4 ms·

Missing from the article - the hacker first compromised Resolv Lab's AWS account, took a private key from KMS that was used to control minting, then managed to

Missing from the article - the hacker first compromised Resolv Lab's AWS account, took a private key from KMS that was used to control minting, then managed to extract $25 million into ETH before all protocol functions were suspended.

thebiblelover7 6mo ago
Do you have a source for that information? I'd like to read more on it.
- layer8 6mo ago
  https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/ https://www.chainalysis.com/blog/lessons-from-the-resolv-hac... https://xcancel.com/zacodil/status/2035658779706974556 https://xcancel.com/zacodil/status/2035658779706974556
abrookewood 6mo ago
It's explicitly mentioned in the article: A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment
- leonidasv 6mo ago
  The link was changed, the old one did not mention it (apparently): https://news.ycombinator.com/item?id=47498220 https://news.ycombinator.com/item?id=47498220
  - rithdmc 6mo ago
    Thank you! I was scratching my head at this, having seen 'Step 1'
WatchDog 6mo ago
> took a private key from KMS They used KMS to sign the minting operation, but they didn't "take" the key, AWS KMS doesn't let you extract keys.
- pants2 6mo ago
  ^ this is a common security misconception in crypto. "We're using an HSM, they can't steal our private key." OK genius now you still have to secure the HSM. There's no shortcut to MPC/multisig with 3+ keyholders.
  - Ferret7446 6mo ago
    It's still significantly better, since access can be revoked, vs a leaked key where you're permanently fucked
    - pants2 6mo ago
      Not much better because even a single signature can drain your whole wallet.
  - WatchDog 6mo ago
    > you still have to secure the HSM Obviously. > There's no shortcut to MPC/multisig with 3+ keyholders. The whole concept of a stablecoin seems to be based on centralised trust. Ultimately there is some org that has the fiat bank account, that mints and redeems the coins.
    - idiotsecant 6mo ago
      Nope, that is the foundation of bad stablecoin. Trustless decentralized stablecoin like DAI exist. People just largely don't do their homework and prefer scams that lure them in with promises of 'yield'
      - Hendrikto 6mo ago
        DAI and SKY are backed in large part by USDC, so they are not truly decentralized. It is possible in theory, but nobody has successfully done it so far.
        6mo ago

thebiblelover7 6mo ago

Do you have a source for that information? I'd like to read more on it.

layer8 6mo ago
https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/ https://www.chainalysis.com/blog/lessons-from-the-resolv-hac... https://xcancel.com/zacodil/status/2035658779706974556 https://xcancel.com/zacodil/status/2035658779706974556

abrookewood 6mo ago

It's explicitly mentioned in the article: A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment

leonidasv 6mo ago
The link was changed, the old one did not mention it (apparently): https://news.ycombinator.com/item?id=47498220 https://news.ycombinator.com/item?id=47498220
- rithdmc 6mo ago
  Thank you! I was scratching my head at this, having seen 'Step 1'

WatchDog 6mo ago

> took a private key from KMS They used KMS to sign the minting operation, but they didn't "take" the key, AWS KMS doesn't let you extract keys.

pants2 6mo ago
^ this is a common security misconception in crypto. "We're using an HSM, they can't steal our private key." OK genius now you still have to secure the HSM. There's no shortcut to MPC/multisig with 3+ keyholders.
- Ferret7446 6mo ago
  It's still significantly better, since access can be revoked, vs a leaked key where you're permanently fucked
  - pants2 6mo ago
    Not much better because even a single signature can drain your whole wallet.
- WatchDog 6mo ago
  > you still have to secure the HSM Obviously. > There's no shortcut to MPC/multisig with 3+ keyholders. The whole concept of a stablecoin seems to be based on centralised trust. Ultimately there is some org that has the fiat bank account, that mints and redeems the coins.
  - idiotsecant 6mo ago
    Nope, that is the foundation of bad stablecoin. Trustless decentralized stablecoin like DAI exist. People just largely don't do their homework and prefer scams that lure them in with promises of 'yield'
    - Hendrikto 6mo ago
      DAI and SKY are backed in large part by USDC, so they are not truly decentralized. It is possible in theory, but nobody has successfully done it so far.
      - 6mo ago