Feels like bybit isn’t getting enough shit for what is essentially a failure to manage risk properly

Farcaster-native research: https://paragraph.xyz/@matthewb | prev. Juicebox, Nouns, RAW DAO | casting about coffee, hi-fi, and other rabbit holes

a few notes on this:

- imo it’s negligent for this amount of capital to be in one multisig and not split up. too big of a target. yes, splitting it up can create other types of vulnerabilities but total loss of funds is worse.

- at this size, signers need to be independently verifying what they’re signing every single time. you simply cannot trust a frontend to display transaction calldata etc. unless it’s being run locally. that is par for the course at this level of security.

- this exploit is due to social engineering, not a failure of ethereum. each signer had malware on their device which misrepresented what they were signing. this could have resulted in many different types of exploits, crypto or otherwise.

- we need better professional custodians that deal with this type of security at a very high level. coinbase’s practices are the gold standard here, others need to catch up.

yeah, agreed

https://warpcast.com/matthewb/0x030b4c16

That and not storing a billion dollars in a single wallet