> I wonder though how a sensible architecture would look like.
Any withdrawal should only ever be authorized from wallets protected by multisig and every withdrawal should go through several machines, running different implementations of the exchanges' verification part of the codebase, replaying the user's entire deposit/trading/withdrawal history and verifying if the withdrawal the user's asking matches his balance/history.
Devs working on "verification before withdrawal" on one of the stack should be forbidden from ever touching the other stack, and vice-versa.
This would prevent SNAFUs like this one for now at least two devs would need to be independently owned before such a heist could be pulled off.
I'm not saying hacks would be impossible. But the "I still $6 bn in 20 minutes" would be much harder to pull.
Another sensible thing to do would be to not have $6 bn on a warm wallet: I really don't think Binance really that much at all times available on warm wallets?
Nothing is 100% secure: but the "one dev gets its laptop owned, hence $6 bn disappear" is just madness and, as a whole (not speaking about crypto here), we can really do better here.
For a start we can do better than thinking: "Nothing can ever be 100% secure, so there's no way to do better than seeing $6 bn vaporize in thin air when a single dev's laptop gets pwned" (I'm know it's not what you're saying: you're asking what can be done better).
So many are going to think: "But if you do that, it still can be hacked because this and that". Which ain't the point: the point is to make hacks harder to pull off, not to make them impossible to pull off.
Any withdrawal should only ever be authorized from wallets protected by multisig and every withdrawal should go through several machines, running different implementations of the exchanges' verification part of the codebase, replaying the user's entire deposit/trading/withdrawal history and verifying if the withdrawal the user's asking matches his balance/history.
Devs working on "verification before withdrawal" on one of the stack should be forbidden from ever touching the other stack, and vice-versa.
This would prevent SNAFUs like this one for now at least two devs would need to be independently owned before such a heist could be pulled off.
I'm not saying hacks would be impossible. But the "I still $6 bn in 20 minutes" would be much harder to pull.
Another sensible thing to do would be to not have $6 bn on a warm wallet: I really don't think Binance really that much at all times available on warm wallets?
Nothing is 100% secure: but the "one dev gets its laptop owned, hence $6 bn disappear" is just madness and, as a whole (not speaking about crypto here), we can really do better here.
For a start we can do better than thinking: "Nothing can ever be 100% secure, so there's no way to do better than seeing $6 bn vaporize in thin air when a single dev's laptop gets pwned" (I'm know it's not what you're saying: you're asking what can be done better).
So many are going to think: "But if you do that, it still can be hacked because this and that". Which ain't the point: the point is to make hacks harder to pull off, not to make them impossible to pull off.