. In the bizarro world of crypto, this is business as usual.
  - killerstorm 2y ago
    How it it different from what banks do? (Except for a central regulator.)
    - tonyhart7 2y ago
      FEDS can print money while Binance does not
      - skeeter2020 2y ago
        not exactly true - Binance is indeed "printing money", just with no centralized regulation. When the Feds do it the expectation is that they are aware of the long-term impacts of doing so, and include in their calculation. For crypto it's the opposite: do it before you erode trust & goodwill to the point where it's no longer valuable. I see it more like it is very different than printing money in a economy that's perceived as stable and quite similar to printing money in one where the people have no faith in the value of sovereign currency. So the crypo-promoters are right about the use-case in certain jurisdictions, but the problem is that's not where the wealth is, so they target rich economies that tend to have stable government currencies & established banking, and do not need crypto for legitimate tasks.
nodesocket 2y ago
My understand is that the original transaction was a small fraction of the total balance of ETH in the wallet. How then were they able to liquidate the entire ETH wallet?
russnes 2y ago
Kim Jong 1337 hacker strikes again
sub7 2y ago
These are not hacks, just like Mtgox, Celsius, FTX etc etc etc were not hacks. These are crypto insiders supporting the stablecoin so they can print and set a floor on prices before/during potential mass sell off events.
czhu12 2y ago
Their English Wikipedia page is deleted as of 1:42am pst. Any idea what that’s about?
- deleted 2y ago
  [deleted]
- codetrotter 2y ago
  https://en.m.wikipedia.org/wiki/Bybit https://en.m.wikipedia.org/wiki/Bybit shows the history of deletions and creations of the page. The current deletion is for reasons that include lack of NCORP (Notability (organizations and companies)). And they back that in turn by saying that the sources are weak. I understand on one side that they don’t want every company in the world to have a Wikipedia page. Because the point of Wikipedia is not to promote or legitimise every company in the world. But you’d think that at the point where widely covered news of a hack leading to a loss of a billion dollars and a half, would be reason to have a Wikipedia article about it. And instead they went and deleted the article today. There’s probably additional editing of the page itself that you can dig into the history of if you want to see what happened during the past couple of days leading up to the page being deleted again. For me, I’ll file this under Wikipedia Editors gonna Edit. They have all kinds of edit wars and page deletions going on all the time in the background that the rest of us mostly don’t even notice most of the time. And all over I’m still happy with Wikipedia for all of the information it has collected within.
  - card_zero 2y ago
    It could be resurrected if there are multiple news stories making it notable for being hacked. It would have to be rewritten, though, to give it substantially different content. https://en.wikipedia.org/wiki/Wikipedia:Speedy_deletion#G4 https://en.wikipedia.org/wiki/Wikipedia:Speedy_deletion#G4 Here's the discussion from the second time it was deleted: https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/Bybit_(2nd_nomination) https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletio... They're basically saying "nah, that's spam". So when it was recreated yet again, of course it was speedily terminated with prejudice because it just looks like another spam attempt. Not sure if there's a rule against covering news stories. Seems like we wouldn't want an article on every news event (I'm pretty sure there is a rule against that), but Crowdstrike got an article.
ChrisMarshallNY 2y ago
As Frank Drebin would say, “Nothing to see here.” https://youtube.com/watch?v=aKnX5wci404 https://youtube.com/watch?v=aKnX5wci404
ycombinatrix 2y ago
>Bybit CEO Ben Zhou wrote on X that a hacker "took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address." Um how tf does a cold wallet get hacked?
- w_TF 2y ago
  Have to wait for a post-mortem, but there was some speculation from Ben earlier in his spaces. They used a gnosis safe which is a smart contract multi-sig wallet that is pretty much the gold standard for Ethereum. They believed that all of the signers' pcs were hacked and that the UI for signing was staged with a fake element to make it appear like a normal transfer. They were signing with hardware wallets, but it's hard to verify what you're signing from a ledger typically. What they ended up signing instead was an upgrade to the smart contract giving control of the gnosis safe to the hacker who then drained it.
  - ycombinatrix 2y ago
    Thanks for the explanation. It wasn't a cold wallet.
lofties 2y ago
> "Please rest assured that all other cold wallets are secure. All withdrawals are normal," he added. There are no American infidels in Baghdad. Never!
- cmcaleer 2y ago
  I'd probably bet on this being and staying the case. Bybit needs to look as strong as possible here and they probably have a bunch of willing lenders. The second they have to pause withdrawals and look weak, it could be game over from the (additional) reputational damage.
- stef25 2y ago
  Chemical Ali ?
fennecbutt 2y ago
And they keep everything in one wallet why?!?! Surely you'd allocate a new wallet/1m roughly and always keep it spread.
Kurtcheng 2y ago
[dead]

