Hacker News

points by panicinducer 3 days ago | 0 comments

Nobody in the entire company should have access to move $billions in crypto, much less a random engineer, even if they're part of the deploy process.

[–] Quinner 3 days ago

They had controls in place to prevent large transfers, so the attackers structured it as a lot of small transfers very quickly

[–] melenaboija 3 days ago

Well, then they need another control that prevents “small transfers very quickly” happening, I guess.

[–] theoreticalmal 3 days ago

Aren’t “small transfers very quickly” kind of the whole point of what Binance does?

[–] IAmBroom 3 days ago

Great hindsight! Anything you want to suggest in advance of it happening?

[–] yobananaboy 3 days ago

Not just that! The EIP-7702 delegation to make the wallet into a smart contract bypassed all of the controls that they had in place on the signer. It's wild that they didn't have a system in place to stop it from signing that transaction type.

[–] tennysont 3 days ago

From my rough understanding, this seems like the main exploit. It seems like the machine with access to the wallet key was presented with a crazy EIP-7702 transaction and signed it (which effectively owned its wallet in a single transaction)[1]. Without knowing their security model, it seems like biggest trust boundary should be between that signing machine and everything else.

[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail

[–] yobananaboy 1 day ago

They had to sign 50 of them because they had to compete timing the transaction with the normal transactions. Transactions have to be in nonce order for the wallet, and if two transactions with the same nonce are submitted to a block, it is up to the miner / validator to determine which one to put in. So if you spray 50, you can almost guarantee that the transaction you want will get in.

[–] stogot 3 days ago

Is quorum signing not a thing in crypto?

[–] cowlevel 3 days ago

In Ethereum it would be implemented by linking your account to smart contract code, then throwing away your private key so you can only make transactions through the smart contract. The approval of linking to smart contract code is exactly what they signed here - only it wasn't a multisig smart contract, it was something malicious.

[–] tennysont 3 days ago

It is---though I don't see the connection

[–] PeeMcGee 3 days ago

A disgruntled employee wouldn't do the exact same thing?

[–] neutronicus 3 days ago

That's the plot of Office Space!

[–] wahern 3 days ago

Also Superman III, which predates it and presumably was well known to the writers. But I have an inkling the scheme and it's infamy go back much further. (Precious metal coin clipping/debasement?) It's one of those ethical questions, like a pauper stealing bread, or thought experiments, like "what if reality is just a dream" that many if not most people encounter during their formative years. Per usual, though, the chasm between theory and application (even just identifying real world potential when it matters) is the toughest one to cross.

[–] vondur 3 days ago

They also mention that in the movie.

[–] otterley 3 days ago

https://en.wikipedia.org/wiki/Salami_slicing_tactics

[–] wolfi1 3 days ago

there's even a Peter Ustinov film from the 60s

[–] theoreticalmal 3 days ago

Where’s Milton when you need him??

[–] burningChrome 3 days ago

If they did and didn't account for a simple scenario like this happening and built in roadblocks and friction to prevent it from happening? Then it would stand to reason their entire EIS team should be fired.

The fact nobody thought of this is pretty staggering.

[–] littlecranky67 3 days ago

It is hard to imagine they lost 6.3$bn and are not firing people...

[–] Betelbuddy 3 days ago

They just spent 6.3$bn to train them....

[–] stinkbeetle 3 days ago

> They had controls in place to prevent large transfers, so the attackers structured it as a lot of small transfers very quickly

lol that's the worst control I've ever heard.

[–] SpaceNoodled 3 days ago

OK, so nobody else has seen Superman III?

[–] RHSeeger 3 days ago

It is such a weird combination of "I enjoyed this movie" and "this really isn't a good superman movie"

[–] wolfi1 3 days ago

at that time I was not old enough to see it

[–] Animats 3 days ago

Nope.

[–] ForHackernews 3 days ago

Be your own IRM 4.26.13!

[–] long-time-first 3 days ago

I think they did that in Superman 3

[–] jMyles 3 days ago

This isn't a mundane detail, Michael!

[–] theatomheart 2 days ago

best part of this thread so far

[–] fhn 3 days ago

most employees shouldn't be able to touch the funds at all except a handful and probably require supervisor verification (dual factor authentication).

[–] ffsm8 3 days ago

I mean sure, but as long as you can deploy directly any permissions models are meaningless for an attacker? They can just be removed.