a few notes on this:

- imo it’s negligent for this amount of capital to be in one multisig and not split up. too big of a target. yes, splitting it up can create other types of vulnerabilities but total loss of funds is worse.

- at this size, signers need to be independently verifying what they’re signing every single time. you simply cannot trust a frontend to display transaction calldata etc. unless it’s being run locally. that is par for the course at this level of security.

- this exploit is due to social engineering, not a failure of ethereum. each signer had malware on their device which misrepresented what they were signing. this could have resulted in many different types of exploits, crypto or otherwise.

- we need better professional custodians that deal with this type of security at a very high level. coinbase’s practices are the gold standard here, others need to catch up.

https://warpcast.com/matthewb/0x030b4c16

absurd

app.intersend.io via sequence. pimlico. poap. polygon. metamask. paxful. flipside crypto. dash. bridgewater. darpa. secdef. navy. dia. linktr.ee/alexanderchopan

We need better noncustodial software and transparent signers and better anonymity to hide from bad actors. starting with rpcs