320 points by tuananh 2y ago

guluarte 2y ago

[flagged]

kinakomochidayo 2y ago
let’s not forget that Satoshi rolled back Bitcoin in 2010, whereas Ethereum was a surgical state change within a smart contract
- adastra22 2y ago
  What are you talking about in 2010?
  - kinakomochidayo 2y ago
    https://en.bitcoin.it/wiki/Value_overflow_incident https://en.bitcoin.it/wiki/Value_overflow_incident Other transactions besides the one that created 184 billion BTC in that block was effectively “rolled back” on the working chain.
    - adastra22 2y ago
      Thank you.
vessenes 2y ago
So salty! And yet...How's ETH Classic doing? It was the right move at the time to fork. And pretty obviously would be the wrong move today. For context, guluarte is referring to a moderately contentious hardfork done by the Ethereum developers and mining community to reverse TheDAO Hack in 2016 or so. The stakes were much larger then -- Ethereum was newer, not yet battle tested, and TheDAO had something like 10% of all ETH in it. A fork was formed -- "ETH Classic" -- ticker ETC -- which did not reverse the DAO hack, and you can see from valuations that the public preferred the reversal.
- 0cf8612b2e1e 2y ago
  I mean, the public comprised of the developers of Ethereum who had significant financial incentive to pretend the hack did not happen and to forever publicize their chain of history. Code is law, up until it costs me.
  - kinakomochidayo 2y ago
    it was actually up to the node operators to update their clients or not, which resulted in a contentious chain split. just like Bitcoin. decentralization worked as intended.

mvdtnz 2y ago

Remember the golden rule that when it comes to crypto it is a scam 100% of the time. Congrats to the Bybit CEO on his newfound wealth.

k__ 2y ago

Whelp, you better shorted $SAFE.

FabHK 2y ago

Crypto use case: Finance North Korea's nuclear missile program.

tmpz22 2y ago
I’m not worried we have entire federal agencies to regulate financial crime and nuclear operations don’t we?
- lexicality 2y ago
  had
- robotnikman 2y ago
  They can't really do anything when it comes to crypto in comparison to actual money. There's a reason why countries like Iran, North Korea, and Russia are resorting to stealing crypto by various means.
deleted 2y ago
[deleted]
cyanydeez 2y ago
Also financing russia, fascism and the worst cryptobros

m00dy 2y ago

We are in the middle of the bull market. fyi.

mdaniel 2y ago

a related blog from Trail of Bits about the opsec failure of this: https://news.ycombinator.com/item?id=43140754 https://news.ycombinator.com/item?id=43140754

dang 2y ago
Currently discussed here: The $1.5B Bybit Hack - https://news.ycombinator.com/item?id=43140754 https://news.ycombinator.com/item?id=43140754 Normally we'd merge that one hither but it looks like that article has more background and the thread is (therefore) better.

moanadavidson 2y ago

[dead]

jameson 2y ago

I found it funny that the idea of blockchain, which, the system trusts no single entity but trusts transaction consensus, yet one trusts a single entity who holds your wallet and risk of losing if they get hacked while there's no mediators/regulators to revert the transaction

karmakaze 2y ago

I have no idea how crypto exchanges work. Could someone ELI5 some of this? I have questions: Did the cold storage wallet contain users' ETH? That seems implied by "Can Cover Loss". If so, why does a crypto exchange hold users' ETH in a wallet that can execute transactions without said user's authorization/password for each transaction. Doesn't even Facebook require entering a password every time to change certain profile settings? Or maybe more generally, why does there need to be such a large cold-storage wallet to run an exchange? Also how or why would they have the assets to be able to cover this? There's some other seemingly conflicting info I found in searches for Bybit: - Bybit is not legal in Canada. Bybit is restricted in Canada and other jurisdictions, including the United States, the United Kingdom, and Singapore. - Bybit originates from Singapore, a global hub for cryptocurrency and blockchain technology. Singapore has a favorable regulatory environment for cryptocurrencies, which has attracted many exchanges to establish their headquarters there. - There's also a mix of results where some say Bybit is safe/secure and others saying they aren't (irrespective of this event). This story seems to indicate that they had measures to make it safe, but it didn't save them.

