a few notes on this:

- imo it’s negligent for this amount of capital to be in one multisig and not split up. too big of a target. yes, splitting it up can create other types of vulnerabilities but total loss of funds is worse.

- at this size, signers need to be independently verifying what they’re signing every single time. you simply cannot trust a frontend to display transaction calldata etc. unless it’s being run locally. that is par for the course at this level of security.

- this exploit is due to social engineering, not a failure of ethereum. each signer had malware on their device which misrepresented what they were signing. this could have resulted in many different types of exploits, crypto or otherwise.

- we need better professional custodians that deal with this type of security at a very high level. coinbase’s practices are the gold standard here, others need to catch up.

we also need to normalize the fact that public blockchains are terrible tools for laundering money.

no way to use a CEX or OTC desk to offramp without full KYC, stablecoins are mostly centralized and can easily be frozen, every transaction is public, etc.

objectively worse in every way from the pov of a criminal org.