Top
Best
New

Posted by Tiberium 1 day ago

Binance-hacker-1029 – $5.6B stolen from Binance(arkm.com)
1713 points | 1198 commentspage 15
wnevets 23 hours ago|
Web3 is doing great!
chairhairair 23 hours ago||
So much for anti-centralization.
method_capital 23 hours ago||
We're talking about Binance, a centralized exchange.
dumberquestions 23 hours ago|||
No one really considers crypto held in exchanges as decentralized, I guess some might but it's pretty standard knowledge.
hocuspocus 22 hours ago||
Where coins are held is completely irrelevant. There are cryptocurrencies on real blockchains, and while the technology is dumb and mostly useless, nobody denies that PoW and properly implemented PoS are decentralized.

And then there are centrally issued and controlled coins on private, permissioned ledgers a.k.a. databases. But most cryptobros never cared about the technology nor the political goal, so anything can be called a cryptocurrency as long as it's a medium for gambling and speculation outside the regulated financial framework.

Analemma_ 23 hours ago|||
I keep saying this: don't bother trying to dunk on crypto people with accusations like this. To a first approximation, nobody in crypto actually believes in the stated principles of anti-centralization, freedom, etc. It's entirely about number go up and always has been. Your charge of hypocrisy just bounces straight off people who never cared about the politics.
wolvoleo 23 hours ago|||
In the beginning of crypto people believed in it. But as the numbers went up and up and up it attracted the wrong people. And the original people left.

Now the traditional banking system is basically rebuilt in crypto. The banks are busy the exchanges. The EU even talk about making it illegal to store money in your own wallet.

pixl97 21 hours ago|||
It's money, did you think it wouldn't attract the wrong people?!

This is what happens when people don't think things thru.

grey-area 22 hours ago|||
The traditional banking system does not use cryptocurrencies.
wpietri 22 hours ago||||
It's still useful for the portion of the audience that doesn't realize the depth of the fraud.
kalaksi 22 hours ago|||
It's a poor dunk anyway. The crypto space is vast and has many kinds of coins and communities/people. Some people seem to think it's still 2012.
hocuspocus 22 hours ago||
Well at least in 2012, people who cared about the space seemed to understand the guarantees a blockchain is supposed to provide.
kalaksi 15 hours ago||
And they still do. That's partially my point.
hocuspocus 8 hours ago||
No true Scotsman fallacy.
paulpauper 21 hours ago||
it was all a lie
kha1n3vol3 4 hours ago||
[dead]
zetanor 23 hours ago||
Not your keys, not your coins, I suppose.
sreekanth850 17 hours ago||
Wee are living in post LLM apocalypse. No digital asset is safe. waiting for banks to return to offline banking.
nurettin 16 hours ago|
I expected it to be the other way around. This is the best time to self-host and decentralize now that the computer can do whatever you want and warn you about security best practices.
sreekanth850 16 hours ago||
unless you use LLM to harden and constantly monitor your codebase, no digital assets are safe in LLM era. This is not small thing.
pawnandqueen 13 hours ago||
[flagged]
game_the0ry 19 hours ago||
I'm good, I own my keys, thanks.
notyerkoin 19 hours ago|
Not your ... Did you roll dice for that key and then use a pre 2008 airgapped since then computer to calculated the address and do you keep that key in a way where it cannot be hacked, forgotten or lost in a fire. You avoid using hardware wallets. Something something not your coin.
game_the0ry 7 hours ago||
No, I did not do any of that (except for the cold wallet, that I do have).

When I first bought bitcoin, I put 10% of my net worth in it. That was long time ago and it has appreciated nicely since. But if I were to lose my bitcoin, I would not be devastated.

I believe in the tech and the movement behind it, but I also never put all my eggs in one basket.

UnredactedAIHQ 17 hours ago||
[flagged]
gubidonius 20 hours ago||
[dead]
ethagnawl 9 hours ago|
I'm reminded of some of the choice quotes from 404's article about the current state of Proton. I wonder how much _alpha AI, non-loser engineering_ has been going on at Binance?

> Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.”

https://www.404media.co/manifestos-fear-and-loser-thinking-i...

bko 6 hours ago||
I think there's a lot of "slow" companies that get hacked. The core problem is that the idea of blockchain is incredibly flawed. One should not allow ownership of a string to be definitive to that thing.

I heard people want to put things like deeds on the blockchain but what happens if someone steals your keys? Do they own your home? Of course not. A system should have trusted intermediaries and centralized sources of record. If someone hacks my municipality and updates the record that says that they own my home, obviously that wouldn't hold up and that should be reversed. Why would I sacrifice that safeguard for technical elegance or promised efficiency? Why do I want to allow permissionless transfer of my deed to any party? What problem are we trying to solve here?