MAGDIE34YY 2y ago

[dead]

Gowtham_HN 2y ago

[dead]

likareg302 2y ago

[dead]

toomuchtodo 2y ago

https://www.web3isgoinggreat.com/ https://www.web3isgoinggreat.com/

philipwhiuk 2y ago

It's obviously not a cold wallet if it's connected to the exchange.

abuani 2y ago
It's also not reassuring that the CEO claims cold wallets are safe and secure, just after losing 1.46B
Etheryte 2y ago
Yeah this makes no sense whatsoever. > [The hacker] took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address. Did the hacker physically break into their office or what?
- TimJRobinson 2y ago
  The wallet is a smart contract (specifically a gnosis safe), the malicious message they signed transferred ownership of that smart contract wallet to the attacker so they could then do whatever they want with it.
- shawabawa3 2y ago
  Possibly yes Or some part of their system failed and the key was compromised without them realising it (like the Debian insecure keys debacle or whatever)
gnabgib 2y ago
It could still be cold. "took control of the specific ETH cold wallet" sounds like stealing the physical hardware. Like someone stealing the vault key, or the HDCP master key getting leaked.
- hotsauceror 2y ago
  Yes. This sounds like a variant of “rubber hose decryption.” “We beat him with a sock full of doorknobs until he gave us the device.”

gosub100 2y ago

[flagged]

drak0n1c 2y ago
In this case yes - everything went by the design and law of the underlying code. There was no exploited bug or vulnerability flaw besides human laziness here. 1) Their multi-signature wallet signing employees lazily clicked through in unison to approve a new smart contract without examining the contents to see if it was unusual. 2) Bad security architecture to keep too much in a single wallet that wasn't properly kept cold. There should have been a few fully cold wallets, that only rarely transact with mostly-cold intermediary "airlock" wallets which are also separated from the exchange operations and wallets. The signers also need to be different combinations of people for each of those wallets - preferably some of those signers being additionally liable 3rd party technical experts.
- fsckboy 2y ago
  >There was no bug or vulnerability flaw when code is law, there can't be any bugs or vulnerabilities, only features.
yapyap 2y ago
“skibidi is toilet” what r u talkin ab?
unyttigfjelltol 2y ago
Yes! A "cleverly masked exploit that altered the smart contract logic"[1] = congratulations!! the contract gives you $1.46B free money!! I anticipate that the defi community will celebrate the inexorable operation of their logical contracts. [1] https://cryptonews.com/news/bybit-crypto-exchange-faces-1-5-billion-suspicious-outflows-whats-going-on/ https://cryptonews.com/news/bybit-crypto-exchange-faces-1-5-...
acc_297 2y ago
^Yep When you decentralize finance like this what becomes okay to do according to system rules is exactly what is possible to do according to system rules. We don't have humans in that loop anymore to enforce moral judgments about what constitutes unlawful theft (except for 1 or 2 rare "hard-forks" of various blockchains to reverse devastating transactions). I feel bad for people who lose large volumes of cryptocurrency to malicious actors in the same way I feel bad for people who lose large volumes of real money to a casino. It is 2025 now and we all know that anyone who can somehow get your private-key to whatever blockchain backed assets you have "owns" those assets just as much as you do and they are permitted to take them under the rules of the system so whatever you do do not lose that key. There is no higher arbiter of justice in this space so use it at your own risk.

huang_chung 2y ago

Society has devolved a bit when not long ago a heist like this would involve sieging Nakatomi Plaza, now it takes just finding a bug in someone's defective Python codes.

Klaster_1 2y ago
I wonder how many programmers resort to crime after they were laid off and couldn't find a job. Like soldiers after a war.
- skeeter2020 2y ago
  not related to the current western market, but countries like Romania pre EU had a huge surplus of soviet-educated young people and no jobs. This definitely increased their involvement with "informal" economies for some time.
- EVa5I7bHFq9mnYK 2y ago
  Most likely these programmers are serving in the DPRK Unit 180.
- adhamsalama 2y ago
  That's pretty much what ex-IDF members do, but they set it up as a company so it becomes legal somehow, I guess...
- wyre 2y ago
  That might make for a good book or movie plot.
  - NetOpWibby 2y ago
    Starring Rami Malek, Tom Holland, Kyla Pratt, and George Clooney?
  - mablopoule 2y ago
    It was the basis of the plot of the first Jurassic Park movie. All shenanigans started because Dennis Nedry, the parc IT manager, disabled some security system at a bad time so he could sell some company secrets to concurrents. There are interesting character analysis to do between the book and the movie version, where the book version or Dennis Nedry is way more sympathetic (even if flawed), he's a extremely talented IT guy who was undersold the amount of work to do in the park, kinda stuck doing unpaid overwork in a remote island and generally been fleeced by a way more villainous book John Hammond.

faefox 2y ago

[flagged]

tombert 2y ago
The genius behind crypto is that it's not just the extremely gullible. I know a fair number of really smart people, academics even, that have bought into the cryptocurrency hype. It has this kind of veil of "high techness" to it that is appealing to smart-but-uninformed people (like me in 2021). I'm embarrassed that I fell for it, but on the bright side it does make me a bit more sympathetic for other people who also fell for it.
- tdb7893 2y ago
  Being smart or academic does absolutely not mean these people aren't gullible.
  - tombert 2y ago
    I know, but it is inversely correlated. I don't think most academics would fall for the "Nigerian Prince" chain emails, or the "Romance Scams" you see on YouTube, which are things I usually associate with extremely gullible people.
- hinkley 2y ago
  Crypto: where Kernighan’s Law meets con artistry.
- akritrime 2y ago
  To be honest, a distributed logic execution engine is an interesting tech, it just isn't something to build any high value economy on top of.
  - tombert 2y ago
    Sure, I'll totally acknowledge that some of the distributed algorithms that have spun out of the blockchain are pretty cool, and I'll even go as far as to say that maybe someday we'll find some very cool high-value uses from them. Pretend money, at least in my opinion, is not one of those uses.

