Posted by Tiberium 12 hours ago
The point of a cold wallet is to keep the private key physically offline. That way you know it cannot be stolen by electronic means, because the physical device containing the key needed to authorize transactions is locked up and not powered on. Then you only power it on during very specific, audited times and conditions when it's needed to fund the hot wallet, which does all the actual automated trading and transfers.
GP's point is to have all incoming transactions to an exchange go to a cold wallet, which becomes a one-way sink, and then periodically the exchange powers up the cold wallet to sign transactions transferring assets to the hot wallet, which then funds all outgoing transactions. This isn't a bad architecture, though I'm not sure it'd save all that much here.
Then when things calm down you go and find ... the keys under the birdbath are lost, and you're fucked in a different way.
But at least it might work.
You can't "move money into an offline crypto wallet that is not online at all."
If "money" i.e. crypto "currency" is in a crypto "wallet" then it is online. Anyone with the key and an Internet connection can transfer it at any time.
The wording is confusing because to someone who doesn't know how cryptocurrencies work it sounds like you can simply "take the crypto offline and put it into a physical device" as if it was a file. But that's not how it works. The physical key merely contains the actual key for the always-online wallet.
Only spending from that wallet needs online access to private key - depositing to it does not.
Sure you can print USD to make it all magically go away
But it would be very convenient if there's some experimental token of which a majority was stolen, so that irreversible damage was caused. If the token is experimental it could have a low damage, but could demonstrate the irreversible nature of these types of attacks, returning fiat money doesn't waive the issue away.
There's also the fact of funding criminal networks for billions of dollars, which probably causes them to scale cyber or non cyber operations or otherwise gain power.
This attack vector has become so common and funny.
In one scenario, i remember a company got hacked because an engineer downloaded a RAT package on company laptop during fake interview and asked him to keep it running for days as part of the interview process while they stole the data.
I guess at some point they'll have to cash out. Seems hard to spend $6B in vape shops.
Need to get better in prompting
Binance wallet 16 came online in 2021.
Why to wait 5 years to attack.