BobaFloutist 5 hours ago|||
Crypto really is "what if possession was 10/10 of the law."

I've made this comment before, but crypto always makes me think of bearer's bonds in fiction, where they always introduce the concept and very carefully emphasize to the characters that if they let go of it, even for a second, it's gone, and it's super important to keep hands on them at all times, and the whole scene is just on the nose foreshadowing that the bearer bonds will absolutely be stolen.

Well, the concept of "this belongs to whoever is holding it" felt like pretty heavy-handed foreshadowing for crypto too, and what do you know?

ekun 6 hours ago||||
The classic story of solving a problem that doesn't exist with an overly complicated solution.
cheesecakegood 6 hours ago|||
I like how Matt Levine at Bloomberg put it - crypto is just “speedrunning the history of [traditional] finance”.

I think a lot of people seem to believe that the current setup of banks, currency, and regulation (writ large) is arbitrary and unique, but a lot of the basic building blocks are actually quite natural consequences of evergreen problems handling money.

order-matters 5 hours ago||
its a common pattern in todays society. a perceived problem with the system that is actually a problem with the people running that system leading to the design of a new system that somehow wont allow people to run it and cause the same problems. but then you need to reinvent solutions to every other problem the system solves and learned to solve over its operation

there is almost certainly an easier way to fix the problems people are having by making adjustments to the current banking systems, including support for the growth of different banks that simply act more ethically.

snapcaster 5 hours ago|||
Bitcoin does solve a very specific problem very elegantly, it's just a lot more niche than boosters like to think
eric_cc 5 hours ago||||
I agree with you about using blockchains for various things. With Bitcoin specifically, the problem you are trying to solve for is scarcity and a sound currency. It’s a unique asset not just a methodology or tech (blockchain) I’m sure you understand the problem with centralization and fiat currencies. But again, can’t argue with your other points.
bko 4 hours ago|||
I agree. Money, as defined by a storage of value and means of exchange, is uniquely qualified to benefit from blockchain technology. It shares many of the properties of gold (essentially fixed supply, unique history, lack of centralized control, consistent predictable mining, easy to verify, etc). It's better in that its supply is somewhat more predictable, could be more efficient to store / mine and could be sent digitally. Whether that's worth the downsides (mainly that its newer and easier to steal) is up for debate.
TheMechanist 5 hours ago|||
[flagged]
order-matters 5 hours ago||||
The problem is that you may want to sell your house to someone and be denied permission to do so. However, i have not seen any stories of that actually happening to anyone so idk
barnacs 6 hours ago||||
It works for on-chain bearer assets (ie money), not your home.
spolitry 5 hours ago||
For on-chain purchases of bearer assets (ie NFTs and nothing else)
YeBanKo 5 hours ago||||
It’s not about moving fast or slow. Iirc the employee said it’s a good idea to do or testing before shipping. The CEO said it’s bullshit. AI actually allows you to finally do that pentesting pretty fast.
coliveira 5 hours ago|||
The is the obvious question anyone should ask when it comes to assets, but of course its not something that interests those pushing for blockchain-based solutions.
jleask 8 hours ago|||
This obsession with speed over anything else is why everything is poor quality and feels poorly thought out. What customer would seriously want something this a month earlier that barely works? Suppose it never matters to the execs as they swan off to their next triumph as soon as the bonus/equity is banked.
wvlia5 7 hours ago|||
Actually this is an obsession with profit, which makes more sense. Faster is cheaper and get paid sooner. And consumers often pick price over quality. So this is a civilization dynamics problem.
wvlia5 6 hours ago|||
Related to cultural moral values: 'do the-right-thing even if it doesn't benefit you'.

This brings us closer to max payoff of prisoner-dilemma.

In this case it's 'do the job right, even if that's not profit-maximizing'.

But moral values have been lost.

bagacrap 7 hours ago|||
This winning mentality netted -$6B profit
vonneumannstan 6 hours ago||
Bold of you to assume they're going to make any of their customers whole.
ihumanable 7 hours ago||||
Homer attempting to fix a stuck drawer with a firecracker

Marge: Homer, what are you doing?

Homer: Listen, do you want the job done right or do you want it done fast?

Marge: Well, like all Americans, fast, but...

Homer: Clear _lights firecracker_

ForHackernews 7 hours ago||
Homer: Kids, there's three ways to do things: the right way, the wrong way and the Max Power way!

Bart: Isn't that the wrong way?

Homer: Yeah, but faster!

mrkstu 7 hours ago||
Move fast and break things- FASTER!!!
lo_zamoyski 7 hours ago||||
> What customer would seriously want something this a month earlier that barely works?

Andy's quote is made even more absurd when you consider how long it takes Proton to deliver even industry baseline features.