chabes 2y ago

From the article: > The wallet in question appears to have sent 401,346 ETH ($1.1 billion) as well as several other iterations of staked ether (stETH) to a fresh wallet, which is now liquidating mETH and stETH on decentralized exchanges, etherscan shows. The wallet has sold around $200 million worth of stETH so far. If you showed me a paragraph like this a decade ago and told me it was from 2025, I would have a difficult time believing you.

netrap 2y ago
Just crazy. Bank heists fully online...
- yard2010 2y ago
  It's a cold wallet which means it should never be connected to the internet, so not entirely online, but yes - these are the wild wild west times of the internet. Imagine how easy it was to go into a bank shoot some people and get out with money, and doing it like, daily? monthly? Today it's not possible.
  - kzrdude 2y ago
    Apparently there was a path from the internet to the wallet anyway, that's what it sounds like.
    - aaronmdjones 2y ago
      So it was a lukewarm wallet?
      - desumeku 2y ago
        What supposedly happened is that malware was installed on every multisig key signer's device and then the hacker showed them all a fake transaction that looked legit but actually changed the smart contract of the cold wallet to give him access.
2y ago

tw1984 2y ago

another "exchange was hacked" story, why I am not surprised.

notfed 2y ago
"Oops, we were hacked, hehe, guess we'll have to shutdown. Oh and our CEO will be moving to another country."

sleazebreeze 2y ago

What are the chances that a Bybit insider is behind this?

hinkley 2y ago
Or former insider. I spent several years pointing out to my last employer that every former employee could have walked off with secrets that allowed them access to our backends. The were already slowly working on hardening write access but read access was still being worked on a couple months before I left, when I got to write about half of the last mile code for the user facing bits. This is not a unique experience by any means. I’ve seen this sort of thing enough to pay attention when acquaintances bitch about it too.
- Falimonda 2y ago
  Are these business-owned exchanges and managed wallets not fundamentally incompatible with making guarantees of security? Is anyone doing it the "right" way and what does the right way even look like?
  - hinkley 2y ago
    I don't know the answer to that, I only have guesses. But one mistake we make over and over is that we write code that just does its best to answer questions as quickly as possible. And when those questions show up 10x as quickly as they have any other time in our company history, they either just plug right along or maybe throw an error. Someone shouldn't be able to empty a billion dollars out of an exchange in 10 minutes, unless they do $250B in daily traffic. And I suspect most of them can be, and in even less time than that.
mvdtnz 2y ago
10000%. You would have to be soft in the head to not conclude that's the case.

tombert 2y ago

The entirety of the cryptocurrency world is so obviously a "Chesterton's Fence" situation. Every pseudo-intellectual thinks that the fiscal world is "too complicated" and they're going to "simplify" it by making some token, only for people to realize that the monetary world is just complicated, and they have to reinvent everything that already existed in the traditional banking system. I had to do some work on an ACH system a couple years ago [1], and I read through a large chunk of the ACH standard, which was about 800 pages. It's easy to see and hear that and think "that's way too complicated, what could possibly be so hard about money transfers that necessitates an 700 page specification??", but as I read it and saw how many edge cases it took into account, it was easy to see why it got so huge. It turns out that dealing with money is just a really hard problem at scale. I fell for the cryptocurrency hype of 2021, and I will fully acknowledge that that came out of a complete lack of understanding of how fiscal systems work. I wish everyone else would just grow up already. [1] Usually disclaimer: not hard to find my work history, it's not hidden, but I ask that you do not post anything about it (or at least any proper nouns about it) here.

