Posted by domhudson 21 hours ago
Isn't Binance the one that needs to be prosecuted for negligent security? How does "a compromised laptop" lead to a $6bn wipe in a matter of minutes?
This is why banks are regulated, though I have no idea if/whether these platforms are regulated in any similar way.
It seems very unlikely they have $3-6B lying around ready to repay customer deposits. At the very least this would be catastrophic for them if they do lose all that money.
Have they re-enabled withdrawals yet? If I were a customer I'd be taking everything out as soon as possible.
For Binance? I’d actually say very likely. They’d need to move a couple of papers around, but should be easy.
Next time this happens to Binance though they won't have an emergency fund and possibly they'll be in debt, and that's when the users will be very screwed.
Their terrible security certainly indicates to me that future of Binance is not going to be a pretty one unless they make some enormous changes.
Note that “crime” has a specific definition in law. You don’t have to be a criminal (commit a crime) to be rightfully sued, civil suits are a thing.
Anyway, your parent comment already answered the question, they would be sued by negligence.
Only the government (e.g., federal, state, local) may bring a criminal suit.[1] But in both civil / criminal cases they are still a suit under the law seeking some form of ordered relief from the Court.
Essentially, you can think of "criminal" as a category of law and relief (e.g., prison) that is only accessible to the government.
Both the government and citizens may bring "civil" suits. Very generally, the remedies in civil suits are a court order to 1) stop doing a thing; 2) to do a thing required by law / agreement; 3) to transfer property, usually but not always money, from one party to another; or 4) to define a set of rules governing the parties going forward.
[1] There may be some obscure exception to this, but it is true for everything I've ever seen / heard of.
No, it's not. At least not historically.
Sorry, what do you mean?
Basically, the historical origins of different bank regulations are quite complicated and also differ from place to place, and they were often put in place by (political) coalitions of people who already had not one single motivation but a whole spectrum of them.
And then in addition to historical reasons, you also need to ask why things are still in place. Inertia is one answer, but it's not the only one.
Sorry, what do you mean?
-- think that's referring to bank deposit insurance schemes...
When everything goes wrong the only defense is to be slow enough to fix it.
This idea that there are shortcuts that you can be decentralised and fast at any size is wrong.
I would assume binance is more like a bad bank but without the internal friction to make stuff like this hard.
Yes. Move fast and break things and forget governance... Cryptocurrency has always been dumb. You either con people out of their money or you lose yours.
I had someone approach me in 2017 or so because he wanted to do a rugpull coin operation. I said I was busy and didn't help, but I'd probably be much richer (and a piece of shit human) if I got involved.
Regulations probably help but they basically serve to keep evolutionary memory in place in a corporate ecosystem where companies can spawn from nothing.
Bad banks no longer exist but regulations, after an extinction event, perhaps try to make that evolutionary event permanent.
At least that is my mental model.
Regulations are very lagging. And they should be understood to create moats and friction. There is no free lunch. Regulations purposefully shrink or destroy markets. That is how markets work.
Something I wish tech folks would absorb more.
If it's not frustrating and stupid, (to you at the time) it's probably not really a regulation.
This is a funny take on things, and untrue. But traditional finance is way safer and better controlled than the crypto frontier. Someone like coffeezilla has to rely on patreon and ad revenue to do the sort of journalism that exposes how debased cryptocurrency finance is. There should be much more money in exposing the fraud, but our premier capitalists are complicit in the fraud. They are fraudsters at heart, which is why they have the money and influence they do.
> Regulations purposefully shrink or destroy markets.
Sometimes maybe, but that's a matter of corruption. Regulatory capture has been used to create regulation that protects monopolies, duopolies, and the broader oligarchy for a very long time. When politicians were representatives of their voters, things worked better. Post-citizens united, the incentives are broken and we have a congress full of duplicitous, self-interested idiots.
But maybe it wouldn't be that exciting to see some guys sitting at a desk.
Let me introduce you to the TV show Industry which takes you into the world of London high finance where tense phone calls, compliance violations and financial crimes are the order of the day [1]
So yeah, really not exciting ... just sad.
Not sure if I want it written and developed by North Korea or its enemies…
They're not in NK, though their family is.
That was the solution that the movie Swordfish came up with to solve this tricky problem.
He is still in China living with his girlfriend.
Miami, Florida – A 17-count indictment was unsealed in federal court in Miami, Florida charging Paul E. Vernon, 48, the founder, operator, and Chief Executive Officer (CEO) of Project Investors Inc., doing business as Cryptsy
https://www.justice.gov/usao-sdfl/pr/ceo-major-online-crypto...
The US and China do not have an extradition treaty. ie even if they wanted to do something, they can’t. The same goes for Russia
China absolutely could do something if they wanted to. No treaty just means they aren't obligated to "do something", not that they can't. For example, if the US wanted to reinstate the $800 no tariff policy in exchange for Vernon, I guarantee you they'd arrest him and turn him over.
I can't find any reference to Vernon's citizenship, ie if he is a Chinese citizen or not. Which would change the math.
That is a safe bet 92% of the time, but they rushed getting the stolen coins into a tumbler service. The kind of people that do business in bitcoin, are not the class of folks you want finding these thieves first.
Yet, picking politically attractive proxy-scapegoats is a classic pro move. =3
Cursor's security announcement was posted on Oct 29 and says that the malicious extension was live "between about 2:27am PT and 1:35pm PT today"
This article says the attack took place "on Thursday" (which means Oct 29) and began at 4pm ET (which is 1pm PT)
and Binance has been tweeting that the cause of the hack may be a compromised employee laptop. yikes
i don't have a solution.
Things like--
* Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum
* Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
* Encrypting data at rest
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.Is encrypting data at rest useful when the app must have access to decrypt the data? What sort of scenarios do you use it for and where do the keys live?
If your plan is to quickly apply upstream patches, your plan is bad.
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.
This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title
I've seen this a few times, and it's pretty annoying as a user, but ultimately it's not that bad usually. If you are ordering something at 3am, the physical shipment still occurs during daylight hours. Many banking operations are not actually instantaneous, they settle in a batch job overnight.
And this doesn't have to be binary. Providing a read-only interface provides lots of value while having a reduced attack surface.
That tooling should be shut off from the internet [1], and if it uses a LLM that should be at least a few years old.
[1] technically impossible if it also has the ability to veto responses, but the surface can be very small.
Easy to drop a sentence in a discussion. Harder to implement.
It's easy, if you already have teams in the US, UK, India, and Australia - it's always normal office hours in one of those location.
It has been days now.
Binance hot wallet signed 50 EIP-7702 delegations 3 minutes before the drain - https://news.ycombinator.com/item?id=50306715 - October 2026
Binance hot wallet signed 50 authorizations 3 minutes before the drain - https://808bits.com/articles/binance-hot-wallet-eip-7702-del... - October 30th, 2026
they also say there’s no evidence any private key leaked yet their own signing system signed the transfers.