YHK - yet another hacker news clone

When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.

And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.

  * Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum 
  * Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
  * Encrypting data at rest

"Claude, steal as much crypto from Binance as you can. Make no mistakes."

The article says preparation started 36 hours before.

Binance saying it has $6b+ is obligatory. We'll find out soon enough

Bybit covered $1.5B last year, so it shouldn't be surprising that Binance, a much larger exchange, is able to cover 4x more.

I think people here underestimate how profitable these exchanges are.

Does this work?

First 10 minutes: Making a team, 2 guys or gals living a life, talk about it

11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up

31-40: But we need money, no one is paying our bounties

41-50: How about? They do not tell what it is

51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)

61-70: Dry Run, text scrolling on the screens

71-85: The Hack, split screens, zoom in and outs

86-88: Oh it was Solozzo (Binance) all along, not Starlink.

89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car

Crazy thought, but what if they went via the Claude Code trojan?

Not saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.

[0]: https://www.bbc.com/news/articles/ce9p6x5ylrzo

[1]: https://www.bbc.com/news/uk-england-tyne-67586863

Isn't the anthropic hack a day late?

The supply chain attack had a software bug which raised error messages that were discovered by a security vendor. I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.

Recency bias. I don’t see much evidence that the two things are related other than the coincidental timing.

https://en.wikipedia.org/wiki/Recency_bias?wprov=sfti1

If you need crypto to avoid the legal framework when transferring value, accept the risk and operate accordingly. If you want crypto exposure as an asset class, find a custodian who will hold the crypto for you offline, prove it is offline, and allow you to borrow or otherwise leverage it as an asset on fiat or traditional rails that provide you recourse. Anything else is pointing a gun at your feet.

Analogy is holding and trading gold underground that hasn't been mined yet using securities or other representation subject to capital market regulations and the legal framework. Is it an asset? Yes, if proven, documented, etc. Is it safe? Yes. Will you get your value back if stolen? Most likely.

But having live value on rails that enable instant movement globally with no recourse for unauthorized transfer? You're gonna have a bad time.

I agree with you. Is there a name for this logical fallacy?

I equate it to anonymity on the internet. Yes, if everyone had to associate their real identity with everything they posted on the internet some unjustly persecuted individuals would not be able to get their stories out. And there would be a heck of a lot less other bullshit.

I think crypto lead in 99% of cases just to bad actors and use-cases, I still have to encounter one real success story of someone using crypto successfully long-term or to pay for legit, legal stuff where a different method was not allowed due to unfair restrictions.

I am a regular guy but I just never understood the point of Crypto other than for scams and get rich quick schemes. Not to mention it still is tied to the dollar for value which defeats the entire purpose doesn't it ? I thought it was supposed to be an independent currency. And then you have companies like coinbase which are centralizing something that was supposed to be decentralized ? I just don't get it.

The value crypto does bring to the world is this:

The unbanked, like myself. People that for any reason is being locked out of the "american" way of doing things

Stripe doesn't cover 200 countries, nor does Apple Pay, Google Pay, Paypal, Visa, etc (all american btw). So a parallel banking system is needed, no questions about that, and Binance provides the best of all, and that's why it's being targeted by we know who (just follow the money)

Now, whether if it is crypto or not, I don't care, all I want is the possibility to pay and receive money (USD, EUR or CNY as the top currencies right now) without the draconian restrictions imposed by the hegemons trying to asphyxiate does who don't kneel

That's exactly why we need a parallel banking system, crypto or not

i hope you say the same thing about AI 10 years from now

Notice that the hacking is mostly happening with centralized venues. And that is to say nothing of FTX, Celsius etc.

The original promise of crypto and blockchain was to cut out the middleman and NOT concentrate a lot of money under a few custodial keys.

If you took your crypto off exchanges when not in use, you’d be fine. Not your keys, not your crypto.

Outside of being money for criminals, there is some value for investors. For them, it is a way for their portfolios to get exposure to the booming criminal economy.

I don't disagree, but the way you say that makes my eye twitch uncontrollably. So many of us have spent the better part of those 17 years trying to get the crypto proponents to have a real discussion about it.

> safe from dictatorial countries.

Yeah, that's definitely an argument. But it's kind of funny when the backdrop is that $6B was taken by North Korea.

It feels like a sibling to the popular attitudes towards not trusting big banks, or voting for <candidate> who demonstrably achieves the opposite of what you're seeking, or feeling that democracy ain't working out great, or that vaccines are scary and dangerous. There's just a fundamental lack of higher-order thinking. It's all vibe-based reasoning. What feels scary is what guides these behaviours. Which, I think, is why it's so unsurprising that people in these camps make such unbelievably strong candidates for exploitation.

I thought that the whole point of crypto was money laundering and tax evasion. Like, it's in cryptocurrency DNA, even if people try to squint and see legitimate use cases. Does anyone think otherwise?

I mean, that's what the big mean government does, they monitor financial transactions and they collect taxes. But when we talk about financial privacy from the prying eyes of the government as a goal, and let's suppose people actually use crypto like was dreamed, this necessarily implies crypto being a tool to launder money. (in practice, this is better realized by privacy coins like Monero and ZCash, since Bitcoin sucks for privacy: your address is an anonymous handle but the network leak metadata. But, the desire for financial privacy was there in the Bitcoin community since the beginning).

And what else people do when they can hide their money from the government? In a lot of cases, they don't pay taxes (which is also a disposition present in the Bitcoin community since the beginning, with a rhetoric like, collecting taxes are not legitimate)

What I think was a later development was the main use case for crypto in real world, which is to collect payment for ransomware and things like this. This, I don't think it's something the early Bitcoin community envisioned.

I think that public/permissionless crypto is going to remain a niche. It's clear that there are too many footguns and failure modes for the average user.

But I think private/permissioned chains will gain some adoption in the background of tradfi, especially for settlement, clearing, collateral management via tokenisation etc. Your bank might eventually use technology developed in crypto, but it'll be called 'distributed ledger technology' or 'tokenisation' rather than crypto because of the negative image.

Cryptocurrencies give sovereignty over your own money... and all the bells and whistles that come with sovereignty: You're responsible for keeping your own funds, and life, safe.

Or, they have bot scanners constantly looking for vulnerabilities and acted quickly once one appeared

If they were Americans, they could even buy a presidential pardon

Literally the locksmith paradox