htrp 2y ago
The crypto community continues to speed run the history of traditional finance. [1] https://news.ycombinator.com/item?id=31777761 https://news.ycombinator.com/item?id=31777761
- a_tartaruga 2y ago
  It's only a matter of time until we get a railroad track laying network secured by proof of railroad track (PoRT) and recreate the panic of 1873.
erikpukinskis 2y ago
For what it’s worth, I’m a “crypto believer” and I have never considered ease of use to be one of its selling points. What you are describing are the systems of power which create a stable financial system. That is, one where you can put a nickel into a bank account and expect it to be there in a year or a hundred years. That indeed requires a complex web of power structures, because its top line goal is to be stable and dependable. And stability within a complex landscape requires an equally complex network of power. Crypto provides the exact opposite value: it cannot be controlled, no matter how robust your power structure is. It can be insured, at a significant cost, but not controlled. That means in the face of even totalitarian powers someone could still move crypto across any boundary that is permeable to information, which it turns out is a set that roughly approximates the set of all boundaries. This is a terrible way to pay for candy bars, because candy bars are not worth insuring. But what I think the crypto opponents miss is that there is a set of transactions—some criminal, some legal, some immoral, some righteous—which cannot be made in a state controlled financial systems. And that these transactions are what gives crypto value as a currency. To me, where I would like the debate to go is not “is crypto a scam?” but “how does society protect people from the violence facilitated by crypto?” Yes, financial “violence”, which can be insured against, but also real violence: human trafficking, extortion, etc. We anarchists sometimes like to pretend that without rulers we will be freed to care for each other. But in the shadow of a history of violence, there will be more violence too. And the “crypto is a scam” argument I fear is a red herring that distracts from this, the real issue.

fjjjrjj 2y ago

More like byebit. Unregulated asset exchanges. Haven't we been there before a loong time ago?

walterbell 2y ago

Bybit CEO Ben Zhou wrote on X that a hacker "took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address." "Control" has a specific meaning under UCC Article 12, which was ratified in 2022 and is slowly being adopted by U.S. states. It links some rights to control/possession of keys, even if a blockchain asset may have been stolen before being sold, https://www.clearygottlieb.com//news-and-insights/publication-listing/ucc-digital-asset-amendments-finalized https://www.clearygottlieb.com//news-and-insights/publicatio... > Article 12 – dealing directly with the acquisition and disposition of interests (including security interests) in “controllable electronic records,” which would include Bitcoin, Ether, and a variety of other digital assets ... a good faith purchaser for value who obtains control (a “qualifying purchaser”) takes its interest free of conflicting property claims... Control under Article 12 is designed to be a technology-neutral functional equivalent of “possession.” It generally encompasses circumstances when a party has the “private key”

adastra22 2y ago
What is the purpose of this comment?
- walterbell 2y ago
  It describes the legal status of stolen cryptocurrency changing after the first sale. This HN story is about stolen cryptocurrency. In particular: > The wallet has sold around $200 million worth of stETH so far If some of those sales took place within jurisdiction of a U.S. state that has ratified UCC Article 12, then the buyer of the stolen cryptocurrency is now the new legal owner.
  - adastra22 2y ago
    The hacked coins are not "free of conflicting property claims."
    - walterbell 2y ago
      > The hacked coins are not "free of conflicting property claims." 2023, American Bar Association, https://www.americanbar.org/groups/business_law/resources/business-law-today/2023-june/how-to-create-a-floating-lien-on-digital-assets/ https://www.americanbar.org/groups/business_law/resources/bu... .. “take free” regime introduced by the 2022 UCC Amendments for these assets. Under these rules, a person who acquires a CER for value, in good faith and without notice of any conflicting property claims, is deemed a “qualifying purchaser” and, as such, takes it free from any preexisting property claims. The 2022 UCC Amendments draw heavily from the UCC Article 3 provisions for negotiable instruments, and these provisions have the effect of making CERs negotiable. It follows that if a secured creditor obtained a security interest in CER inventory and only perfected by filing, that creditor would be at risk of the debtor disposing of the collateral and transferring control to a qualifying purchaser that would take it free from any competing claim.

scrlk 2y ago

I wouldn't be surprised if Bybit cuts a deal with the hacker to return the funds. There's no way that $1.46 billion of marked ETH can be liquidated and off-ramped to fiat.

adastra22 2y ago
That’s well within the daily trading volume.
- scrlk 2y ago
  Exchanges will blacklist the addresses that hold the hacked ETH. They won't be able to deposit, or if they can deposit, the ETH will be frozen by the exchange.
  - cherryteastain 2y ago
    Tornado cash and similar exist
    - theamk 2y ago
      So? Taint entire mixer output if any of the inputs is tainted. After a few instances, no one wpuld want to participate. If someone complains, remind them that Tornado is illegal in US.
  - theamk 2y ago
    I am sure there are still plenty of suckers who believe the whole "cryptocurrencies are fungible" narrative, and would get those ETHs with a discount.
  - medellin 2y ago
    It is on eth and they can use decentralized exchanges.
    - scrlk 2y ago

ArtTimeInvestor 2y ago

When even professional companies that have billions of dollars under management can't securely manage their crypto assets, how likely is it that individuals can?

kangda123 2y ago
It's a different ball game. The resources that went into executing this kind of hack were probably far higher than most wallets are worth anyway.
- acc_297 2y ago
  Maybe not - a number of high-value past hacks have been very low effort I have yet to see a thorough explanation of what specifically was hacked here anyhow
deleted 2y ago
[deleted]

UncleMeat 2y ago

"Please rest assured that all other cold wallets are secure." Unreal.

otabdeveloper4 2y ago
He means "...secure. (For now.)" He just left off the implied part.

mkagenius 2y ago

A crypto exchange WazirX was hacked for ~$300M, roughly 50% of the users fund gone. There is no action on the CEO since the hack in July 2024. He sits in Dubai. He just got a nod from Supreme Court of SG to just average out the funds and distribute it among the users. No action has been initiated against the company/ceo for losing the fund. He is geared up to launch another company/exchange.

