EthFinance

What a crafty hack. Pyongyang is now on par with Dubai, New York, and Zug for being a hotspot of crypto innovation.

If draining a multisig cold wallet managed by a competent professional team is now in the realm of possibilities, how can we expect corporates and normies to embrace the tech (let alone self-custody) without strong layer-0 guarantees and insurance?

And if we do implement those, how is it not just TardFi and the FDIC with extra steps?

Aviator, diver, Etherean, nexialist, PhD in aviation ∩ climate science | Host of /diving /ethfinance /eth-staker /geopolitics /science /singapore /thomas

IDK about a detailed formal PDF yet, but Bybit has explained that their multisig signatories had been hit with malware used to obfuscate the real transaction, which tampered with their smart contract

This is an S-tier supply chain attack

app.intersend.io via sequence. pimlico. poap. polygon. metamask. paxful. flipside crypto. dash. bridgewater. darpa. secdef. navy. dia. linktr.ee/alexanderchopan

Agreed, in hindsight I should have added “presumably”

It's a multisig gnosis wallet with signing keys on ledger wallets. This isn't remotely a "competent professional team"'s version of cold storage.

If pros can’t stop hacks, how do we sell normies on self-custody?

Calling a network connected process “cold” instantly cancels any discussion of “competence”.

Hackers are everywhere and pervasive, please protect your wallet