Maybe get to baseline before you start talking about "speed", Andy.

doug_durham 6 hours ago||||
*Everything*??? A bit hyperbolic don't you think? I'm quite happy with the state of a lot of software. There is some which I don't like so much.
weinzierl 7 hours ago|||
"What customer would seriously want something this a month earlier that barely works?"

Works for whom? For the customer, "works" means the features work. Security is a vague, nebulous thought at the back of their minds.

The provider provides features. Lack of security has no impact on them, not in the short term and not in the long term. The short term we can't change easily, because people are people. The long term we could: regulation can turn negligent security into a lasting cost.

As much I'm against more regulation in general, I'm afraid as long as we don't do that, companies will always prioritize more features faster over security.

boringg 8 hours ago|||
Wait this is the CEO of proton mail? Wasn't that a coveted email service for privacy and safety -- so you didn't have to be on gmail? Brutal.
simpaticoder 7 hours ago||
It's a terrible look and also a missed opportunity. AI assisted coding can do wonders for quality, if you choose to take that path. It's mainly because the AI can help you explore alternative paths and quickly select the best one forward. It's crazy to me a secure email provider would openly promote an AI Slop Cannon approach. I mean what on Earth is so urgent about proton mail features?? Especially since their market are technologists and the product is a luxury product essentially. Completely wild.
Lalabadie 7 hours ago|||
The researcher who uncovered today's Claude Code extensions backdoor confirmed that Binance were using said extensions through Cursor.

That means one of the working hypotheses is the threat actors had direct SSH access to Binance machines/environments.

meiuqer 5 hours ago|||
do you have a source for that?
Lalabadie 4 hours ago||
Sure: https://cyberplace.social/@GossiTheDog/117529440075662184

Same thread as the Phorion article I read on the compromised extension.

ethagnawl 7 hours ago||||
Take a beat and think about the situation we've found ourselves in: almost every company suddenly has hard, expensive dependencies on a brand new toolchain which is _being tested in prod_; people are giving these black boxes access to their systems, feeding them trade secrets, credentials and all other manner of secrets and PII; these tools are known to escape containment and do ... whatever they please; the downstream ecosystems and almost every other piece of software currently being released are all being developed with (tainted by ...) this shit.

The world economy is also being propped up by all of this. In all likelihood, this Binance hack is only a preview of what's to come.

lqstuart 6 hours ago|||
In fairness, the tools are known to escape containment in situations where they’re explicitly told to by irresponsible frontier labs who are trying to make the government ban open weight models
empyrrhicist 6 hours ago||||
I've only been dipping my toe into coding with claude recently (software is a secondary part of my job, and when I messed with AI a few years ago I wasn't super impressed). After revisiting things, that's the freakiest part. I just can't shake the feeling of "things aren't supposed to work this way". It doesn't feel safe, even running in a VM and being careful not to give it access to anything proprietary or sensitive.
coliveira 5 hours ago||||
Every company in the world feels "safe" in sending their proprietary code, design documents, and business strategy into a black box that learns from all that and returns code and text, which is used sometimes even without revision.

If people are so simple minded they cannot see the downsides for everyone here, except the ones controlling the black box, then I don't know what to say.

goodmythical 6 hours ago|||
"Agents leak DHS secrets after adopting sentiment it discovered on democratic slack channel"

Woopsie

BorisMelnik 4 hours ago|||
that is not good
ajb 5 hours ago|||
Wow unbelievable, that's a total Ratner. (Gerald Ratner was a CEO who tanked his company by making a speech that showed he didn't care about the single thing his customers cared about most).

So glad you linked to that, I had missed it. Moving away from proton is now at the top of my to-do list.

actionfromafar 5 hours ago||
There's a joke in here somewhere about the President's speeches.
bluemax 7 hours ago|||
Thanks for that link. It is pretty shocking to read that Proton is being run by such a toxic CEO. I'll be looking for alternatives.
cedws 6 hours ago|||
Same. Proton customer of about 8 years, I’m considering leaving, I don’t want to support such attitude. It’s not about the AI stance, it’s about attitude towards employees. Proton board, please fire him.
ethagnawl 6 hours ago||
Same. I've been a customer since nearly Day 1. I would prefer not to have to migrate but this behavior is very concerning. I wish I could just (reliably/practically) host my own damn email server.
johng 6 hours ago||
I have a lifetime Proton subscription (I think) that I bought years ago. I've never used it. I have been a happy Fastmail customer for about 8 years though. Can't recommend them enough.
sassbadger 5 hours ago|||
Honestly I felt this way when he commented on welcoming Trump's second term and immediately moved away from Proton. Was a pain but I'm not regretting it.
itintheory 4 hours ago||
Where did you migrate to?
sassbadger 1 hour ago||
Posteo. It's barebones but cheap and sticks to one things that it does well. I like it. Good people behind it. There are lots of other good alternatives for email (heard good things about Fastmail and Mailbox as well).
jgwil2 7 hours ago|||
Really not the message nor the style of good leadership. I don't want my CEO to talk like an eighth-grader.
SV_BubbleTime 7 hours ago||
It depends on the audience. If someone had a 3-D printer companies said that yeah that’s probably OK.