EVa5I7bHFq9mnYK 2y ago
Atomic Wallet users lost $100M in June 2023 hack, the company continues to operate as if nothing happened, no word of any restitution to the users.
ycombinatrix 2y ago
What action can be taken? There's no law against getting hacked or being a moron.
- ghhrjfkt4k 2y ago
  There is a law against gross negligence. Holding client money comes with other obligations too.
  - joshstrange 2y ago
    It’s not money though. It’s property at best. It doesn’t get held to the same standards. CryptoBros are all about “no laws, do whatever” right up until the, inevitable, point at which /they/ are getting swindled and then they want to cry foul and run to the authorities. It’s just like the whole DAO situation which showed “Crypto is immutable and we want to live and die by the code unless of course someone finds a flaw in the code and steals our money, then we will roll back the immutable chain to recover it” what a farce.
    - Saline9515 2y ago
      Ethereum wasn't rolled back after TheDao hack, they simply forked. Also crypto is about uncensorable transactions, not lawlessness.

insane_dreamer 2y ago

Given how many of these exchanges have been hacked (or were fraudulent), how is it that people still use them?

jauntywundrkind 2y ago

Terrifying to imagine how much funding terrorist states might be getting by hacks like this.

a_tartaruga 2y ago
One in particular gets about 1 billion dollars a year. Already hit their quota in February

deleted 2y ago

[deleted]

rkagerer 2y ago

There's some info and speculation in these two (distinct) articles, but I'd love to know technical details of where the gaffs were. eg. Was client software compromised? Did the multisig keyholders succumb to social engineering? Were the signers using airgapped machines / hardware devices? https://archive.ph/YMZrq https://archive.ph/YMZrq https://blockworks.co/news/bybit-hack-raises-security-questions https://blockworks.co/news/bybit-hack-raises-security-questi...

cypherpunks01 2y ago
A huge problem with signing EVM transactions using hardware wallets is that is common to be blind signing messages. The device has no knowledge of the SAFE EVM contract functions or any other context, it just asks you to sign an gobblygook opaque binary message so you may have no idea what's being signed, is my experience using multiple different vendor HW wallets. Not sure if that's what happened, but possible this type of problem contributed to the exploit. BTC TXs are simple enough that all HW wallets can basically display what's happening, but with turing-complete arbitrary computations in EVM this becomes very difficult.
- killerstorm 2y ago
  In almost all cases EVM smart contract interaction looks like a function call which can be easily decoded into JSON if you know ABI. HW wallet doesn't need to understand the contract logic, it just needs ABI, which is generally a simpler task. Also it can show the name of function you're calling as selector is a hash of a name. Safe is a bit more complex as it also wraps it in EIP-712 message, but that can also be decoded in a systematic way.
- deleted 2y ago
  [deleted]
- rkagerer 2y ago
  Thanks for spelling this out, the explanation makes a lot of sense. You'd think they could at least show a blockie representing the contract, or reputational party who cryptographically vouched for it.

medellin 2y ago

Old man yells at cloud vibes every time a crypto post comes on HN. No interesting discussions ever. Just axes being sharpened and people who dislike it taking the opportunity to gloat. I would characterize the pro crypto people but I don’t see any. Which is said because over the last 5 years I have found crypto, bitcoin, and stable coins to be extremely useful when helping family members in emerging markets. But hey it’s all trash, the west doesn’t need it so let’s all dance on its grave.. i guess we will keep dancing for another 15 years.

ddorian43 2y ago
There's no interesting discussion to be had. That's the simple reason you always miss.

throwaway_v 2y ago

woops

zer0x4d 2y ago

I'm a huge crypto believer but I can admit that we don't have a serious system if a person can just transfer over $1.5B from a well known crypto cold wallet to different accounts with nothing flagging it and no way to reverse it.

