grey-area
Joined 14 years ago
Joined 14 years ago
https://www.fastmail.com/blog/fastmail-offers-eu-data-region...
Binance has cold wallets and hot wallets. The hot wallets used to be small and therefore low value, but have grown to be huge, without anyone really paying attention. The hot wallets have much less ceremony attached to moving money, as they are required to move money multiple times a second to track customer inflows/outflows from the system. There are no controls or transaction limits on the hot wallet because it's just a bitcoin wallet (or set of wallets). The hackers got access to the system via the dev machine, found the hot wallet keys in the system (which it requires to function), and simply started draining it of funds, it turned out the hot wallets contained a LOT of funds.
That doesn't require in-depth knowledge of Binance operations, all they need is access to hot wallets via the keys which we know the app would need to have in order to use it.
The lack of controls on the Binance side here is astounding, but it does appear like they had no safeguards, limits or monitoring on the hot wallet in spite of the money involved, or if they did they kicked in too late.
Partly this is a problem with the crypto itself which underlies their system: it's designed to be permissionless and without controls slowing down or reversing transfers.
It seems very unlikely they have $3-6B lying around ready to repay customer deposits. At the very least this would be catastrophic for them if they do lose all that money.
Have they re-enabled withdrawals yet? If I were a customer I'd be taking everything out as soon as possible.
Is encrypting data at rest useful when the app must have access to decrypt the data? What sort of scenarios do you use it for and where do the keys live?
Yes it will lead to new bugs, but the older code probably contains a ton of bugs already and is probably difficult to update (original writers long gone, docs out of date etc), so this is probably the best way out of that situation, as long as proper support is given afterwards so they don't end up in the same situation a year later (this is the hard bit).
The ra-ra commentary from the CEO is somewhat off-putting, but the idea is not all bad.
It's a bunch of text files in a repo with massive churn (all new version 5!), but somehow even the technical debt 'skill' (i.e. text file) has technical debt itself:
https://github.com/DietrichGebert/ponytail/blob/main/skills/...
> ...every ponytail shortcut is marked with a shortcut: comment ... (older code may say ponytail:).
We'll see whether Tether has the assets they claim when the next crypto winter comes. Till then I think we'll have to agree to disagree.
Hardly anyone actually uses crypto anymore, silly ideas like NFT, rewiring the financial system, asset tracking and apps on the blockchain have died, and all that is left are the last bag-holders, fraud and extra-legal financial transactions.
So there are good reasons to be skeptical of his statements.