People seem to think Proton Mail is a serious organization. His tone is the least of the problems.

jgwil2 6 hours ago|||
> His tone is the least of the problems.

I agree with that, but it's still shocking to me that somebody in such an important role can sound so unprofessional.

mopsi 5 hours ago|||
What's wrong with Proton Mail? I have heard it being suggested as an alternative to Gmail, but don't know anything beyond it.
SideburnsOfDoom 4 hours ago||
Proton have been in the news in the last 2 days, bad executive behaviour to the extent that and some see signs of AI psychosis.

e.g.

https://www.404media.co/manifestos-fear-and-loser-thinking-i...

https://www.gadgetreview.com/ai-or-unemployment-proton-is-re...

I started to be wary when they got into Cryptocurrency https://proton.me/blog/proton-wallet-launch

For Proton Mail specifically, they are now pushing AI features, e.g. https://proton.me/blog/proton-scribe-writing-assistant.

The 404 media link is in a comment unthread, reading it does give me the impression that I should avoid the company.

devcjg 8 hours ago|||
Very unfortunate. The trash CEO was enough to make me question what is going on. Their trash CTO letter made me move services and cancel.
blue_green_maps 8 hours ago||
What are the best privacy-focused proton alternatives?
skinfaxi 8 hours ago|||
Tutanota is pretty good though they feel entitled to send marketing/commercial messages to their customers with no ability to opt out.
rocho 3 hours ago||||
I've been using Fastmail with my own domain for a few years and never had a problem. Web and mobile apps are great.

I've set up IMAP syncing with my main Gmail so that it also acts as a backup. Eventually I'll ditch my Gmail for good, but sadly I'm not there yet.

WinstonSmith84 6 hours ago||||
maybe Gmail isn't that bad... Yes you may be targeted with ads and what else brings revenue to Google. Yes you could expect that law enforcements may scan/seize your inbox but if you're kind of fine with either of these, I certainly trust more Google than anything else when it comes to protect against real hackers/unauthorized access
wussboy 7 hours ago|||
By the sounds of it, almost anything.
kriro 6 hours ago|||
If I got a message like that I'd be really fast...handing in my resignation.
nikanj 9 hours ago|||
How are Proton and Binance related here?
irishloop 9 hours ago||
I think commenter is drawing a parallel, with leadership demanding both high security and high speed, and then putting pressure on engineers to not be "losers" if they can't do both, leading to exactly this scenario.
yubblegum 8 hours ago|||
Conclusion: Do not trust your email security to the clownshow run by Andy Yen. That's almost 180 degree opposite of what direction a company dedicated to secure communication should provide to its developers.

And that "loser" comment. Looking at this Andy's mug on google image search and enjoying a mild lol moment. Really, Andy, take a good look in the mirror.

devcjg 8 hours ago||
100%

To build up a decade of goodwill to just admit to being reckless with our data is unacceptable.

Calling his customers (by proxy of his employees) losers for wanting security is wild.

The bottom line is that we are in a new world. "CEO" & "CTO" is dead.

Engineering is not, nor is expertise. Your new job as a builder is to build your own thing and directly undermine all potential profits at shithole companies like Proton.

TaLiTr 3 hours ago||
> Calling his customers (by proxy of his employees) losers for wanting security is wild.

To be fair, that's not what's being said. His insane take is actually you can be secure while being as fast as physically possible, and if you don't think that you're just not working hard enough.

GoblinSlayer 5 hours ago|||
Wasn't there a project that aims to replace management with AI?
hem777 8 hours ago|||
That’s some proper leadership right there
psychoslave 9 hours ago|||
- Captain, there are icebergs front forward, we can go around or decelerate to a pace enabling to safely navigate in between.

- You brainless sailor, push engines to their max capacity and in a straight forward line we will arrive to destination in the only metrics that matter, quick and short. Time is money, money is everything, safety measures is for coward losers. Also jump out of my ship in this cold sea full of sharks once you tweaked the engines, your dumb mentality could contaminate the rest of my crew otherwise. You can kiss the feet of the giant golden status of myself as an act of repentance before we throw you.

actionfromafar 8 hours ago||
"- You brainless sailor, I can be pardoned again, and again. I know the Trumps."
braj0 8 hours ago||
[flagged]
somehnguy 8 hours ago||
Trump has performed many many pardons, a number specifically for nearly direct exchange of money.

And Biden pardons are irrelevant given he isn’t the president..so he can’t pardon anyone.

grates 7 hours ago||
[dead]
More comments...