stouset 2y ago
In the face of the never-ending list of these kinds of events, the laughably impossible task of average nontechnical individuals protecting their own assets (and the consequence of total financial ruin when they fail to do so), the overwhelming number of and size of scams, rug pulls, fraud, outright Ponzi schemes, and on and on and on… what exactly is left to keep anyone a “huge believer”? Put differently, it’s been seventeen years of constant and escalating mayhem. What would finally be enough to shake your faith?
- desumeku 2y ago
  Maybe when it stops escalating and getting bigger and bigger and continually growing over time?
- EVa5I7bHFq9mnYK 2y ago
  In 17 years, USD holders got hacked for 65% of their money (based on gold, or eggs, prices). At the same time, btc holders ... you know.
  - stouset 2y ago
    In 17 years, the value of my traditionally-invested assets (VTSAX) went up 700%. I didn’t risk losing everything to scams. When I forgot my password my brokerage was able to restore my access. When I made a mistake in a transaction I was able to call them and sort it out. Meanwhile, despite the incredible runup of BTC I know precisely zero Bitcoin billionaires. I know people who have theoretical fortunes on hard drives that have died. I know people who mistimed purchases and sales and who’ve perhaps turned a small profit. I know people who turned a large profit and then lost it all to malware or exchange failure. So yeah, I do know what happened to the BTC holders.

qingcharles 2y ago

Can someone even explain what Bybit is actually about? I searched around when the hack was announced, but I'm very confused. Mostly what I saw said "scam" on it. This isn't your run-of-the-mill Coinbase style exchange, right?

cypherpunks01 2y ago
It's the second largest crypto exchange by volume globally, behind Binance. Specialized in derivatives but they have lots of regular retail products that you might find at Coinbase. Basically like a bigger version of Coinbase from Asia.
billfruit 2y ago
Also a major sponsor of Red bull Racing in Formula 1.

rNULLED 2y ago

> have a wallet, work at bybit > understand backdoor > steal money from your account, some from others > bybit pays you back > still have money you stole

thesumofall 2y ago

In case of a state actor just imagine the weapons that could be bought with this kind of money and the potential lives lost due to this mess

Geee 2y ago

There should be something like a "finalizing transaction", which both the sender and receiver need to sign after the first transaction has been mined, i.e. like an in-built escrow. If it's not signed by both, then funds are returned. This wouldn't protect against key leakage, but in this case, the tx was signed by accident. This would also protect against sending to wrong address.

Mengkudulangsat 2y ago
This would also protect againts dusting attacks. Illicit addresses sending to thousands of random recipients and making them all marked by automated KYC systems.
tromp 2y ago
There are cryptocurrencies in which transactions must be signed by both sender and receiver, such as those implementing the pure Mimblewimble protocol. > Both the sender and receiver need to sign after the first transaction has been mined That makes no sense; miners don't mine transactions unless they're guaranteed to be valid. All signing must be done before transactions are even published. Otherwise one could DoD-attack the network by having it forward tons of invalid transactions.
- vlovich123 2y ago
  You’d mine the first transaction which is a nominal value but the rest of the transaction won’t get mined until that first transaction is signed by both parties indicating acceptance. You could even break it down into an arbitrarily multi-stage process where the next stage is exponentially larger more money (i.e. transfer $100, then transfer $1000, then $1000, etc). This would make the accident “hit a button and lose a B right away” much harder to pull off. Of course, in this case I don’t know that it would help as I believe the attacked party signed approval to change the contract itself.
- dcow 2y ago
  What does DoD stand for, in this context?

Animats 2y ago

Who says ByBit can cover the loss? The article title says that but the article quotes do not. The CEO only said that their other cold wallets are intact and that withdrawals remain normal. Bybit claims to be regulated by the Virtual Assets Regulatory Authority of Dubai.[1] But the lookup page at VARA says they only have "In-principle approval", not a full license. "Applicants holding an IPA are strictly prohibited from initiating operations, conducting any virtual asset activities, or servicing clients until they have obtained their full VASP licence from VARA." Uh oh. [1] https://www.vara.ae/en/licenses-and-register/public-register/ https://www.vara.ae/en/licenses-and-register/public-register...

nprateem 2y ago
They're probably just saying that to avoid a run.
zaphodias 2y ago
> Who says ByBit can cover the loss? CEO on X
- Animats 2y ago
  Right. If you have a balance in ByBit, get it out NOW.
- deleted 2y ago
  [deleted]
- DonHopkins 2y ago
  When has the CEO of a cryptocurrency exchange ever lied before? What possible motivation would he have to not tell the truth, the whole truth, and nothing but the truth? Harumph!!! Gentleman, please, rest your sphincters! https://www.youtube.com/watch?v=g2Bp8SqYrnE https://www.youtube.com/watch?v=g2Bp8SqYrnE

plantain 2y ago

How on earth is it possible they can cover a 1.5B loss? Are they really sitting on that much profit, or is the goal to ponzi it out from here, MtGox style?

jqpabc123 2y ago
How on earth is it possible they can cover a 1.5B loss? Easy! They give Binance an IOU in exchange for 1.5 billion BUSD which is just "minted" out of fresh new electrons. Neither of them has really lost anything. Everyone can carry on as if it never happened. In the bizarro world of crypto, this is business as usual.
- killerstorm 2y ago
  How it it different from what banks do? (Except for a central regulator.)
  - tonyhart7 2y ago
    FEDS can print money while Binance does not
    - skeeter2020 2y ago
      not exactly true - Binance is indeed "printing money", just with no centralized regulation. When the Feds do it the expectation is that they are aware of the long-term impacts of doing so, and include in their calculation. For crypto it's the opposite: do it before you erode trust & goodwill to the point where it's no longer valuable. I see it more like it is very different than printing money in a economy that's perceived as stable and quite similar to printing money in one where the people have no faith in the value of sovereign currency. So the crypo-promoters are right about the use-case in certain jurisdictions, but the problem is that's not where the wealth is, so they target rich economies that tend to have stable government currencies & established banking, and do not need crypto for legitimate tasks.

nodesocket 2y ago

My understand is that the original transaction was a small fraction of the total balance of ETH in the wallet. How then were they able to liquidate the entire ETH wallet?

russnes 2y ago

Kim Jong 1337 hacker strikes again

sub7 2y ago

These are not hacks, just like Mtgox, Celsius, FTX etc etc etc were not hacks. These are crypto insiders supporting the stablecoin so they can print and set a floor on prices before/during potential mass sell off events.

czhu12 2y ago

Their English Wikipedia page is deleted as of 1:42am pst. Any idea what that’s about?

deleted 2y ago
[deleted]
codetrotter 2y ago
https://en.m.wikipedia.org/wiki/Bybit https://en.m.wikipedia.org/wiki/Bybit shows the history of deletions and creations of the page. The current deletion is for reasons that include lack of NCORP (Notability (organizations and companies)). And they back that in turn by saying that the sources are weak. I understand on one side that they don’t want every company in the world to have a Wikipedia page. Because the point of Wikipedia is not to promote or legitimise every company in the world. But you’d think that at the point where widely covered news of a hack leading to a loss of a billion dollars and a half, would be reason to have a Wikipedia article about it. And instead they went and deleted the article today. There’s probably additional editing of the page itself that you can dig into the history of if you want to see what happened during the past couple of days leading up to the page being deleted again. For me, I’ll file this under Wikipedia Editors gonna Edit. They have all kinds of edit wars and page deletions going on all the time in the background that the rest of us mostly don’t even notice most of the time. And all over I’m still happy with Wikipedia for all of the information it has collected within.
- card_zero 2y ago
  It could be resurrected if there are multiple news stories making it notable for being hacked. It would have to be rewritten, though, to give it substantially different content. https://en.wikipedia.org/wiki/Wikipedia:Speedy_deletion#G4 https://en.wikipedia.org/wiki/Wikipedia:Speedy_deletion#G4 Here's the discussion from the second time it was deleted: https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/Bybit_(2nd_nomination) https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletio... They're basically saying "nah, that's spam". So when it was recreated yet again, of course it was speedily terminated with prejudice because it just looks like another spam attempt. Not sure if there's a rule against covering news stories. Seems like we wouldn't want an article on every news event (I'm pretty sure there is a rule against that), but Crowdstrike got an article.

ChrisMarshallNY 2y ago

As Frank Drebin would say, “Nothing to see here.” https://youtube.com/watch?v=aKnX5wci404 https://youtube.com/watch?v=aKnX5wci404

ycombinatrix 2y ago

>Bybit CEO Ben Zhou wrote on X that a hacker "took control of the specific ETH cold wallet and transferred all the ETH in the cold wallet to this unidentified address." Um how tf does a cold wallet get hacked?

w_TF 2y ago
Have to wait for a post-mortem, but there was some speculation from Ben earlier in his spaces. They used a gnosis safe which is a smart contract multi-sig wallet that is pretty much the gold standard for Ethereum. They believed that all of the signers' pcs were hacked and that the UI for signing was staged with a fake element to make it appear like a normal transfer. They were signing with hardware wallets, but it's hard to verify what you're signing from a ledger typically. What they ended up signing instead was an upgrade to the smart contract giving control of the gnosis safe to the hacker who then drained it.
- ycombinatrix 2y ago
  Thanks for the explanation. It wasn't a cold wallet.

lofties 2y ago

> "Please rest assured that all other cold wallets are secure. All withdrawals are normal," he added. There are no American infidels in Baghdad. Never!

cmcaleer 2y ago
I'd probably bet on this being and staying the case. Bybit needs to look as strong as possible here and they probably have a bunch of willing lenders. The second they have to pause withdrawals and look weak, it could be game over from the (additional) reputational damage.
stef25 2y ago
Chemical Ali ?

fennecbutt 2y ago

And they keep everything in one wallet why?!?! Surely you'd allocate a new wallet/1m roughly and always keep it spread.

Kurtcheng 2y ago

[dead]